Internet of vehicles security defense method, device and equipment, and storage medium

Abstract

The present disclosure provides a kind of vehicle networking security defense method, device, equipment and storage medium, the method comprises: receiving first authentication data, the first authentication data is generated by vehicle chip based on component number symmetric encryption;Based on the first authentication data is decrypted, first wired authentication is carried out;Based on the first wired authentication passes, with chip number as seed code to generate RLWE gold key;With the RLWE gold key to the random security number of generating RLWE encryption, obtains second authentication data;The second authentication data is sent to vehicle chip, to make the vehicle chip with the same RLWE gold key that chip number is as seed code to generate second authentication data decryption, obtains the security number.The vehicle networking security defense method of the embodiment of the present disclosure can improve the security of vehicle networking.

Description

Technical Field

[0001] This disclosure relates to the field of computers, and in particular to a method, apparatus, device, and storage medium for vehicle network security defense. Background Technology

[0002] With the continuous advancement of communication technology, vehicle-to-everything (V2X) technology has emerged. Utilizing V2X, onboard devices can transmit information with servers and other equipment via wireless transmission and other technologies, effectively monitoring the vehicle's operational status and providing comprehensive services according to different needs. However, V2X faces security risks, such as unauthorized intrusion into computer systems, remote command theft or alteration of data, and data being spied on or modified during transmission. Furthermore, asymmetric encryption is easily cracked. Summary of the Invention

[0003] This disclosure provides a method, apparatus, device, and storage medium for vehicle network security defense, in order to at least solve the above-mentioned technical problems existing in the prior art.

[0004] According to a first aspect of this disclosure, a vehicle-to-everything (V2X) security defense method is provided, the method comprising: receiving first authentication data, the first authentication data being generated by an on-board chip using symmetric encryption based on a component number; performing a first connection authentication based on decrypting the first authentication data; generating an RLWE (ring learning with errors) key using the chip number as a seed code based on the successful first connection authentication; encrypting a randomly generated security sequence number using the RLWE key to obtain second authentication data; and sending the second authentication data to the on-board chip, so that the on-board chip decrypts the second authentication data using the same RLWE key generated using the chip number as a seed code to obtain the security sequence number.

[0005] In one embodiment, the method further includes: receiving user password data, wherein the user password data is generated by symmetrically encrypting the security serial number and the one-way encrypted user password using the chip number of the vehicle-mounted chip, and adding a security serial number; obtaining the chip number based on the security serial number, and decrypting the user password data based on the chip number to obtain the security serial number and the one-way encrypted user password.

[0006] In one embodiment, the method further includes: verifying the obtained one-way encrypted user password based on the security serial number verification; generating a single-use license using a random value based on the one-way encrypted user password verification; encrypting the single-use license using an RLWE key generated with the chip number as the seed code to obtain single-use license data; and sending the single-use license data so that the vehicle chip and the vehicle manufacturer server respectively decrypt the single-use license data using the same RLWE key generated with the chip number as the seed code to obtain the single-use license, wherein the single-use license is used to form a post-quantum channel between the vehicle chip and the vehicle manufacturer server.

[0007] In one possible implementation, the first authentication data is generated by the vehicle-mounted chip based on symmetric encryption of the component number, including: the vehicle-mounted chip performs one-way encryption on the component number to obtain a one-way encrypted component number; the vehicle-mounted chip uses the chip number to perform symmetric encryption on the one-way encrypted component number, and adds a security serial number to generate the first authentication data.

[0008] In one possible implementation, the first connection authentication is performed based on the decryption of the first authentication data, including: obtaining the corresponding chip number using the security serial number; performing symmetric decryption with the chip number to obtain the one-way encryption component number; comparing the obtained one-way encryption component number with the stored one-way encryption component number; and passing the first connection authentication if the comparison is successful.

[0009] In one possible implementation, generating an RLWE key using the chip number as a seed code includes: generating a random number using the chip number as a seed code, and then generating an RLWE key using the random number.

[0010] According to a second aspect of this disclosure, a method for vehicle-to-everything (V2X) security defense is provided. The method includes: generating first authentication data based on component number symmetric encryption; sending the first authentication data to enable a security server to perform a first connection authentication based on decrypting the first authentication data; receiving second authentication data, wherein the second authentication data is generated by the security server using an RLWE key to encrypt a randomly generated security serial number, the RLWE key being generated by the security server using a chip number as a seed code based on successful first connection authentication; and decrypting the second authentication data using the same RLWE key generated with the chip number as the seed code to obtain the security serial number.

[0011] In one possible implementation, the method further includes: symmetrically encrypting the security serial number and the one-way encrypted user password using the chip number, and adding a security serial number to generate user password data; sending the user password data so that the security server obtains the chip number based on the security serial number, decrypts the user password data based on the chip number to obtain the security serial number and the one-way encrypted user password, and performs verification.

[0012] In one possible implementation, the method further includes: receiving single-permission data, wherein the single-permission data is obtained by RLWE encryption of the single-permission using an RLWE key generated by a security server using the chip number as a seed code, and the single-permission is generated by the security server based on sequential verification of the security serial number and the one-way encrypted user password using a random value; decrypting the single-permission data using the same RLWE key generated using the chip number as a seed code to obtain the single-permission, so as to form a post-quantum channel between the vehicle chip and the vehicle manufacturer server using the single-permission.

[0013] In one possible implementation, generating first authentication data based on symmetric encryption of component numbers includes: performing one-way encryption on the component number to obtain a one-way encrypted component number; performing symmetric encryption on the one-way encrypted component number using the chip number, and adding a security serial number to generate the first authentication data.

[0014] In one possible implementation, the security server performs a first connection authentication based on the decrypted first authentication data, including: the security server obtaining the corresponding chip number using the security serial number; the security server performing symmetric decryption using the chip number to obtain the one-way encryption component number; the security server comparing the obtained one-way encryption component number with the stored one-way encryption component number, and if the comparison is successful, the first connection authentication is passed.

[0015] In one possible implementation, decrypting the second authentication data using the same RLWE key generated with the chip number as the seed code includes: generating a random number using the chip number as the seed code, and then generating an RLWE key using the random number; using the RLWE key to decrypt the second authentication data to obtain a security serial number.

[0016] According to a third aspect of this disclosure, a vehicle-to-everything (V2X) security defense device is provided. The device includes: a first receiving module for receiving first authentication data, wherein the first authentication data is generated by an on-board chip using symmetric encryption based on a component number; a first authentication module for performing a first connection authentication based on decrypting the first authentication data; a first encryption module for generating an RLWE key using the chip number as a seed code based on the successful first connection authentication; and RLWE encryption of a randomly generated security sequence number using the RLWE key to obtain second authentication data; and a first sending module for sending the second authentication data to the on-board chip, so that the on-board chip decrypts the second authentication data using the same RLWE key generated using the chip number as a seed code to obtain the security sequence number.

[0017] According to a fourth aspect of this disclosure, a vehicle-to-everything (V2X) security defense device is provided. The device includes: a second encryption module for generating first authentication data using symmetric encryption based on a component number; a second sending module for sending the first authentication data so that a security server performs a first connection authentication based on decrypting the first authentication data; a second receiving module for receiving second authentication data, wherein the second authentication data is generated by the security server using an RLWE key to encrypt a randomly generated security serial number, and the RLWE key is generated by the security server using a chip number as a seed code based on successful first connection authentication; and a second decryption module for decrypting the second authentication data using the same RLWE key generated with the chip number as the seed code to obtain the security serial number.

[0018] According to a fifth aspect of this disclosure, an electronic device is provided, comprising:

[0019] At least one processor; and

[0020] A memory communicatively connected to the at least one processor; wherein,

[0021] The memory stores instructions that can be executed by the at least one processor to enable the at least one processor to perform the methods described in this disclosure.

[0022] According to a sixth aspect of this disclosure, a non-transitory computer-readable storage medium is provided storing computer instructions for causing the computer to perform the methods described in this disclosure.

[0023] In this disclosed vehicle-to-everything (V2X) security defense method, the first authentication data generated by the vehicle-mounted chip using symmetric encryption based on the component number is decrypted to perform a first connection authentication. Based on the successful first connection authentication, an RLWE key is generated using the chip number as a seed code. The randomly generated security sequence number is then encrypted using the RLWE key to obtain second authentication data. This second authentication data is sent to the vehicle-mounted chip, which uses the same RLWE key generated using the chip number as a seed code to decrypt the second authentication data, obtaining the security sequence number. This disclosed V2X security defense method employs post-quantum encryption distribution of symmetric keys, which helps improve the connection security between the vehicle-mounted chip and the vehicle manufacturer's server. Furthermore, using the received symmetric encryption key for symmetric encryption transmission accelerates transmission efficiency.

[0024] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of this disclosure, nor is it intended to limit the scope of this disclosure. Other features of this disclosure will become readily apparent from the following description. Attached Figure Description

[0025] The above and other objects, features, and advantages of this disclosure will become readily apparent from the following detailed description of exemplary embodiments, taken in conjunction with the accompanying drawings. Several embodiments of this disclosure are illustrated in the drawings by way of example and not limitation, in which:

[0026] In the accompanying drawings, the same or corresponding reference numerals indicate the same or corresponding parts.

[0027] Figure 1 This illustration shows the implementation flow of the vehicle network security defense method according to an embodiment of the present disclosure. Figure 1 ;

[0028] Figure 2 A schematic diagram of the composition structure of the vehicle network security defense device according to Embodiment 1 of this disclosure is shown;

[0029] Figure 3 This illustration shows the implementation flow of the vehicle network security defense method according to an embodiment of the present disclosure. Figure 2 ;

[0030] Figure 4 A schematic diagram of the composition structure of Embodiment 2 of the vehicle network security defense device of this disclosure is shown;

[0031] Figure 5 A schematic diagram of the composition structure of an electronic device according to an embodiment of the present disclosure is shown. Detailed Implementation

[0032] To make the objectives, features, and advantages of this disclosure more apparent and understandable, the technical solutions in the embodiments of this disclosure will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this disclosure, and not all of them. All other embodiments obtained by those skilled in the art based on the embodiments of this disclosure without creative effort are within the scope of protection of this disclosure.

[0033] See Figure 1 This disclosure provides a vehicle network security defense method, which includes: S101 receiving first authentication data, the first authentication data being generated by an on-board chip using symmetric encryption based on component numbers; S102 performing a first connection authentication based on decrypting the first authentication data; S103 generating an RLWE key using the chip number as a seed code based on successful first connection authentication; S104 encrypting a randomly generated security sequence number using the RLWE key to obtain second authentication data; S105 sending the second authentication data to the on-board chip, so that the on-board chip decrypts the second authentication data using the same RLWE key generated using the chip number as a seed code to obtain the security sequence number.

[0034] The vehicle-to-everything (V2X) security defense method of this disclosure can be used in a cybersecurity server to achieve secure information transmission between the cybersecurity server and the vehicle-mounted chip. This enables the establishment of a post-quantum encryption channel between the vehicle-mounted chip and the vehicle manufacturer's server for secure connection and transmission. In this method, the first authentication data generated by the vehicle-mounted chip using symmetric encryption based on the component number is decrypted to perform a first connection authentication. Based on the successful first connection authentication, an RLWE key is generated using the chip number as a seed code. The randomly generated security sequence number is then encrypted using the RLWE key to obtain second authentication data. The second authentication data is sent to the vehicle-mounted chip, which uses the same RLWE key generated using the chip number as a seed code to decrypt the second authentication data, obtaining the security sequence number. This V2X security defense method employs post-quantum encryption to distribute symmetric keys, which helps improve the connection security between the vehicle-mounted chip and the vehicle manufacturer's server. Furthermore, using the received symmetric encryption key for symmetric encryption transmission accelerates transmission efficiency.

[0035] In one embodiment, the vehicle network security defense method of this disclosure includes: receiving user password data, wherein the user password data is generated by symmetrically encrypting a security serial number and a one-way encrypted user password using a chip number from an on-board chip, and adding a security serial number; obtaining a chip number based on the security serial number, and decrypting the user password data based on the chip number to obtain a security serial number and a one-way encrypted user password, and verifying them. In this embodiment, after receiving the user password data generated by the on-board chip, the security server obtains the corresponding chip number using the security serial number in the user password data, and decrypts it based on the chip number to obtain a one-way encrypted user password. Based on the first obtained one-way encrypted user password, the one-way encrypted user password can be saved for use in establishing a connection channel. If a one-way encrypted user password already exists, it can be verified by comparison with the received one-way encrypted user password to further establish a connection channel.

[0036] In this embodiment of the disclosure, decrypting the user password data specifically includes: using the security serial number in the user password data to query the corresponding chip number, and using the chip number to perform symmetric decryption to obtain the one-way encrypted user password and security serial number.

[0037] In one embodiment, the vehicle network security defense method of this disclosure includes: verifying the obtained one-way encrypted user password based on the security serial number verification; generating a single-use license using a random value based on the one-way encrypted user password verification; encrypting the single-use license using an RLWE key generated with the chip number as the seed code to obtain single-use license data; and sending the single-use license data so that the vehicle chip and the vehicle manufacturer server can decrypt the single-use license data using the same RLWE key generated with the chip number as the seed code to obtain the single-use license. The single-use license is used to form a post-quantum channel between the vehicle chip and the vehicle manufacturer server. In this embodiment, post-quantum encryption is used to distribute symmetric encryption keys to the vehicle manufacturer server and the vehicle chip to establish a post-quantum defense channel for connection transmission, which helps to ensure the connection security between the vehicle manufacturer server and the vehicle chip. Furthermore, the received symmetric encryption key can be used for symmetric encryption transmission, accelerating the transmission rate and improving security of messages and commands. Multiple encryption security defenses enhance security.

[0038] In one possible implementation, the first authentication data is generated by the vehicle-mounted chip using symmetric encryption based on the component number. This includes: the vehicle-mounted chip performing one-way encryption on the component number to obtain a one-way encrypted component number; the vehicle-mounted chip then using the chip number to perform symmetric encryption on the one-way encrypted component number, and adding a security serial number to generate the first authentication data. The chip number and the corresponding security serial number are stored on a security server, the vehicle-mounted chip, and the vehicle manufacturer's server, respectively. Encryption is performed using the chip number, and the data, including the component number, is sent along with the security serial number. During decryption, the corresponding chip number is obtained based on the security serial number, and decryption using the chip number yields the transmitted data.

[0039] In one possible implementation, the first connection authentication is performed based on the decrypted first authentication data, including: obtaining the corresponding chip number using a security serial number; performing symmetric decryption using the chip number to obtain a one-way encryption component number; comparing the obtained one-way encryption component number with a stored one-way encryption component number; and if the comparison is successful, the first connection authentication is passed. The stored corresponding chip number can be obtained from the security serial number, and symmetric decryption can be performed accordingly. The decrypted one-way encryption component number is compared with the stored one-way encryption component number for verification. If they match, the comparison is successful, and the first connection authentication is passed; otherwise, the first connection authentication fails.

[0040] In one embodiment, generating an RLWE key using the chip number as a seed code includes: generating a random number using the chip number as a seed code, and then generating an RLWE key using the random number. Specifically, generating the RLWE key in this embodiment may involve generating a random number using the chip number as a seed code, generating the RLWE key using the random number, and then using the RLWE key for encryption and decryption.

[0041] In this embodiment, the component number can be established by the vehicle manufacturer's server. The vehicle manufacturer's server establishes a unique component number for each vehicle, which is stored on the vehicle manufacturer's server and in the corresponding vehicle's on-board chip. The vehicle manufacturer's server performs one-way encryption on the component number to form a one-way encrypted component number. Then, it uses the chip number to perform symmetric encryption on the one-way encrypted component number, adds a security sequence number, and transmits it to the security server. The security server uses the security sequence number to query the corresponding chip number, and then performs symmetric decryption on the chip number to obtain the one-way encrypted component number, which is stored on the security server for comparison with the on-board chip.

[0042] The symmetric encryption and decryption in this embodiment can specifically employ AES encryption and decryption. The user password can include any type of information, such as manually entered information or biometric information.

[0043] See Figure 2This disclosure provides a vehicle network security defense device that can be used in a cybersecurity server to implement the methods described in the above embodiments. The device includes: a first receiving module for receiving first authentication data, which is generated by an on-board chip using symmetric encryption based on a component number; a first authentication module for performing a first connection authentication based on the decrypted first authentication data; a first encryption module for generating an RLWE key using the chip number as a seed code based on successful first connection authentication; and RLWE encryption of a randomly generated cybersecurity sequence number using the RLWE key to obtain second authentication data; and a first sending module for sending the second authentication data to the on-board chip, so that the on-board chip decrypts the second authentication data using the same RLWE key generated using the chip number as a seed code to obtain the cybersecurity sequence number.

[0044] In one possible implementation, the receiving module receives user password data. The user password data is generated by the vehicle-mounted chip using the chip number to symmetrically encrypt the security serial number and the one-way encrypted user password, and adding a security serial number. The first authentication module obtains the chip number based on the security serial number, decrypts the user password data based on the chip number to obtain the security serial number and the one-way encrypted user password, and performs verification.

[0045] In one implementation, the first authentication module verifies the obtained one-way encrypted user password; based on the security serial number and the one-way encrypted user password, the verification passes sequentially, and a single-use license is generated using a random value; the single-use license is encrypted using an RLWE key generated with the chip number as the seed code to obtain single-use license data; the first sending module sends the single-use license data so that the vehicle chip and the vehicle manufacturer server decrypt the single-use license data using the same RLWE key generated with the chip number as the seed code to obtain the single-use license, which is used to form a post-quantum channel between the vehicle chip and the vehicle manufacturer server.

[0046] In one possible implementation, the first authentication data is generated by the vehicle-mounted chip based on symmetric encryption of the component number, including: the vehicle-mounted chip performs one-way encryption on the component number to obtain a one-way encrypted component number; the vehicle-mounted chip uses the chip number to perform symmetric encryption on the one-way encrypted component number, and adds a security serial number to generate the first authentication data.

[0047] In one possible implementation, the first authentication module performs a first connection authentication based on the decrypted first authentication data, including: the first authentication module obtains the corresponding chip number using the security serial number; performs symmetric decryption using the chip number to obtain a one-way encryption component number; compares the obtained one-way encryption component number with the stored one-way encryption component number; and if the comparison is successful, the first connection authentication is passed.

[0048] In one possible implementation, the first authentication module generates an RLWE key using the chip number as a seed code, including: the first authentication module uses the chip number as a seed code to generate a random number, and then uses the random number to generate an RLWE key.

[0049] The vehicle network security defense device of this disclosure can implement the methods of the above embodiments. The description of the vehicle network security defense device embodiments is similar to the description of the foregoing method embodiments and has similar beneficial effects, so it will not be described again. For technical details not disclosed in the description of the vehicle network security defense device embodiments of this disclosure, please refer to the description of the foregoing method embodiments of this disclosure for understanding. To save space, it will not be described again.

[0050] See Figure 3 This disclosure provides a vehicle network security defense method, which includes: S301 generating first authentication data based on component number symmetric encryption; S302 sending the first authentication data so that the security server performs a first connection authentication based on the decrypted first authentication data; S303 receiving second authentication data, the second authentication data being generated by the security server using an RLWE key to encrypt a randomly generated security serial number, the RLWE key being generated by the security server based on the first connection authentication and using the chip number as the seed code; S304 decrypting the second authentication data using the same RLWE key generated using the chip number as the seed code to obtain the security serial number.

[0051] The vehicle-to-everything (V2X) security defense method of this disclosure can be used for in-vehicle chips, enabling secure information transmission between a security server and the in-vehicle chip. This allows for the establishment of a post-quantum channel between the in-vehicle chip and the vehicle manufacturer's server for secure connection transmission. In this method, first authentication data is generated using symmetric encryption based on the component number and sent, allowing the security server to perform a first connection authentication based on the decrypted first authentication data. A second authentication data is decrypted using an RLWE key generated with the chip number as the seed code to obtain a security serial number. The second authentication data is obtained by RLWE encryption of the randomly generated security serial number using the RLWE key generated with the chip number as the seed code. This V2X security defense method employs post-quantum encryption for distributing symmetric keys, which helps improve the connection security between the in-vehicle chip and the vehicle manufacturer's server. Furthermore, using the received symmetric encryption key for symmetric encryption transmission accelerates transmission efficiency.

[0052] In one embodiment, the vehicle network security defense method of this disclosure includes: symmetrically encrypting a security serial number and a one-way encrypted user password using a chip number, and adding a security serial number to generate user password data; sending the user password data so that the security server obtains the chip number based on the security serial number, and decrypts the user password data based on the chip number to obtain the security serial number and the one-way encrypted user password, and then verifies them. In this embodiment, the vehicle chip symmetrically encrypts the one-way encrypted user password using a chip number, adds a security serial number to generate user password data, and sends the user password data to the security server. The security server obtains the corresponding chip number using the security serial number in the user password data, and decrypts it based on the chip number to obtain the one-way encrypted user password. Based on the first time the security server obtains the one-way encrypted user password, it can save the one-way encrypted user password for use in establishing a connection channel. If a one-way encrypted user password already exists, it can be verified by comparison with the received one-way encrypted user password to further establish a connection channel.

[0053] In one embodiment, the vehicle network security defense method of this disclosure includes: receiving single-permission data, wherein the single-permission data is obtained by a security server using an RLWE key generated with the chip number as a seed code to encrypt the single-permission data using RLWE encryption; the single-permission data is obtained by the security server verifying the security serial number and the one-way encrypted user password sequentially using a random value; and decrypting the single-permission data using the same RLWE key generated with the chip number as a seed code to obtain the single-permission data, thereby forming a post-quantum channel between the vehicle chip and the vehicle manufacturer server. In this embodiment, the vehicle chip receives the single-permission data obtained by the security server using an RLWE key generated with the chip number as a seed code to encrypt the single-permission data using RLWE encryption; decrypts the single-permission data using the same RLWE key generated with the chip number as a seed code to obtain the single-permission data; and forms a post-quantum channel with the vehicle manufacturer server that obtained the single-permission data in the same way. By using post-quantum encryption and decryption of the symmetric encryption key, a post-quantum defense channel is established between the vehicle manufacturer server and the vehicle chip for connection transmission, which helps to ensure the connection security between the vehicle manufacturer server and the vehicle chip. It can also use the received symmetric encryption key for symmetric encryption transmission, accelerating the transmission rate of messages and commands while improving security. Multiple layers of encryption enhance security.

[0054] In one possible implementation, generating first authentication data based on symmetric encryption of the component number includes: performing one-way encryption on the component number to obtain a one-way encrypted component number; performing symmetric encryption on the one-way encrypted component number using the chip number, and adding a security serial number to generate the first authentication data. The chip number and the corresponding security serial number are stored on a security server, an in-vehicle chip, and a vehicle manufacturer server, respectively. Encryption is performed using the chip number, and the data, including the component number, is sent together with the security serial number. During decryption, the corresponding chip number is obtained based on the security serial number, and decryption is performed using the chip number to obtain the transmitted data.

[0055] In one implementation, the security server performs a first connection authentication based on decrypted first authentication data, including: the security server obtaining the corresponding chip number using a security serial number; the security server performing symmetric decryption using the chip number to obtain a one-way encryption component number; and the security server comparing the obtained one-way encryption component number with a stored one-way encryption component number. If the comparison is successful, the first connection authentication is passed. The stored corresponding chip number can be obtained from the security serial number, and symmetric decryption can be performed accordingly. The decrypted one-way encryption component number is compared with the stored one-way encryption component number for verification. If they match, the comparison is successful, and the first connection authentication is passed; otherwise, the first connection authentication fails.

[0056] In one possible implementation, decrypting the second authentication data using the same RLWE key generated with the chip number as the seed code includes: generating a random number using the chip number as the seed code, then generating an RLWE key using the random number; and using the RLWE key to decrypt the second authentication data to obtain a security serial number. Specifically, generating the RLWE key in this embodiment may involve generating a random number using the chip number as the seed code, generating an RLWE key using the random number, and then using the RLWE key for encryption and decryption.

[0057] See Figure 4 This disclosure provides a vehicle network security defense device for use with an in-vehicle chip, capable of implementing the methods described in the above embodiments. The device includes: a second encryption module for generating first authentication data using symmetric encryption based on a component number; a second sending module for sending the first authentication data so that a security server performs a first connection authentication based on the decrypted first authentication data; a second receiving module for receiving second authentication data, wherein the second authentication data is generated by the security server using an RLWE key to encrypt a randomly generated security serial number, and the RLWE key is generated by the security server using the chip number as a seed code based on successful first connection authentication; and a second decryption module for decrypting the second authentication data using the same RLWE key generated with the chip number as the seed code to obtain the security serial number.

[0058] In one possible implementation, the second encryption module uses the chip number to perform symmetric encryption on the security serial number and the one-way encrypted user password, and adds the security serial number to generate user password data; it sends the user password data so that the security server can obtain the chip number based on the security serial number, and decrypt the user password data based on the chip number to obtain the security serial number and the one-way encrypted user password, and then verify it.

[0059] In one possible implementation, the second receiving module receives single-license data. The single-license data is obtained by the security server using an RLWE key generated with the chip number as the seed code to encrypt the single-license. The single-license is verified by the security server based on the security serial number and the one-way encrypted user password in sequence, and is generated using a random value. The second authentication module decrypts the single-license data using the same RLWE key generated with the chip number as the seed code to obtain the single-license, so as to form a post-quantum channel between the vehicle chip and the vehicle manufacturer server using the single-license.

[0060] In one possible implementation, the second encryption module generates first authentication data based on symmetric encryption of the component number, including: the second encryption module performs one-way encryption on the component number to obtain a one-way encrypted component number; the one-way encrypted component number is symmetrically encrypted using the chip number, and a security serial number is added to generate the first authentication data.

[0061] In one possible implementation, the security server performs a first connection authentication based on the decrypted first authentication data, including: the security server obtaining the corresponding chip number using the security serial number; the security server performing symmetric decryption using the chip number to obtain a one-way encryption component number; the security server comparing the obtained one-way encryption component number with the stored one-way encryption component number, and if the comparison is successful, the first connection authentication is passed.

[0062] In one possible implementation, the second authentication module uses the same RLWE key generated with the chip number as the seed code to decrypt the second authentication data, including: the second authentication module uses the chip number as the seed code to generate a random number, and then uses the random number to generate an RLWE key; and uses the RLWE key to decrypt the second authentication data to obtain the security serial number.

[0063] The vehicle network security defense device of this disclosure can implement the methods of the above embodiments. The description of the vehicle network security defense device embodiments is similar to the description of the foregoing method embodiments and has similar beneficial effects, so it will not be described again. For technical details not disclosed in the description of the vehicle network security defense device embodiments of this disclosure, please refer to the description of the foregoing method embodiments of this disclosure for understanding. To save space, it will not be described again.

[0064] This disclosure provides a vehicle-to-everything (V2X) security defense system. The methods and apparatus described in the above embodiments can be used in this V2X security defense system. The descriptions of the method and apparatus embodiments described above can be used to understand the system of this disclosure. The descriptions of the system embodiments below can also be used to understand the methods and apparatus of the above embodiments. The V2X security defense system includes a cybersecurity server, an in-vehicle chip, and a vehicle manufacturer server. The V2X security defense system can implement one or more of the following stages, or some steps in a stage.

[0065] During the data setup phase, the security server generates a chip number and a corresponding security serial number using a random value. This chip number and security serial number are stored on both the security server and the vehicle manufacturer's server. The vehicle-mounted chip is then created using this chip number and security serial number, ensuring that the security server, vehicle manufacturer's server, and vehicle-mounted chip all share the same set of chip numbers and corresponding security serial numbers. The vehicle manufacturer's server creates a unique component number for each vehicle. This component number is stored on the vehicle manufacturer's server and also within the matching vehicle's vehicle-mounted chip. The vehicle manufacturer's server then performs one-way encryption on this component number to create a one-way encrypted component number. This one-way encrypted component number is then encrypted using AES with the chip number and the security serial number added before being transmitted to the security server. The security server uses this security serial number to retrieve the corresponding chip number, then decrypts it using AES to obtain the one-way encrypted component number, which is stored for comparison during vehicle-mounted chip connection.

[0066] For vehicle connectivity authentication, the onboard chip performs one-way encryption on the component number to obtain a one-way encrypted component number. This chip number is then used to perform AES encryption on the one-way encrypted component number, and a security sequence number is added before transmission to the security server. The security server uses the security sequence number to retrieve the corresponding chip number, and then performs AES decryption on that chip number to obtain the one-way encrypted component number. Further, the security server compares the obtained one-way encrypted component number with its stored one-way encrypted component number, completing the first stage of the authentication connection. After receiving and verifying the one-way encryption component number from the vehicle, the security server generates a security serial number using a random value and uses the chip number as a seed code to generate a random number. This random number is then used to generate an RLWE key, which is used to encrypt the security serial number using RLWE encryption, resulting in an RLWE encrypted security serial number. This RLWE encrypted security serial number is then sent to the vehicle chip. The vehicle chip, using the same chip number as a seed code, generates the same random number, uses this random number to generate an RLWE key, and decrypts the RLWE encrypted security serial number to obtain the security serial number. The security serial number is stored in the vehicle chip, completing the second stage of the authentication connection.

[0067] After establishing a connection password, the vehicle-mounted chip obtains the security serial number, sets and stores a user password. This user password is first one-way encrypted to obtain a one-way encrypted user password, and then the security serial number is added. Next, it is encrypted using AES with the chip number, and finally, a security serial number is added to obtain the user password data. This user password data is sent to the security server. The security server uses the security serial number to look up the corresponding chip number, and then uses that chip number to perform AES decryption to obtain the one-way encrypted user password and security serial number. The received security serial number is verified and compared with the security serial number stored on the security server; if they match, the verification is successful. If this is the first time the one-way encrypted user password has been received, after verifying the received security serial number, the one-way encrypted user password is further stored in the security database.

[0068] A connection channel is established. If a one-way encrypted user password is not received for the first time, the security server, upon receiving a one-way encrypted user password, verifies the received security sequence number and then compares the received password with the password to determine its correctness. If the password is correct, the security server generates a one-time authorization using a random value. Simultaneously, it uses the chip number as a seed code to generate an RLWE key, which is then used to encrypt the one-time authorization using RLWE encryption. This RLWE-encrypted one-time authorization is sent to both the vehicle chip and the vehicle manufacturer's server. Both the vehicle chip and the vehicle manufacturer's server generate the same random number using the chip number as a seed code, and then use this random number to generate the same RLWE key. Finally, the RLWE-encrypted one-time authorization is decrypted using the RLWE key to obtain the one-time authorization. Based on this one-time authorization, symmetric encryption and decryption are performed, forming a post-quantum channel between the vehicle chip and the vehicle manufacturer's server for secure data transmission.

[0069] According to embodiments of this disclosure, this disclosure also provides an electronic device and a readable storage medium.

[0070] Figure 5 A schematic block diagram of an example electronic device 500 that can be used to implement embodiments of the present disclosure is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device may also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the present disclosure described and / or claimed herein.

[0071] like Figure 5As shown, device 500 includes a computing unit 501, which can perform various appropriate actions and processes based on a computer program stored in read-only memory (ROM) 502 or a computer program loaded from storage unit 508 into random access memory (RAM) 503. RAM 503 may also store various programs and data required for the operation of device 500. The computing unit 501, ROM 502, and RAM 503 are interconnected via bus 504. Input / output (I / O) interface 505 is also connected to bus 504.

[0072] Multiple components in device 500 are connected to I / O interface 505, including: input unit 506, such as keyboard, mouse, etc.; output unit 507, such as various types of monitors, speakers, etc.; storage unit 508, such as disk, optical disk, etc.; and communication unit 509, such as network card, modem, wireless transceiver, etc. Communication unit 509 allows device 500 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0073] The computing unit 501 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of the computing unit 501 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. The computing unit 501 performs the various methods and processes described above, such as vehicle-to-everything (V2X) security defense methods. For example, in some embodiments, the V2X security defense method can be implemented as a computer software program tangibly contained in a machine-readable medium, such as storage unit 508. In some embodiments, part or all of the computer program can be loaded and / or installed on device 500 via ROM 502 and / or communication unit 509. When the computer program is loaded into RAM 503 and executed by the computing unit 501, one or more steps of the V2X security defense method described above can be performed. Alternatively, in other embodiments, the computing unit 501 can be configured to perform the V2X security defense method by any other suitable means (e.g., by means of firmware).

[0074] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), payload-programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0075] The program code used to implement the methods of this disclosure may be written in any combination of one or more programming languages. This program code may be provided to a processor or controller of a general-purpose computer, special-purpose computer, or other programmable data processing apparatus, such that when executed by the processor or controller, the program code causes the functions / operations specified in the flowcharts and / or block diagrams to be implemented. The program code may be executed entirely on a machine, partially on a machine, as a standalone software package partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0076] In the context of this disclosure, a machine-readable medium can be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, apparatus, or device. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can be, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0077] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device for displaying information to the user (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor); and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the computer. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0078] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as a data server), or computing systems that include middleware components (e.g., an application server), or computing systems that include frontend components (e.g., a user computer with a graphical user interface or web browser through which a user can interact with embodiments of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., a communication network). Examples of communication networks include local area networks (LANs), wide area networks (WANs), and the Internet.

[0079] Computer systems can include clients and servers. Clients and servers are generally located far apart and typically interact via communication networks. Client-server relationships are created by computer programs running on the respective computers and having a client-server relationship with each other. Servers can be cloud servers, servers in distributed systems, or servers incorporating blockchain technology.

[0080] It should be understood that the various forms of processes shown above can be used to rearrange, add, or delete steps. For example, the steps described in this disclosure can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution disclosed in this disclosure can be achieved, and this is not limited herein.

[0081] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of that feature. In the description of this disclosure, "a plurality of" means two or more, unless otherwise explicitly specified.

[0082] The above description is merely a specific embodiment of this disclosure, but the scope of protection of this disclosure is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this disclosure should be included within the scope of protection of this disclosure. Therefore, the scope of protection of this disclosure should be determined by the scope of the claims.

Claims

1. A vehicle-to-everything (V2X) security defense method, characterized in that, Applied to a cybersecurity server, the method includes: The system receives first authentication data, which is generated by the vehicle-mounted chip using symmetric encryption based on the component number. This includes: the vehicle-mounted chip performing one-way encryption on the component number to obtain a one-way encrypted component number; the vehicle-mounted chip using the chip number to perform symmetric encryption on the one-way encrypted component number, and adding a security sequence number to generate the first authentication data. The security sequence number is a sequence number generated by a security server using a random value, corresponding to the chip number. The component number is a unique identifier assigned to each vehicle by the vehicle manufacturer's server, used to uniquely identify vehicle components. Based on the decryption of the first authentication data, the first connection authentication is performed: the corresponding chip number is obtained using the security serial number; the first authentication data is symmetrically decrypted using the chip number to obtain the one-way encryption component number; the obtained one-way encryption component number is compared with the stored one-way encryption component number; if the comparison is successful, the first connection authentication is passed. Based on the successful authentication of the first connection, an RLWE key is generated using the chip number as the seed code. The randomly generated security serial number is encrypted using the RLWE key to obtain the second authentication data. The security serial number is generated by the security server using a random value. The second authentication data is sent to the vehicle chip, so that the vehicle chip can decrypt the second authentication data using the same RLWE key generated with the chip number as the seed code, and obtain the security serial number.

2. The method according to claim 1, characterized in that, The method further includes: Receive user password data, wherein the user password data is generated by the vehicle chip using the chip number to symmetrically encrypt the security serial number and the one-way encrypted user password, and adding a security serial number; The chip number is obtained based on the security serial number, and the user password data is decrypted based on the chip number to obtain the security serial number and the one-way encrypted user password.

3. The method according to claim 2, characterized in that, The method further includes: Based on the successful verification of the security serial number, the obtained one-way encrypted user password is then verified. Once the user password verification based on the one-way encryption is successful, a single permission is generated using a random value. The single license is encrypted using an RLWE key generated with the chip number as the seed code to obtain the single license data. The single-permission data is sent so that the vehicle chip and the vehicle manufacturer server decrypt the single-permission data using the same RLWE key generated with the chip number as the seed code, and obtain the single-permission. The single-permission is used to form a post-quantum channel between the vehicle chip and the vehicle manufacturer server.

4. The method according to claim 1, characterized in that, The RLWE key is generated using the chip number as the seed code, including: A random number is generated using the chip number as a seed code, and then an RLWE key is generated using the random number.

5. A method for security defense in vehicle networking, characterized in that, Applied to automotive chips, the method includes: The method for generating first authentication data based on symmetric encryption of component numbers includes: the vehicle chip performing one-way encryption on the component number to obtain a one-way encrypted component number; the vehicle chip using the chip number to perform symmetric encryption on the one-way encrypted component number, and adding a security sequence number to generate the first authentication data, wherein the security sequence number is a sequence number corresponding to the chip number generated by the security server using a random value; the component number is a unique identifier assigned to each vehicle by the vehicle manufacturer's server to uniquely identify vehicle components; Sending the first authentication data enables the security server to perform a first connection authentication based on the decrypted first authentication data, including: the security server obtaining the corresponding chip number using the security serial number; performing symmetric decryption on the first authentication data using the chip number to obtain a one-way encryption component number; comparing the obtained one-way encryption component number with a stored one-way encryption component number; and passing the first connection authentication based on a successful comparison. Receive second authentication data. The second authentication data is generated by the security server using RLWE encryption of a randomly generated security serial number with an RLWE key. The RLWE key is generated by the security server based on the first connection authentication and using the chip number as the seed code. The security serial number is generated by the security server using a random value. The second authentication data is decrypted using the same RLWE key generated with the chip number as the seed code to obtain the security serial number.

6. The method according to claim 5, characterized in that, The method further includes: The security serial number and the one-way encrypted user password are symmetrically encrypted using the chip number, and the security serial number is added to generate the user password data. The user password data is sent so that the security server can obtain the chip number based on the security serial number, and decrypt the user password data based on the chip number to obtain the security serial number and the one-way encrypted user password, and then verify them.

7. The method according to claim 6, characterized in that, The method further includes: Receive single-permission data, which is obtained by the security server using an RLWE key generated with the chip number as the seed code to encrypt the single-permission. The single-permission is verified by the security server based on the security serial number and the one-way encrypted user password in sequence, and is generated using a random value. The single-license data is decrypted using the same RLWE key generated with the chip number as the seed code to obtain the single-license, which is then used to form a post-quantum channel between the vehicle chip and the vehicle manufacturer's server.

8. The method according to claim 5, characterized in that, The second authentication data is decrypted using the same RLWE key generated with the chip number as the seed code, including: A random number is generated using the chip number as a seed code, and then an RLWE key is generated using the random number. The security serial number is obtained by using the RLWE key to decrypt the second authentication data.

9. A vehicle network security defense device, characterized in that, The device used in the cybersecurity server includes: The first receiving module is used to receive first authentication data, which is generated by the vehicle-mounted chip based on symmetric encryption of the component number. The process includes: the vehicle-mounted chip performing one-way encryption on the component number to obtain a one-way encrypted component number; the vehicle-mounted chip using the chip number to perform symmetric encryption on the one-way encrypted component number, and adding a security sequence number to generate the first authentication data. The security sequence number is a sequence number corresponding to the chip number generated by a security server using a random value. The component number is a unique identifier assigned to each vehicle by the vehicle manufacturer's server, used to uniquely identify vehicle components. The first authentication module is used to perform a first connection authentication based on the decryption of the first authentication data, including: obtaining the corresponding chip number using the security serial number; performing symmetric decryption on the first authentication data using the chip number to obtain a one-way encryption component number; comparing the obtained one-way encryption component number with a stored one-way encryption component number; and passing the first connection authentication based on a successful comparison. The first encryption module, based on the successful authentication of the first connection, generates an RLWE key using the chip number as the seed code; and uses the RLWE key to encrypt a randomly generated security serial number using RLWE to obtain second authentication data, wherein the security serial number is generated by the security server using a random value. The first sending module is used to send the second authentication data to the vehicle chip, so that the vehicle chip can decrypt the second authentication data using the same RLWE key generated with the chip number as the seed code to obtain the security serial number.

10. A vehicle network security defense device, characterized in that, The device, used in automotive chips, includes: The second encryption module is used to generate first authentication data based on symmetric encryption of component numbers, including: the vehicle chip performs one-way encryption on the component number to obtain a one-way encrypted component number; the vehicle chip uses the chip number to perform symmetric encryption on the one-way encrypted component number, and adds a security sequence number to generate the first authentication data, wherein the security sequence number is a sequence number corresponding to the chip number generated by the security server using a random value; the component number is a unique identifier assigned to each vehicle by the vehicle manufacturer server to uniquely identify vehicle components; The second sending module is used to send the first authentication data so that the security server can perform the first connection authentication based on the decrypted first authentication data, including: the security server using the security serial number to obtain the corresponding chip number; using the chip number to symmetrically decrypt the first authentication data to obtain the one-way encryption component number; comparing the obtained one-way encryption component number with the stored one-way encryption component number; and based on the successful comparison, the first connection authentication is passed. The second receiving module is used to receive the second authentication data. The second authentication data is generated by the security server using the RLWE key to encrypt a randomly generated security serial number. The RLWE key is generated by the security server based on the first connection authentication and using the chip number as the seed code. The security serial number is generated by the security server using a random value. The second authentication module is used to decrypt the second authentication data using the same RLWE key generated with the chip number as the seed code, to obtain the security serial number.

11. An electronic device, characterized in that, include: At least one processor; as well as A memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor to enable the at least one processor to perform the method of any one of claims 1-8.

12. A non-transitory computer-readable storage medium storing computer instructions, characterized in that, The computer instructions are used to cause the computer to perform the method according to any one of claims 1-8.

Images