A method and system for authenticating a vehicle user based on a digital key

Abstract

The application discloses a kind of based on digital key's vehicle user's identity authentication method and system.According to the information of vehicle and vehicle user, digital key is generated and downloaded to the software of mobile terminal equipment of vehicle user;The software of mobile terminal equipment of vehicle user carries out analysis to the digital key selected by user and obtains analysis data, obtains the connection information of vehicle from analysis data, and according to the connection information, data pairing is carried out between user mobile terminal equipment and vehicle;After pairing successfully, the identity of vehicle user is authenticated using the digital key, and after authentication, it indicates that the identity authentication of vehicle user is successful;In the application, digital key is associated with vehicle information and user information, when any field of vehicle and user information changes, identity authentication does not pass, and the security of digital key is increased;Multiple keys stored in different security chips are used to generate digital key, which greatly reduces the risk of key leakage.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of vehicle safety communication, and particularly relates to a vehicle user identity authentication method and system based on a digital key. BACKGROUND

[0002] With the development of intelligent networked vehicles, the types of vehicle networking services are also increasing, including remote vehicle control, remote upgrade, safety diagnosis, safety start, vehicle cloud communication and the like. However, the vehicle communication security problem is also brought. In order to protect the safety of CAN communication in the vehicle, a symmetric key is generated as a session key to protect the communication security. However, in addition to communication security, the authentication of the vehicle user identity is also crucial. Once the vehicle system is invaded by an illegal user, a series of problems such as information leakage and driving safety will be caused. The current vehicle user identity recognition is to authenticate the user information after simple encryption. The best way to encrypt the user information key is to use random numbers, because the key needs to have the property of not being easy to be guessed. In possible cases, hardware devices that can generate cryptographic random numbers are preferably used, but in most cases, a pseudo-random number generator designed specifically for cryptographic purposes is used to generate the key. However, when using a pseudo-random number generator to generate a key, although the purpose is to generate random numbers, human bias cannot be avoided in any way, which will become the target of attackers. For example, some pseudo-random number generators can be used for games and simulation algorithms, although the sequence generated by these pseudo-random number generators looks random, but as long as it is not designed specifically for cryptographic purposes, it does not have the property of unpredictability, and therefore cannot be used to generate session keys on vehicles. The pseudo-random number generator for cryptographic purposes must be designed specifically for cryptographic purposes.

[0003] Sometimes a password or passphrase that a human being can remember is also used to generate a key. Passphrase refers to a longer password composed of multiple words. Strictly speaking, a password is rarely used directly as a key. Generally, the password is input into a one-way hash function, and the hash value obtained is used as the key. When generating a key using a password, in order to avoid dictionary attacks, a string of random numbers called salt is attached to the password, and then input into a one-way hash function. This method of generating a key is called "password-based cryptography".

[0004] However, the above methods have the following problems: using a single element to generate a key, which is easy to be cracked, and cannot achieve one key per vehicle, thereby resulting in poor key security. SUMMARY

[0005] In order to strengthen the security of vehicle communication, the application provides a digital key-based vehicle user identity authentication method and system.

[0006] A digital key-based vehicle user identity authentication method for achieving one of the purposes of the application, comprising the following steps:

[0007] S1. Generating a digital key according to the information of the vehicle and the vehicle user and downloading the digital key into the software of the mobile terminal device of the vehicle user;

[0008] S2. The software of the mobile terminal device of the vehicle user analyzes the digital key selected by the user to obtain analysis data, obtains the connection information of the vehicle from the analysis data, and pairs the mobile terminal device of the user with the vehicle according to the connection information; after successful pairing, the digital key is used for vehicle user identity authentication, and after successful authentication, it is indicated that the vehicle user identity authentication is successful.

[0009] Further, in step S1, the method for generating the Key value of the digital key comprises:

[0010] S101. Selecting n data information Info1-Info n ;

[0011] S102. Using a random number as a key to generate the first intermediate key KEY1 by using an encryption algorithm on the data information Info1;

[0012] S103. Using KEY i as a key to generate the i+1 intermediate key KEY i+1 by using an encryption algorithm on the data information Info i+1 ; i∈[1, n-1];

[0013] S104. Selecting the digital key permission data VCKINFO containing the vehicle feature information and the user feature information to perform HASH operation to obtain the HASH value DF;

[0014] S105. Using KEY n as a key to generate the digital key by using an encryption algorithm on the HASH value DF.

[0015] The vehicle feature information is the feature information that distinguishes each vehicle from other vehicles, such as the ID of the security module used by the vehicle, the unique code of the security chip of the vehicle, etc. Each data information Info i (i∈[1, n]) contains at least one or more vehicle feature information of the vehicle.

[0016] The user feature information is the feature information that distinguishes each user from other users, such as a Bluetooth address of a user mobile terminal device, a user account ID, a user mobile phone IMEI, and the like.

[0017] Further, the random number in step S102, and each intermediate key KEY1-KEY n Respectively stored in different security chips on the vehicle.

[0018] Further, in step S2, the method for authenticating the vehicle user identity by using the digital key comprises:

[0019] S201, after the pairing succeeds, the software of the mobile terminal device of the vehicle user parses the following data from the digital key: the HASH value DF, the signature value SignDF for signing the HASH value DF, and the permission data VCKINFO, and sends them to the vehicle end;

[0020] S202, the vehicle end performs signature verification on the signature value SignDF, and checks the permission data VCKINFO of the digital key; after the signature verification and the checking pass, a string S1 is selected to be encrypted to obtain encrypted data SDA1, and the encrypted data is sent to the mobile terminal device of the vehicle user;

[0021] S203, the software of the mobile terminal device of the vehicle user checks the string SDA1, and after the checking passes, a string S2 is selected to be encrypted to obtain encrypted data SDA2, which is sent to the vehicle end;

[0022] S204, the vehicle end checks the received encrypted data SDA2, and after the checking passes, the identity authentication of the vehicle user is completed.

[0023] Further, in step S202, the method for generating the encrypted data SDA1 comprises:

[0024] performing an AES encryption operation on the HASH value DF to obtain a value VCK; selecting a vehicle feature information SEID and a random number TRnd to generate a string S1; using the value VCK as an encryption key to encrypt the string S1 to obtain the encrypted data SDA1.

[0025] Further, the method for generating the encrypted data SDA2 comprises:

[0026] The software of the mobile terminal device of the vehicle user verifies the received encrypted data SDA1, and after the verification passes, parses the vehicle feature information SEID and the random number TRnd;

[0027] generating a random data CRnd, and selecting a vehicle feature information TEEID;

[0028] Combine the data of random numbers CRnd, TRnd, CRnd, and TEEID into a single string S2;

[0029] The HASH value DF is encrypted using AES to obtain a value VCK. The value VCK is used as the encryption key to encrypt the string S2 to obtain encrypted data SDA2.

[0030] Furthermore, the method for the vehicle to verify the received encrypted data SDA2 includes: using VCK to decrypt the received encrypted data SDA2 to obtain string S; parsing the vehicle feature information SEID' and random number TRnd' in string S; comparing SEID' and TRnd' with SEID and random number TRnd respectively; if they are the same, the verification is considered to have passed.

[0031] Furthermore, the digital key's permission data VCKINFO includes the digital key's request index, the target vehicle's feature information, and the target user's feature information; the target vehicle's feature information includes one or more pieces of information that distinguish the vehicle from other vehicles; the target vehicle's feature information includes one or more pieces of information that distinguish the user from other users.

[0032] Furthermore, the request index of the digital key includes a set request ID, a random number IRR, the activation time of the digital key, and the validity period of the digital key.

[0033] A second objective of this invention is a vehicle user authentication method based on a digital key, comprising a digital key generation module, a digital key parsing module, and a vehicle user authentication module.

[0034] The digital key generation module is used to generate a digital key based on information about the vehicle and its user.

[0035] The digital key parsing module is used by the software on the user's mobile device to parse the digital key selected by the user and obtain the vehicle's connection information from the parsed data;

[0036] The vehicle user identity authentication module is used to perform data pairing with the vehicle based on the vehicle connection information obtained from the digital key parsing module; to authenticate the vehicle user's identity using the digital key; and to indicate that the vehicle user's identity authentication is successful after successful authentication.

[0037] Beneficial effects:

[0038] 1. In this invention, the digital key is associated with vehicle information and user information. When any field of the vehicle or user information changes, the identity authentication fails, thus increasing the security of the digital key.

[0039] 2. The final digital key is generated using multiple keys stored in different secure chips, and the digital key cannot be generated without any key, greatly reducing the risk of key leakage. BRIEF DESCRIPTION OF DRAWINGS

[0040] Figure 1 is a flowchart of the method of the present application;

[0041] Figure 2 is a method for generating a digital key according to the present application;

[0042] Figure 3 is a flowchart of the vehicle user identity authentication according to the present application. DETAILED DESCRIPTION

[0043] The following detailed description is used to explain the technical solutions of the claims of the present application, so that those skilled in the art can understand the claims of the present application. The protection scope of the present application is not limited to the following specific implementation structure. The technical solutions of the claims of the present application which are different from the following specific implementation are also within the protection scope of the present application.

[0044] S1, generating a digital key according to the information of the vehicle and the vehicle user and downloading it into the software of the mobile terminal device of the vehicle user; in this embodiment, each data item of the digital key is shown in Table 1: including the request index of the digital key, the characteristic information of the target vehicle and the characteristic information of the target user; in this embodiment, the characteristic information of the target vehicle includes the vehicle VIN number and the vehicle Bluetooth UUID; the characteristic information of the target user includes the user phone IMEI, the user phone Bluetooth address and the user account ID; the request index of the digital key includes the set request ID, the random number IRR, the activation time of the digital key and the validity period of the digital key.

[0045]

[0046]

[0047] Table 1

[0048] The KEY value of the digital key is generated by the digital key key platform when the user applies, the digital key business system ensures the uniqueness of the digital key permission data VCKINFO, and the digital key key platform generates the digital key KEY value according to the information of the VCKINFO field and ensures that the digital key cannot be used in the case that the digital key permission data (VCKINFO) is tampered.

[0049] To achieve the above technical requirements, the digital key uses VCKINFO as the main parameter for generating the digital key key KEY value, and ensures that any modification of VCKINFO will cause the KEY value to be mismatched during the use of the digital key, resulting in authentication failure.

[0050] The Key value generation method of the digital key in this embodiment is as shown in Figure 2 The specific steps are as follows:

[0051] S101, select n data information Info1-Info n ;

[0052] In this embodiment, SE_VENDOR_ID (security module supplier ID) and SEID (security module ID) of the vehicle are selected as data information Info1-Info2; the acquisition method is: using the vehicle VIN value contained in the data key permission data VCKINFO to find the SEID of the vehicle; using the SE supplier information in the SEID to find the ID value SE_VENDOR_ID of the supplier;

[0053] S102, use a random number (in this embodiment, the group root master key GMPK shown in Figure 2 ) as the key to generate the 1st intermediate key KEY1 using the HMAC algorithm for data information Info1 (in this embodiment, SE_VENDOR_ID), KEY1 in this embodiment is VMPK shown in Figure 2 ;

[0054] S103, use KEY1 (VMPK) as the key to generate the 2nd intermediate key KEY2 using the HMAC algorithm for data information Info2, that is, the security chip master key CMPK in this embodiment;

[0055] S104, select the digital key permission data VCKINFO containing vehicle feature information and user feature information to perform HASH operation to obtain the HASH value DF;

[0056] S105, use KEY2 as the key to generate the Key value of the digital key using the HMAC encryption algorithm for the HASH value DF.

[0057] Preferably, the GMPK, VMPK, and CMPK in the above steps are respectively stored in different security chips on the vehicle, and the key is stored separately, which greatly reduces the risk of key leakage, thereby ensuring the security of the digital key.

[0058] S2, the software of the vehicle user mobile terminal device parses the digital key selected by the user to obtain parsed data, obtains the Bluetooth pairing information of the vehicle from the parsed data, and pairs the user mobile terminal device with the vehicle according to the connection information; after successful pairing, the digital key is used to authenticate the user identity of the vehicle, and after successful authentication, it is indicated that the identity authentication of the vehicle user is successful.

[0059] The user mobile terminal and the vehicle terminal are required to have corresponding authentication data in the process of identity authentication. In this embodiment, the user mobile terminal device is set as a mobile phone; the mobile phone APP side should have successfully downloaded the required parameters for identity authentication and stored in the mobile phone security SDK.

[0060]

[0061]

[0062] Table 2

[0063] In this embodiment, the vehicle terminal security chip should have successfully written the security data shown in Table 3 in the production stage:

[0064] SEID Secure chip unique code CMPK Secure chip master key

[0065] Table 3

[0066] In step S2, the method for authenticating the user identity of the vehicle using the digital key is as shown in Figure 3 , and specifically includes the following steps:

[0067] S201, after successful Bluetooth pairing, the software of the vehicle user mobile terminal device parses the following data from the digital key: the HASH value DF, the signature value SignDF for signing the HASH value DF, and the permission data VCKINFO, and sends them to the vehicle terminal;

[0068] S202, the vehicle terminal performs signature verification on the signature value SignDF; checks the permission data VCKINFO of the digital key; after successful signature verification and checking, selects a string S1 to encrypt to obtain encrypted data SDA1, and sends the encrypted data to the vehicle user mobile terminal device;

[0069] Preferably, the method for obtaining the encrypted data SDA1 includes:

[0070] AES encryption operation on the HASH value DF to obtain a value VCK, the key used in the AES encryption algorithm in this embodiment is the intermediate key CMPK generated when the digital key is generated, but is not limited thereto; a vehicle feature information SEID and a random number TRnd are selected to generate a string S1; the value VCK is used as an encryption key to encrypt the string S1 to obtain encrypted data SDA1;

[0071] S203, the software of the mobile terminal device of the vehicle user checks the string SDA1, after the check is passed, a string S2 is selected to be encrypted to obtain encrypted data SDA2 which is sent to the vehicle end;

[0072] Preferably, the method for obtaining the encrypted data SDA2 comprises:

[0073] The software of the mobile terminal device of the vehicle user verifies the received encrypted data SDA1, and parses the vehicle feature information SEID and the random number TRnd after the verification is passed;

[0074] A random data CRnd is generated;

[0075] A vehicle feature information TEEID is selected;

[0076] The data of CRnd, TRnd, SEID and TEEID are combined into a string S2;

[0077] The value VCK is used as an encryption key to encrypt the string S2 to obtain the encrypted data SDA2;

[0078] S204, the vehicle end checks the received encrypted data SDA2, and the identity authentication of the vehicle user is completed after the check is passed;

[0079] Preferably, the method for checking the received encrypted data SDA2 by the vehicle end comprises: using VCK to decrypt the received encrypted data SDA2 to obtain a string S; parsing the vehicle feature information SEID' and the random number TRnd' in the string S, and comparing SEID' and TRnd' with SEID and the random number TRnd respectively, if they are all the same, it is considered that the check is passed.

[0080] It should be understood that the size of the serial number of each step in the above embodiment does not mean the order of execution, the execution order of each process should be determined according to its function and inherent logic, and should not constitute any limitation on the implementation process of the embodiment of the application.

[0081] The embodiment also provides a vehicle user identity authentication system based on a digital key, comprising a digital key generation module, a digital key parsing module and a vehicle user identity authentication module;

[0082] The digital key generation module is configured to generate a digital key according to information of a vehicle and a vehicle user;

[0083] The digital key analysis module is configured to analyze the digital key selected by the user by using software of the user mobile terminal device, and obtain connection information of the vehicle from the analysis data;

[0084] The vehicle user identity authentication module is configured to perform data pairing with the vehicle according to the connection information of the vehicle obtained from the digital key analysis module, perform identity authentication of the vehicle user by using the digital key, and indicate that the identity authentication of the vehicle user is successful after the identity authentication is passed

[0085] The contents not described in detail in the specification belong to the prior art known to those skilled in the art.

Claims

1. A method for authenticating vehicle user identity based on a digital key, characterized in that, Includes the following steps: S1. Generate a digital key based on vehicle information and vehicle user information, and download it to the software on the vehicle user's mobile device; S2. The software on the vehicle user's mobile device parses the digital key selected by the user to obtain parsing data, retrieves the vehicle's connection information from the parsing data, and pairs the user's mobile device with the vehicle based on the connection information. After successful pairing, the vehicle user's identity is authenticated using the digital key. Once authentication is successful, it indicates that the vehicle user's identity has been successfully authenticated. In S1, the methods for generating digital keys include: S101. Select n data points Info1~Info1 that contain vehicle feature information and / or user feature information. n ; S102. Using a random number as the key, generate the first intermediate key KEY1 by using an encryption algorithm on the data information Info1; S103, KEY i As a key, for data information Info i+1 Use an encryption algorithm to generate the (i+1)th intermediate key KEY. i+1 i∈[1,n-1]; S104. Select the digital key access data VCKINFO containing vehicle feature information and user feature information and perform a HASH operation to obtain its HASH value DF. S105, KEY n As a key, a digital key is generated by using an encryption algorithm on the HASH value DF.

2. The vehicle user authentication method based on digital keys as described in claim 1, characterized in that, The random number in step S102, and the intermediate keys KEY1~KEY n They are stored in different security chips in the vehicle.

3. The vehicle user authentication method based on a digital key as described in any one of claims 1 to 2, characterized in that, In step S2, the method for authenticating the vehicle user's identity using the digital key includes: S201. After successful pairing, the software on the vehicle user's mobile device parses the following data from the digital key: the HASH value DF, the signature value SignDF that signs the HASH value DF, and the permission data VCKINFO, and sends them to the vehicle terminal. S202. The vehicle terminal verifies the signature value SignDF; verifies the digital key's permission data VCKINFO; after the signature verification and verification are passed, selects a string S1 and encrypts it to obtain encrypted data SDA1, and sends the encrypted data to the vehicle user's mobile device. S203. The software on the vehicle user's mobile device verifies the string SDA1. After the verification is successful, a string S2 is selected and encrypted to obtain encrypted data SDA2, which is then sent to the vehicle. S204. The vehicle verifies the received encrypted data SDA2. If the verification is successful, the vehicle user's identity authentication is completed.

4. The vehicle user authentication method based on a digital key as described in claim 3, characterized in that, In step S202, the method for obtaining the encrypted data SDA1 includes: The HASH value DF is encrypted using AES to obtain a value VCK; a vehicle feature information SEID and a random number TRnd are selected to generate a string S1; the string S1 is encrypted using the value VCK as the encryption key to obtain encrypted data SDA1.

5. The vehicle user authentication method based on a digital key as described in claim 4, characterized in that, In step S203, the method for obtaining the encrypted data SDA2 includes: The software on the vehicle user's mobile device verifies the received encrypted data SDA1. After successful verification, it parses out the vehicle feature information SEID and the random number TRnd. Generate a random data CRnd; Select a vehicle feature information TEEID; Combine the data from the random numbers CRnd, TRnd, SEID, and TEEID into a single string S2; The string S2 is encrypted using the value VCK as the encryption key to obtain encrypted data SDA2.

6. The vehicle user authentication method based on a digital key as described in claim 4, characterized in that, The method for the vehicle to verify the received encrypted data SDA2 includes: using VCK to decrypt the received encrypted data SDA2 to obtain string S; parsing the vehicle feature information SEID' and random number TRnd' in string S; comparing SEID' and TRnd' with SEID and random number TRnd respectively; if they are the same, the verification is considered to have passed.

7. The vehicle user authentication method based on digital keys as described in claim 1, characterized in that, The digital key's access control data VCKINFO includes the digital key's request index, the target vehicle's feature information, and the target user's feature information; the target vehicle's feature information includes one or more pieces of information that distinguish the vehicle from other vehicles; the target user's feature information includes one or more pieces of information that distinguish the user from other users.

8. The vehicle user authentication method based on a digital key as described in claim 7, characterized in that, The request index of the digital key includes the set request ID, random number IRR, digital key activation time, and digital key validity period.

9. A vehicle user authentication system based on a digital key, implementing the vehicle user authentication method based on a digital key as described in claim 1, characterized in that, It includes a digital key generation module, a digital key parsing module, and a vehicle user identity authentication module; The digital key generation module is used to generate a digital key based on vehicle and vehicle user information; The digital key parsing module is used by the software on the user's mobile device to parse the digital key selected by the user and obtain the vehicle's connection information from the parsed data; The vehicle user identity authentication module is used to perform data pairing with the vehicle based on the vehicle connection information obtained from the digital key parsing module; and to authenticate the vehicle user identity using the digital key. Once authentication is successful, it indicates that the vehicle user's identity has been successfully verified.

Images