Encryption communication method for vehicle infrastructure integration and device with encryption communication function

Abstract

This invention relates to an encrypted communication method and device for vehicle-to-everything (V2X) communication, belonging to the field of V2X technology. The invention includes: after successful authentication with a second device, determining the target string used by the second device to generate a communication key; generating a communication key by processing the target string using the same key generation method as the second device; during communication with the second device, encrypting V2X data sent to the second device using the communication key, and decrypting received V2X data from the second device using the communication key. Because this invention uses the same string and the same key generation method between the two communicating devices to generate the communication key, and encrypts the V2X data during communication, it improves communication security.

Description

Technical Field

[0001] This invention relates to the field of vehicle-road cooperative technology, and in particular to an encrypted communication method for vehicle-road cooperation and a device with encrypted communication function. Background Technology

[0002] Vehicle-road cooperation involves the dynamic real-time information exchange between vehicles and between vehicles and roads, and conducts active safety control of vehicles and cooperative road management based on the collection and fusion of dynamic traffic signal information in all time and space. In vehicle-road cooperation technology, information is exchanged between two roadside devices, between roadside devices and road traffic control signal controllers, and between two road traffic control signal controllers.

[0003] Currently, the vehicle-road cooperative data broadcast between two roadside devices, between a roadside device and a traffic control signal, or between two traffic control signal devices is all in plaintext, without encryption. This leads to security risks such as leakage and illegal acquisition of the transmitted vehicle-road cooperative data. Summary of the Invention

[0004] This invention provides an encrypted communication method and a device with encrypted communication function for vehicle-road cooperation. It can generate a communication key between the two communicating devices using the same target string and the same key generation method, and encrypt the vehicle-road cooperative communication data for communication, thereby improving the security of communication.

[0005] In a first aspect, an embodiment of the present invention provides a first device for vehicle-road cooperation, comprising: a communication unit and a processor;

[0006] The processor is configured to, after successfully authenticating with the second device for vehicle-road cooperation, determine the target string used by the second device when generating the communication key; perform key generation processing on the target string according to the same key generation method as the second device to generate a communication key; and, during communication with the second device, use the communication key to encrypt the vehicle-road cooperative data sent to the second device, and use the communication key to decrypt the vehicle-road cooperative data received from the second device.

[0007] The communication unit is used to send encrypted vehicle-road cooperative data to the second device; and to receive encrypted vehicle-road cooperative data sent by the second device.

[0008] The first device mentioned above can generate a communication key after the second device has been authenticated, using the target string used when generating the communication key with the second device and the same key generation method as the second device. This eliminates the need for both parties to send keys, ensuring the security of the communication key. Furthermore, the use of the communication key for encryption during communication also improves the security of the vehicle-road cooperative data between the two parties.

[0009] In one possible implementation, the processor is specifically used for:

[0010] A first random number is generated using a random number generator. A first string, consisting of the certificate of the first device, the first random number signed with the private key of the first device, and the identifier of the first device, is sent to the second device as first authentication information.

[0011] Receive feedback information sent by the second device; if the feedback information is successfully decrypted using the first random number, it is determined that the identity verification with the second device is successful, and the key negotiation success information is sent back to the second device;

[0012] The feedback information is obtained by encrypting a second string composed of a first random number and a second random number generated by a random number generator after the second device has successfully authenticated the first device; or

[0013] The system receives second authentication information sent by the second device; wherein the second authentication information includes the certificate of the second device, a third string composed of a second random number of the second device signed with the private key of the second device, and a second device identifier; if the certificate of the second device is valid, and the signature verification of the signed third string is successful, then the authentication of the second device is determined to be successful.

[0014] A first random number is generated using a random number generator; a fourth string composed of the first and second random numbers is encrypted using the second random number, and the encrypted fourth string is sent to the second device; if a key negotiation success message is received from the second device, it is determined that the authentication with the second device has been successful.

[0015] The aforementioned first device can perform identity authentication using three aspects: random numbers, certificates, and signatures, when the two communicating parties, the first device and the second device, authenticate each other, thereby improving the security of identity authentication.

[0016] In one possible implementation, the processor is specifically used for:

[0017] Use the first random number and the second random number as the target string;

[0018] Using the same key generation method as the second device, the target string is processed to generate a communication key, including:

[0019] Characters are selected from the first random number and the second random number using the same extraction method as the second device.

[0020] Using the same combination method as the second device, the characters selected from the first random number and the characters selected from the second random number are combined to obtain the root key, and the root key is used as the communication key.

[0021] The first device described above can use the random number generated during the authentication process as the target string to generate a communication key, which reduces the number of communication attempts. At the same time, it uses the same extraction and combination methods as the second device to obtain the communication key, ensuring that the communication key actually used does not go through transmission, thus improving the security of communication.

[0022] In one possible implementation, the processor is specifically used for:

[0023] The first random number, the second random number, and the dynamic string are used as the target string, wherein the dynamic string includes some or all of the following: the generation time of the dynamic string, the identifier of the first device, and the identifier of the second device;

[0024] Using the same key generation method as the second device, the target string is processed to generate a communication key, including:

[0025] Characters are selected from the first random number and the second random number using the same extraction method as the second device.

[0026] The root key is obtained by combining the characters selected from the first random number and the characters selected from the second random number in the same way as the second device.

[0027] The dynamic string is encrypted using the root key in the same encryption method as the second device to obtain a derived key, which is then used as the communication key.

[0028] The first device mentioned above generates communication keys that include not only random numbers used during communication but also dynamic strings, which increases the difficulty of cracking the communication keys and improves their security.

[0029] In one possible implementation, the processor is further configured to:

[0030] If the number of communications between the first device and the second device exceeds a preset number, the dynamic string is updated, and the updated dynamic string is encrypted using the root key in the same encryption method as the second device to generate a new derived key, which is then used as the communication key.

[0031] The aforementioned first device can update the dynamic string and generate a new derived key when the number of communications between the first device and the second device exceeds a preset number, thereby preventing the communication key from being cracked and further enhancing the security of vehicle-road cooperative data transmission.

[0032] Secondly, an embodiment of the present invention provides a roadside unit, comprising: a communication unit, a main chip, and a security chip;

[0033] The security chip is used to determine the target string used by the second device to generate the communication key after successful authentication with the second device for vehicle-road cooperation; to perform key generation processing on the target string according to the same key generation method as the second device to generate a communication key; and to use the communication key to encrypt the vehicle-road cooperative data sent to the second device and to use the communication key to decrypt the vehicle-road cooperative data received from the second device during communication with the second device.

[0034] The main chip is used to receive vehicle-road cooperative data sent to the second device after encryption by the security chip, and to receive vehicle-road cooperative data sent by the second device after decryption by the security chip.

[0035] The communication unit is used to receive encrypted vehicle-road cooperative data sent by the main chip and send it to the second device; and to receive encrypted vehicle-road cooperative data sent by the second device and send it to the security chip.

[0036] Thirdly, an embodiment of the present invention provides a road traffic control signal controller, comprising: a communication unit, a main chip, and a security chip;

[0037] The security chip is used to determine the target string used by the second device to generate the communication key after successful authentication with the second device for vehicle-road cooperation; to perform key generation processing on the target string according to the same key generation method as the second device to generate a communication key; and to use the communication key to encrypt the vehicle-road cooperative data sent to the second device and to use the communication key to decrypt the vehicle-road cooperative data received from the second device during communication with the second device.

[0038] The main chip is used to receive vehicle-road cooperative data sent to the second device after encryption by the security chip, and to receive vehicle-road cooperative data sent by the second device after decryption by the security chip.

[0039] The communication unit is used to receive encrypted vehicle-road cooperative data sent by the main chip and send it to the second device; and to receive encrypted vehicle-road cooperative data sent by the second device and send it to the security chip.

[0040] Fourthly, an encrypted communication method for vehicle-to-infrastructure (V2I) communication is provided in an embodiment of the present invention, applied in a first device for V2I communication, the method comprising:

[0041] After successful authentication with the second device used for vehicle-road cooperation, the target string used by the second device when generating the communication key is determined;

[0042] The target string is processed using the same key generation method as the second device to generate a communication key;

[0043] During communication with the second device, the communication key is used to encrypt the vehicle-road cooperative data sent to the second device, and the communication key is used to decrypt the vehicle-road cooperative data received from the second device.

[0044] In one possible implementation, authentication with the second device is confirmed in the following way:

[0045] A first random number is generated using a random number generator. A first string, consisting of the certificate of the first device, the first random number signed with the private key of the first device, and the identifier of the first device, is sent to the second device as first authentication information.

[0046] Receive feedback information sent by the second device; if the feedback information is successfully decrypted using the first random number, it is determined that the identity verification with the second device is successful, and the key negotiation success information is sent back to the second device;

[0047] The feedback information is obtained by encrypting a second string composed of a first random number and a second random number generated by a random number generator after the second device has successfully authenticated the first device; or

[0048] The system receives second authentication information sent by the second device; wherein the second authentication information includes the certificate of the second device, a third string composed of a second random number of the second device signed with the private key of the second device, and a second device identifier; if the certificate of the second device is valid, and the signature verification of the signed third string is successful, then the authentication of the second device is determined to be successful.

[0049] A first random number is generated using a random number generator; a fourth string composed of the first and second random numbers is encrypted using the second random number, and the encrypted fourth string is sent to the second device; if a key negotiation success message is received from the second device, it is determined that the authentication with the second device has been successful.

[0050] In one possible implementation, determining the target string used by the second device when generating the communication key includes:

[0051] Use the first random number and the second random number as the target string;

[0052] Using the same key generation method as the second device, the target string is processed to generate a communication key, including:

[0053] Characters are selected from the first random number and the second random number using the same extraction method as the second device.

[0054] Using the same combination method as the second device, the characters selected from the first random number and the characters selected from the second random number are combined to obtain the root key, and the root key is used as the communication key.

[0055] In one possible implementation, determining the target string used by the second device when generating the communication key includes:

[0056] The first random number, the second random number, and the dynamic string are used as the target string, wherein the dynamic string includes some or all of the following: the generation time of the dynamic string, the identifier of the first device, and the identifier of the second device;

[0057] Using the same key generation method as the second device, the target string is processed to generate a communication key, including:

[0058] Characters are selected from the first random number and the second random number using the same extraction method as the second device.

[0059] The root key is obtained by combining the characters selected from the first random number and the characters selected from the second random number in the same way as the second device.

[0060] The dynamic string is encrypted using the root key in the same encryption method as the second device to obtain a derived key, which is then used as the communication key.

[0061] In one possible implementation, after encrypting the dynamic string using the root key in the same encryption method as the second device to obtain the derived key, the method further includes:

[0062] If the number of communications between the first device and the second device exceeds a preset number, the dynamic string is updated, and the updated dynamic string is encrypted using the root key in the same encryption method as the second device to generate a new derived key, which is then used as the communication key.

[0063] Fifthly, this application also provides a computer storage medium having a computer program stored thereon, which, when executed by a processing unit, implements the steps of the encrypted communication method for vehicle-road cooperation described in the fourth aspect.

[0064] Furthermore, the technical effects of any of the implementation methods in the second to fifth aspects can be found in the technical effects of different implementation methods in the first aspect, and will not be repeated here.

[0065] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and are not intended to limit the invention. Attached Figure Description

[0066] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with the invention and, together with the description, serve to explain the principles of the invention, but do not constitute an undue limitation of the invention.

[0067] Figure 1 This is a schematic diagram of a vehicle-road cooperative roadside system for secure communication provided in an embodiment of the present invention;

[0068] Figure 2 This is a structural diagram of a roadside unit provided in an embodiment of the present invention;

[0069] Figure 3 This is a structural diagram of a signal machine provided in an embodiment of the present invention;

[0070] Figure 4 This is a flowchart of an encrypted communication method for vehicle-road cooperation provided in an embodiment of the present invention;

[0071] Figure 5 This is a schematic diagram illustrating the authentication of a first device and a second device according to an embodiment of the present invention;

[0072] Figure 6 This is a schematic diagram illustrating another method of authentication for the first and second devices provided in an embodiment of the present invention;

[0073] Figure 7 This is a schematic diagram of the interaction between a roadside unit and a signal controller provided in an embodiment of the present invention. Detailed Implementation

[0074] To enable those skilled in the art to better understand the technical solutions of the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings.

[0075] It should be noted that the terms "first," "second," etc., used in the specification and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this invention. Rather, they are merely examples of apparatuses and methods consistent with some aspects of the invention as detailed in the appended claims.

[0076] The application scenarios described in the embodiments of this invention are for the purpose of more clearly illustrating the technical solutions of the embodiments of this invention, and do not constitute a limitation on the technical solutions provided by the embodiments of this invention. Those skilled in the art will understand that with the emergence of new application scenarios, the technical solutions provided by the embodiments of this invention are also applicable to similar technical problems. In the description of this invention, unless otherwise stated, the word "multiple" has the meaning of...

[0077] Currently, communication between two devices in a vehicle-road cooperative system is mostly in plaintext, which leads to security risks such as data leakage and illegal acquisition of transmitted vehicle-road cooperative data.

[0078] This invention provides a first device for vehicle-road cooperation, including a communication unit and a processor;

[0079] The processor is configured to, after successfully authenticating with the second device for vehicle-road cooperation, determine the target string used by the second device when generating the communication key; perform key generation processing on the target string according to the same key generation method as the second device to generate a communication key; and, during communication with the second device, use the communication key to encrypt the vehicle-road cooperative data sent to the second device, and use the communication key to decrypt the vehicle-road cooperative data received from the second device.

[0080] The communication unit is used to send encrypted vehicle-road cooperative data to the second device; and to receive encrypted vehicle-road cooperative data sent by the second device.

[0081] As an application scenario, combined with Figure 1 As shown, the vehicle-road cooperative roadside system includes multiple devices for vehicle-road cooperation, such as a road traffic control signal controller (hereinafter referred to as a signal controller) 100, an edge computing server (MEC) 101, a roadside unit (RSU) 102, and a signal controller central platform 103.

[0082] Certificate Authentication Center 104 issues certificates to signal controller 100, edge computing server 101, roadside unit 102, signal controller central platform 103, and certificates for related equipment.

[0083] Among them, both devices that have information exchange need to save each other's certificates in order to authenticate each other's identities. When two roadside units need to communicate, both roadside units 102 save their own certificates and the other party's certificates.

[0084] When the roadside unit 102 and the signal controller 100 communicate with each other, both the roadside unit 102 and the signal controller 100 store their own certificates and the other party's certificates.

[0085] Signal 100 is a control device for traffic signal lights.

[0086] Edge computing server 101 provides edge computing services to roadside unit 102.

[0087] The Road Side Unit (RSU) 102 is a device that integrates multiple functions such as road traffic information collection, dissemination and broadcasting, and vehicle-road cooperative data analysis, and has the ability to interact with other vehicle-road cooperative devices and cloud platforms.

[0088] The signal control center platform 103 is used to control the signal controller;

[0089] It should be noted that the vehicle-road cooperative roadside system may also include other components as needed, such as a vehicle-road cooperative cloud platform, which is used to control the roadside unit 102.

[0090] To improve the security of information transmission in the entire system, the edge computing server 101 and the signal controller 100 need to undergo certificate authentication, the roadside unit 102 in the vehicle-road cooperative roadside system needs to undergo certificate authentication with the edge computing server 101, the roadside unit 102 in the vehicle-road cooperative roadside system needs to undergo certificate authentication with the signal controller 100, and the signal controller 100 needs to undergo certificate authentication with the signal controller central platform 103.

[0091] The specific authentication process includes: when the edge computing server 101 and the traffic signal controller 100 communicate via vehicle-road cooperative data, the edge computing server 101 sends its own vehicle-road cooperative data and simultaneously sends a certificate sent by the certificate authentication center 104 to the traffic signal controller 100. The traffic signal controller 100 receives the certificate sent by the certificate authentication center 104 from the edge computing server 101 and verifies the certificate. If the verification is successful, the traffic signal controller 100 determines that the identity of the edge computing server 101 is legitimate. Similarly, the traffic signal controller 100 sends its own certificate to the edge computing server 101. The edge computing server 101 verifies the received certificate. If the verification is successful, the edge computing server 101 determines that the identity of the traffic signal controller 100 is legitimate.

[0092] It should be noted that the first device used for vehicle-to-infrastructure (V2I) communication can be a roadside unit, edge computing server (MEC), traffic signal center platform, or road traffic control signal in a V2I roadside system. The second device used for V2I communication can also be a roadside unit, edge computing server (MEC), traffic signal center platform, or road traffic control signal in a V2I roadside system. V2I data refers to the interactive information between the first and second devices. The specific devices used for the first and second devices, and the V2I data exchanged between them, can be determined based on the specific scenario.

[0093] When a vehicle needs to make an emergency pass through an intersection waiting for a traffic light, the first device can be a roadside unit 102 and the second device can be a traffic signal controller 100. The vehicle will generally communicate with the roadside unit 102. The vehicle sends the request for emergency passage to the roadside unit 102, and the roadside unit 102 sends the request to the traffic signal controller 100 in encrypted form. The traffic signal controller 100 determines whether the green light can be turned on based on the current status of the traffic light, and then sends the conclusion on whether the green light can be turned on to the roadside unit 102. The roadside unit 102 then sends it to the vehicle. Based on the information from the traffic signal controller 100, the vehicle can decide whether to slow down or proceed directly through the intersection. When the roadside unit 102 and the signal controller 100 need to exchange information, they also need to encrypt the transmitted vehicle-road cooperative data, namely the request for emergency passage and the conclusion on whether the green light can be turned on. The specific communication process is as follows: after the roadside unit 102 successfully authenticates with the signal controller 100, it determines the target string used by the signal controller 100 when generating the communication key; according to the same key generation method as the signal controller 100, it performs key generation processing on the target string to generate the communication key; during the communication with the signal controller 100, it uses the communication key to encrypt the request for emergency passage sent to the signal controller 100, and uses the communication key to decrypt the conclusion on whether the green light can be turned on received from the signal controller 100.

[0094] Since both the roadside unit 102 and the signal controller 100 use the same string for generating the communication key and the same key generation method, and then use the communication key to encrypt the vehicle-road cooperative data, the communication key between the roadside unit 102 and the signal controller 100 is not transmitted, so other devices cannot obtain the communication key by intercepting the communication information of the two devices, thus improving the security of communication.

[0095] When a vehicle is navigating, it needs to know the current status and time of the traffic lights along the navigation route to determine the waiting time at intersections. Adding this to the travel time gives the navigation time. This application requires information exchange between the edge computing server 101 and the traffic light 100; that is, the first device can be the edge computing server 101, and the second device can be the traffic light 100. During information exchange, the edge computing server 101 needs to authenticate with the traffic signal controller 100 on the navigation route and determine the target string used by the traffic signal controller 100 to generate the communication key. Following the same key generation method as the traffic signal controller 100, the edge computing server 101 performs key generation processing on the target string to generate the communication key. During communication with the traffic signal controller 100, the edge computing server 101 uses the communication key to encrypt the request sent to the traffic signal controller 100 regarding the traffic light status and the duration of maintaining the current status. The traffic signal controller 100 sends the encrypted traffic light status and duration of maintaining the current status to the edge computing server 101 using the communication key. The edge computing server 101 uses the communication key to decrypt the received traffic light status and duration of maintaining the current status from the traffic signal controller 100. After determining the navigation time based on the traffic light status and duration of maintaining the current status sent by the traffic signal controller 100, the edge computing server 101 sends the information to the vehicle.

[0096] When a traffic signal controller needs to determine changes in the traffic lights at an intersection, it can do so by observing vehicles on the road. This application requires information exchange between an edge computing server 101 and a traffic signal controller 100; the first device can be the traffic signal controller 100, and the second device can be the edge computing server 101. During this information exchange, the traffic signal controller 100 needs to authenticate with the edge computing server 101 at the intersection and determine the target string used by the edge computing server 101 when generating the communication key. Following the same key generation method as the edge computing server 101, the target string is processed to generate a communication key. During communication with the edge computing server 101, the traffic signal controller 100 uses the communication key to encrypt requests from vehicles at the intersection sent to the edge computing server 101. The edge computing server 101 then encrypts the images of the vehicles at the intersection using the communication key and sends them to the traffic signal controller 100. The traffic signal controller 100 then uses the communication key to decrypt the received images of the vehicles at the intersection. After receiving the images of the vehicles at the intersection, the traffic signal controller 100 determines the congestion situation at the intersection and then controls the traffic lights accordingly.

[0097] During urban traffic control, the signal control center platform 103 can control the status of all signal controllers in the city. Based on the current time, such as the start or end of the workday, when urban traffic pressure is high, the signal control center platform 103 can determine which signal controllers have green lights and how long they should maintain the green light. In this way, the signal control center platform 103 and the signal controller 100 can each generate a communication key, and then use the communication key to encrypt the vehicle-road cooperative data they exchange.

[0098] When the first device is a roadside unit, the function of generating communication keys by the processor described in the first device is implemented in the security chip of the roadside unit, and the security chip communicates with the communication unit through the main chip.

[0099] Specifically, embodiments of the present invention provide a roadside unit, combined with Figure 2 As shown, it includes a communication unit 200, a main chip 201, and a security chip 202;

[0100] The security chip 202 is used to determine the target string used by the second device when generating the communication key after successful authentication with the second device; to generate a communication key by performing key generation processing on the target string according to the same key generation method as the second device; and to encrypt vehicle-road cooperative data sent to the second device and decrypt vehicle-road cooperative data received from the second device using the communication key during communication with the second device. The second device is a device that communicates with a roadside unit. It can be another roadside unit or a traffic signal controller.

[0101] The main chip 201 is used to receive vehicle-road cooperative data sent to the second device after encryption by the security chip, and to receive vehicle-road cooperative data sent by the second device after decryption by the security chip.

[0102] The communication unit 200 is used to receive encrypted vehicle-road cooperative data sent by the main chip and send it to the second device; and to receive encrypted vehicle-road cooperative data sent by the second device and send it to the security chip.

[0103] In detail, when the roadside unit sends information to the traffic signal, the main chip 201 needs to first generate the vehicle-road cooperative data to be sent and send the vehicle-road cooperative data to the safety chip 202. The safety chip 202 uses a communication key to encrypt the vehicle-road cooperative data and returns the encrypted vehicle-road cooperative data to the main chip 201. The main chip 201 sends it to the communication unit 200, and the communication unit 200 sends the encrypted vehicle-road cooperative data to the traffic signal.

[0104] When the roadside unit receives vehicle-road cooperative data from the signal controller, the communication unit 200 sends the received vehicle-road cooperative data to the security chip 202 through the main chip 201. The security chip 202 decrypts the vehicle-road cooperative data using the communication key and then sends it back to the main chip 201.

[0105] The main chip 201 interacts with the security chip 202 via the SPI interface (Serial Peripheral Interface), and the main chip 201 interacts with the communication unit 200 via USB (Universal Serial Bus) 3.0.

[0106] The communication unit 200 can use V2X (vehicle to everything) for communication.

[0107] The security chip 202 includes a key negotiation module 2021, a key storage module 2022, an identity authentication module 2023, an encryption algorithm module 2024, a key management module 2025, and a certificate management module 2026.

[0108] The key negotiation module 2021 is used for key negotiation with the signal controller;

[0109] The key storage module 2022 is used to store communication keys;

[0110] The identity authentication module 2023 is used for identity authentication with the signal controller;

[0111] The encryption algorithm module 2024 is used to generate a communication key according to the key generation method, and to encrypt the vehicle-road cooperative data to be transmitted to the second device using the communication key, and to decrypt the vehicle-road cooperative data received from the second device using the communication key.

[0112] The Key Management Module 2025 is used to manage communication keys for different devices separately;

[0113] The Certificate Management Module 2026 is used to apply for certificates for roadside units from the Certificate Authority, and to store the certificates of roadside units and other devices that communicate with them.

[0114] Based on this, embodiments of the present invention provide a signal machine, combined with Figure 3 As shown, it includes a communication unit 300, a main chip 301, and a security chip 302;

[0115] The security chip 302 is used to determine the target string used by the second device when generating the communication key after successful authentication with the second device; to generate a communication key by performing key generation processing on the target string according to the same key generation method as the second device; and to encrypt vehicle-road cooperative data sent to the second device and decrypt vehicle-road cooperative data received from the second device using the communication key during communication with the second device. The second device is a device that communicates with a traffic signal controller. It can be another traffic signal controller or a roadside device.

[0116] The main chip 301 is used to receive vehicle-road cooperative data sent to the second device after encryption by the security chip, and to receive vehicle-road cooperative data sent by the second device after decryption by the security chip.

[0117] The communication unit 300 is used to receive encrypted vehicle-road cooperative data sent by the main chip and send it to the second device; and to receive encrypted vehicle-road cooperative data sent by the second device and send it to the security chip.

[0118] In detail, when the signal controller sends information to the roadside unit, the main chip 301 needs to first generate the vehicle-road cooperative data to be sent and send the vehicle-road cooperative data to the safety chip 302. The safety chip 302 uses a communication key to encrypt the vehicle-road cooperative data and returns the encrypted vehicle-road cooperative data to the main chip 301. The main chip 301 sends it to the communication unit 300, and the communication unit 300 sends the encrypted vehicle-road cooperative data to the roadside unit.

[0119] When the signal receives information from the roadside unit, the communication unit 300 sends the received vehicle-road cooperative data to the safety chip 302 through the main chip 301. The safety chip 302 decrypts the vehicle-road cooperative data using the communication key and then sends it back to the main chip 301.

[0120] The security chip 302 includes a key negotiation module 3021, a key storage module 3022, an identity authentication module 3023, an encryption algorithm module 3024, a key management module 3025, and a certificate management module 3026.

[0121] The key negotiation module 3021 is used to negotiate keys with the signal controller;

[0122] The key storage module 3022 is used to store communication keys;

[0123] The identity authentication module 3023 is used for identity authentication with the signal controller;

[0124] The encryption algorithm module 3024 is used to generate a communication key according to the key generation method, and to encrypt the vehicle-road cooperative data to be transmitted to the second device using the communication key, and to decrypt the vehicle-road cooperative data received from the second device using the communication key.

[0125] The key management module 3025 is used to manage communication keys with different devices separately;

[0126] The certificate management module 3026 is used to apply for certificates for roadside units from the certificate authority, and to store the certificates of roadside units and other devices that communicate with them.

[0127] It should be noted that the "first device" and "second device" mentioned below refer to any device in the vehicle-road cooperative roadside system, such as roadside equipment or traffic signals. The first device and the second device are two devices that need to communicate.

[0128] Based on the aforementioned equipment, this embodiment of the invention provides an encrypted communication method for vehicle-to-infrastructure (V2I) communication, applied to a first device for V2I communication, combined with... Figure 4 As shown, the method includes:

[0129] S400: After successful authentication with the second device used for vehicle-road cooperation, determine the target string used by the second device when generating the communication key;

[0130] S401: Based on the same key generation method as the second device, perform key generation processing on the target string to generate a communication key;

[0131] S402: During communication with the second device, the vehicle-road cooperative data sent to the second device is encrypted using a communication key, and the vehicle-road cooperative data received from the second device is decrypted using a communication key.

[0132] For example, authentication with the second device is confirmed to be successful in the following ways:

[0133] For example, when the first device is the device sending the identity request and the second device is the receiving device, the first device generates a first random number using a random number generator, and sends a first string consisting of the first device's certificate, the first random number signed with the first device's private key, and the first device's identifier as first authentication information to the second device; and

[0134] Receive feedback information sent by the second device; if the feedback information is successfully decrypted using the first random number, it is determined that the identity verification with the second device is successful, and the key negotiation success information is sent back to the second device;

[0135] The feedback information is obtained by encrypting a second string composed of a first random number and a second random number generated by a random number generator after the second device has successfully authenticated the first device.

[0136] For example, in combination Figure 5 As shown, the first device 500 sends a first string consisting of its certificate, a first random number signed with its private key, and a first device identifier as first authentication information to the second device 501. After the second device 501 successfully authenticates the first device, it encrypts a second string consisting of the first random number and a second random number generated by a random number generator using the first random number. The encrypted second string is then sent back to the first device 500 as feedback information. The authentication process of the second device 501 includes verifying the validity of the first device's certificate and verifying the first string consisting of the first random number signed with its private key and the first device identifier. If the first device's certificate is valid and the signature verification of the first string is successful, the second device 501 successfully authenticates the first device. If the first device's certificate is invalid or the signature verification of the second string is unsuccessful, the second device 501 fails to authenticate the first device. When the certificate is invalid, an error code is sent back to the first device 500. When the signature verification fails, the second device 501 discards the information and communication is interrupted.

[0137] The first device 500 receives feedback information sent by the second device 501; if the feedback information is successfully decrypted using the first random number, it determines that the authentication with the second device 501 is successful, and sends a key negotiation success message back to the second device 501.

[0138] For example, when the second device is the device sending the identity request and the first device is the receiving device, the first device receives the second authentication information sent by the second device; wherein, the second authentication information includes the certificate of the second device, a third string composed of a second random number of the second device signed with the private key of the second device and a second device identifier; if the certificate of the second device is valid and the signature verification of the signed third string is passed, then it is determined that the authentication of the second device is successful, and

[0139] A first random number is generated using a random number generator; a fourth string composed of the first and second random numbers is encrypted using the second random number, and the encrypted fourth string is sent to the second device; if a key negotiation success message is received from the second device, it is determined that the authentication with the second device has been successful.

[0140] Combination Figure 6 As shown, the second device 501 sends a third string consisting of its own certificate, a second random number signed with its private key, and a second device identifier, as second authentication information to the first device 500. Upon receiving this second authentication information, if the second device 501's certificate is valid and the signature verification of the signed third string is successful, then the first device 500 has successfully authenticated the second device. The first device 500 generates a first random number using a random number generator; it then encrypts a fourth string consisting of the first and second random numbers using the second random number and sends the encrypted fourth string to the second device 501. The second device 501 decrypts the fourth string using the second random number. If decryption is successful, it sends a key negotiation success message back to the first device 500. Upon receiving this message, the first device 500 has successfully authenticated the second device 501.

[0141] To enhance the security of password transmission, a hash algorithm can be introduced into the authentication process.

[0142] For example, if the first device is the device sending the identity request and the second device is the receiving device, then the first device sends the first identity authentication information to the second device. After receiving the first identity authentication information, the second device verifies whether the certificate of the first device is valid. If it is valid, it verifies whether the first string is successfully signed. If the signature is successful, the second device generates a second random number, uses the first random number as a symmetric key to perform ECB encryption of the string composed of the first random number and the second random number using the SM1 algorithm to obtain the encryption result, and uses the SM3 algorithm to perform hash calculation on the encryption result to obtain the hash result. The encryption result and the hash result are then transmitted to the first device.

[0143] The first device performs a hash calculation using the SM3 algorithm on the encrypted result and compares the resulting hash with the transmitted hash. If they are different, an error is returned and key negotiation fails. If they are the same, the encrypted result is decrypted using the first random number to obtain the first random number and the second random number. The decrypted first random number is compared with the first random number stored locally. If they are different, an error is returned and key negotiation fails. If successful, a key negotiation success message is returned to the second device.

[0144] Of course, when the first device is the receiving device and the second device is the device that sends the authentication, the process is similar to the above, and the specific process can be referred to the above.

[0145] The aforementioned identity authentication process can be the function of the identity authentication module and key negotiation module in the security chip, and the following communication key generation method can be the function of the encryption algorithm module.

[0146] For example, embodiments of the present invention provide the following two methods for generating communication keys:

[0147] The first method uses the first and second random numbers as the target string;

[0148] Using the same extraction method as the second device, characters are selected from the first random number and the second random number respectively;

[0149] Using the same combination method as the second device, the characters selected from the first random number and the characters selected from the second random number are combined to obtain the root key, which is then used as the communication key.

[0150] For example, the extraction method is the same as that of the second device, which is to extract the first 8 characters. The combination method is also the same as that of the second device, which is to combine the first device first and the second device last. The first 8 characters of the first random number and the second random number are used to form a new character. The new character is used to encrypt the vehicle-road cooperative data, and the new character can also be used to decrypt the vehicle-road cooperative data received from the second device.

[0151] The second method uses the first random number, the second random number, and the dynamic string as the target string, wherein the dynamic string includes some or all of the following: the generation time of the dynamic string, the identifier of the first device, and the identifier of the second device;

[0152] Using the same extraction method as the second device, characters are selected from the first random number and the second random number respectively;

[0153] Using the same combination method as the second device, the characters selected from the first random number and the characters selected from the second random number are combined to obtain the root key;

[0154] Using the same encryption method as the second device, the dynamic string is encrypted with the root key to obtain the derived key, which is then used as the communication key.

[0155] For example, the dynamic string includes the generation time of the dynamic string and the identifier of the device sending the authentication. For instance, when the first device is the device sending the authentication, the dynamic string includes the generation time of the dynamic string and the identifier of the first device; when the second device is the device sending the authentication, the dynamic string includes the generation time of the dynamic string and the identifier of the second device.

[0156] The first device obtains the system time from the device, which can be 8 bytes. The identifier of the first device is obtained and formed into a dynamic string. The dynamic string is encrypted in SM1 ECB mode using the negotiated root key to obtain a 16-byte derived key, denoted as KT.

[0157] The first device uses a derived key KT to encrypt and transmit vehicle-to-infrastructure (V2I) data, and the second device uses the derived key KT to decrypt and transmit the V2I data.

[0158] To prevent the key from being cracked or stolen, after obtaining the derived key, the method further includes:

[0159] If the number of communications between the first device and the second device exceeds a preset number, the dynamic string is updated, and the updated dynamic string is encrypted using the root key in the same encryption method as the second device to generate a new derived key, which is then used as the communication key.

[0160] For example, when the dynamic string includes the generation time of the dynamic string, the first device obtains the system time recorded in the first device, and then obtains a new dynamic string by modifying the time. The new dynamic string is then encrypted using the negotiated root key in SM1 ECB mode to obtain a 16-byte derived key, denoted as KT1. The encryption process is denoted as KT1 = SM1 - ecb - ENC(K1, M3). K1 is the root key, and M3 is the new dynamic string.

[0161] For example, taking the roadside unit 102 as the device sending the authentication and the traffic signal controller 100 as the receiving device, combined with... Figure 7 As shown, this embodiment of the invention provides an encrypted communication method between a roadside unit and a signal controller, including:

[0162] S700: The roadside unit stores the application certificate and key pair, which consists of a public key and a private key.

[0163] S701: The roadside unit generates a 16-byte random number SR, signs SR and the identifier SN using its private key to obtain S1, and sends SR, SN, S1, and Cer1 to the traffic signal controller; where SR = SR1 + SR2. The first random number is represented by SR, the identifier of the first device is represented by SN, and the certificate of the first device is represented by Cer1. The second random number is represented by RR.

[0164] S702: The signal controller verifies the validity of Cer1. If the certificate is invalid, communication is stopped.

[0165] S703: The signal device verifies the signature of S1. If the signature fails verification, communication is stopped.

[0166] S704: If the signal machine verifies the legitimacy of Cer1 and the signature of S1 is verified, a 16-byte random number RR is generated. SR is used as the symmetric key to encrypt SR and RR using the SM1 algorithm in ECB mode to obtain E1. Then, the SM3 algorithm is used to hash E1 to obtain H1. E1 and H1 are fed back. Wherein, RR = RR1 + RR2.

[0167] S705: The roadside unit performs an SM3 algorithm hash operation on E1 to obtain the hash result, and compares it with H1. If they are different, an error is reported. If they are the same, SR is used to decrypt E1. The decrypted SR is compared with the SR stored on the local machine. If they are different, an error is reported.

[0168] S706: If the roadside units are the same, the key negotiation success information is fed back to the signal controller, and the first 8 bytes of SR and RR are taken respectively to form the root key K1;

[0169] S707: The roadside equipment obtains the system time T1, encrypts SN and T1 using the root key K1 to obtain the derived key KT; among them, M2 is encrypted in SM1 ECB mode using the negotiated root key K1, M2 = SN + T1, and the encryption process is recorded as KT = SM1 - ecb - ENC(K1, M2).

[0170] S708: If the signal receiver receives a key negotiation success message, it takes the first 8 bytes of SR and RR respectively to form the root key K1;

[0171] S709: The signal device obtains the system time T1, encrypts SN and T1 using the root key K1 to obtain the derived key KT; among them, M2 is encrypted in SM1 ECB mode using the negotiated root key K1, M2 = SN + T1, and the encryption process is recorded as KT = SM1 - ecb - ENC(K1, M2).

[0172] S710: The roadside equipment adopts the SM4 CFB encryption algorithm mode, with initial vectors IV = SR2 and RR2. It uses KT to encrypt and transmit vehicle-road cooperative data M, resulting in ciphertext C = SM4-cfb-ENC(KT, IV, M).

[0173] S711: The signal uses KT to decrypt the ciphertext C. The decryption algorithm is SM4 CFB mode, with initial vectors IV = SR2 and RR2, resulting in plaintext M = SM4-cfb-DEC(KT, IV, C).

[0174] Based on the above description, embodiments of the present invention also provide a first device for vehicle-road cooperation, comprising: a communication unit and a processor;

[0175] The processor is configured to, after successfully authenticating with the second device for vehicle-road cooperation, determine the target string used by the second device when generating the communication key; perform key generation processing on the target string according to the same key generation method as the second device to generate a communication key; and, during communication with the second device, use the communication key to encrypt the vehicle-road cooperative data sent to the second device, and use the communication key to decrypt the vehicle-road cooperative data received from the second device.

[0176] The communication unit is used to send encrypted vehicle-road cooperative data to the second device; and to receive encrypted vehicle-road cooperative data sent by the second device.

[0177] Optionally, the processor is specifically used for:

[0178] A first random number is generated using a random number generator. A first string, consisting of the certificate of the first device, the first random number signed with the private key of the first device, and the identifier of the first device, is sent to the second device as first authentication information.

[0179] Receive feedback information sent by the second device; if the feedback information is successfully decrypted using the first random number, it is determined that the identity verification with the second device is successful, and the key negotiation success information is sent back to the second device;

[0180] The feedback information is obtained by encrypting a second string composed of a first random number and a second random number generated by a random number generator after the second device has successfully authenticated the first device; or

[0181] The system receives second authentication information sent by the second device; wherein the second authentication information includes the certificate of the second device, a third string composed of a second random number of the second device signed with the private key of the second device, and a second device identifier; if the certificate of the second device is valid, and the signature verification of the signed third string is successful, then the authentication of the second device is determined to be successful.

[0182] A first random number is generated using a random number generator; a fourth string composed of the first and second random numbers is encrypted using the second random number, and the encrypted fourth string is sent to the second device; if a key negotiation success message is received from the second device, it is determined that the authentication with the second device has been successful.

[0183] Optionally, the processor is specifically used for:

[0184] Use the first random number and the second random number as the target string;

[0185] Using the same key generation method as the second device, the target string is processed to generate a communication key, including:

[0186] Characters are selected from the first random number and the second random number using the same extraction method as the second device.

[0187] Using the same combination method as the second device, the characters selected from the first random number and the characters selected from the second random number are combined to obtain the root key, and the root key is used as the communication key.

[0188] Optionally, the processor is specifically used for:

[0189] The first random number, the second random number, and the dynamic string are used as the target string, wherein the dynamic string includes some or all of the following: the generation time of the dynamic string, the identifier of the first device, and the identifier of the second device;

[0190] Using the same key generation method as the second device, the target string is processed to generate a communication key, including:

[0191] Characters are selected from the first random number and the second random number using the same extraction method as the second device.

[0192] The root key is obtained by combining the characters selected from the first random number and the characters selected from the second random number in the same way as the second device.

[0193] The dynamic string is encrypted using the root key in the same encryption method as the second device to obtain a derived key, which is then used as the communication key.

[0194] Optionally, the processor is further configured to:

[0195] If the number of communications between the first device and the second device exceeds a preset number, the dynamic string is updated, and the updated dynamic string is encrypted using the root key in the same encryption method as the second device to generate a new derived key, which is then used as the communication key.

[0196] Based on the above description, embodiments of the present invention also provide a roadside unit, including: a communication unit, a main chip, and a security chip;

[0197] The security chip is used to determine the target string used by the second device to generate the communication key after successful authentication with the second device for vehicle-road cooperation; to perform key generation processing on the target string according to the same key generation method as the second device to generate a communication key; and to use the communication key to encrypt the vehicle-road cooperative data sent to the second device and to use the communication key to decrypt the vehicle-road cooperative data received from the second device during communication with the second device.

[0198] The main chip is used to receive vehicle-road cooperative data sent to the second device after encryption by the security chip, and to receive vehicle-road cooperative data sent by the second device after decryption by the security chip.

[0199] The communication unit is used to receive encrypted vehicle-road cooperative data sent by the main chip and send it to the second device; and to receive encrypted vehicle-road cooperative data sent by the second device and send it to the security chip.

[0200] Optionally, the security chip is specifically used for:

[0201] A first random number is generated using a random number generator. A first string consisting of the roadside unit's certificate, the first random number signed with the roadside unit's private key, and the roadside unit's identifier is sent to the second device as first authentication information.

[0202] Receive feedback information sent by the second device; if the feedback information is successfully decrypted using the first random number, it is determined that the identity verification with the second device is successful, and the key negotiation success information is sent back to the second device;

[0203] The feedback information is obtained by encrypting a second string consisting of a first random number and a second random number generated by a random number generator after the second device has successfully authenticated the roadside unit; or

[0204] The system receives second authentication information sent by the second device; wherein the second authentication information includes the certificate of the second device, a third string composed of a second random number of the second device signed with the private key of the second device, and a second device identifier; if the certificate of the second device is valid, and the signature verification of the signed third string is successful, then the authentication of the second device is determined to be successful.

[0205] A first random number is generated using a random number generator; a fourth string composed of the first and second random numbers is encrypted using the second random number, and the encrypted fourth string is sent to the second device; if a key negotiation success message is received from the second device, it is determined that the authentication with the second device has been successful.

[0206] Optionally, the security chip is specifically used for:

[0207] Use the first random number and the second random number as the target string;

[0208] Using the same key generation method as the second device, the target string is processed to generate a communication key, including:

[0209] Characters are selected from the first random number and the second random number using the same extraction method as the second device.

[0210] Using the same combination method as the second device, the characters selected from the first random number and the characters selected from the second random number are combined to obtain the root key, and the root key is used as the communication key.

[0211] Optionally, the security chip is specifically used for:

[0212] The first random number, the second random number, and the dynamic string are used as the target string, wherein the dynamic string includes some or all of the following: the generation time of the dynamic string, the identifier of the roadside unit, and the identifier of the second device;

[0213] Using the same key generation method as the second device, the target string is processed to generate a communication key, including:

[0214] Characters are selected from the first random number and the second random number using the same extraction method as the second device.

[0215] The root key is obtained by combining the characters selected from the first random number and the characters selected from the second random number in the same way as the second device.

[0216] The dynamic string is encrypted using the root key in the same encryption method as the second device to obtain a derived key, which is then used as the communication key.

[0217] Optionally, the security chip is also used for:

[0218] If the number of communications between the roadside unit and the second device exceeds a preset number, the dynamic string is updated, and the updated dynamic string is encrypted using the root key in the same encryption method as the second device to generate a new derived key, which is then used as the communication key.

[0219] Based on the above description, this embodiment of the invention also provides a road traffic control signal controller, comprising: a communication unit, a main chip, and a security chip;

[0220] The security chip is used to determine the target string used by the second device to generate the communication key after successful authentication with the second device for vehicle-road cooperation; to perform key generation processing on the target string according to the same key generation method as the second device to generate a communication key; and to use the communication key to encrypt the vehicle-road cooperative data sent to the second device and to use the communication key to decrypt the vehicle-road cooperative data received from the second device during communication with the second device.

[0221] The main chip is used to receive vehicle-road cooperative data sent to the second device after encryption by the security chip, and to receive vehicle-road cooperative data sent by the second device after decryption by the security chip.

[0222] The communication unit is used to receive encrypted vehicle-road cooperative data sent by the main chip and send it to the second device; and to receive encrypted vehicle-road cooperative data sent by the second device and send it to the security chip.

[0223] Optionally, the security chip is specifically used for:

[0224] A first random number is generated using a random number generator. A first string consisting of the road traffic control signal controller's certificate, the first random number signed with the road traffic control signal controller's private key, and the road traffic control signal controller's identifier is sent as first authentication information to the second device.

[0225] Receive feedback information sent by the second device; if the feedback information is successfully decrypted using the first random number, it is determined that the identity verification with the second device is successful, and the key negotiation success information is sent back to the second device;

[0226] The feedback information is obtained by encrypting a second string consisting of a first random number and a second random number generated by a random number generator after the second device has successfully authenticated the road traffic control signal controller; or

[0227] The system receives second authentication information sent by the second device; wherein the second authentication information includes the certificate of the second device, a third string composed of a second random number of the second device signed with the private key of the second device, and a second device identifier; if the certificate of the second device is valid, and the signature verification of the signed third string is successful, then the authentication of the second device is determined to be successful.

[0228] A first random number is generated using a random number generator; a fourth string composed of the first and second random numbers is encrypted using the second random number, and the encrypted fourth string is sent to the second device; if a key negotiation success message is received from the second device, it is determined that the authentication with the second device has been successful.

[0229] Optionally, the security chip is specifically used for:

[0230] Use the first random number and the second random number as the target string;

[0231] Using the same key generation method as the second device, the target string is processed to generate a communication key, including:

[0232] Characters are selected from the first random number and the second random number using the same extraction method as the second device.

[0233] Using the same combination method as the second device, the characters selected from the first random number and the characters selected from the second random number are combined to obtain the root key, and the root key is used as the communication key.

[0234] Optionally, the security chip is specifically used for:

[0235] The first random number, the second random number, and the dynamic string are used as the target string, wherein the dynamic string includes some or all of the following: the generation time of the dynamic string, the identifier of the road traffic control signal, and the identifier of the second device;

[0236] Using the same key generation method as the second device, the target string is processed to generate a communication key, including:

[0237] Characters are selected from the first random number and the second random number using the same extraction method as the second device.

[0238] The root key is obtained by combining the characters selected from the first random number and the characters selected from the second random number in the same way as the second device.

[0239] The dynamic string is encrypted using the root key in the same encryption method as the second device to obtain a derived key, which is then used as the communication key.

[0240] Optionally, the security chip is also used for:

[0241] If the number of communications between the road traffic control signal controller and the second device exceeds a preset number, the dynamic string is updated, and the updated dynamic string is encrypted using the root key in the same encryption method as the second device to generate a new derived key, which is then used as the communication key.

[0242] In an exemplary embodiment, a storage medium including instructions is also provided, such as a memory including instructions, wherein the instructions can be executed by a processor of a first device to complete the encrypted communication method for vehicle-to-infrastructure (V2I) communication; or the instructions can be executed by a security chip of a roadside unit to complete the encrypted communication method for V2I; or the instructions can be executed by a security chip of a road traffic control signal controller to complete the encrypted communication method for V2I. Optionally, the storage medium can be a non-transitory computer-readable storage medium, such as a ROM, random access memory (RAM), CD-ROM, magnetic tape, floppy disk, and optical data storage device.

[0243] This invention also provides a computer program product that, when running on a first device, causes the first device to execute any of the above-described encrypted communication methods for vehicle-road cooperation in this invention; or causes the roadside unit to execute any of the above-described encrypted communication methods for vehicle-road cooperation in this invention; or causes the road traffic control signal controller to execute any of the above-described encrypted communication methods for vehicle-road cooperation in this invention.

[0244] Other embodiments of the invention will readily occur to those skilled in the art upon consideration of the specification and practice of the invention described herein. This invention is intended to cover any variations, uses, or adaptations of the invention that follow the general principles of the invention and include common knowledge or customary techniques in the art not invented herein. The specification and examples are to be considered exemplary only, and the true scope and spirit of the invention are indicated by the following claims.

[0245] It should be understood that the present invention is not limited to the precise structure described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of the invention is limited only by the appended claims.

Claims

1. A first device for vehicle-road cooperation, characterized in that, include: Communication unit and processor; The processor is configured to, after successfully authenticating with the second device used for vehicle-road cooperation, determine the target string used by the second device when generating the communication key; and perform key generation processing on the target string according to the same key generation method as the second device to generate the communication key; During communication with the second device, the communication key is used to encrypt the vehicle-road cooperative data sent to the second device, and the communication key is used to decrypt the vehicle-road cooperative data received from the second device; the target string is a first random number and a second random number, or a first random number, a second random number, and a dynamic string; The communication unit is used to send encrypted vehicle-road cooperative data to the second device; and to receive encrypted vehicle-road cooperative data sent by the second device. The processor is also configured to authenticate with a second device for vehicle-to-everything (V2X) communication in the following manner: A first random number is generated by a random number generator, and a first string consisting of the certificate of the first device, the first random number signed with the private key of the first device, and the identifier of the first device is sent to the second device as the first authentication information. If the certificate of the first device is valid and the signature verification of the first string after signing is successful, then the second device can successfully authenticate the first device. as well as Receive feedback information sent by the second device; if the feedback information is successfully decrypted using the first random number, it is determined that the identity verification with the second device is successful, and the key negotiation success information is sent back to the second device; The feedback information is obtained by encrypting a second string composed of a first random number and a second random number generated by a random number generator after the second device has successfully authenticated the first device; or The system receives second authentication information sent by the second device; wherein the second authentication information includes the certificate of the second device, a third string composed of a second random number of the second device signed with the private key of the second device, and a second device identifier; if the certificate of the second device is valid, and the signature verification of the signed third string is successful, then the authentication of the second device is determined to be successful. A first random number is generated using a random number generator; a fourth string composed of the first and second random numbers is encrypted using the second random number, and the encrypted fourth string is sent to the second device; if a key negotiation success message is received from the second device, it is determined that the authentication with the second device has been successful.

2. The first device of claim 1, wherein, The processor is specifically used for: Use the first random number and the second random number as the target string; Using the same key generation method as the second device, the target string is processed to generate a communication key, including: Characters are selected from the first random number and the second random number using the same extraction method as the second device. The characters selected from the first random number and the characters selected from the second random number are combined according to the same combination manner as the second device to obtain a root key, and the root key is used as a communication key.

3. The first device of claim 1, wherein, The processor is specifically configured to: The first random number, the second random number, and a dynamic string are used as the target string, wherein the dynamic string includes part or all of the following: a generation time of the dynamic string, an identifier of the first device, and an identifier of the second device; The target string is subjected to key generation processing according to the same key generation manner as the second device to generate a communication key, including: Characters are selected from the first random number and the second random number according to the same extraction manner as the second device; The characters selected from the first random number and the characters selected from the second random number are combined according to the same combination manner as the second device to obtain a root key; The root key is used to encrypt the dynamic string according to the same encryption manner as the second device to obtain a derived key, and the derived key is used as a communication key.

4. The first device of claim 3, wherein, The processor is further configured to: If the number of communications between the first device and the second device exceeds a preset number, the dynamic string is updated, and the updated dynamic string is encrypted using the root key according to the same encryption manner as the second device to generate a new derived key, and the new derived key is used as a communication key.

5. A roadside unit, comprising: including: a communication unit, a main chip, and a security chip; The security chip is configured to determine a target string used by the second device when generating a communication key after identity verification with the second device for vehicle-road cooperation is passed; The target string is subjected to key generation processing according to the same key generation manner as the second device to generate a communication key; In the communication process with the second device, the vehicle-road cooperation data sent to the second device is subjected to an encryption operation using the communication key, and the received vehicle-road cooperation data of the second device is subjected to a decryption operation using the communication key; The target string is a first random number and a second random number, or a first random number, a second random number, and a dynamic string; The main chip is configured to receive vehicle-road cooperation data sent to the second device after encryption operation of the security chip, and receive vehicle-road cooperation data sent by the second device after decryption operation of the security chip; The communication unit is configured to receive the encrypted vehicle-road cooperation data sent by the main chip and send it to the second device, and receive the encrypted vehicle-road cooperation data sent by the second device and send it to the security chip; The second device for vehicle-road cooperation is authenticated through the following manner: generating a first random number by a random number generator, sending a first string composed of a certificate of the first device, the first random number signed by a private key of the first device and an identification of the first device as first authentication information to the second device; if the certificate of the first device is legal and the signature verification of the signed first string is passed, the second device passes the identity authentication of the first device; and receiving feedback information sent by the second device; if the feedback information is decrypted successfully by the first random number, it is determined that the identity authentication with the second device is passed, and key negotiation success information is fed back to the second device; wherein the feedback information is a second string composed of the first random number and a second random number generated by the random number generator encrypted by the first random number after the second device passes the identity authentication of the first device; or receiving second authentication information sent by the second device; wherein the second authentication information includes a third string composed of a certificate of the second device, a second random number of the second device signed by a private key of the second device and an identification of the second device; if the certificate of the second device is legal and the signature verification of the signed third string is passed, it is determined that the identity authentication of the second device is passed, and generating a first random number by a random number generator; encrypting a fourth string composed of the first random number and the second random number by the second random number, and sending the encrypted fourth string to the second device; if the key negotiation success information fed back by the second device is received, it is determined that the identity authentication with the second device is passed.

6. A road traffic control signal, characterised in that It includes: a communication unit, a main chip, and a security chip; the security chip is used to determine a target string used by the second device for generating a communication key after passing the identity authentication with the second device for vehicle-road cooperation; performing key generation processing on the target string according to the same key generation method as the second device to generate a communication key; in the process of communicating with the second device, the communication key is used to encrypt the vehicle-road cooperation data sent to the second device, and the communication key is used to decrypt the vehicle-road cooperation data received from the second device; the target string is a first random number and a second random number, or a first random number, the second random number and a dynamic string; the main chip is used to receive the vehicle-road cooperation data sent to the second device after the encryption operation of the security chip, and receive the vehicle-road cooperation data sent by the second device after the decryption operation of the security chip; the communication unit is used to receive the encrypted vehicle-road cooperation data sent by the main chip and send it to the second device; and receive the encrypted vehicle-road cooperation data sent by the second device and send it to the security chip; the identity authentication with the second device for vehicle-road cooperation is performed by the following way: generating a first random number by a random number generator, sending, as first authentication information, a first string composed of a certificate of the first device, the first random number signed by a first device private key and a first device identifier to the second device; if the certificate of the first device is legal and the signature verification of the signed first string is passed, the second device passes the authentication of the first device; and receiving feedback information sent by the second device; if the feedback information is decrypted successfully by the first random number, it is determined that the authentication with the second device is passed, and the second device is fed back key negotiation success information; wherein the feedback information is a second string composed of the first random number and a second random number generated by the random number generator, encrypted by the first random number after the second device passes the authentication of the first device; or receiving second authentication information sent by the second device; wherein the second authentication information includes a third string composed of a certificate of the second device, a second random number of the second device signed by a second device private key and a second device identifier; if the certificate of the second device is legal and the signature verification of the signed third string is passed, it is determined that the authentication of the second device is passed, and generating a first random number by a random number generator; encrypting a fourth string composed of the first random number and the second random number by the second random number, and sending the encrypted fourth string to the second device; if the second device feedback key negotiation success information is received, it is determined that the authentication with the second device is passed.

7. A method for encrypted communication for vehicle infrastructure integration, characterized in that, The method is applied to a first device for vehicle-road cooperation, and the method comprises: after passing the authentication with a second device for vehicle-road cooperation, determining a target string used by the second device to generate a communication key; the target string is a first random number and a second random number, or a first random number, the second random number and a dynamic string; generating the communication key by performing key generation processing on the target string according to the same key generation mode as the second device; in the process of communication with the second device, performing an encryption operation on vehicle-road cooperation data sent to the second device by using the communication key, and performing a decryption operation on the vehicle-road cooperation data received from the second device by using the communication key; the authentication with the second device for vehicle-road cooperation is performed in the following way: generating a first random number by a random number generator, sending, as first authentication information, a first string composed of a certificate of the first device, the first random number signed by a first device private key and a first device identifier to the second device; if the certificate of the first device is legal and the signature verification of the signed first string is passed, the second device passes the authentication of the first device; and receiving feedback information sent by the second device; if the feedback information is successfully decrypted by using the first random number, determining that the identity authentication with the second device is passed, and feeding back key negotiation success information to the second device; wherein the feedback information is a second string composed of the first random number and a second random number generated by a random number generator, which is encrypted by using the first random number after the second device passes the identity authentication of the first device; or receiving second identity authentication information sent by the second device; wherein the second identity authentication information includes a third string composed of a certificate of the second device, a second random number of the second device signed by a private key of the second device, and an identifier of the second device; if the certificate of the second device is legal and the signature verification of the signed third string is passed, determining that the identity authentication of the second device is passed, and generating a first random number by using a random number generator; encrypting a fourth string composed of the first random number and the second random number by using the second random number, and sending the encrypted fourth string to the second device; if the key negotiation success information fed back by the second device is received, determining that the identity authentication with the second device is passed.

8. The encryption communication method for vehicle infrastructure integration according to claim 7, wherein, determining a target string used by the second device when generating a communication key, including: taking the first random number and the second random number as the target string; generating the communication key by performing key generation processing on the target string according to the same key generation manner as the second device, including: selecting characters from the first random number and the second random number respectively according to the same extraction manner as the second device; combining the characters selected from the first random number and the characters selected from the second random number according to the same combination manner as the second device to obtain a root key, and taking the root key as the communication key.

9. The encryption communication method for vehicle infrastructure integration according to claim 7, wherein, determining a target string used by the second device when generating a communication key, including: taking the first random number, the second random number, and a dynamic string as the target string, wherein the dynamic string includes part or all of the following: the generation time of the dynamic string, the identifier of the first device, and the identifier of the second device; generating the communication key by performing key generation processing on the target string according to the same key generation manner as the second device, including: selecting characters from the first random number and the second random number respectively according to the same extraction manner as the second device; combining the characters selected from the first random number and the characters selected from the second random number according to the same combination manner as the second device to obtain a root key; encrypting the dynamic string by using the root key according to the same encryption manner as the second device to obtain a derived key, and taking the derived key as the communication key.

Images