An identity authentication method and device, and a storage medium

Abstract

This application relates to an authentication method, apparatus, and storage medium. The method is applied to a first vehicle-mounted device having a first key management service and a first communication management interface. The method includes: upon detecting an access request initiated by an application installed on the first vehicle-mounted device, the first key management service obtains application information of the application and device information of the first vehicle-mounted device; wherein the access request is for requesting access to services of a second vehicle-mounted device, and the first and second vehicle-mounted devices operate in different domains under the same operating system; the first key management service generates a token message based on the application information and device information; and sends the token message to a second communication management interface of the second vehicle-mounted device through the first communication management interface, so that the second vehicle-mounted device can authenticate the application installed on the first vehicle-mounted device based on the token message. Since the token message is generated jointly based on the application information and device information, it is unique in a multi-domain environment.

Description

Technical Field

[0001] This application relates to the field of vehicle technology, and in particular to an identity authentication method, device and storage medium. Background Technology

[0002] In existing technologies, cross-device access to application services is primarily a scenario in the Internet of Things (IoT) field and on cloud servers. In the IoT field, due to the limited functionality of embedded devices, device authentication can be achieved simply by authorizing the device. In cloud server scenarios, different devices host different services, and the registration information for these services is uniformly stored in an authentication server. Therefore, the verification of identity information for different services and applications is performed on the authentication server.

[0003] In the context of software-defined vehicles, vehicles are moving towards electrification, intelligence, and connectivity, and the number of devices inside vehicles will also increase. Therefore, in the multi-domain operating system inside the vehicle, there are a variety of applications. As a result, the authentication methods for embedded devices cannot fully meet the authentication needs of related applications inside the vehicle. Furthermore, in the multi-domain environment inside the vehicle, there is no separate authentication server, so the authentication methods for cloud servers are not applicable. Summary of the Invention

[0004] To overcome the problems existing in related technologies, this application provides an identity authentication method, apparatus and storage medium.

[0005] According to a first aspect of the embodiments of this application, an identity authentication method is provided, applied to a first vehicle-mounted device having a first key management service and a first communication management interface, including:

[0006] Upon detecting an access request initiated by an application installed on the first vehicle device, the first key management service obtains the application information of the application and the device information of the first vehicle device; wherein, the access request is used to request access to the services of the second vehicle device, and the first vehicle device and the second vehicle device operate in different domains under the same operating system;

[0007] The first key management service generates a token message based on the application information and the device information;

[0008] The token message is sent from the first communication management interface to the second communication management interface of the second vehicle device, so that the second vehicle device can authenticate the application installed on the first vehicle device according to the token message.

[0009] In some embodiments, the first key management service generates a token message based on the application information and the device information, including:

[0010] The first key management service establishes a binding relationship between the application information and the device information;

[0011] The first key management service generates the token message based on the application information, the device information, and the binding relationship.

[0012] In some embodiments, the method further includes:

[0013] The first key management service performs digital signature processing on the token message to obtain a signature value corresponding to the token message; wherein, the signature value is used to verify whether the application information and / or device information in the token message is abnormal;

[0014] Sending the token message to the second communication management interface of the second vehicle-mounted device through the first communication management interface includes:

[0015] The token message carrying the signature value is sent to the second communication management interface through the first communication management interface.

[0016] In some embodiments, the first key management service performs digital signature processing on the token message to obtain a signature value corresponding to the token message, including:

[0017] The first key management service processes the token message using a digest algorithm to obtain a first digest value;

[0018] The first key management service uses the private key of the first vehicle device to encrypt the first digest value, and determines the encrypted first digest value as the signature value.

[0019] In some embodiments, the first key management service generates a token message based on the application information and the device information, including:

[0020] If the first communication management interface detects the access request, a token acquisition request is sent to the first key management service;

[0021] Upon receiving the token acquisition request, the first key management service generates the token message based on the application information and the device information.

[0022] In some embodiments, the method further includes:

[0023] Receive the authentication result through the first communication management interface;

[0024] If the authentication result indicates that the second vehicle device has successfully authenticated the application, the access request is sent to the second communication management interface of the second vehicle device through the first communication management interface.

[0025] In some embodiments, the first vehicle-mounted device and the second vehicle-mounted device are located in the same smart cockpit;

[0026] The first communication management interface and the second communication management interface are provided by the same communication framework.

[0027] According to a second aspect of the embodiments of this application, an authentication method is provided, applied to a second vehicle-mounted device having a second key management service and a second communication management interface, the method comprising:

[0028] The token message is obtained from the first communication management interface of the first vehicle device through the second communication management interface, and the token message is forwarded to the second key management service; wherein, the token message includes: application information of the application installed on the first vehicle device and device information of the first vehicle device;

[0029] The second key management service parses application information and device information from the token message;

[0030] The second key management service authenticates the application installed on the first vehicle device based on the application information and the device information, and obtains the authentication result; wherein, the first vehicle device and the second vehicle device operate in different domains under the same operating system;

[0031] The authentication result is sent to the first vehicle-mounted device through the second communication management interface.

[0032] In some embodiments, the second key management service authenticates the application installed on the first vehicle device based on the application information and the device information, and obtains an authentication result, including:

[0033] The second key management service determines whether the application information exists in the application list, and the device information bound to the application information; wherein, the application list pre-stores: device information of vehicle devices in each domain of the operating system and application information of applications installed on each vehicle device;

[0034] If the application information and the device information bound to the application information exist in the application list, an authentication result indicating successful authentication of the application is obtained.

[0035] In some embodiments, the token message carries a signature value, and the method further includes:

[0036] The second key management service determines whether the application information and / or device information in the token message is abnormal based on the signature value;

[0037] The second key management service authenticates the application installed on the first vehicle device based on the application information and the device information, including:

[0038] If the application information and device information in the token message are both normal, the second key management service authenticates the application installed on the first vehicle device based on the application information and the device information.

[0039] In some embodiments, the method further includes:

[0040] If the application information and / or device information in the token message is found to be abnormal, the second key management service refuses to authenticate the application installed on the first vehicle device.

[0041] In some embodiments, the signature value includes: an encrypted first digest value, and the step of determining whether the application information and / or device information in the token message is abnormal based on the signature value includes:

[0042] The encrypted first digest value is decrypted using the public key of the first vehicle-mounted device to obtain the first digest value;

[0043] The second key management service processes the application information and / or device information in the token message according to the digest algorithm to obtain a second digest value;

[0044] Compare the first digest value and the second digest value;

[0045] If the comparison results indicate that the first digest value and the second digest value match, it is determined that the application information and device information in the token message are both normal.

[0046] In some embodiments, the method further includes:

[0047] If the authentication result indicates that the application has been successfully authenticated, the application's access request is received through the second communication management interface.

[0048] In some embodiments, the second in-vehicle device has application services, and the method further includes:

[0049] When the access request is directed to the application service of the second vehicle-mounted device, the access request is sent to the application service through the second communication management interface;

[0050] The application service provides corresponding services to the application based on the access request.

[0051] In some embodiments, the method further includes:

[0052] If the authentication result indicates that the application's authentication has failed and an access request for the application is received, the access request for the application shall be refused.

[0053] According to a third aspect of the embodiments of this application, an identity authentication device is provided, applied to a first vehicle-mounted device having a first key management service and a first communication management interface, comprising:

[0054] The acquisition module is configured to, upon detecting an access request initiated by an application installed on the first vehicle device, acquire application information of the application and device information of the first vehicle device through the first key management service; wherein, the access request is used to request access to the services of the second vehicle device, and the first vehicle device and the second vehicle device operate in different domains under the same operating system;

[0055] The generation module is configured to generate a token message based on the application information and the device information through the first key management service;

[0056] The first sending module is configured to send the token message to the second communication management interface of the second vehicle device through the first communication management interface, so that the second vehicle device can authenticate the application installed on the first vehicle device according to the token message.

[0057] According to a fourth aspect of the embodiments of this application, an identity authentication device is provided, applied to a second vehicle-mounted device having a second key management service and a second communication management interface, comprising:

[0058] The forwarding module is configured to obtain a token message from the first communication management interface of the first vehicle-mounted device through the second communication management interface, and forward the token message to the second key management service; wherein, the token message includes: application information of the application installed on the first vehicle-mounted device and device information of the first vehicle-mounted device;

[0059] The parsing module is configured to parse application information and device information from the token message through the second key management service;

[0060] The verification module is configured to authenticate the application installed on the first vehicle device based on the application information and the device information through the second key management service, and obtain the authentication result; wherein the first vehicle device and the second vehicle device operate in different domains under the same operating system;

[0061] The second sending module is configured to send the authentication result to the first vehicle-mounted device through the second communication management interface.

[0062] According to a fifth aspect of the embodiments of this application, an identity authentication device is provided, comprising:

[0063] processor;

[0064] Memory configured to store processor-executable instructions;

[0065] The processor is configured to implement the steps of either the first aspect or the second aspect of the authentication method described above during execution.

[0066] According to a sixth aspect of the embodiments of this application, a non-transitory computer-readable storage medium is provided, wherein when the instructions in the storage medium are executed by the processor of an authentication device, the device is enabled to perform the steps of any one of the authentication methods in the first and second aspects described above.

[0067] The technical solutions provided by the embodiments of this application may include the following beneficial effects:

[0068] In this application, since the application information is unique for the application that initiates the access request and the device information is unique for the in-vehicle device, by generating a token message based on the application information and device information, and identifying the application based on the token message, on the one hand, the uniqueness of the identity of each application in the multi-domain environment inside the vehicle can be guaranteed; on the other hand, the in-vehicle device can perform dual authentication of the application, which can reduce the possibility of authentication failure. Attached Figure Description

[0069] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0070] Figure 1 This is a flowchart illustrating an identity authentication method according to an exemplary embodiment. Figure 1 .

[0071] Figure 2 This is a flowchart illustrating an identity authentication method according to an exemplary embodiment. Figure 2 .

[0072] Figure 3 This is a schematic diagram of key storage according to an exemplary embodiment.

[0073] Figure 4 This is a flowchart illustrating an identity authentication method according to an exemplary embodiment. Figure 3 .

[0074] Figure 5 This is a flowchart illustrating an identity authentication method according to an exemplary embodiment. Figure 4 .

[0075] Figure 6 This is an example of an identity authentication device frame shown in an exemplary embodiment. Figure 1 .

[0076] Figure 7 This is an example of an identity authentication device frame shown in an exemplary embodiment. Figure 2 .

[0077] Figure 8 This is a block diagram illustrating an identity authentication device according to an exemplary embodiment. Detailed Implementation

[0078] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.

[0079] Figure 1 This is a flowchart illustrating an identity authentication method according to an exemplary embodiment. Figure 1 ,like Figure 1 As shown, the authentication method is applied to a first vehicle-mounted device having a first key management service and a first communication management interface, and includes the following steps:

[0080] In step 101, when an access request is detected from an application installed on the first vehicle device, the first key management service obtains the application information of the application and the device information of the first vehicle device; wherein, the access request is used to request access to the services of the second vehicle device, and the first vehicle device and the second vehicle device operate in different domains under the same operating system;

[0081] In step 102, the first key management service generates a token message based on the application information and the device information;

[0082] In step 103, the token message is sent to the second communication management interface of the second vehicle device through the first communication management interface, so that the second vehicle device can authenticate the application installed on the first vehicle device according to the token message.

[0083] It should be noted that in-vehicle devices can be devices installed in a smart cockpit that can perform set functions. For example, an in-vehicle device can be an in-vehicle entertainment system installed in a smart cockpit, which can provide various entertainment applications, such as video applications, music applications, and games. The in-vehicle device can also be a central control display device installed in a smart cockpit, which can provide display services. For example, it can be used to obtain the vehicle's speed and display it on the screen, and it can also be used to obtain playback requests sent by video applications in the in-vehicle entertainment system and display the video on the screen based on the playback request. The central control display device can include a passenger-side display device and a rear-seat display device, thus enabling multi-screen playback and synchronized playback.

[0084] In some embodiments, the same operating system can have multiple domains. A domain can be understood as a subsystem based on the operating system's architecture and integrating the functions of different in-vehicle devices. The processes of each subsystem are invoked based on the operating system, enabling the operating system to uniformly schedule resources and improve efficiency. This makes the vehicle more standardized and modular. For example, domains can be named according to their functions, such as a safety instrument domain, an infotainment domain, and a real-time vehicle control domain. During implementation, each in-vehicle device can operate in a different domain under the same operating system. For instance, an in-vehicle entertainment device can operate in both the infotainment domain and the instrument cluster / safety instrument cluster domain. The operating system can include AliOS, Android, etc.

[0085] In this embodiment, the first vehicle-mounted device and the second vehicle-mounted device can be different domains operating under the same operating system. For example, the first vehicle-mounted device can be a safety instrument domain operating under the AliOS operating system, and the second vehicle-mounted device can be an ecosystem entertainment domain operating under the AliOS operating system.

[0086] In other embodiments, the first vehicle-mounted device and the second vehicle-mounted device may also operate in the same domain under the same operating system. For example, the first vehicle-mounted device and the second vehicle-mounted device may be the ecosystem entertainment domain operating under the AliOS operating system; as another example, the first vehicle-mounted device and the second vehicle-mounted device may be the safety instrument domain operating under the AliOS operating system.

[0087] In this embodiment of the application, when an access request is detected from an application installed on the first vehicle-mounted device, the first key management service can obtain the application information of the application and the device information of the first vehicle-mounted device; wherein, the access request is used to request access to a service on the vehicle-mounted device, for example, it can be used to request access to an application service on a second vehicle-mounted device. Of course, the access request can also be used to access a service on the first vehicle-mounted device.

[0088] In some embodiments, the first key management service is a key management application in the first vehicle-mounted device, which can not only generate token messages for the application, but also verify the identity of the application.

[0089] In some embodiments, when the first vehicle-mounted device and the second vehicle-mounted device operate in different domains under the same operating system, the application information of an application on the first vehicle-mounted device may overlap with that of an application on the second vehicle-mounted device. If only the application information is used to characterize the application, the uniqueness of the application in a multi-domain environment cannot be guaranteed. The application information can be used to identify the application. For example, if the application information is an application identifier, and there is an application with an application identifier of 60001 on the first vehicle-mounted device, there may also be an application with an application identifier of 60001 on the second vehicle-mounted device. During the identification process, the application on the first vehicle-mounted device may be misidentified as an application on the second vehicle-mounted device, thus causing confusion.

[0090] In some embodiments, when an application is installed on a first in-vehicle device, the first in-vehicle device can obtain the application's signature information from the application's installation package and assign a corresponding application identifier to the application based on the application's signature information; wherein, the application's signature information can characterize the developer's identity, and the application identifier can serve as a unique identifier for the application within the first in-vehicle device. For example, the application identifier may include: 60002.

[0091] In some embodiments, device information can be set for each in-vehicle device inside the vehicle. Taking device information as a device identifier as an example, the device identifier of an in-vehicle device is unique, that is, each in-vehicle device corresponds to a device identifier. In the embodiments of this application, the device identifier of the first in-vehicle device can be set when the first in-vehicle device leaves the factory. For example, the device identifier of the first in-vehicle device may include: 10, and may also include: Number One.

[0092] In some embodiments, when an application initiates an access request, it can carry application information in the access request. During implementation, the first vehicle-mounted device can detect the access request through a first communication management interface. This communication management interface is an interface for information exchange, used to receive and send information.

[0093] Taking the first key management service detecting access requests through the first communication management interface as an example, when the access request carries application information, the first communication management interface can directly forward the access request carrying application information to the first key management service, and the first key management service can parse the application information from the access request.

[0094] In other embodiments, the application may also directly send the access request to the first key management service. When the access request carries application information, the first key management service can directly parse the application information from the access request. Compared to forwarding the access request to the first key management service through the first communication management interface, the method of the application directly sending the access request to the first key management service is easier to implement and simpler.

[0095] In other embodiments, when an application initiates an access request, a first process can be started; wherein the first process carries the application information of the application; when the first key management service detects the access request through the first communication management interface, a second process can be started, so that the first key management service can parse the application information of the application from the first process through the second process, thereby realizing cross-process communication.

[0096] In some embodiments, the first key management service may send a request instruction to the first vehicle-mounted device to obtain device information. When the first vehicle-mounted device receives the request instruction, it may open its device memory to the first key management service so that the first key management service can obtain the device information of the first vehicle-mounted device from the device memory.

[0097] In other embodiments, since the first key management service is a built-in application of the first vehicle device, the device information of the first vehicle device can be pre-stored in the first key management service when the first vehicle device leaves the factory, so that the first key management service can directly obtain the device information of the first vehicle device.

[0098] In this application, since the application information is unique for the application that initiates the access request and the device information is unique for the in-vehicle device, by generating a token message based on the application information and device information, and identifying the application based on the token message, on the one hand, the uniqueness of the identity of each application in the multi-domain environment inside the vehicle can be guaranteed; on the other hand, the in-vehicle device can perform dual authentication of the application, which can reduce the possibility of authentication failure.

[0099] Figure 2 This is a flowchart illustrating an identity authentication method according to an exemplary embodiment. Figure 2 .like Figure 2 As shown, the method mainly includes the following steps:

[0100] In step 201, if the first communication management interface of the first vehicle-mounted device detects an access request, a token acquisition request is sent to the first key management service.

[0101] In step 202, the first key management service of the first vehicle device obtains the application information of the application and the device information of the first vehicle device upon receiving a token acquisition request.

[0102] In step 203, the first key management service of the first vehicle device generates a token message based on the application information of the application and the device information of the first vehicle device.

[0103] In step 204, the first key management service of the first vehicle device sends a token message to the first communication management interface of the first vehicle device.

[0104] In some embodiments, the token message can be saved to the first key management service to avoid the waste of resources caused by repeatedly obtaining the application information of the application and the device information of the first vehicle device; wherein, the token message can guarantee the uniqueness of the application's identity in a multi-domain environment.

[0105] In this embodiment, the first vehicle-mounted device and the second vehicle-mounted device can interact with each other through a communication management interface. For example, when the first key management service generates a token message based on application information and device information, it can send the token message to the second communication management interface of the second vehicle-mounted device through the first communication management interface, so that the second vehicle-mounted device can authenticate the application installed on the first vehicle-mounted device based on the application's token message.

[0106] In some embodiments, the first communication management interface and the second communication management interface are provided by the same communication framework.

[0107] In some embodiments, the first communication management interface is a communication management interface on a first in-vehicle device, and the second communication management interface is a communication management interface on a second in-vehicle device. The first and second communication management interfaces can enable communication not only between applications on the same in-vehicle device, but also between different in-vehicle devices.

[0108] In some embodiments, the communication framework may include: the Fusion framework, and the first communication management interface and the second communication management interface may be communication management interfaces provided by the Fusion framework, thereby enabling communication between the first vehicle-mounted device and the second vehicle-mounted device.

[0109] In some embodiments, each vehicle-mounted device can be provided with a communication management interface; of course, each vehicle-mounted device can also share a communication management interface. That is, the first communication management interface and the second communication management interface can simultaneously realize cross-device communication management interfaces for communication between various vehicle-mounted devices.

[0110] In other embodiments, the first communication management interface and the second communication management interface may further include an application programming interface (API) that enables communication between applications.

[0111] In this application, since the application information is unique for the application that initiates the access request and the device information is unique for the in-vehicle device, by generating a token message based on the application information and device information, and identifying the application based on the token message, on the one hand, the uniqueness of the identity of each application in the multi-domain environment inside the vehicle can be guaranteed; on the other hand, the in-vehicle device can perform dual authentication of the application, which can reduce the possibility of authentication failure.

[0112] In some embodiments, the first vehicle-mounted device and the second vehicle-mounted device may be located in the same smart cockpit.

[0113] It should be noted that the intelligent cockpit is a component of an intelligent vehicle and may include: LCD instrument panel, intelligent management equipment, etc.

[0114] Taking the case where both the first and second in-vehicle devices are installed in the same vehicle as an example, such as the first in-vehicle device being a central control display device installed in the smart cockpit, and the second in-vehicle device being an in-vehicle entertainment device installed in the smart cockpit, in the process of implementation, the central control display device can access the in-vehicle entertainment device, thereby playing videos and music on the central control display device, and when playing music, lyrics can also be displayed on the central control display device.

[0115] For example, the first in-vehicle device is a liquid crystal instrument panel installed in the smart cockpit, and the second in-vehicle device is a central control display device installed in the smart cockpit. In the implementation process, the central control display device can access the liquid crystal instrument panel, thereby enabling the central control display device to obtain the vehicle's operating parameters from the liquid crystal instrument panel and display the vehicle's operating parameters on the central control display device.

[0116] In this embodiment of the application, in-vehicle devices belonging to the same smart cockpit can achieve information communication even if they operate in different domains, and can also achieve identity authentication of applications on each in-vehicle device.

[0117] In some embodiments, the smart cockpit has multiple in-vehicle devices, where the first in-vehicle device and the second in-vehicle device are any two in-vehicle devices in the smart cockpit.

[0118] In some embodiments, the first key management service generates a token message based on the application information and the device information, including:

[0119] The first key management service establishes a binding relationship between the application information and the device information;

[0120] The first key management service generates the token message based on the application information, the device information, and the binding relationship.

[0121] In some embodiments, the first key management service can generate a first key-value pair based on application information and a second key-value pair based on device information, and arrange the first and second key-value pairs to generate a token message. Taking application information 60002 and device information 10 as an example, the first key-value pair can be represented as (UID: 60002), the second key-value pair can be represented as (ID: 10), and the token message can be represented as {UID: 60002, ID: 10} by arranging the first and second key-value pairs.

[0122] In other embodiments, the first key management service can generate a first string based on application information and a second string based on device information, and use the first and second strings to generate a text message, which is then identified as a token message. For example, String mDeviceId = Number One, uint32_t mUid = 60001; where String and Uint32_t are both encoded data types, mDeviceId represents the device information of the first vehicle-mounted device, and mUid represents the application information.

[0123] Taking a video application installed on the first vehicle-mounted device as an example, the first key service can obtain the application information of the video application and the device information of the first vehicle-mounted device, thereby generating a token for the video application. The content of the token may include: {UID: 60002, ID: 10}; where UID: 60002 indicates that the application identifier of the video application is 60002, and ID: 10 indicates that the device identifier of the first vehicle-mounted device is 10.

[0124] In some embodiments, by binding the application information of the application with the device information of the first vehicle device, dual identity information of the application is established, and a token message is generated based on the dual identity information. This can ensure the uniqueness of the application in multi-domain scenarios, and thus enable cross-device management of application identity information based on the application's token message.

[0125] In some embodiments, the method further includes:

[0126] The first key management service performs digital signature processing on the token message to obtain a signature value corresponding to the token message; wherein, the signature value is used to verify whether the application information and / or device information in the token message is abnormal;

[0127] Sending the token message to the second communication management interface of the second vehicle-mounted device through the first communication management interface includes:

[0128] The token message carrying the signature value is sent to the second communication management interface through the first communication management interface.

[0129] It should be noted that a digital signature is a signature value generated by the sending end (the first vehicle-mounted device). This signature value cannot be forged by others, and it is also a valid proof of the authenticity of the information sent by the sending end. When cryptographic technologies are used to implement the digital signature, it can be used to identify abnormal situations in the information, such as whether the information is complete.

[0130] In some embodiments, the first key management service can process the token message using a digital signature algorithm. During the processing, a pair of keys for the token message, namely a public key and a private key, can be generated. The private key can be used to sign the token message to obtain a signature value. The token message carrying the signature value and the public key are then sent to the second communication management interface through the first communication management interface, so that the second vehicle-mounted device can verify the token message carrying the signature value based on the public key, thereby identifying abnormal situations of the token message.

[0131] In some embodiments, the digital signature algorithm may include: an asymmetric encryption algorithm, and may also include: a group signature algorithm and a blind signature algorithm; wherein, the asymmetric encryption algorithm may include: the RSA algorithm, an asymmetric encryption algorithm based on Diffie-Hellman key exchange (ElGamal encryption algorithm), an elliptic curve cryptography (ECC) algorithm, etc. The digital signature algorithm can be selected according to actual needs, and no specific limitation is made here.

[0132] In other embodiments, a symmetric encryption algorithm can be used to process the token message to obtain a signature value corresponding to the token message. During the processing of the token message using the symmetric encryption algorithm, a key for the token message can be generated. A symmetric encryption algorithm is a single-key encryption algorithm, meaning that the same key is used to encrypt and decrypt information. Symmetric encryption algorithms can include: Data Encryption Standard (DES) algorithm, Triple Data Encryption Algorithm (TDEA), etc.

[0133] In some embodiments, a mapping table can be preset in the first key management service. This mapping table can be used to store: application information of the application and token messages carrying signature values ​​corresponding to the application information. After the first key management service obtains the token messages carrying signature values, it can establish a mapping relationship between the token messages carrying signature values ​​and the application information of the application. Based on the token messages carrying signature values, the application information of the application, and the mapping relationship, the mapping table is updated. In this way, when the application initiates an access request again, the first key management service can search the mapping table based on the application information of the application to find the corresponding token messages carrying signature values, thereby avoiding the resource waste caused by repeatedly generating token messages carrying signature values.

[0134] In some embodiments, using a digital signature algorithm to process token messages can ensure the integrity of the application's dual identity information and prevent malicious individuals from tampering with the application's dual identity information.

[0135] In some embodiments, the first key management service performs digital signature processing on the token message to obtain a signature value corresponding to the token message, including:

[0136] The first key management service processes the token message using a digest algorithm to obtain a first digest value;

[0137] The first key management service uses the private key of the first vehicle device to encrypt the first digest value, and determines the encrypted first digest value as the signature value.

[0138] In some embodiments, when the operating system is released, the key of the vehicle device is stored in the key management service of the relevant vehicle device in advance; wherein, the key of the vehicle device includes: the private key of the vehicle device and the public key of the vehicle device.

[0139] Figure 3 This is a schematic diagram of key storage according to an exemplary embodiment. For example... Figure 3As shown, the first key management service 301 pre-stores: the private key of the first vehicle-mounted device, the certificate of the first vehicle-mounted device, and the certificate of the second vehicle-mounted device; the second key management service 302 pre-stores: the private key of the second vehicle-mounted device, the certificate of the first vehicle-mounted device, and the certificate of the second vehicle-mounted device. The certificate of the first vehicle-mounted device includes: the public key of the first vehicle-mounted device, and the certificate of the second vehicle-mounted device includes: the public key of the second vehicle-mounted device.

[0140] In some embodiments, a Public Key Infrastructure (PKI) system can be used to generate a certificate for the vehicle-mounted device based on its public key. The PKI system is a system or platform that provides public key encryption and digital signature services. Its main function is to bind the identity of the certificate holder (first vehicle-mounted device, second vehicle-mounted device) and the associated key pair, providing convenient means for certificate application, certificate revocation, certificate acquisition, and certificate status inquiry. For example, the PKI system can generate a certificate for the first vehicle-mounted device based on its public key.

[0141] In some embodiments, a digest algorithm can be used to calculate the token message to obtain an output digest (first digest value) of a preset length. The digest algorithm can be used to identify abnormal situations in the token message, and its operation result is irreversible. The preset length can be a fixed value. The digest algorithm may include: Message Digest (MD) algorithm, Secure Hash Algorithm (SHA) algorithm, and Message Authentication Code (MAC) algorithm. The digest algorithm can be selected to process the token message according to actual needs, and no specific limitation is made here.

[0142] In some embodiments, the first key management service can parse the application information of the application and the device information of the first vehicle device from the token message, and process the application information and device information respectively using a digest algorithm to obtain a first digest value. In this case, the digest algorithm can be preset in the operating system.

[0143] In another embodiment, the first key management service can also directly process the token message using a digest algorithm to obtain a first digest value. For example, the first key management service processes the token message using the MD algorithm to obtain a first digest value, and encrypts the first digest value using the private key of the first vehicle device to obtain an encrypted first digest value. The encrypted first digest value is then used as a signature value, and the token message carrying the signature value is sent to the second vehicle device so that the second vehicle device can verify whether the application information and / or device information in the token message is abnormal.

[0144] In some embodiments, processing the token message using a digest algorithm and the private key of the first vehicle-mounted device can ensure the integrity and security of the token message, and can also determine the source of the information based on the signature value, thereby ensuring the security of the information source.

[0145] In some embodiments, the method further includes:

[0146] Receive the authentication result through the first communication management interface;

[0147] If the authentication result indicates that the second vehicle device has successfully authenticated the application, the access request is sent to the second communication management interface of the second vehicle device through the first communication management interface.

[0148] In some embodiments, the authentication result sent by the second vehicle device can be received through the first communication management interface. If the authentication result indicates that the application installed on the first vehicle device has been successfully authenticated, the first communication management interface will then send the application's access request to the second management communication management interface of the second vehicle device. In this way, the second vehicle device can provide corresponding services for the application installed on the first vehicle device.

[0149] In some embodiments, if the application is successfully authenticated, the application's access request is then sent to the second communication management interface of the second vehicle device, which can reduce the waste of resources caused by application authentication failure.

[0150] Figure 4 This is a flowchart illustrating an identity authentication method according to an exemplary embodiment. Figure 3 The identity authentication method provided in this application embodiment is applied to a second vehicle-mounted device having a second key management service and a second communication management interface. The method includes:

[0151] In step 401, a token message is obtained from the first communication management interface of the first vehicle device through the second communication management interface, and the token message is forwarded to the second key management service; wherein, the token message includes: application information of the application installed on the first vehicle device and device information of the first vehicle device;

[0152] In step 402, the second key management service parses application information and device information from the token message;

[0153] In step 403, the second key management service authenticates the application installed on the first vehicle device based on the application information and the device information, and obtains the authentication result; wherein, the first vehicle device and the second vehicle device operate in different domains under the same operating system;

[0154] In step 404, the authentication result is sent to the first vehicle-mounted device through the second communication management interface.

[0155] In this embodiment, the first vehicle-mounted device and the second vehicle-mounted device can interact with each other through a communication management interface. For example, the first key management service can send a token message to the second communication management interface through the first communication management interface. In this way, the second communication management interface can send the token message to the second key management service, so that the second key management service can authenticate the application and send the authentication result to the first vehicle-mounted device through the second communication management interface. The first and second communication management interfaces can be communication management interfaces provided by the Fusion framework, so that the application on the first vehicle-mounted device can access the application on the second vehicle-mounted device according to the communication management interface.

[0156] In other embodiments, the first communication management interface and the second communication management interface may further include an API interface, which enables communication between applications.

[0157] In this embodiment, the second key management service receives a token message through the second communication management interface and parses the application information and device information from the token message, thereby enabling the second key management service to authenticate the application installed on the first vehicle device based on the application information and device information; wherein, the token message includes: application information of the application installed on the first vehicle device and device information of the first vehicle device.

[0158] In some embodiments, the second key management service is a key management application in the second vehicle-mounted device. The second key management service can authenticate applications not only on the second vehicle-mounted device but also on the first vehicle-mounted device, thereby enabling cross-device management of application identities.

[0159] In some embodiments, the second key management service can traverse token messages to obtain application information of the application and device information of the first vehicle device from the token messages.

[0160] In other embodiments, the second key management service can also directly obtain the application identifier of the application and the device identifier of the first vehicle device from the token message, thereby parsing the application information and device information from the token message.

[0161] Here, after parsing the application information and device information from the token message, the application corresponding to that application information can be authenticated based on the parsed information. For example, it can be determined whether the application information and device information are pre-stored in the second vehicle-mounted device. If they are, the authentication of the application is successful, and the application can access the services on the second vehicle-mounted device. Conversely, if they are not, the authentication fails, and the application cannot access the services on the second vehicle-mounted device. The application information and device information included in the same token message have a corresponding relationship. In some embodiments, authentication failure may be due to: the application's origin being unclear, or the application information not being registered.

[0162] In some embodiments, when the second key management service obtains the authentication result, it can send the authentication result to the first communication management interface of the first vehicle device through the second communication management interface, so that the first vehicle device can determine whether to send an application access request to the second communication management interface based on the authentication result. When the authentication result indicates that the second vehicle device has successfully authenticated the application, it can send the application access request to the second communication management interface through the first communication management interface. When the authentication result indicates that the second vehicle device has failed to authenticate the application, the first communication management interface can refuse to send the application access request to the second communication management interface of the second vehicle device.

[0163] In some embodiments, the second key management service receives the application's token message through the second communication management interface and performs dual authentication on the application based on the application's token message. This can confirm the application's identity information, ensure the security of application access, and realize the transmission and authentication process of application identity information during cross-device communication.

[0164] In some embodiments, the second key management service authenticates the application installed on the first vehicle device based on the application information and the device information, and obtains an authentication result, including:

[0165] The second key management service determines whether the application information exists in the application list, and the device information bound to the application information; wherein, the application list pre-stores: device information of vehicle devices in each domain of the operating system and application information of applications installed on each vehicle device;

[0166] If the application information and the device information bound to the application information exist in the application list, an authentication result indicating successful authentication of the application is obtained.

[0167] In some embodiments, each in-vehicle device pre-stores an application list, which pre-stores device information of all in-vehicle devices in the vehicle of this application and application information of the applications installed on each in-vehicle device; wherein, the first in-vehicle device and the second in-vehicle device are any two in-vehicle devices among all in-vehicle devices in the vehicle of this application.

[0168] In some embodiments, when a new application is installed on the in-vehicle device, the application information of the application and the device information bound to the application information can be added to the application list, thereby updating the application list. For example, when a game application is installed on a second in-vehicle device, the application information of the game application and the device information bound to the game application can be added to the application list.

[0169] In some embodiments, the second key management service can search the application list based on application information and device information. If the application information and device information exist in the application list and the application information and device information are bound together, it indicates that the authentication of the application corresponding to the application information is successful.

[0170] In some embodiments, if application information is detected in the application list but device information is not detected; or device information is detected in the application list but application information is not detected; or both device information and application information are detected but they are not bound together, then the authentication of the application has failed.

[0171] In some embodiments, the first key management service determines whether application information and device information bound to the application information exist based on the application list, thereby achieving dual authentication of applications installed on the first vehicle device, which can effectively protect the user's privacy and security.

[0172] In some embodiments, the token message carries a signature value, and the method further includes:

[0173] The second key management service determines whether the application information and / or device information in the token message is abnormal based on the signature value;

[0174] The second key management service authenticates the application installed on the first vehicle device based on the application information and the device information, including:

[0175] If the application information and device information in the token message are both normal, the second key management service authenticates the application installed on the first vehicle device based on the application information and the device information.

[0176] In some embodiments, when the signature value is generated using a digital signature algorithm, the second key management service can decrypt the signature value according to the public key of the received token message to obtain the decrypted token message. The decrypted application information and decrypted device information are then parsed from the decrypted token message. If the decrypted application information matches the application information in the token message and the decrypted device information matches the device information in the token message, the second key management service can authenticate the application installed on the first vehicle device based on the application information and device information in the token message.

[0177] In other embodiments, when the signature value is generated using a symmetric encryption algorithm, the second key management service can decrypt the signature value according to the key of the received token information to obtain the decrypted token message. From the decrypted token message, the decrypted application information and the decrypted device information are obtained. If the decrypted application information matches the application information in the token message and the decrypted device information matches the device information in the token message, the second key management service can authenticate the application installed on the first vehicle device based on the application information and device information in the token message.

[0178] In some embodiments, if the application information and device information in the token message are both normal, the second key management service then authenticates the application installed on the first vehicle device, which not only ensures the integrity of the token message but also guarantees the security of the application identity.

[0179] In some embodiments, the method further includes:

[0180] If the application information and / or device information in the token message is found to be abnormal, the second key management service refuses to authenticate the application installed on the first vehicle device.

[0181] In some embodiments, when the signature value is generated using a digital signature algorithm, the second key management service can decrypt the signature value according to the public key of the received token message to obtain the decrypted token message. The decrypted application information and decrypted device information are obtained from the decrypted token message. If the decrypted application information and the application information in the token message do not match and / or the decrypted device information and the device information in the token message do not match, the second key management service may refuse to authenticate the application installed on the first vehicle device.

[0182] In other embodiments, when the signature value is generated using a symmetric encryption algorithm, the second key management service can decrypt the signature value according to the key of the received token message to obtain the decrypted token message. From the decrypted token message, the decrypted application information and the decrypted device information can be obtained. If the decrypted application information and the application information in the token message do not match and / or the decrypted device information and the device information in the token message do not match, the second key management service can refuse to authenticate the application installed on the first vehicle device.

[0183] In other embodiments, if the second key management service parses application information from the token message but not device information, or if the second key management service parses device information from the token message but not application information, it indicates that there is an anomaly in the application information or device information in the token message.

[0184] In some embodiments, if the application information and / or device information in the token message is found to be abnormal, the second key management service refuses to authenticate the application installed on the first vehicle device, thereby protecting the user's privacy and security.

[0185] In some embodiments, the signature value includes: an encrypted first digest value, and the step of determining whether the application information and / or device information in the token message is abnormal based on the signature value includes:

[0186] The encrypted first digest value is decrypted using the public key of the first vehicle-mounted device to obtain the first digest value;

[0187] The second key management service processes the application information and / or device information in the token message according to the digest algorithm to obtain a second digest value;

[0188] Compare the first digest value and the second digest value;

[0189] If the comparison results indicate that the first digest value and the second digest value match, it is determined that the application information and device information in the token message are both normal.

[0190] In some embodiments, the second key management service can parse application information and device information from the token message, and process the application information and device information respectively using a digest algorithm to obtain a second digest value.

[0191] In another embodiment, the second key management service can also use a digest algorithm to directly process the token message to obtain a second digest value.

[0192] In this embodiment, the second key management service can parse the signature value from the token message. The signature value includes an encrypted first digest value. The encrypted first digest value is decrypted using the public key of the first vehicle device to obtain a second digest value. By comparing the first digest value and the second digest value, it is determined whether the application information and / or device information in the token message is abnormal. When the first digest value and the second digest value match, it indicates that the application information and device information in the token message are normal. When the first digest value and the second digest value do not match, it indicates that the application information and / or device information in the token message is abnormal.

[0193] In some embodiments, the second key management service processes the signature value using the public key and digest algorithm of the first vehicle device, thereby verifying the integrity and accuracy of the token message.

[0194] In some embodiments, the method further includes:

[0195] If the authentication result indicates that the application has been successfully authenticated, the application's access request is received through the second communication management interface.

[0196] In some embodiments, if the authentication result indicates that the application has been successfully authenticated, the access request sent by the first communication management interface is received through the second communication management interface, thereby reducing the waste of resources caused by the application's authentication failure.

[0197] In some embodiments, if the authentication result indicates that the application has been successfully authenticated, an access request from the application is received, thereby enabling cross-device management and authentication of the application's identity.

[0198] In some embodiments, the second in-vehicle device has application services, and the method further includes:

[0199] When the access request is directed to the application service of the second vehicle-mounted device, the access request is sent to the application service through the second communication management interface;

[0200] The application service provides corresponding services to the application based on the access request.

[0201] In some embodiments, the application service may include: permission management service, and may also include: camera service and playback service; there may be multiple application services, which are not specifically limited here.

[0202] In this embodiment of the application, when the access request is for the permission management service of the second vehicle device, the access request can be sent to the permission management service through the second communication management interface, so that the permission management service can obtain the permissions required by the application installed on the first vehicle device according to the access request, thereby enabling the permission management service of the second vehicle device to authorize the application installed on the first vehicle device.

[0203] In some embodiments, sending the application's access request to the application service upon successful authentication can ensure the security of applications accessing the application service and protect the privacy of the application service.

[0204] In some embodiments, the method further includes:

[0205] If the authentication result indicates that the application's authentication has failed and an access request for the application is received, the access request for the application shall be refused.

[0206] In some embodiments, when the authentication result indicates that the application's authentication has failed and the second communication management interface receives the application's access request, the second communication management interface may refuse to send the application's access request to the application service of the second vehicle device, thereby ensuring the user's privacy and security.

[0207] Figure 5 This is a flowchart illustrating an identity authentication method according to an exemplary embodiment. Figure 4 .like Figure 5 As shown, the method mainly includes the following steps:

[0208] In step 501, if the first communication management interface of the first vehicle device detects an access request, it sends a token acquisition request to the first key management service of the first vehicle device.

[0209] In step 502, the first key management service of the first vehicle device obtains the application information of the application and the device information of the first vehicle device upon receiving a token acquisition request.

[0210] In step 503, the first key management service of the first vehicle device generates a token message based on the application information of the application and the device information of the first vehicle device.

[0211] In step 504, the first key management service of the first vehicle device sends a token message to the first communication management interface of the first vehicle device.

[0212] In step 505, the first communication management interface of the first vehicle-mounted device sends a token message to the second communication management interface of the second vehicle-mounted device.

[0213] In step 506, the second communication management interface of the second vehicle-mounted device sends a token message to the second key management service of the second vehicle-mounted device.

[0214] In step 507, the second key management service of the second vehicle-mounted device parses the application information and device information from the token message.

[0215] In step 508, the second key management service of the second vehicle-mounted device performs identity authentication on the application installed on the first vehicle-mounted device based on application information and device information.

[0216] In step 509, the second key management service of the second vehicle-mounted device sends the authentication result to the second communication management interface of the second vehicle-mounted device.

[0217] In step 510, the second communication management interface of the second vehicle-mounted device sends the authentication result to the first communication management interface of the first vehicle-mounted device.

[0218] In step 511, if the authentication result indicates that the second vehicle device has successfully authenticated the application, the first communication management interface of the first vehicle device will send the access request to the second communication management interface of the second vehicle device.

[0219] In step 512, if the access request is for the application service of the second vehicle device, the second communication management interface of the second vehicle device will send the access request to the application service of the second vehicle device.

[0220] In some embodiments, the first key management service may also perform digital signature processing on the token message to obtain a signature value corresponding to the token message, and send the token message carrying the signature value to the second communication management interface through the first communication management interface, so that the second vehicle device can verify whether the application information and / or device information in the token message is abnormal based on the signature value.

[0221] In some embodiments, if the second key management service determines, based on the signature value, that both the application information and device information in the token message are normal, the second key management service authenticates the application installed on the first vehicle device based on the application information and device information. In other embodiments, if it is determined that the application information and / or device information in the token message is abnormal, the second key management service may refuse to authenticate the application installed on the first vehicle device.

[0222] Figure 6 This is an example of an identity authentication device frame shown in an exemplary embodiment. Figure 1 .like Figure 6 As shown, the identity authentication device 600 mainly includes:

[0223] The acquisition module 601 is configured to acquire application information of the application and device information of the first vehicle device through the first key management service when an access request is detected from an application installed on the first vehicle device; wherein the access request is used to request access to the service of the second vehicle device, and the first vehicle device and the second vehicle device operate in different domains under the same operating system;

[0224] The generation module 602 is configured to generate a token message through the first key management service based on the application information and the device information;

[0225] The first sending module 603 is configured to send the token message to the second communication management interface of the second vehicle device through the first communication management interface, so that the second vehicle device can authenticate the application installed on the first vehicle device according to the token message.

[0226] In some embodiments, the generation module 602 is configured to:

[0227] The binding relationship between the application information and the device information is established through the first key management service;

[0228] The first key management service generates the token message based on the application information, the device information, and the binding relationship.

[0229] In some embodiments, the device 600 further includes:

[0230] The signature module is configured to perform digital signature processing on the token message through the first key management service to obtain a signature value corresponding to the token message; wherein, the signature value is used to verify whether the application information and / or device information in the token message is abnormal;

[0231] The first sending module 603 is configured as follows:

[0232] The token message carrying the signature value is sent to the second communication management interface through the first communication management interface.

[0233] In some embodiments, the signature module is configured as follows:

[0234] The first key management service processes the token message using a digest algorithm to obtain a first digest value;

[0235] The first digest value is encrypted using the private key of the first vehicle device through the first key management service, and the encrypted first digest value is determined as the signature value.

[0236] In some embodiments, the generation module 602 is configured to:

[0237] If the first communication management interface detects the access request, a token acquisition request is sent to the first key management service;

[0238] Upon receiving the token acquisition request, the first key management service generates the token message based on the application information and the device information.

[0239] In some embodiments, the device 600 further includes:

[0240] The receiving module is configured to receive the authentication result through the first communication management interface;

[0241] The third sending module is configured to send the access request to the second communication management interface of the second vehicle device through the first communication management interface when the authentication result indicates that the second vehicle device has successfully authenticated the application.

[0242] In some embodiments, the first vehicle-mounted device and the second vehicle-mounted device are located in the same smart cockpit;

[0243] The first communication management interface and the second communication management interface are provided by the same communication framework.

[0244] Figure 7 This is an example of an identity authentication device frame shown in an exemplary embodiment. Figure 2 .like Figure 7 As shown, the identity authentication device 700 mainly includes:

[0245] The forwarding module 701 is configured to obtain a token message from the first communication management interface of the first vehicle-mounted device through the second communication management interface, and forward the token message to the second key management service; wherein, the token message includes: application information of the application installed on the first vehicle-mounted device and device information of the first vehicle-mounted device;

[0246] The parsing module 702 is configured to parse application information and device information from the token message through the second key management service;

[0247] The verification module 703 is configured to authenticate the application installed on the first vehicle device based on the application information and the device information through the second key management service, and obtain the authentication result; wherein the first vehicle device and the second vehicle device operate in different domains under the same operating system;

[0248] The second sending module 704 is configured to send the authentication result to the first vehicle-mounted device through the second communication management interface.

[0249] In some embodiments, the verification module 700 is configured as follows:

[0250] The second key management service determines whether the application information exists in the application list and the device information bound to the application information; wherein, the application list pre-stores: device information of vehicle devices in each domain of the operating system and application information of applications installed on each vehicle device;

[0251] If the application information and the device information bound to the application information exist in the application list, an authentication result indicating successful authentication of the application is obtained.

[0252] In some embodiments, the token message carries a signature value, and the device 700 further includes:

[0253] The determination module is configured to determine, based on the signature value, whether the application information and / or device information in the token message is abnormal through the second key management service;

[0254] The verification module 703 is configured as follows:

[0255] If the application information and device information in the token message are both normal, the second key management service authenticates the application installed on the first vehicle device based on the application information and the device information.

[0256] In some embodiments, the device 700 further includes:

[0257] The first rejection module is configured to refuse authentication of the application installed on the first vehicle device through the second key management service if it is determined that the application information and / or device information in the token message is abnormal.

[0258] In some embodiments, the signature value includes: an encrypted first digest value, and the determining module is configured to:

[0259] The encrypted first digest value is decrypted using the public key of the first vehicle-mounted device to obtain the first digest value;

[0260] The second key management service processes the application information and / or device information in the token message according to the digest algorithm to obtain the second digest value;

[0261] Compare the first digest value and the second digest value;

[0262] If the comparison results indicate that the first digest value and the second digest value match, it is determined that the application information and device information in the token message are both normal.

[0263] In some embodiments, the second vehicle-mounted device has application services, and the device 700 further includes:

[0264] The fourth sending module is configured to send the access request to the application service through the second communication management interface when the access request is directed to the application service of the second vehicle-mounted device.

[0265] A module is configured to provide corresponding services to the application based on the access request through the application service.

[0266] In some embodiments, the device 700 further includes:

[0267] The second denial module is configured to refuse to execute the application's access request if the authentication result indicates that the application's authentication has failed and an access request for the application is received.

[0268] Regarding the apparatus in the above embodiments, the specific manner in which each module performs its operation has been described in detail in the embodiments related to the method, and will not be elaborated upon here.

[0269] Figure 8 This is a block diagram illustrating an identity authentication device according to an exemplary embodiment. For example, device 800 may be a mobile phone, computer, digital broadcasting terminal, messaging device, game console, tablet device, medical device, fitness equipment, personal digital assistant, etc.

[0270] Reference Figure 8 The device 800 may include one or more of the following components: a processing component 802, a memory 804, a power supply component 806, a multimedia component 808, an audio component 810, an input / output (I / O) interface 812, a sensor component 814, and a communication component 816.

[0271] Processing component 802 typically controls the overall operation of device 800, such as operations associated with display, telephone calls, data communication, camera operation, and recording. Processing component 802 may include one or more processors 820 to execute instructions to perform all or part of the steps of the methods described above. Furthermore, processing component 802 may include one or more modules to facilitate interaction between processing component 802 and other components. For example, processing component 802 may include a multimedia module to facilitate interaction between multimedia component 808 and processing component 802.

[0272] Memory 804 is configured to store various types of data to support the operation of device 800. Examples of such data include instructions for any application or method operating on device 800, contact data, phonebook data, messages, pictures, videos, etc. Memory 804 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk.

[0273] Power supply component 806 provides power to various components of device 800. Power supply component 806 may include a power management system, one or more power sources, and other components associated with generating, managing, and distributing power to device 800.

[0274] Multimedia component 808 includes a screen that provides an output interface between the device 800 and the user. In some embodiments, the screen may include a liquid crystal display (LCD) and a touch panel (TP). If the screen includes a touch panel, the screen may be implemented as a touchscreen to receive input signals from the user. The touch panel includes one or more touch sensors to sense touches, swipes, and gestures on the touch panel. The touch sensors may sense not only the boundaries of the touch or swipe action but also the duration and pressure associated with the touch or swipe operation. In some embodiments, multimedia component 808 includes a front-facing camera and / or a rear-facing camera. When the device 800 is in an operating mode, such as a shooting mode or a video mode, the front-facing camera and / or the rear-facing camera may receive external multimedia data. Each front-facing camera and rear-facing camera may be a fixed optical lens system or have focal length and optical zoom capabilities.

[0275] Audio component 810 is configured to output and / or input audio signals. For example, audio component 810 includes a microphone (MIC) configured to receive external audio signals when device 800 is in an operating mode, such as call mode, recording mode, and voice recognition mode. The received audio signals may be further stored in memory 804 or transmitted via communication component 816. In some embodiments, audio component 810 also includes a speaker for outputting audio signals.

[0276] I / O interface 812 provides an interface between processing component 802 and peripheral interface modules, such as keyboards, click wheels, buttons, etc. These buttons may include, but are not limited to, home buttons, volume buttons, power buttons, and lock buttons.

[0277] Sensor assembly 814 includes one or more sensors for providing status assessments of various aspects of device 800. For example, sensor assembly 814 may detect the on / off state of device 800, the relative positioning of components such as the display and keypad of device 800, changes in the position of device 800 or a component of device 800, the presence or absence of user contact with device 800, the orientation or acceleration / deceleration of device 800, and temperature changes of device 800. Sensor assembly 814 may include a proximity sensor configured to detect the presence of nearby objects without any physical contact. Sensor assembly 814 may also include a light sensor, such as a CMOS or CCD image sensor, for use in imaging applications. In some embodiments, sensor assembly 814 may also include an accelerometer, a gyroscope, a magnetometer, a pressure sensor, or a temperature sensor.

[0278] Communication component 816 is configured to facilitate wired or wireless communication between device 800 and other devices. Device 800 can access wireless networks based on communication standards, such as WiFi, 4G, or 5G, or combinations thereof. In one exemplary embodiment, communication component 816 receives broadcast signals or broadcast-related information from an external broadcast management system via a broadcast channel. In one exemplary embodiment, communication component 816 also includes a near-field communication (NFC) module to facilitate short-range communication. For example, the NFC module may be implemented based on radio frequency identification (RFID) technology, Infrared Data Association (IrDA) technology, ultra-wideband (UWB) technology, Bluetooth (BT) technology, and other technologies.

[0279] In an exemplary embodiment, the apparatus 800 may be implemented by one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field-programmable gate arrays (FPGAs), controllers, microcontrollers, microprocessors, or other electronic components to perform the methods described above.

[0280] In an exemplary embodiment, a non-transitory computer-readable storage medium including instructions is also provided, such as a memory 804 including instructions, which can be executed by a processor 820 of the device 800 to perform the above-described method. For example, the non-transitory computer-readable storage medium may be a ROM, random access memory (RAM), CD-ROM, magnetic tape, floppy disk, and optical data storage device, etc.

[0281] A non-transitory computer-readable storage medium, when instructions in the storage medium are executed by a processor of an authentication device, wherein the authentication device includes an on-board device having a first key management service and a first communication management interface, enables the first on-board device to execute an authentication method, the method comprising:

[0282] Upon detecting an access request initiated by an application installed on the first vehicle device, the first key management service obtains the application information of the application and the device information of the first vehicle device; wherein, the access request is used to request access to the services of the second vehicle device, and the first vehicle device and the second vehicle device operate in different domains under the same operating system;

[0283] The first key management service generates a token message based on the application information and the device information;

[0284] The token message is sent from the first communication management interface to the second communication management interface of the second vehicle device, so that the second vehicle device can authenticate the application installed on the first vehicle device according to the token message.

[0285] In the case where the authentication device includes a second vehicle-mounted device having a second key management service and a second communication management interface, the second vehicle-mounted device is enabled to perform an authentication method, the method comprising:

[0286] The token message is obtained from the first communication management interface of the first vehicle device through the second communication management interface, and the token message is forwarded to the second key management service; wherein, the token message includes: application information of the application installed on the first vehicle device and device information of the first vehicle device;

[0287] The second key management service parses application information and device information from the token message;

[0288] The second key management service authenticates the application installed on the first vehicle device based on the application information and the device information, and obtains the authentication result; wherein, the first vehicle device and the second vehicle device operate in different domains under the same operating system;

[0289] The authentication result is sent to the first vehicle-mounted device through the second communication management interface.

[0290] Other embodiments of this application will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of this application that follow the general principles of this application and include common knowledge or customary techniques in the art not disclosed herein. The specification and embodiments are to be considered exemplary only, and the true scope of this application is indicated by the following claims. It should be understood that this application is not limited to the precise structures described above and shown in the drawings, and various modifications and changes can be made without departing from its scope. The scope of this application is limited only by the appended claims.

Claims

1. A method of identity authentication, characterized by, The application is applied to a first vehicle-mounted device with a first key management service and a first communication management interface, and comprises the following steps: In the case that an application installed on the first vehicle-mounted device is detected to initiate an access request, the first key management service acquires application information of the application and device information of the first vehicle-mounted device; wherein the access request is used to request access to an application service of a second vehicle-mounted device, the first vehicle-mounted device and the second vehicle-mounted device work in respective domains under the same operating system; the same operating system has multiple domains, and the domain of the operating system comprises subsystems integrated based on functions of different vehicle-mounted devices, and the invocation of processes of each subsystem is based on the same operating system; The first key management service generates a token message according to the application information and the device information; wherein the application information of the application on the first vehicle-mounted device is repeated with the application information of the application on the second vehicle-mounted device; The token message is sent to a second communication management interface of the second vehicle-mounted device through the first communication management interface, so that the second vehicle-mounted device performs identity authentication on the application installed on the first vehicle-mounted device according to the token message; wherein the first vehicle-mounted device and the second vehicle-mounted device are located in the same intelligent cockpit; the first communication management interface and the second communication management interface are provided by the same communication framework.

2. The method of claim 1, wherein, The first key management service generates a token message according to the application information and the device information, comprising: The first key management service establishes a binding relationship between the application information and the device information; The first key management service generates the token message based on the application information, the device information and the binding relationship.

3. The method of claim 1, wherein, The method further comprises: The first key management service performs digital signature processing on the token message to obtain a signature value corresponding to the token message; wherein the signature value is used to verify whether the application information and / or the device information in the token message are abnormal; The token message is sent to a second communication management interface of the second vehicle-mounted device through the first communication management interface, comprising: The token message carrying the signature value is sent to the second communication management interface through the first communication management interface.

4. The method of claim 3, wherein, The first key management service performs digital signature processing on the token message to obtain a signature value corresponding to the token message, comprising: The first key management service processes the token message by using a digest algorithm to obtain a first digest value; The first key management service encrypts the first digest value by using a private key of the first vehicle-mounted device, and determines the encrypted first digest value as the signature value.

5. The method of claim 1, wherein, The first key management service generates a token message according to the application information and the device information, comprising: In the case that the first communication management interface detects the access request, a token acquisition request is sent to the first key management service; The first key management service generates the token message according to the application information and the device information upon receiving the token acquisition request.

6. The method of claim 1, wherein, The method further comprises: receiving an identity verification result through the first communication management interface; in a case where the identity verification result indicates that the second vehicle-mounted device successfully verifies the application, sending the access request to a second communication management interface of the second vehicle-mounted device through the first communication management interface.

7. A method of identity authentication, characterized by, The method applied to a second vehicle-mounted device having a second key management service and a second communication management interface, comprises: acquiring a token message from a first communication management interface of a first vehicle-mounted device through the second communication management interface, and forwarding the token message to the second key management service; wherein the token message comprises application information of an application installed on the first vehicle-mounted device and device information of the first vehicle-mounted device; the second key management service parses the application information and the device information from the token message; the second key management service verifies the application installed on the first vehicle-mounted device based on the application information and the device information, to obtain an identity verification result; wherein the first vehicle-mounted device and the second vehicle-mounted device work in respective domains under the same operating system; the same operating system has multiple domains, and a domain of the operating system comprises a subsystem integrated based on functions of different vehicle-mounted devices, with a process of each subsystem calling the same operating system as a basis; wherein the application information of the application on the first vehicle-mounted device is repeated with the application information of the application on the second vehicle-mounted device; sending the identity verification result to the first vehicle-mounted device through the second communication management interface; wherein the first vehicle-mounted device and the second vehicle-mounted device are located in the same intelligent cockpit; the first communication management interface and the second communication management interface are provided by the same communication framework; in a case where the identity verification result indicates that the application is successfully verified, receiving an access request of the application through the second communication management interface; the access request is used to request access to an application service of the second vehicle-mounted device.

8. The method of claim 7, wherein, the second key management service verifies the application installed on the first vehicle-mounted device based on the application information and the device information, to obtain an identity verification result, comprising: the second key management service determines whether the application information and the device information bound with the application information exist in an application list; wherein the application list pre-stores device information of vehicle-mounted devices of respective domains in the operating system and application information of applications installed on respective vehicle-mounted devices; in a case where the application information and the device information bound with the application information exist in the application list, obtaining an identity verification result indicating that the application is successfully verified.

9. The method of claim 7, wherein, The token message carries a signature value, and the method further comprises: the second key management service determines whether the application information and / or the device information in the token message are abnormal based on the signature value; The second key management service authenticates the application installed on the first in-vehicle device based on the application information and the device information, including: In a case where the application information and the device information in the token message are determined to be normal, the second key management service authenticates the application installed on the first in-vehicle device based on the application information and the device information.

10. The method of claim 9, wherein, The method further includes: In a case where the application information and / or the device information in the token message is determined to be abnormal, the second key management service refuses to authenticate the application installed on the first in-vehicle device.

11. The method of claim 9, wherein, The signature value includes an encrypted first digest value, and the determination of whether the application information and / or the device information in the token message is abnormal based on the signature value includes: decrypting the encrypted first digest value by using the public key of the first in-vehicle device to obtain the first digest value; The second key management service processes the application information and / or the device information in the token message according to a digest algorithm to obtain a second digest value; comparing the first digest value and the second digest value; In a case where the comparison result indicates that the first digest value and the second digest value match, it is determined that the application information and the device information in the token message are normal.

12. The method of claim 7, wherein, The method further includes: In a case where the access request is for an application service of the second in-vehicle device, the access request is sent to the application service through the second communication management interface; The application service provides corresponding services for the application according to the access request.

13. The method of claim 7, wherein, The method further includes: In a case where the authentication result indicates that the authentication of the application fails and the access request of the application is received, the access request of the application is refused to be executed.

14. An identity authentication apparatus characterized by comprising: Applied to a first in-vehicle device having a first key management service and a first communication management interface, including: An acquisition module is configured to, in a case where an application installed on the first in-vehicle device is detected to initiate an access request, acquire application information of the application and device information of the first in-vehicle device through the first key management service; wherein the access request is used to request access to an application service of a second in-vehicle device, the first in-vehicle device and the second in-vehicle device work in respective domains under a same operating system; the same operating system has multiple domains, and a domain of the operating system includes a subsystem integrated based on functions of different in-vehicle devices with the operating system as a basic framework, and a process of each subsystem is invoked based on the same operating system; A generation module is configured to generate a token message through the first key management service according to the application information and the device information; wherein the application information of the application on the first in-vehicle device is repeated with the application information of the application on the second in-vehicle device. The first sending module is configured to send the token message to a second communication management interface of a second in-vehicle device through a first communication management interface, so that the second in-vehicle device performs identity authentication on the application installed on the first in-vehicle device according to the token message; and the application information of the application on the first in-vehicle device is repeated with the application information of the application on the second in-vehicle device.

15. An identity authentication apparatus characterized by comprising: The application is applied to a second in-vehicle device with a second key management service and a second communication management interface, and comprises: The forwarding module is configured to acquire a token message from a first communication management interface of a first in-vehicle device through the second communication management interface, and forward the token message to the second key management service; wherein the token message comprises application information of an application installed on the first in-vehicle device and device information of the first in-vehicle device; The parsing module is configured to parse the application information and the device information from the token message through the second key management service; The verification module is configured to perform identity authentication on the application installed on the first in-vehicle device based on the application information and the device information through the second key management service, and obtain an identity authentication result; wherein the first in-vehicle device and the second in-vehicle device work in respective domains under the same operating system; the same operating system has a plurality of domains, and the domains of the operating system comprise subsystems integrated based on functions of different in-vehicle devices with the operating system as a basic framework, and the calling of processes of each of the subsystems is based on the same operating system; the application information of the application on the first in-vehicle device is repeated with the application information of the application on the second in-vehicle device; The second sending module is configured to send the identity authentication result to the first in-vehicle device through the second communication management interface; wherein the first in-vehicle device and the second in-vehicle device are located in the same intelligent cockpit; and the first communication management interface and the second communication management interface are provided by the same communication framework; In a case where the identity authentication result represents that the identity authentication of the application is successful, an access request of the application is received through the second communication management interface; and the access request is used to request access to an application service of the second in-vehicle device.

16. An identity authentication apparatus characterized by comprising: Comprise: A processor; A memory for storing processor-executable instructions; The processor is configured to implement the steps in any one of the identity authentication methods in claims 1-13 when executed.

17. A non-transitory computer-readable storage medium, when instructions in the storage medium are executed by a processor of an identity authentication apparatus, enable the apparatus to perform the steps in any one of the identity authentication methods in claims 1-13.

Images