A car bluetooth key security management method, system, device and medium

Abstract

The application provides a car Bluetooth key security management method, system, device and medium, the method comprising: generating a Bluetooth key enabling request in response to a request operation of a user terminal and outputting to the cloud; obtaining a digital key of a corresponding vehicle of the cloud according to the Bluetooth key enabling request, wherein the digital key is generated by the cloud according to a pre-stored vehicle master key, and the vehicle master key is associated with vehicle information; and generating a session key according to the digital key to perform an encrypted session with the vehicle end. The application can effectively ensure the security of vehicle control.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of intelligent automobiles, and in particular to a car Bluetooth key security management method, system, device and medium. BACKGROUND

[0002] With the rapid development of networked and intelligent automobiles, Bluetooth keys have become a standard feature of modern automobiles. A car Bluetooth key enables the interconnection of a vehicle and a mobile phone APP, and the mobile phone APP establishes a connection with the vehicle through a Bluetooth module to perform vehicle control operations, such as remotely starting the air conditioner, unlocking or locking the vehicle door, and starting the engine.

[0003] In the current scenario of using Bluetooth keys, security authentication is required to ensure the legitimacy of the user and the vehicle. However, there is currently a lack of methods for generating and managing the keys used for security authentication, which may result in security attacks on the user and the vehicle, information security breaches, and in severe cases, threats to the user's life and property safety. SUMMARY

[0004] In view of the problems existing in the prior art, the present application provides a car Bluetooth key security management method, system, device and medium, which mainly solves the problem of security risks in vehicle control using existing Bluetooth keys and the difficulty in ensuring data transmission security.

[0005] To achieve the above-mentioned purposes and other purposes, the technical solution adopted by the present application is as follows.

[0006] The present application provides a car Bluetooth key security management method, comprising:

[0007] generating a Bluetooth key activation request in response to a request operation of a user terminal and outputting the request to the cloud;

[0008] obtaining a digital key of a corresponding vehicle in the cloud according to the Bluetooth key activation request, wherein the digital key is generated by the cloud based on a pre-stored vehicle master key, and the vehicle master key is associated with vehicle information;

[0009] generating a session key based on the digital key to perform an encrypted session with the vehicle end.

[0010] In an embodiment of the present application, generating a Bluetooth key activation request in response to a request operation of a user terminal comprises:

[0011] collecting key information through an interactive interface of the user terminal, wherein the key information includes vehicle information, key validity time and key type;

[0012] generating the Bluetooth key activation request based on the key information.

[0013] In an embodiment of the present application, the digital key is generated by the cloud according to a pre-stored vehicle master key, comprising:

[0014] Obtaining the vehicle information in the Bluetooth key enabling request;

[0015] Calling the associated vehicle master key according to the vehicle information in the Bluetooth key enabling request;

[0016] Generating a key digest according to the key information in the Bluetooth key enabling request;

[0017] Generating the digital key according to the key digest and the vehicle master key.

[0018] In an embodiment of the present application, after generating the digital key according to the key digest and the vehicle master key, further comprising:

[0019] Generating a key signature according to the key digest and the vehicle master key;

[0020] Filling the key signature into the key information, and synchronously outputting the digital key and the key information to the user terminal.

[0021] In an embodiment of the present application, generating a session key according to the digital key, further comprising:

[0022] Performing vehicle-side authentication according to the digital key and the corresponding key information;

[0023] After the authentication passes, establishing a communication channel for data transmission, and the data transmitted in the communication channel is encrypted by the session key.

[0024] In an embodiment of the present application, performing vehicle-side authentication according to the digital key and the corresponding key information, comprising:

[0025] Obtaining a first random number generated by the vehicle side, generating a session key according to the digital key and the first random number, and generating a first ciphertext by encrypting the first random number through the session key, and outputting the first ciphertext and the key information to the vehicle side, so that the vehicle side performs one-time authentication according to the key information and the first ciphertext;

[0026] Decrypting and verifying according to the second ciphertext fed back by the vehicle side, and after the verification passes, generating a third ciphertext according to the session key of the user terminal and outputting the third ciphertext to the vehicle side, wherein the second ciphertext is obtained by encrypting a second random number of the user terminal according to a preset encryption algorithm by the vehicle side after the one-time authentication passes;

[0027] establishing the communication channel in response to verification pass information fed back by the vehicle end, wherein the verification pass message is generated after the vehicle end successfully decrypts the third ciphertext.

[0028] In an embodiment of the present application, the vehicle end performs one-time authentication according to the key information and the first ciphertext, including:

[0029] generating a signature value according to a vehicle master key pre-stored by the vehicle end and the key information;

[0030] comparing the signature value with a key signature in the key information, and decrypting the first ciphertext, wherein if the signature value is consistent with the key signature and the data corresponding to the decrypted first ciphertext is consistent with the first random number, one-time authentication is passed.

[0031] In an embodiment of the present application, the second ciphertext is encrypted by the vehicle end according to a preset encryption algorithm on a second random number of the user terminal after the one-time authentication is passed, including:

[0032] obtaining the second random number generated by the user terminal;

[0033] generating a vehicle digital key according to a vehicle master key pre-stored by the vehicle end and the key information;

[0034] generating a vehicle end session key according to the vehicle digital key and the second random number;

[0035] encrypting the second random number according to the vehicle end session key to obtain the second ciphertext.

[0036] In an embodiment of the present application, the second ciphertext fed back by the vehicle end is decrypted and verified, including:

[0037] decrypting the second ciphertext according to an agreed algorithm to obtain data in the second ciphertext;

[0038] comparing the data in the second ciphertext with the second random number, wherein if the two are consistent, the verification is passed.

[0039] The present application provides a kind of automobile Bluetooth key security management system, including:

[0040] key request module, for generating Bluetooth key enable request and output to cloud in response to the request operation of user terminal;

[0041] key acquisition module, for obtaining the digital key of the vehicle corresponding to cloud according to the Bluetooth key enable request, wherein the digital key is generated by cloud according to pre-stored vehicle master key, and the vehicle master key is associated with vehicle information;

[0042] An encryption control module is configured to generate a session key based on the digital key to perform an encrypted session with the vehicle end.

[0043] The application also provides a computer readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the steps of the vehicle Bluetooth key security management method.

[0044] The application also provides a computer readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the steps of the vehicle Bluetooth key security management method.

[0045] As described above, the vehicle Bluetooth key security management method, system, device and medium of the application have the following beneficial effects.

[0046] The application generates a Bluetooth key enabling request in response to a request operation of a user terminal and outputs the Bluetooth key enabling request to the cloud; acquires a digital key of a corresponding vehicle of the cloud according to the Bluetooth key enabling request, wherein the digital key is generated by the cloud according to a pre-stored vehicle master key, and the vehicle master key is associated with vehicle information; and generates a session key based on the digital key to perform an encrypted session with the vehicle end. The application generates a digital key based on a vehicle master key associated with vehicle information, ensures the uniqueness of the digital key and the session key, and generates a session key based on the interaction between the user terminal and the cloud, thereby realizing closed-loop management of key distribution and key storage and ensuring the security of data transmission. BRIEF DESCRIPTION OF DRAWINGS

[0047] Figure 1 The figure is a schematic diagram of the application scenario of the vehicle Bluetooth key security management method in an embodiment of the application.

[0048] Figure 2 The figure is a schematic diagram of the structure of the terminal provided in an embodiment of the application.

[0049] Figure 3 The figure is a schematic diagram of the flow of the vehicle Bluetooth key security management method in an embodiment of the application.

[0050] Figure 4 The figure is a schematic diagram of the flow of the vehicle Bluetooth key security management method in another embodiment of the application.

[0051] Figure 5 The figure is a schematic diagram of the flow of the generation of the vehicle master key in an embodiment of the application.

[0052] Figure 6 The figure is a schematic diagram of the flow of the derivation of the vehicle master key in an embodiment of the application.

[0053] Figure 7 The figure is a schematic diagram of the flow of the key management in an embodiment of the application.

[0054] Figure 8 A module diagram of a vehicle Bluetooth key security management system in an embodiment of the present application.

[0055] Figure 9 A structural schematic diagram of an apparatus in an embodiment of the present application. DETAILED DESCRIPTION

[0056] The present application will be described in detail with specific reference being made to certain embodiments thereof, but it is to be understood that the application is not limited to such embodiments. It will be apparent to a skilled person that other advantages and modifications of the application will occur to them from the disclosure made herein. The present application can be practiced by other than the described embodiments, which are presented for purposes of illustration and not of limitation. It is therefore desired to be covered in the appended claims all modifications of the present application falling within the scope of the claims. It is noted that features of the embodiments described below can be combined with each other, where possible, without departing from the scope of the present application.

[0057] It is noted that the drawings of the embodiments provided below only schematically illustrate the basic concept of the present application, and thus the drawings only show the components related to the present application, rather than being drawn according to the number, shape and size of the components in actual implementation. The shapes, number and proportions of the components in actual implementation can be arbitrarily changed, and the layout pattern of the components can be more complex.

[0058] In the existing Bluetooth key management method, the Bluetooth key is also distributed to the user terminal and the T-BOX of the target vehicle through the vehicle networking platform, and the distribution process is encrypted and protected. Such a method mainly aims at the secure distribution of the key, and does not provide measures for the secure use of the key, which cannot guarantee that the key is stolen in the communication authentication process, and may exist the problem that the communication data is forged, and thus illegal vehicle control operation is performed.

[0059] In addition, in the existing method, a signature algorithm is also used to extract a digest of the digital key, and the correspondence between the digest obtained by authentication decryption and the digital key is compared, and whether the decrypted digital key is consistent with the digital key recorded in the database of the party is compared. However, such a scheme only emphasizes the consistency of the key, and does not provide a secure solution from the security perspective of key generation, key distribution, and key derivation, and cannot guarantee the security and reliability of the key in the entire link.

[0060] Based on the problems existing in the prior art, the present application provides a vehicle Bluetooth key security management method, system, device and medium.

[0061] The embodiments of the present application can be applied to various scenarios, including but not limited to cloud technology, artificial intelligence, intelligent transportation, assisted driving, intelligent vehicles, and the like. The following describes exemplary applications of the device provided by the embodiments of the present application. The device provided by the embodiments of the present application can be implemented as various types of user terminals such as a smartphone, a smart watch, a notebook computer, a tablet computer, a desktop computer, a set-top box, a mobile device (for example, a mobile phone, a portable music player, a personal digital assistant, a dedicated message device, a portable game device), a smart voice interaction device, a smart home appliance, and a vehicle-mounted terminal, and can also be implemented as a server. In the following, exemplary applications when the device is implemented as a server are described.

[0062] In an embodiment, the vehicle can submit vehicle information to a PKI (Public Key Infrastructure) system through a network to apply for a vehicle master key. The PKI system generates a vehicle master key according to the vehicle information and distributes the vehicle master key to the vehicle and a Bluetooth key management platform of the cloud after encryption by an encryption algorithm. The vehicle master key is generated by the PKI system according to the uniqueness information of the vehicle, and one vehicle one key can be realized. The key is transmitted in an encrypted manner and can be stored in a secure storage environment such as a secure chip or a hardware security module. The generation of the master key, the distribution of the master key, and the storage of the master key adopt closed-loop management, thereby reducing the risk of leakage of the master key.

[0063] Please refer to Figure 1 , Figure 1 is a schematic diagram of an application scenario of the automobile Bluetooth key security management method in an embodiment of the present application. The vehicle information can be sent to the PKI system through the vehicle to apply for a vehicle master key. The PKI system generates a vehicle master key and distributes the vehicle master key to the vehicle 300 and the server 200 for Bluetooth key management in an encrypted manner for storage. The user can send a Bluetooth key enabling request to the server 200 through the terminal 400. The terminal 400 is connected to the server 200 through the network 100 to send the Bluetooth key enabling request to the server 200. The vehicle information can be included in the Bluetooth key enabling request. After the server 200 obtains the vehicle information, the server 200 generates a digital key according to the vehicle information and distributes the digital key to the terminal 400. The terminal 400 generates a session key according to the digital key and establishes a communication channel with the vehicle 300, and transmits session data such as control instructions of the digital key through the established communication channel to perform vehicle-side control, such as unlocking the vehicle door, starting the engine, turning on the air conditioner, and the like.

[0064] In an embodiment, the server 200 can be a stand-alone physical server, a server cluster or a distributed system composed of multiple physical servers, a cloud server providing cloud services, cloud database, cloud computing, cloud function, cloud storage, network service, cloud communication, middleware service, domain name service, security service, CDN, and basic cloud computing services such as big data and artificial intelligence platform.

[0065] In an embodiment, the vehicle information can also be input on the terminal 400, and the vehicle information is sent to the PKI system to apply for the vehicle master key of the corresponding vehicle. The PKI system generates the vehicle master key and then issues the vehicle master key to the vehicle 300 and the server 200 for storage. In another embodiment, the terminal can be a smart phone, a tablet computer, a notebook computer, a desktop computer, a smart speaker, a smart watch, a smart voice interaction device, a smart home appliance, a vehicle terminal, and the like, but is not limited thereto.

[0066] Referring to Figure 2 , Figure 2 is a structural schematic diagram of the terminal 400 provided by the embodiment of the present application, Figure 2 The terminal 400 shown in FIG. 4 includes at least one processor 410, a memory 450, at least one network interface 420, and a user interface 430. The various components in the terminal 400 are coupled together by a bus system 440. It can be understood that the bus system 440 is used to realize the connection and communication between the components. In addition to the data bus, the bus system 440 also includes a power bus, a control bus, and a status signal bus. However, for the purpose of clear illustration, all kinds of buses are marked as the bus system 440 in Figure 2 .

[0067] The processor 410 can be an integrated circuit chip with signal processing capability, such as a general-purpose processor, a digital signal processor (DSP), or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc., wherein the general-purpose processor can be a microprocessor or any conventional processor.

[0068] The user interface 430 includes one or more output devices 431 that enable presentation of media content, including one or more speakers and / or one or more visual display screens. The user interface 430 also includes one or more input devices 432, including user interface components that facilitate user input, such as a keyboard, a mouse, a microphone, a touch screen display, a camera, other input buttons and controls.

[0069] The memory 450 can be removable, non-removable, or a combination thereof. Exemplary hardware devices include solid-state memory, hard drives, optical drives, and the like. The memory 250 optionally includes one or more storage devices remotely located from the processor(s) 410.

[0070] The memory 450 includes volatile memory or nonvolatile memory, and can also include both volatile and nonvolatile memory. Nonvolatile memory can be read only memory (ROM), volatile memory can be random access memory (RAM). The memory 450 described in embodiments of the present application is intended to include any suitable type of memory.

[0071] In some embodiments, the memory 450 is capable of storing data to support various operations, examples of which include programs, modules, and data structures or a subset or superset thereof, which are exemplarily illustrated below.

[0072] The operating system 451 includes system programs for processing various basic system services and performing hardware-related tasks, such as a framework layer, a core library layer, a driver layer, and the like, for implementing various basic services and processing hardware-based tasks;

[0073] The network communication module 452 is used to communicate with other computing devices via one or more (wired or wireless) network interfaces 420, exemplary network interfaces 420 include Bluetooth, wireless compatibility certification (WiFi), and universal serial bus (USB), and the like;

[0074] The presentation module 453 is used to enable the presentation of information via one or more output devices 431 associated with the user interface 430 (e.g., display screen, speaker, and the like) (e.g., user interface for operating peripheral devices and displaying content and information);

[0075] The input processing module 454 is used to detect and interpret one or more user inputs or interactions from one or more input devices 432.

[0076] In some embodiments, the apparatus provided by the embodiments of the present application can be implemented in software, Figure 2 An automobile Bluetooth key security management system 455 stored in the memory 450 is shown, which can be software in the form of programs and plug-ins, including the following software modules: key request module 4551, key acquisition module 4552, and encryption control module 4553, these modules are logical, so they can be combined or further split according to the functions implemented.

[0077] The functions of the various modules will be described below.

[0078] In some embodiments, the system provided by the embodiments of the present application can be implemented in a hardware manner. For example, the system provided by the embodiments of the present application can be a hardware decoding processor programmed to execute the vehicle Bluetooth key security management method provided by the embodiments of the present application. For example, the hardware decoding processor can be implemented by one or more application specific integrated circuits (ASICs), DSPs, programmable logic devices (PLDs), complex programmable logic devices (CPLDs), field programmable gate arrays (FPGAs) or other electronic elements.

[0079] In some embodiments, the terminal or server can implement the vehicle Bluetooth key security management method provided by the embodiments of the present application by running a computer program. For example, the computer program can be a native program or a software module in an operating system; can be a native application program (APP) that needs to be installed in an operating system to run, such as a social application APP or a message sharing APP; can be a mini program that only needs to be downloaded into a browser environment to run; or can be a mini program or a web client program that can be embedded into any APP. In summary, the above computer program can be any form of application program, module or plug-in.

[0080] The vehicle Bluetooth key security management method provided by the embodiments of the present application will be described below in conjunction with exemplary applications and implementations of the device provided by the embodiments of the present application.

[0081] Please refer to Figure 3 The present application provides a vehicle Bluetooth key security management method, which comprises the following steps.

[0082] Step S001, in response to the request operation of the user terminal, a Bluetooth key enable request is generated and output to the cloud.

[0083] In an embodiment, before enabling the Bluetooth key, vehicle information can be sent to the PKI system to apply for a vehicle master key. The PKI system issues the vehicle master key to the vehicle and the Bluetooth key management platform of the cloud for storage.

[0084] Specifically, please refer to Figure 4 ,Figure 4 The flowchart of the vehicle Bluetooth key security management method in another embodiment of the present application is shown. The method comprises the following steps:

[0085] S1, key generation: the vehicle applies for a vehicle master key, and the vehicle obtains the vehicle master key by submitting vehicle information to a PKI system; the PKI (Public Key Infrastructure) system generates a vehicle master key according to the vehicle information, encrypts the vehicle master key through an encryption algorithm, and distributes the vehicle master key to the vehicle and a Bluetooth key management platform.

[0086] S2, key storage: the vehicle stores the obtained vehicle master key in a secure chip of the vehicle for secure storage; the Bluetooth key management platform saves the obtained vehicle master key in a secure storage space and establishes a binding relationship between the vehicle master key and the vehicle information.

[0087] S3, key derivation: when the user applies to enable the Bluetooth key, the Bluetooth key management platform generates a digital key according to an algorithm and distributes the digital key to the user's mobile phone through a secure channel.

[0088] S4, key management: when the user uses the Bluetooth key, the mobile phone APP and the vehicle establish a secure communication channel through the digital key and generate a session key for communication data encryption and decryption to ensure data security.

[0089] In an embodiment, please refer to Figure 5 , Figure 5 The flowchart of the vehicle master key generation in an embodiment of the present application is shown. The generation of the vehicle master key comprises the following steps:

[0090] S11, the vehicle submits vehicle information to the PKI system to apply for a vehicle master key. The submitted vehicle information can include the VIN code of the vehicle, the TUID code of the vehicle machine, and other information that can uniquely identify the vehicle;

[0091] S12, the PKI system generates a vehicle master key through an algorithm after receiving the vehicle information;

[0092] In an embodiment, the symmetric algorithm-AES can be used as the algorithm for generating the vehicle master key, and the key length can be selected as 128 bits, 192 bits or 256 bits. The national cryptographic algorithm-SM3 can also be used to generate the vehicle master key. The specific vehicle master key generation algorithm can be set according to actual application requirements, which is not limited here.

[0093] S13, the PKI system encrypts the vehicle master key generated according to the vehicle information through an encryption algorithm and distributes the vehicle master key to the vehicle and the Bluetooth key management platform.

[0094] In an embodiment, symmetric algorithm-AES, white-box algorithm or asymmetric algorithm-RSA can be used as the encryption algorithm in the vehicle master key transmission process.

[0095] In an embodiment, please refer to Figure 5 , Figure 5 is a flowchart of the vehicle master key storage in an embodiment of the present application. The vehicle fills the obtained vehicle master key into the security chip of the vehicle for secure storage; the Bluetooth key management platform saves the obtained vehicle master key in the secure storage space and establishes the association between the vehicle master key and the vehicle information. The security chip, hardware security module or trusted execution environment can be used as the secure storage space of the Bluetooth key management platform. The vehicle master key storage includes the following steps:

[0096] S21, the vehicle fills the vehicle master key into the security chip of the vehicle for secure storage;

[0097] S22, the Bluetooth key management platform saves the vehicle master key in the secure storage space;

[0098] S23, the Bluetooth key management platform collects the vehicle information and establishes the association with the vehicle master key.

[0099] In an embodiment, the Bluetooth key activation request is generated in response to the request operation of the user terminal, including:

[0100] Collecting the key information through the interactive interface of the user terminal, wherein the key information includes vehicle information, key valid time and key type;

[0101] Generating the Bluetooth key activation request according to the key information.

[0102] In an embodiment, the user terminal can include a mobile phone, a tablet and other portable terminals, and can also include a computer and other terminal devices. The user terminal can provide an interactive interface for the user to input the key information. The user terminal generates the Bluetooth key activation request according to the key information input by the user. The Bluetooth key activation request is sent to the Bluetooth key management platform.

[0103] Step S002, obtaining the digital key of the corresponding vehicle in the cloud according to the Bluetooth key activation request, wherein the digital key is generated by the cloud according to the pre-stored vehicle master key, and the vehicle master key is associated with the vehicle information.

[0104] In an embodiment, the digital key is generated by the cloud according to the pre-stored vehicle master key, including:

[0105] Obtaining the vehicle information in the Bluetooth key activation request;

[0106] deriving a vehicle master key according to vehicle information in the Bluetooth key enablement request;

[0107] generating a key digest according to key information in the Bluetooth key enablement request;

[0108] generating the digital key according to the key digest and the vehicle master key.

[0109] Specifically, refer to Figure 6 , Figure 6 a flowchart of deriving a vehicle master key in an embodiment of the present application. When a user applies for enabling a Bluetooth key, the Bluetooth key management platform generates a digital key according to an algorithm and delivers it to the user terminal through a secure channel. Derivation of the vehicle master key includes the following steps:

[0110] S31, the user applies for enabling the Bluetooth key, and the mobile phone APP generates key information and uploads it to the Bluetooth key management platform. The key information should include vehicle information, key validity time, key type, etc.

[0111] In an embodiment, the key information can include the ID of the key, user information, vehicle VIN, creation time of the key, validity period of the key, type of the key, etc.

[0112] In an embodiment, the key type can support NFC key, ICCE key, CCC key, etc.

[0113] S32, the Bluetooth key management platform queries the vehicle master key of the corresponding vehicle by using the vehicle information in the key information data;

[0114] S33, after receiving the key information, the Bluetooth key management platform performs a hash operation on the data to generate a digest of the key information.

[0115] In an embodiment, the key information digest can be calculated by SHA256 algorithm or SM3 algorithm. The specific calculation process is not described here.

[0116] S34, the vehicle master key and the digest information of the key information are used to obtain a digital key by using a dispersion algorithm.

[0117] In an embodiment, AES_ECB algorithm or SM4 algorithm can be used as a dispersion algorithm to calculate the digital key.

[0118] In an embodiment, after generating the digital key according to the key digest and the vehicle master key, the method further includes:

[0119] generating a key signature according to the key digest and the vehicle master key;

[0120] The key signature is filled into the key information, and the digital key is synchronized and output to the user terminal.

[0121] Referring to Figure 6 Steps S35 and S36 in the figure, in step S35, the vehicle master key and the key information are used to obtain the signature value of the key information by using the MAC algorithm, and the signature value is filled into the key information.

[0122] In step S36, the digital key and the key information are transmitted to the user terminal in a secure manner, such as a mobile phone APP.

[0123] Step S003, a session key is generated according to the digital key to perform an encrypted session with the vehicle end.

[0124] In an embodiment, after receiving the digital key, the user terminal can establish a communication channel between the user terminal and the vehicle end according to the digital key to achieve secure data transmission, prevent the session key from being stolen, and ensure the security of vehicle control.

[0125] In an embodiment, generating a session key according to the digital key further includes:

[0126] Vehicle end authentication is performed according to the digital key and the corresponding key information;

[0127] After authentication, a communication channel is established for data transmission, and the data transmitted in the communication channel is encrypted by the session key.

[0128] Specifically, the user terminal and the vehicle can establish a secure communication channel through the digital key, and generate a session key for encryption and decryption of communication data to ensure data security and complete the vehicle control operation.

[0129] In an embodiment, vehicle end authentication according to the digital key and the corresponding key information includes:

[0130] A first random number generated by the vehicle end is obtained, a session key is generated according to the digital key and the first random number, and the first random number is encrypted by the session key to generate a first ciphertext, and the first ciphertext and the key information are output to the vehicle end to enable the vehicle end to perform one-time authentication according to the key information and the first ciphertext.

[0131] Specifically, referring to Figure 7 , Figure 7 is a flowchart of key management in an embodiment of the present application. One-time authentication includes the following steps:

[0132] S41, the vehicle generates a random number and sends it to the user terminal to obtain key information;

[0133] S42, the user terminal generates a session key through an algorithm, and encrypts the random number and sends the encrypted random number to the vehicle together with the key information;

[0134] In an embodiment, the AES_CBC algorithm or the SM4 algorithm can be used as the generation algorithm of the session key. When the session key is generated, the digital key can be used as the key of the session key generation algorithm, and the vehicle-side random number can be used as the data input. Through the algorithm, the session key is generated, and the specific calculation process is not described here. The first ciphertext is obtained by encrypting the random number generated by the vehicle through the session key.

[0135] In an embodiment, the vehicle end performs one-time authentication according to the key information and the first ciphertext, including the following steps:

[0136] Step S030, generating a signature value according to the vehicle master key pre-stored in the vehicle end and the key information.

[0137] In an embodiment, when the vehicle master key is applied to the PKI system in the foregoing step, the PKI system has issued the corresponding vehicle master key to the vehicle and the Bluetooth key management platform. The vehicle end can pre-store the vehicle master key. The vehicle master key of the vehicle end can be called to generate the digital key signature value of the vehicle end in combination with the key information obtained from the user terminal.

[0138] Step S031, comparing the signature value with the key signature in the key information, and decrypting the first ciphertext. If the signature value is consistent with the key signature, and the data corresponding to the decrypted first ciphertext is consistent with the first random number, the one-time verification is passed.

[0139] In an embodiment, the vehicle obtains the vehicle information from the key information, generates the digital key and the signature value of the key information, compares the correctness, and generates the session key to decrypt the data according to the same algorithm, and verifies the correctness of the data. If correct, the vehicle sends the second ciphertext generated by encrypting the mobile terminal random number by the session key of the vehicle end to the user terminal.

[0140] In an embodiment, the second ciphertext is obtained by encrypting the second random number of the user terminal according to a preset encryption algorithm after the one-time verification is passed, including: obtaining the second random number generated by the user terminal; generating a vehicle digital key according to the vehicle master key pre-stored in the vehicle end and the key information; generating a vehicle end session key according to the vehicle digital key and the second random number; and encrypting the second random number according to the vehicle end session key to obtain the second ciphertext.

[0141] Specifically, SHA256 or SM3 can be used to calculate the key information digest; the vehicle calculates the digital key at the vehicle end by using the vehicle master key and the key information digest through a dispersion algorithm; the vehicle calculates the new signature value of the key by using the vehicle master key and the key information digest through a MAC algorithm. Further, the digital key at the vehicle end is used as the key of the vehicle end session key generation algorithm, and the random number of the user terminal is used as the data input, and the session key at the vehicle end is generated through the algorithm, and the session key at the vehicle end is used to encrypt the random number generated by the user terminal to obtain the second ciphertext sent to the user terminal for decryption verification.

[0142] In step S032, the second ciphertext fed back by the vehicle end is decrypted and verified, and after the verification is passed, the third ciphertext is generated according to the session key of the user terminal and output to the vehicle end, wherein the second ciphertext is obtained by encrypting the second random number of the user terminal according to a preset encryption algorithm by the vehicle end after the first verification is passed.

[0143] In an embodiment, the decryption and verification of the second ciphertext fed back by the vehicle end comprises:

[0144] The data in the second ciphertext is decrypted according to the agreed algorithm to obtain the data in the second ciphertext.

[0145] The data in the second ciphertext is compared with the second random number, and if they are consistent, the verification is passed.

[0146] Specifically, after receiving the second ciphertext, the user terminal can decrypt the second ciphertext by using the agreed decryption algorithm to obtain the random number in the second ciphertext, and compare the random number in the second ciphertext with the second random number generated before, and if they are consistent, the verification is passed.

[0147] The communication channel is established in response to the verification passed information fed back by the vehicle end, wherein the verification passed message is generated by the vehicle end after the decryption of the third ciphertext is successful.

[0148] Specifically, please refer to steps S44-S46 in Figure 7

[0149] S44, the mobile phone APP decrypts the data and verifies. After receiving the second ciphertext, the mobile phone APP decrypts the data, verifies and passes, and generates the third ciphertext by using the session key generated by the agreed algorithm to encrypt the data and sends it to the vehicle.

[0150] In an embodiment, after receiving the third ciphertext, the vehicle calculates the session key by using the digital key at the vehicle end and the random number at the vehicle side through dispersion calculation; the session key generation algorithm can include AES_CBC or SM4.

[0151] ​S45, the vehicle generates a session key to decrypt the data by using the same algorithm, if the decryption is successful, the mutual authentication is ended, and a secure communication channel is established;

[0152] In an embodiment, the vehicle generates a vehicle-side session key by using a digital key of a vehicle side and a vehicle-side random number through a dispersion calculation;

[0153] In an embodiment, an AES_CBC algorithm or an SM4 algorithm can be used as a generation algorithm of the session key.

[0154] S46, the mobile phone APP and the vehicle encrypt and decrypt data by using the session key, and perform a vehicle control operation.

[0155] Based on the above technical solution, the vehicle master key in the application is generated by a PKI system according to device uniqueness information, one-to-one encryption is realized, the key is transmitted in an encrypted manner, and the key is stored in a secure chip or a hardware security module or the like, closed-loop management is adopted for key generation, key distribution and key storage, compared with the traditional master key, only the encrypted transmission manner or only the secure storage manner is used, the risk of key leakage is reduced; a derived algorithm is used to generate a communication key, the derived key is set to be valid, and the key applied each time is different, compared with the traditional fixed communication key mechanism, the key cracking difficulty is increased, and the data communication security is improved; a two-way authentication mechanism must be used when a secure connection is established, a session key is generated by a communication key and a random number through a dispersion algorithm, the session key is ensured to be different, and the risk that the key is identified due to communication data leakage is avoided.

[0156] Please refer to Figure 8 , Figure 8 FIG. 1 is a module diagram of a car Bluetooth key security management system in an embodiment of the application, the system includes: a key request module 4551, configured to generate a Bluetooth key enabling request and output to the cloud in response to a request operation of a user terminal; a key acquisition module 4552, configured to acquire a digital key of a corresponding vehicle of the cloud according to the Bluetooth key enabling request, wherein the digital key is generated by the cloud according to a pre-stored vehicle master key, and the vehicle master key is associated with vehicle information; and an encryption control module 4553, configured to generate a session key according to the digital key to perform an encrypted session with a vehicle side.

[0157] In an embodiment, the key request module 4551 is further configured to collect key information through an interactive interface of the user terminal, wherein the key information includes vehicle information, key valid time and key type; and the Bluetooth key enabling request is generated according to the key information.

[0158] In an embodiment, the key obtaining module 4552 is further configured to generate the digital key according to the vehicle master key pre-stored in the cloud, including: obtaining the vehicle information in the Bluetooth key enabling request; calling the associated vehicle master key according to the vehicle information in the Bluetooth key enabling request; generating a key digest according to the key information in the Bluetooth key enabling request; and generating the digital key according to the key digest and the vehicle master key.

[0159] In an embodiment, after the key obtaining module 4552 is configured to generate the digital key according to the key digest and the vehicle master key, the key obtaining module 4552 is further configured to generate a key signature according to the key digest and the vehicle master key; fill the key signature into the key information; and synchronously output the digital key and the key information to the user terminal.

[0160] In an embodiment, the encryption control module 4553 is further configured to generate a session key according to the digital key, and the encryption control module 4553 is further configured to perform vehicle-side authentication according to the digital key and the corresponding key information; after the authentication is passed, establish a communication channel for data transmission, and the data transmitted in the communication channel is encrypted by the session key.

[0161] In an embodiment, the encryption control module 4553 is further configured to perform vehicle-side authentication according to the digital key and the corresponding key information, including: obtaining a first random number generated by the vehicle side, generating a session key according to the digital key and the first random number, and generating a first ciphertext by encrypting the first random number by the session key, and outputting the first ciphertext and the key information to the vehicle side, so that the vehicle side performs one-time authentication according to the key information and the first ciphertext; perform decryption verification according to the second ciphertext fed back by the vehicle side, and after the verification is passed, generate a third ciphertext according to the session key of the user terminal to output to the vehicle side, wherein the second ciphertext is obtained by encrypting a second random number of the user terminal by the vehicle side after the one-time authentication is passed; and in response to the verification pass message fed back by the vehicle side, establish the communication channel, wherein the verification pass message is generated by the vehicle side after the third ciphertext is successfully decrypted.

[0162] In an embodiment, the encryption control module 4553 is further configured to perform one-time authentication by the vehicle side according to the key information and the first ciphertext, including: generating a signature value according to the vehicle master key pre-stored in the vehicle side and the key information; comparing the signature value with the key signature in the key information, and decrypting the first ciphertext, if the signature value is consistent with the key signature and the decrypted first ciphertext corresponds to the same data as the first random number, the one-time authentication is passed.

[0163] In an embodiment, the encryption control module 4553 is further configured to encrypt the second random number of the user terminal according to a preset encryption algorithm to obtain the second ciphertext after the first verification passes, including: obtaining the second random number generated by the user terminal; generating a vehicle digital key according to the vehicle master key and the key information stored in the vehicle; generating a vehicle session key according to the vehicle digital key and the second random number; and encrypting the second random number according to the vehicle session key to obtain the second ciphertext.

[0164] In an embodiment, the encryption control module 4553 is further configured to perform decryption verification according to the second ciphertext fed back by the vehicle end, including: decrypting the second ciphertext according to the agreed algorithm to obtain the data in the second ciphertext; and comparing the data in the second ciphertext with the second random number, and if they are consistent, the verification passes.

[0165] The above-mentioned automobile Bluetooth key security management system can be realized in the form of a computer program, and the computer program can run on a computer device as shown in Figure 9 The computer device includes a memory, a processor, and a computer program stored in the memory and executable on the processor.

[0166] The above-mentioned automobile Bluetooth key security management system can be realized in the form of a computer program, and the computer program can run on a computer device as shown in

[0167] As shown in Figure 9 , it is an internal structure diagram of the computer device in an embodiment. A computer device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, and the processor implements the following steps when executing the computer program: generating a Bluetooth key enablement request in response to a request operation of a user terminal and outputting the Bluetooth key enablement request to the cloud; obtaining a digital key of a vehicle corresponding to the cloud according to the Bluetooth key enablement request, wherein the digital key is generated by the cloud according to a pre-stored vehicle master key, and the vehicle master key is associated with vehicle information; and generating a session key according to the digital key to perform an encrypted session with the vehicle end.

[0168] In an embodiment, when the processor executes, the Bluetooth key enablement request is generated in response to the request operation of the user terminal, including: collecting key information through an interactive interface of the user terminal, wherein the key information includes vehicle information, key validity time, and key type; and generating the Bluetooth key enablement request according to the key information.

[0169] In an embodiment, when the processor executes, the implemented digital key is generated by the cloud according to a pre-stored vehicle master key, including: obtaining vehicle information in the Bluetooth key enabling request; calling an associated vehicle master key according to the vehicle information in the Bluetooth key enabling request; generating a key digest according to the key information in the Bluetooth key enabling request; and generating the digital key according to the key digest and the vehicle master key.

[0170] In an embodiment, when the processor executes, after the implemented generation of the digital key according to the key digest and the vehicle master key, it further includes: generating a key signature according to the key digest and the vehicle master key; filling the key signature into the key information, and synchronously outputting the digital key to the user terminal.

[0171] In an embodiment, when the processor executes, the implemented generation of the session key according to the digital key and the corresponding key information further includes: performing vehicle-side authentication according to the digital key and the corresponding key information; after the authentication passes, establishing a communication channel for data transmission, and the data transmitted in the communication channel is encrypted by the session key.

[0172] In an embodiment, when the processor executes, the implemented vehicle-side authentication according to the digital key and the corresponding key information includes: obtaining a first random number generated by the vehicle side, generating a session key according to the digital key and the first random number, and generating a first ciphertext by encrypting the first random number through the session key, outputting the first ciphertext and the key information to the vehicle side, so that the vehicle side performs one-time authentication according to the key information and the first ciphertext; performing decryption verification according to the second ciphertext fed back by the vehicle side, and after the verification passes, generating a third ciphertext according to the session key of the user terminal to output to the vehicle side, wherein the second ciphertext is obtained by encrypting a second random number of the user terminal through a preset encryption algorithm by the vehicle side after the one-time verification passes; and establishing the communication channel in response to the verification pass message fed back by the vehicle side, wherein the verification pass message is generated by the vehicle side after successfully decrypting the third ciphertext.

[0173] In an embodiment, when the processor executes, the implemented one-time authentication of the vehicle side according to the key information and the first ciphertext includes: generating a signature value according to a pre-stored vehicle master key of the vehicle side and the key information; comparing the signature value with the key signature in the key information, and decrypting the first ciphertext, if the signature value is consistent with the key signature and the decrypted first ciphertext corresponds to the same data as the first random number, then the one-time authentication passes.

[0174] In an embodiment, the processor, when executed, implements the second ciphertext obtained by encrypting the second random number of the user terminal according to a preset encryption algorithm by the vehicle end after the first verification passes, including: obtaining the second random number generated by the user terminal; generating a vehicle digital key according to the vehicle master key and the key information stored in the vehicle end in advance; generating a vehicle end session key according to the vehicle digital key and the second random number; encrypting the second random number according to the vehicle end session key to obtain the second ciphertext.

[0175] In an embodiment, the processor, when executed, implements the decryption verification according to the second ciphertext fed back by the vehicle end, including: decrypting the second ciphertext according to an agreed algorithm to obtain data in the second ciphertext; comparing the data in the second ciphertext with the second random number, and if they are consistent, the verification passes.

[0176] In an embodiment, the computer device can be used as a server, including but not limited to a stand-alone physical server, or a server cluster composed of multiple physical servers, and the computer device can also be used as a terminal, including but not limited to a mobile phone, a tablet computer, a personal digital assistant, or a smart device, etc. Figure 5 As shown in the figure, the computer device includes a processor, a non-volatile storage medium, an internal memory, a display screen, and a network interface connected through a system bus.

[0177] The processor of the computer device is used to provide computing and control capabilities to support the operation of the entire computer device. The non-volatile storage medium of the computer device stores an operating system and a computer program. The computer program can be executed by the processor to implement the automobile Bluetooth key security management method provided in each of the above embodiments. The internal memory of the computer device provides a cache running environment for the operating system and the computer program in the non-volatile storage medium. The display interface can display data through the display screen. The display screen can be a touch screen, such as a capacitive screen or an electronic screen, which can generate corresponding instructions by receiving the click operation of the control displayed on the touch screen.

[0178] Those skilled in the art can understand that, Figure 9 The structure of the computer device shown in the figure is only a block diagram of part of the structure related to the scheme of the present application, and does not constitute a limitation on the computer device to which the scheme of the present application is applied. A specific computer device can include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0179] In one embodiment, a computer readable storage medium is provided, and a computer program is stored on the computer readable storage medium, and the computer program is executed by a processor to implement the following steps: generating a Bluetooth key enable request in response to a request operation of a user terminal and outputting to the cloud; obtaining a digital key of a corresponding vehicle of the cloud according to the Bluetooth key enable request, wherein the digital key is generated by the cloud according to a pre-stored vehicle master key, and the vehicle master key is associated with vehicle information; and generating a session key according to the digital key to perform an encrypted session with a vehicle terminal.

[0180] In one embodiment, the computer program is executed by the processor to generate the Bluetooth key enable request in response to the request operation of the user terminal, including: collecting key information through an interactive interface of the user terminal, wherein the key information includes vehicle information, key validity time, and key type; and generating the Bluetooth key enable request according to the key information.

[0181] In one embodiment, the computer program is executed by the processor to generate the digital key by the cloud according to the pre-stored vehicle master key, including: obtaining vehicle information in the Bluetooth key enable request; calling an associated vehicle master key according to the vehicle information in the Bluetooth key enable request; generating a key digest according to the key information in the Bluetooth key enable request; and generating the digital key according to the key digest and the vehicle master key.

[0182] In one embodiment, the computer program is executed by the processor to generate the digital key according to the key digest and the vehicle master key, and further includes: generating a key signature according to the key digest and the vehicle master key; filling the key signature into the key information, and synchronously outputting the digital key and the key information to the user terminal.

[0183] In one embodiment, the computer program is executed by the processor to generate the session key according to the digital key, and further includes: performing vehicle terminal authentication according to the digital key and corresponding key information; after the authentication is passed, establishing a communication channel to perform data transmission, and data transmitted in the communication channel is encrypted by the session key.

[0184] In an embodiment, when the computer program is executed by the processor, the vehicle-side authentication according to the digital key and the corresponding key information is implemented, including: obtaining a first random number generated by the vehicle side, generating a session key according to the digital key and the first random number, and generating a first ciphertext by encrypting the first random number through the session key, and outputting the first ciphertext and the key information to the vehicle side to enable the vehicle side to perform one-time authentication according to the key information and the first ciphertext; performing decryption verification according to a second ciphertext fed back by the vehicle side, and generating a third ciphertext according to the session key of the user terminal to output to the vehicle side after the verification is passed, wherein the second ciphertext is obtained by encrypting a second random number of the user terminal according to a preset encryption algorithm by the vehicle side after the one-time verification is passed; and establishing the communication channel in response to a verification pass message fed back by the vehicle side, wherein the verification pass message is generated by the vehicle side after the third ciphertext is successfully decrypted.

[0185] In an embodiment, when the instructions are executed by the processor, the one-time authentication of the vehicle side according to the key information and the first ciphertext is implemented, including: generating a signature value according to a vehicle master key pre-stored by the vehicle side and the key information; comparing the signature value with a key signature in the key information, and decrypting the first ciphertext, and if the signature value is consistent with the key signature and the decrypted first ciphertext corresponds to the first random number, the one-time authentication is passed.

[0186] In an embodiment, when the instructions are executed by the processor, the second ciphertext obtained by the vehicle side according to a preset encryption algorithm on the second random number of the user terminal after the one-time authentication is passed is implemented, including: obtaining a second random number generated by the user terminal; generating a vehicle digital key according to a vehicle master key pre-stored by the vehicle side and the key information; generating a vehicle session key according to the vehicle digital key and the second random number; and encrypting the second random number according to the vehicle session key to obtain the second ciphertext.

[0187] In an embodiment, when the instructions are executed by the processor, the decryption verification according to the second ciphertext fed back by the vehicle side is implemented, including: decrypting the second ciphertext according to an agreed algorithm to obtain data in the second ciphertext; comparing the data in the second ciphertext with the second random number, and if they are consistent, the verification is passed.

[0188] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by a computer program instructing relevant hardware. The program can be stored in a non-volatile computer readable storage medium. When the program is executed, the program can include the processes of the above-mentioned embodiment methods. The storage medium can be a magnetic disc, an optical disc, a read-only memory (ROM), and the like.

[0189] The above embodiments are only illustrative of the principles and effects of the present application, and are not intended to limit the present application. Any person skilled in the art can modify or change the above embodiments without departing from the spirit and scope of the present application. Therefore, all equivalent modifications or changes made by those skilled in the art without departing from the spirit and technical ideas disclosed in the present application should be covered by the claims of the present application.

Claims

1. A method for secure management of automotive Bluetooth keys, characterized in that, include: In response to a user terminal's request, a Bluetooth key activation request is generated and output to the cloud; The digital key for the corresponding vehicle is obtained from the cloud according to the Bluetooth key activation request. The digital key is generated by the cloud based on the pre-stored vehicle master key, which is associated with vehicle information. Generating a session key based on the digital key to establish an encrypted session with the vehicle terminal. Generating the session key based on the digital key further includes: authenticating the vehicle terminal based on the digital key and corresponding key information; after successful authentication, establishing a communication channel for data transmission, wherein the data transmitted in the communication channel is encrypted using the session key; authenticating the vehicle terminal based on the digital key and corresponding key information includes: obtaining a first random number generated by the vehicle terminal; generating a session key based on the digital key and the first random number; encrypting the first random number using the session key to generate a first ciphertext; outputting the first ciphertext and the key information to the vehicle terminal, so that the vehicle terminal performs an authentication based on the key information and the first ciphertext; decrypting and verifying a second ciphertext fed back by the vehicle terminal; after successful verification, generating a third ciphertext based on the user terminal's session key and outputting it to the vehicle terminal, wherein the second ciphertext is obtained by the vehicle terminal encrypting the user terminal's second random number using a preset encryption algorithm after the first successful authentication; establishing the communication channel in response to authentication success information fed back by the vehicle terminal, wherein the authentication success information is generated by the vehicle terminal after successfully decrypting the third ciphertext.

2. The automotive Bluetooth key security management method according to claim 1, characterized in that, In response to a user terminal's request, a Bluetooth key activation request is generated, including: Key information is collected through the user terminal's interactive interface, including vehicle information, key validity period, and key type. The Bluetooth key activation request is generated based on the key information.

3. The automotive Bluetooth key security management method according to claim 2, characterized in that, The digital key is generated in the cloud based on a pre-stored vehicle master key, and includes: Obtain the vehicle information from the Bluetooth key activation request; The associated vehicle master key is retrieved based on the vehicle information in the Bluetooth key activation request; Generate a key digest based on the key information in the Bluetooth key activation request; The digital key is generated based on the key digest and the vehicle master key.

4. The automotive Bluetooth key security management method according to claim 3, characterized in that, After generating the digital key based on the key digest and the vehicle master key, the method further includes: Generate a key signature based on the key digest and the vehicle master key; The key signature is filled into the key information and output to the user terminal synchronously with the digital key.

5. The automotive Bluetooth key security management method according to claim 1, characterized in that, The vehicle terminal performs an authentication based on the key information and the first ciphertext, including: A signature value is generated based on the vehicle master key pre-stored on the vehicle and the key information; The signature value is compared with the key signature in the key information, and the first ciphertext is decrypted. If the signature value matches the key signature and the data corresponding to the decrypted first ciphertext matches the first random number, then the authentication is successful.

6. The automotive Bluetooth key security management method according to claim 1, characterized in that, The second ciphertext is obtained by encrypting a second random number from the user terminal using a preset encryption algorithm after the first authentication is successful. This includes: Obtain the second random number generated by the user terminal; The digital key is generated based on the vehicle master key pre-stored in the vehicle and the key information. A vehicle-side session key is generated based on the digital key and the second random number; The second random number is encrypted using the vehicle-side session key to obtain the second ciphertext.

7. The automotive Bluetooth key security management method according to claim 1, characterized in that, Decryption and verification are performed based on the second ciphertext returned by the vehicle, including: The second ciphertext is decrypted according to the agreed algorithm to obtain the data in the second ciphertext; The data in the second ciphertext is compared with the second random number. If they match, the verification is successful.

8. A car Bluetooth key security management system that implements the car Bluetooth key security management method as described in any one of claims 1-7, characterized in that, include: The key request module is used to generate a Bluetooth key activation request in response to a request from the user terminal and output it to the cloud. The key acquisition module is used to acquire the digital key of the corresponding vehicle in the cloud according to the Bluetooth key activation request, wherein the digital key is generated by the cloud according to the pre-stored vehicle master key, and the vehicle master key is associated with vehicle information; An encryption control module is used to generate a session key based on the digital key to conduct an encrypted session with the vehicle.

9. A computer device, comprising: A memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, when the processor executes the computer program, it implements the steps of the automotive Bluetooth key security management method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the steps of the automotive Bluetooth key security management method according to any one of claims 1 to 7.

Images