A Fine-Grained Permission Control Method and System for Digital Keys Based on Digital Certificates

Abstract

The present invention discloses a fine-grained permission control method for digital keys based on digital certificates. The control permissions of the device end are subdivided, code bits are defined for each subdivided device control permission, and they are mapped into byte bits to form a device end control permission coding mapping table. The following extension items are added to the digital certificate bound to the digital key: a device end control permission code bit table indicating the device end control permissions explicitly granted to the digital key; the effective time of the device end control permission; the expiration time of the device end control permission. When verifying the control permission, first check the legal validity of the digital certificate itself, then check whether the current time is within the interval between the effective time and the expiration time of the device end control permission, and then decode the device end control permission code bit table to confirm whether the digital key can use specific device end control permissions. The present invention also discloses a fine-grained permission control system for digital keys based on digital certificates.

Description

Technical Field

[0001] The present invention belongs to the technical field of vehicle control, and particularly relates to a method for fine-grained permission control of a digital vehicle key based on off-line verification of a digital certificate. Background Art

[0002] As an important function of intelligent connected vehicles, a digital vehicle key (or "automobile digital key") integrates the vehicle key function into a mobile terminal device. Based on security technologies such as SE and TEE, through communication technologies such as near-field communication, Bluetooth, cellular communication, and ultra-wideband, symmetric key and asymmetric key technologies are used to authenticate vehicle users to complete functions such as opening the vehicle door, starting the vehicle, and driving records. A digital vehicle key based on a digital certificate can balance the security and convenience of the digital vehicle key.

[0003] With the development of vehicle intelligence and the continuous expansion of vehicle usage scenarios, when a vehicle owner (the owner of a motor vehicle, i.e., the car owner) authorizes a digital vehicle key to a vehicle user (such as a driver, a freight carrier, etc.), it may be desirable to limit the scope of use permissions of the vehicle by the vehicle user. For example, in order to trace possible malicious damage to the vehicle by the vehicle user, the car owner hopes to keep the in-cabin recording and video equipment working continuously and prohibit the vehicle user from turning off the in-cabin recording and video equipment to normally record the vehicle usage process. Another example is that when using the vehicle as a temporary storage place for items for contactless item handover, the car owner hopes that the item handover person can only open and close the trunk door within a short period of time, and cannot open other vehicle doors, or start the vehicle, or turn off the in-cabin recording and video equipment, etc.

[0004] In order to achieve the purpose of finely controlling the scope of use permissions of the digital vehicle key for the vehicle, the vehicle can rely on the cloud-based vehicle enterprise platform to verify the permission scope information of the digital vehicle key in real time. However, when the vehicle is located in places with poor or no network signals, such as underground parking lots, tunnels, and remote areas, it is difficult to effectively verify the permission scope of the digital vehicle key. Summary of the Invention

[0005] In view of the above technical problems, the present invention discloses a method and system for fine-grained permission control of a digital key based on a digital certificate, enabling the device side to open specified control permissions to the device user in an off-line state and disable other specific control permissions.

[0006] To achieve the above object, the technical solution adopted by the present invention is: a method for fine-grained permission control of a digital key based on a digital certificate, in which fine-grained key permission control information is embedded in the digital certificate, which means digital signature endorsement and can be used as indisputable legal evidence.

[0007] Subdivide the control permissions of the device end, define code positions for each subdivided device control permission, and map them to byte positions to form a device end control permission encoding mapping table, which serves as a reference for setting the values of the vehicle control permissions that can be explicitly granted.

[0008] In the digital certificate system of the digital key, add a permission encoding and decoding mechanism, and add the following extension items to the digital certificate bound to the digital key, which respectively represent the permissions granted by the digital certificate and their validity periods:

[0009] 1) The device end control permission code position table, indicating the device end control permissions explicitly granted to the digital key;

[0010] 2) The effective time of the device end control permission;

[0011] 3) The expiration time of the device end control permission;

[0012] When verifying the control permission, first check the legal validity of the digital certificate itself, then check whether the current time is within the effective time and expiration time range of the device end control permission, and then decode the device end control permission code position table to confirm whether the digital key can use specific device end control permissions.

[0013] Furthermore, for the device end control permissions not defined in the device end control permission encoding mapping table, or the device end control permissions not granted in the device end control permission code position table bound to the digital key of the digital key, the device end processes them according to the default authorization status.

[0014] Furthermore, for the device end control permission code position table, its encoding order counts incrementally starting from the high bit or starting from the low bit.

[0015] The present invention also discloses a digital key fine-grained permission control system based on digital certificates. The server end and the device end deploy a device end control permission encoding mapping table. The device end control permission encoding mapping table is: subdivide the control permissions of the device end, define code positions for each subdivided device control permission, and map them to byte positions;

[0016] The server end deploys a digital key platform, a device control permission encoder, and a digital certificate authentication system to issue a digital certificate with a device end control permission code position table to the using terminal; the device control permission encoder generates a device end control permission code position table according to the device end control permission encoding mapping table; the digital certificate authentication system generates a digital certificate including the device end control permission code position table; the digital key platform distributes the digital certificate to the using terminal;

[0017] The device - side deployment decodes the device control permission code bit table of the device control permission decoder according to the device - side control permission coding mapping table, a digital key authentication system capable of verifying the validity of digital certificates, and a digital key authentication system for determining whether the use terminal can execute specific control permissions;

[0018] The use terminal issues a digital certificate that can store the digital certificate sent by the server - side and communicates with the device - side.

[0019] Another aspect of the present invention discloses a method for issuing fine - grained permissions of a digital key based on digital certificates:

[0020] The control permissions of the device are subdivided, a code bit is defined for each subdivided device - side control permission, and it is mapped into byte bits to generate a device - side control permission coding mapping table;

[0021] The digital key platform receives the authorization message of the device control permission. The device control permission encoder encodes the authorization message of the device control permission according to the device - side control permission coding mapping table to generate a device - side control permission code bit table and returns it to the digital key platform;

[0022] Generate a digital certificate including the device - side control permission code bit table through the digital certificate authentication system, and the digital key platform issues the digital certificate to the use terminal.

[0023] Further, the method for generating a digital certificate including the device - side control permission code bit table is:

[0024] Add the following extension items to the digital certificate bound to the digital key:

[0025] 1) The device - side control permission code bit table, indicating the device - side control permissions explicitly granted to the digital key;

[0026] 2) The effective time of the device - side control permission;

[0027] 3) The expiration time of the device - side control permission;

[0028] In the device - side control permission code bit table, when the code bit value is 1, it means that the device control permission corresponding to the code bit in the device - side control permission coding mapping table is granted; when the code bit value is 0, it means it is disabled.

[0029] Another aspect of the present invention discloses a method for verifying fine - grained permissions of a digital key based on digital certificates:

[0030] The use terminal sends a digital certificate with the device - side control permission code bit table to the device - side, requesting to execute specific control permissions;

[0031] The device extracts the device - side control permission code bit table from the digital certificate, and the device control permission decoder decodes the device - side control permission code bit table according to the device - side control permission coding mapping table. If the digital key authentication system determines that the specific control permission that the using terminal has the right to execute, the device responds with a specific control operation result.

[0032] Further, after the device receives the digital certificate, first, the digital key authentication system checks the legal validity of the digital certificate itself, then checks whether the current time is within the effective time and expiration time range of the device - side control permission. Then, the device control permission decoder decodes the device - side control permission code bit table and maps it to the corresponding device control permission table. The digital key authentication system determines whether there is a specific control permission in the device control permission table that the using terminal applies to execute.

[0033] Further, for the device - side control permissions not defined in the device - side control permission coding mapping table, or the device - side control permissions not granted in the device - side control permission code bit table bound in the digital key digital certificate, the device processes them according to the default authorization status.

[0034] The present invention has the following beneficial effects: The technical solution of the present invention enables the device, in an offline situation, to verify the legal validity of the digital certificate bound to the digital key, and on this basis, verify the information and validity period of the device - side control permission code bit table defined in the extension item of the digital certificate, so as to grant the corresponding device control permissions to the digital key holder. Description of the Drawings

[0035] Figure 1 It is the vehicle control permission coding mapping table of the digital key fine - grained permission control method based on digital certificate according to the embodiment of the present invention.

[0036] Figure 2 It is the vehicle control permission code bit table of the digital key fine - grained permission control method based on digital certificate according to the embodiment of the present invention.

[0037] Figure 3 It is the system architecture diagram of the digital key fine - grained permission control based on digital certificate according to the embodiment of the present invention.

[0038] Figure 4 It is the flowchart of the issuing method of the digital key fine - grained permission based on digital certificate according to the embodiment of the present invention.

[0039] Figure 5 It is the flowchart of the verification method of the digital key fine - grained permission based on digital certificate according to the embodiment of the present invention. Detailed Embodiment

[0040] For the convenience of those skilled in the art to understand, the present invention will be further described below in conjunction with the embodiments and the drawings.

[0041] In the digital certificate system of the digital car key, the method of this embodiment adds a vehicle key permission encoding and decoding mechanism, which finely divides and defines the control permissions of the vehicle (device side), and adds three extension items to the digital certificate bound to the digital car key, respectively representing the permissions granted by the digital certificate and their validity periods:

[0042] (1) CPE: Car Priveleges Enabled, a table of vehicle control permission bits (bits). That is, the vehicle control rights that the vehicle key permission management system explicitly grants the digital car key to use, as well as the vehicle control rights that are explicitly disabled.

[0043] (2) CPENB: Car Priveleges Enabled Not Before, the effective time of the explicitly granted vehicle control permission.

[0044] (3) CPENA: Car Priveleges Enabled Not After, the expiration time of the explicitly granted vehicle control permission.

[0045] As shown in the bold content in the following figure:

[0046]

[0047] First, the control permissions of the vehicle are subdivided, and the subdivision granularity should be such that the function can be independently controlled. For example, the control permissions of a vehicle can be subdivided into the following small items:

[0048] Open the left front door

[0049] Open the right front door

[0050] Open the left rear door

[0051] Open the right rear door

[0052] Open the trunk door

[0053] Start the vehicle

[0054] View the historical data of the in-vehicle driving recorder

[0055] View the historical data of the out-of-vehicle driving recorder

[0056] Turn off the in-vehicle driving recorder

[0057] Turn off the external driving recorder

[0058] Retrieve vehicle sensitive information (VIN code, etc.)

[0059] ……

[0060] Then, define code positions for each subdivided vehicle control right and map them into byte positions (either incrementing the count starting from the high bit or starting from the low bit), which serves as a reference for setting the values of the explicitly disabled vehicle control permission list, and is called the "Vehicle Control Permission Coding Mapping Table". Taking the "Vehicle Control Permission Coding Mapping Table" with incrementing count starting from the low bit as an example, the above vehicle control permission items can define their respective code positions in sequence. As Figure 1 shown

[0061] When the digital key system grants the following permission constraints for a certain digital key:

[0062]

[0063] Then, the values of each code position in the explicitly granted vehicle control permission list (CPE) are as follows Figure 2 shown (a code position with a value of 1 indicates being granted, while a code position with a value of 0 indicates being disabled).

[0064] In this way, when the digital key system grants the specified permission constraints for a specific digital key, the vehicle, on the basis of checking the legal validity of the digital certificate of the digital key itself, checks whether the current time is within the effective time and expiration time interval of the vehicle control permission, and then decodes the "Vehicle Control Permission Code Position Table" bound in the digital certificate of the digital key to confirm whether the digital key can use specific vehicle control functions.

[0065] In addition, for those vehicle control permissions not defined in the "Vehicle Control Permission Coding Mapping Table" or not indicated in the "Vehicle Control Right Code Position Table" bound in the digital certificate of the digital key, the vehicle can be processed according to the default authorization status set for the whole vehicle.

[0066] To use the above-designed "Vehicle Control Right Code Position Table", as follows Figure 3As shown, the vehicle enterprise platform (server side) first formulates a "Vehicle Control Permission Coding Mapping Table" and synchronizes it to the vehicle. The vehicle enterprise platform deploys a "Digital Vehicle Key Platform", a "Vehicle Control Permission Encoder", and a "Digital Certificate Authentication System" to issue a digital certificate containing a "Vehicle Control Permission Bit Table" to the terminal device (usage terminal) of the vehicle user. The vehicle side deploys an "On-vehicle Digital Key Authentication, Authorization, and Control System" and a "Vehicle Control Permission Decoder" to verify the validity of the digital certificate and the information of the "Vehicle Control Permission Bit Table" it contains, and determine whether the terminal device of the vehicle user can execute specific vehicle control permissions.

[0067] Thus, when it is necessary to issue a digital certificate bound to a digital vehicle key with specific vehicle control permission authorization information for a specific vehicle user, the process is as follows Figure 4 as shown:

[0068] After the digital vehicle key platform determines the authorization message for vehicle control permissions, the vehicle control permission encoder generates a "Vehicle Control Permission Bit Table" according to the authorization message and the "Vehicle Control Permission Coding Mapping Table", and returns it to the digital vehicle key platform. The digital vehicle key platform generates a digital certificate including the "Vehicle Control Permission Bit Table" through the digital certificate authentication system, and issues the digital certificate to the terminal device of the vehicle user. The terminal device of the vehicle user sends a receipt to the digital vehicle key platform.

[0069] When the vehicle needs to verify the specific vehicle control permission authorization information contained in the digital certificate bound to the digital vehicle key held by a specific vehicle user, the process is as follows Figure 5 as shown:

[0070] The terminal device of the vehicle user sends a digital certificate with a "Vehicle Control Permission Bit Table" to the vehicle, requesting to execute specific control permissions. The vehicle extracts the "Vehicle Control Permission Bit Table" from the digital certificate. The vehicle control permission decoder maps it to the corresponding vehicle control permission table according to the "Vehicle Control Permission Coding Mapping Table". If there is a specific control permission applied by the terminal device of the vehicle user in the vehicle control permission table, the vehicle responds with a specific control operation result.

[0071] The above embodiments are only used to illustrate the technical idea of the present invention, and the protection scope of the present invention cannot be limited thereby. Any changes made on the basis of the technical solution according to the technical idea proposed by the present invention fall within the protection scope of the present invention.

Claims

1. A fine-grained permission control method for digital keys based on digital certificates, characterized in that: The control permissions of the device end are subdivided, a code bit is defined for each subdivided device control permission, and it is mapped into a byte bit to form a device end control permission coding mapping table; The following extension items are added to the digital certificate bound to the digital key: A device end control permission code bit table indicating the device end control permissions explicitly granted to the digital key; The effective time of the device end control permission; The expiration time of the device end control permission; When verifying the control permissions of the digital key, first check the legal validity of the digital certificate it is bound to, then check whether the current time is within the effective time and expiration time range of the device end control permission, and then decode the device end control permission code bit table to confirm whether the digital key can use specific device end control permissions.

2. The fine-grained permission control method for digital keys based on digital certificates according to claim 1, characterized in that: For device end control permissions not defined in the device end control permission coding mapping table, or device end control permissions not granted in the device end control permission code bit table bound to the digital key digital certificate, the device end processes them according to the default authorization status.

3. The fine-grained permission control method for digital keys based on digital certificates according to claim 1, characterized in that: The device end control permission code bit table, the encoding order bit counts incrementally starting from the high bit or starting from the low bit.

4. A fine-grained permission control system for digital keys based on digital certificates, characterized in that: The device end control permission coding mapping table is deployed on the server side and the device end. The device end control permission coding mapping table is: the control permissions of the device end are subdivided, a code bit is defined for each subdivided device control permission, and it is mapped into a byte bit; The server side deploys a digital key platform, a device control permission encoder, and a digital certificate authentication system to issue digital certificates with a device end control permission code bit table to the using terminal; The device control permission encoder generates a device end control permission code bit table according to the device end control permission coding mapping table; The digital certificate authentication system generates a digital certificate including the device end control permission code bit table; The digital key platform issues the digital certificate to the using terminal; In the digital certificate system of the digital key, a permission encoding and decoding mechanism is added, and the following extension items are added to the digital certificate bound to the digital key, respectively representing the permissions granted by the digital certificate and their validity periods: A device end control permission code bit table indicating the device end control permissions explicitly granted to the digital key; The effective time of the device end control permission; The expiration time of the device end control permission; The device end deploys a device control permission decoder that decodes the device end control permission code bit table according to the device end control permission coding mapping table, a digital key authentication system that can verify the validity of the digital certificate, and a digital key authorization system that determines whether the using terminal can execute specific control permissions; The using terminal issues a digital certificate that can store the digital certificate sent by the server side and communicate with the device end.

5. A method for issuing fine-grained permissions of digital keys based on digital certificates, characterized in that: Subdivide the control rights of the device, define code positions for each subdivided device-side control right, and map them into byte positions to generate a device-side control right encoding mapping table; The digital key platform receives the authorization message of the device control right. The device control right encoder encodes the authorization message of the device control right according to the device-side control right encoding mapping table to generate a device-side control right code position table, and returns it to the digital key platform; Generate a digital certificate including the device-side control right code position table through the digital certificate authentication system, and the digital key platform issues the digital certificate to the usage terminal; In the digital certificate system of the digital key, add a permission encoding and decoding mechanism, and add the following extension items to the digital certificate bound to the digital key, which respectively represent the permissions granted by the digital certificate and their validity periods: The device-side control right code position table, indicating the device-side control rights explicitly granted to the digital key; The effective time of the device-side control right; The expiration time of the device-side control right.

6. The method for issuing fine-grained permissions of a digital key based on a digital certificate according to claim 5, wherein In the device-side control right code position table, if the code position value is 1, it means that the device control right corresponding to the code position in the device-side control right encoding mapping table is granted; if the code position value is 0, it means that it is disabled.

7. A verification method for fine-grained permissions of digital keys based on digital certificates, characterized in that: Execute the method for issuing the fine-grained permissions of the digital key based on the digital certificate according to claim 5 or 6, and the usage terminal obtains the digital certificate of the device-side control right code position table; The usage terminal sends the digital certificate with the device-side control right code position table to the device-side and requests to execute specific control rights; The device-side extracts the device-side control right code position table in the digital certificate, and the device control right decoder decodes the device-side control right code position table according to the device-side control right encoding mapping table. The digital key authentication system judges that if the usage terminal has the right to execute specific control rights, the device-side responds with the result of the specific control operation.

8. The method for verifying the fine-grained permissions of the digital key based on the digital certificate according to claim 7, wherein: After receiving the digital certificate, the device-side first checks the legal validity of the digital certificate itself by the digital key authentication system, then checks whether the current time is within the interval of the effective time and the expiration time of the device-side control right, and then the device control right decoder decodes the device-side control right code position table and maps it into the corresponding device control right table. The digital key authentication system judges whether there is a specific control right applied by the usage terminal in the device control right table.

9. The method for verifying the fine-grained permissions of the digital key based on the digital certificate according to claim 8, wherein: For the device-side control rights not defined in the device-side control right encoding mapping table, or the device-side control rights not granted in the device-side control right code position table bound in the digital key digital certificate, the device-side processes them according to the default authorization status.

Images