A key management method and system for whole vehicle key distribution

Abstract

The present invention discloses a key management method and system for whole vehicle key distribution. In the production line electrical inspection link of the vehicle, the global unique key of the IVI and each ECU is applied for and issued to the IVI and each ECU; after the vehicle is powered on, the key is updated or deleted according to the key status of the IVI and each ECU; the present invention distributes the whole vehicle key by using the IVI, and the IVI is responsible for maintaining the key status of all ECUs in the vehicle and performing operations such as distribution, updating, and revocation; the requirements for the whole vehicle key are met, and flexible and efficient key management is achieved through unified technical specifications.

Description

Technical Field

[0001] The present invention belongs to the technical field of vehicle key distribution management, and in particular relates to a key management method and system for whole vehicle key distribution. Background Art

[0002] The ECUs in the vehicle communicate through the CAN bus. In order to ensure the security of CAN communication in the vehicle, a symmetric key needs to be generated as a session key. The industry usually uses a unified preset symmetric key to achieve secure communication between ECUs. The required keys of the vehicle are preset in the production line tool, and then the production line tool is used on the vehicle production line to communicate with each ECU of the vehicle and burn the key into each ECU. Since each ECU is designed and produced by different suppliers, the hardware security capabilities and operating environments vary greatly. The hardware capabilities of each ECU in the vehicle are different, and some do not have a hardware encryption module to store keys, which will have the risk of key leakage. With the development of intelligent connected vehicles and the increase in Internet of Vehicles services, including remote control of vehicles, remote upgrades, security diagnosis, secure startup, digital keys, external device access authentication, in-vehicle communication security, application signatures, vehicle-to-cloud communications, data encryption, identity authentication and other scenarios all require security services based on the certificate key system. Once the unified preset symmetric key is leaked, secure communication cannot be effectively guaranteed; and the current key distribution method can only realize the burning of the same key for all vehicles, and it is impossible to achieve one machine and one key. Summary of the invention

[0003] In order to ensure the key requirements of each component of the vehicle, and further meet the encryption, signature verification and authentication requirements of all Internet of Vehicles services, including remote vehicle control, remote upgrade, safety diagnosis, safety startup, digital key, external device access authentication, in-vehicle safety communication, etc., the present invention proposes a key management method and system for vehicle key distribution.

[0004] A key management method for whole vehicle key distribution that achieves one of the purposes of the present invention includes: in the production line electrical inspection link of the vehicle, applying for the global unique key of the IVI and each ECU and issuing it to the IVI and each ECU; after the vehicle is powered on, the key is updated or deleted according to the key status of the key of the IVI and each ECU; the key status includes whether the key has expired or has been revoked in the cloud; the IVI is In-Vehicle Infotainment, an in-vehicle infotainment system; the production line electrical inspection link is to use electrical inspection equipment (EOL) on the production line to perform vehicle software configuration and electronic and electrical testing; the EOL device periodically requests the device for the issuance status of the certificate, whether the issuance is successful; if the certificate is not issued successfully, the EOL displays an alarm to prompt the user that the key application failed.

[0005] Furthermore, the application method for the globally unique key includes: in the electrical inspection link of the vehicle production line, the VIN (Vehicle Identification Number) triggers the application for the whole vehicle key; after the IVI receives the whole vehicle key application request, it loops through the key status table of the whole vehicle and applies for the key from the cloud; if the application fails, the failure type is recorded and fed back to the EOL (End of Line) device; if the application is successful, the corresponding distribution is carried out according to the returned key number; that is, if it is determined to be a gateway key, it is stored in the IVI, and if it is an ECU key, it is distributed to the corresponding ECU; the key status table is stored in the non-volatile memory mounted on the IVI device.

[0006] The key status table includes the key number, the name of the key and / or certificate, the source of the key and / or certificate, the level of the key and / or certificate, the number of keys, the issuance time, the duration and the issuance status.

[0007] When applying for a key, use the device's PIN code as an identifier to ensure that each key is globally unique.

[0008] Furthermore, the method for updating the key according to the key status of each ECU includes:

[0009] When the vehicle is powered on, the key status table is traversed in a loop, and the key of the IVI and / or each ECU is determined to be expired according to the duration, issuance time and current time in the key status table; if expired, a key is requested from the cloud; the cloud creates a globally unique key based on the unique identification of each vehicle and sends it to the IVI; the IVI verifies the received key, and after successful verification, the key is issued or stored accordingly according to the key number; that is, if it is a gateway key, it is stored in the IVI, and if it is a non-gateway key, that is, an ECU key, it is distributed to the corresponding ECU.

[0010] Furthermore, the cloud records the key distribution results and logs for each time, which can be used in the background to query the key distribution results of each vehicle.

[0011] Furthermore, the method for deleting the key according to the key status of each ECU includes:

[0012] When the device is powered on, IVI traverses the key status table and queries whether the key corresponding to each key number in the key status table has been revoked in the cloud; if it has been revoked, delete the key corresponding to the vehicle and delete all information corresponding to the key number in the key status table; notify the cloud to terminate the relationship between the key and the vehicle.

[0013] Furthermore, the key status table includes: key number, key name, key source, key level, key quantity, key issuance time, key duration, key issuance status; the key source refers to whether the key is PKI or KMS。

[0014] A key management system for whole-vehicle key distribution to achieve the second purpose of the present invention includes a security platform module and a whole-vehicle key management module; the security platform module is used to communicate with the cloud and forward key application requests from the whole-vehicle key management module; the whole-vehicle key management module is used to manage vehicle-side keys, including key application, update and deletion, and checking key status.

[0015] Furthermore, the security platform module establishes communication with the cloud based on a preset universal certificate, generates a vehicle certificate, and uses the vehicle certificate to establish a two-way authenticated communication link with the cloud.

[0016] Furthermore, the vehicle key management module includes a key update module, which is used to determine whether the key of the IVI and / or each ECU is expired according to the duration, issuance time and current time in the key status table; if expired, apply for the key from the cloud; the cloud generates a globally unique key based on the unique identifier of each vehicle and sends it to the IVI and / or each ECU.

[0017] Furthermore, the vehicle key management module includes a key deletion module, which is used to query whether the key corresponding to each key number in the key status table has been revoked in the cloud; if it has been revoked, the key corresponding to the vehicle side is deleted and all information corresponding to the key number in the key status table is deleted, and the cloud cancels the relationship between the key and the vehicle.

[0018] The present invention utilizes IVI to distribute the whole vehicle key, and the IVI is responsible for maintaining the key status of all ECUs in the vehicle and performing operations such as distribution, update, and revocation; the demand for the whole vehicle key is met, and through unified technical specifications, flexible and efficient key management is achieved. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] Figure 1 It is a schematic diagram of the architecture of the present invention;

[0020] Figure 2 It is a schematic diagram of the key application process of the present invention;

[0021] Figure 3 It is a schematic diagram of the key update process of the present invention;

[0022] Figure 4 It is a schematic diagram of the process of deleting the key described in the present invention. DETAILED DESCRIPTION

[0023] The following specific implementations are used to explain the technical solutions of the claims of the present invention so that those skilled in the art can understand the claims. The protection scope of the present invention is not limited to the following specific implementation structures. The technical solutions of the claims of the present invention made by those skilled in the art but different from the following specific implementations are also within the protection scope of the present invention.

[0024] The present invention pre-installs the functions that should be implemented by the production line tool of vehicle key distribution in the form of a vehicle key management module in IVI. IVI is responsible for maintaining the key status of all ECUs in the vehicle and performing operations such as distribution, update, and revocation. The architecture is as follows: Figure 1 As shown in the figure, the vehicle-side SDK of the safety platform in IVI is responsible for completing the following functions:

[0025] (1) Call the security platform vehicle-side SDK and establish communication with the cloud in combination with the pre-set universal certificate to generate a unique device certificate for the controller;

[0026] (2) Use the device's unique certificate to establish a secure two-way authenticated TLS1.2 communication link with the cloud;

[0027] (3) Forward the key application request of the vehicle key management module.

[0028] The vehicle key management module in IVI is responsible for completing the following functions:

[0029] (1) Apply for keys from the cloud and send them to each ECU, and communicate with the ECU using the in-vehicle CAN network;

[0030] (2) Check the key status every time the power is turned on, and apply for keys that are missing or about to expire;

[0031] (3) Check the key status every time the power is turned on, and delete the revoked keys on the vehicle side;

[0032] (4) After-sales replacement triggers key application.

[0033] During the electrical inspection of the vehicle production line, a globally unique key for the IVI and each ECU is applied for and sent to the IVI and each ECU; after the vehicle is powered on, the key is updated or deleted according to the key status of the IVI and each ECU; the key status includes whether the key has expired or has been revoked in the cloud; the IVI is the In-Vehicle Infotainment, the in-vehicle infotainment system.

[0034] Specifically, Figure 2 As shown, during the production line electrical inspection, the IVI dynamically applies for the key and distributes it to each ECU in the vehicle. The steps are as follows:

[0035] (1) During the electrical inspection of the vehicle production line, the VIN injection command triggers the application of the vehicle key;

[0036] (2) After receiving the key application request, the IVI traverses the key status table shown in Table 1 below and applies for the key. When applying for the key, the device's PIN code is used as an identifier to ensure that each key is globally unique. Each vehicle corresponds to a key status table.

[0037]

[0038] Table 1 Key status table

[0039] If the key application fails, the failure type is recorded and returned to the EOL device when the EOL device polls for the application result;

[0040] If the key application is successful, the returned key number is used to determine whether it is a gateway key or a key of another ECU. If the key applied for is a gateway key, it is stored in the IVI; if the key applied for is a key of another ECU, it is distributed to the ECU.

[0041] When the key is stored, in order to ensure the integrity of the key, the key needs to be hash-checked. If the check fails, the failure type is recorded and returned to the EOL device when waiting for the EOL device to poll the application result.

[0042] After the key is stored or distributed successfully, the key status is updated and the cloud is notified to record the distribution results and logs;

[0043] When EOL polls, the key distribution result is fed back to EOL.

[0044] like Figure 3 The following is a scenario of key update, and the basic process is summarized as follows:

[0045] (1) When the IVI device is powered on, the expiration check of the vehicle key is triggered;

[0046] (2) IVI loops through all key status tables of the vehicle to check whether the key is about to expire. The threshold for determining whether the key is about to expire is configurable;

[0047] (3) If the IVI device certificate is about to expire, trigger the key application;

[0048] (4) After the key application is successful, if the application is for a gateway key or gateway device certificate, it is stored in IVI;

[0049] (5) If the application is for other ECU keys, distribute them to the ECUs;

[0050] (6) After successful storage or distribution, the key status is updated to notify the cloud of the relationship between the binding key and the vehicle.

[0051] like Figure 4 The following is a scenario of key deletion. Every time the vehicle starts, it checks the key status in the cloud. If the key has been revoked, the local key is deleted. The basic process is summarized as follows:

[0052] (1) When the IVI device is powered on, a check is triggered to see if the vehicle key is revoked;

[0053] (2) IVI loops through all key status tables of the vehicle and queries the cloud to see if the key has been revoked.

[0054] (3) If it has been revoked, determine whether the key to be deleted is a gateway key; if the key to be deleted is a gateway key, notify the IVI to delete it; if the key to be deleted is another ECU key, notify the ECU to delete it;

[0055] (4) After successful deletion, the key status is updated and the cloud is notified to unbind the relationship between the key and the vehicle.

[0056] The embodiment of the present application also provides an embodiment of a key distribution process.

[0057] Step 1: After the vehicle is powered on, the IVI uses a hash algorithm to generate a local session key SK1 on the end and temporarily stores it in the security chip. The local session key SK1 is used to verify the key A sent to the ECU in the subsequent process. The method for generating the local session key SK1 in this embodiment is as follows:

[0058] SK1=LOW16_BIT[HMAC[KEY,random_B]]

[0059] Where:

[0060] LOW16_BIT means taking the lower 16 bits of the result value [HMAC[KEY,random_B];

[0061] HMAC[KEY, random_B] indicates that a 256-bit hash value is generated according to the preset symmetric key KEY and the random number random_B, and is usually expressed in hexadecimal.

[0062] Step 2: Encrypt key A, fresh value, and message MAC according to the preset symmetric key KEY, generate ciphertext data and broadcast it on the CAN network with a period of 100ms, and the maximum broadcast time shall not exceed 2s;

[0063] Step 3: After receiving the above ciphertext data, the ECU or IVI uses the preset symmetric key KEY to decrypt the data and obtain the key, and verify the correctness of the MAC and message freshness value;

[0064] When the ECU or IVI verifies that the decrypted data is valid, it takes out the key, which is set as key B here. Since it cannot be guaranteed that there is no abnormality in the distribution process and whether the key value has been illegally tampered with, the correctness of the key needs to be verified. The ECU or IVI uses a hash algorithm to generate the local session key SK2 of this end, encrypts the parsed key B with the local session key SK2, and responds with the ciphertext data (TOKEN) using their respective CAN ID nodes. After the IVI receives the ciphertext data (TOKEN) returned by the CAN ID node of the corresponding ECU, it uses the local session key SK1 to decrypt the key, which is set as C here, and compares whether key C is consistent with the sent key A. If they are consistent, the key distribution is considered successful.

[0065] If the IVI receives responses from all ECUs and the parsing is correct, it stops sending key distribution messages.

[0066] In this embodiment, the method for generating the local session key SK2 includes:

[0067] SK2=LOW16_BIT[HMAC[KEY,random_A]]

[0068] Where:

[0069] LOW16_BIT means taking the lower 16 bits of the result value HMAC[KEY,random_A];

[0070] HMAC[KEY,random_B] means generating a 256-bit hash value based on the preset symmetric key KEY and the random number random_A, usually expressed in hexadecimal;

[0071] KEY is the preset symmetric key.

[0072] It should be understood that the size of the serial numbers of the steps in the above embodiments does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0073] An embodiment of the present application also provides a key management system for vehicle-wide key distribution, including a security platform module and a vehicle-wide key management module; the security platform module is used to communicate with the cloud and forward key application requests from the vehicle-wide key management module; the vehicle-wide key management module is used to manage vehicle-side keys, including key application, update and deletion, and checking key status.

[0074] The security platform module establishes communication with the cloud based on a preset universal certificate, generates a vehicle certificate, and uses the vehicle certificate to establish a two-way authenticated communication link with the cloud.

[0075] In another embodiment, the vehicle key management module includes a key update module, which is used to determine whether the key of the IVI and / or each ECU is expired according to the duration, issuance time and current time in the key status table; if expired, apply for the key from the cloud; the cloud generates a globally unique key based on the unique identifier of each vehicle and sends it to the IVI.

[0076] In another embodiment, the vehicle key management module includes a key deletion module, which is used to query whether the key corresponding to each key number in the key status table has been revoked in the cloud; if it has been revoked, the key corresponding to the vehicle side is deleted and all information corresponding to the key number in the key status table is deleted, and the cloud cancels the relationship between the key and the vehicle.

[0077] The contents not described in detail in this specification belong to the prior art known to professional and technical personnel in this field.

Claims

1. A key management method for vehicle key distribution, characterized in that: During the vehicle production line electrical inspection, apply for the global unique key of IVI and each ECU and send it to IVI and each ECU; After the vehicle is powered on, the key is updated or deleted according to the key status of the IVI and each ECU's key; The application method of the global unique key includes: in the electrical inspection link of the vehicle production line, the VIN triggers the application of the vehicle key; after the IVI receives the vehicle key application request, it traverses the key status table of the vehicle and applies for the key from the cloud; if the application fails, the failure type is recorded and fed back to the EOL device; if the application is successful, the corresponding distribution is carried out according to the returned key number; that is, if it is judged to be a gateway key, the key is stored in the IVI, and if it is judged to be an ECU key, it is distributed to the corresponding ECU; The method of updating the key according to the key status of each ECU includes: When the vehicle is powered on, the key status table is traversed, and the key of the IVI and / or each ECU is determined to be expired according to the duration, issuance time and current time in the key status table; if expired, the key is requested from the cloud; the cloud generates a globally unique key based on the unique identification of each vehicle and sends it to the IVI; the IVI verifies the received key, and after successful verification, the key is issued and / or stored accordingly according to the key number; Methods for deleting keys according to the key status of each ECU include: When the vehicle is powered on, the IVI traverses the key status table and queries whether the key corresponding to each key number in the key status table has been revoked in the cloud; if it has been revoked, the key corresponding to the vehicle is deleted and all information corresponding to the key number in the key status table is deleted, and the cloud cancels the relationship between the key and the vehicle.

2. The key management method for vehicle key distribution according to claim 1, characterized in that: The key status table includes: key number, key name, key source, key level, key quantity, key issuance time, key duration, and key issuance status.

3. A key management system for vehicle key distribution based on the method of claim 1, characterized in that: It includes a security platform module and a vehicle key management module; the security platform module is used to communicate with the cloud and forward the key application request of the vehicle key management module; the vehicle key management module is used to manage the vehicle-side keys, including key application, update and deletion and checking the key status.

4. The key management system for vehicle key distribution according to claim 3, characterized in that: The security platform module establishes communication with the cloud based on a preset universal certificate, generates a vehicle certificate, and uses the vehicle certificate to establish a two-way authenticated communication link with the cloud.

5. The key management system for vehicle key distribution according to claim 3, characterized in that: The vehicle key management module includes a key application module, which is used to determine whether the key of the IVI and / or each ECU is expired according to the duration, issuance time and current time in the key status table; if expired, apply for the key from the cloud through the security platform module; the cloud creates a global unique key according to the unique identification of each vehicle and sends it to the IVI and / or ECU; the IVI and / or ECU verifies the received key, and after successful verification, the key is issued or stored accordingly according to the key number.

6. The key management system for vehicle key distribution according to claim 3, characterized in that: The vehicle key management module includes a key update module, which is used to determine whether the key of the IVI and / or each ECU is expired according to the duration, issuance time and current time in the key status table; if expired, apply for the key from the cloud; the cloud generates a global unique key according to the unique identifier of each vehicle and sends it to the IVI.

7. The key management system for vehicle key distribution according to claim 3, characterized in that: The vehicle key management module includes a key deletion module, which is used to query whether the key corresponding to each key number in the key status table has been revoked in the cloud; if it has been revoked, the key corresponding to the vehicle end is deleted and all information corresponding to the key number in the key status table is deleted, and the cloud cancels the relationship between the key and the vehicle.

Images