A method, device and storage medium for vehicle-to-cloud communication

Abstract

The present application provides a method, apparatus and related equipment for vehicle-to-cloud communication. By presetting a default key for the vehicle, the unique identification code and default key of the vehicle are imported into the cloud server. When the vehicle is offline, in response to the diagnostic instruction of the vehicle-side electronic control unit, based on the unique identification code and the default key, the vehicle-side and the cloud server are supported to negotiate keys and determine the session key for the current period to support the communication between the vehicle and the cloud server in the current period. Before the vehicle is offline and the session key for the current period expires, a new session key is generated based on the key negotiation process initiated by the vehicle-side electronic control unit to the cloud server to update the session key, and the communication between the vehicle and the cloud server in the next period is supported by the new session key. While ensuring the key security of vehicle-to-cloud communication, the session key is updated to ensure that the session key is valid and available, avoiding the complex process of key negotiation before each communication, and improving timeliness.

Description

Technical Field

[0001] The present application relates to the field of information security technology for intelligent connected vehicles, and in particular to a method, device and storage medium for vehicle-cloud communication. Background Art

[0002] With the continuous development of automobile intelligence and networking, the number of scenarios requiring communication between the vehicle and the cloud service platform is increasing. In order to ensure the security of the communication process between the vehicle and the cloud service platform, how to effectively resist attacks such as eavesdropping, forgery and information tampering is an important prerequisite for ensuring the safe and reliable operation of the Internet of Vehicles. At present, in order to ensure the security of vehicle-to-cloud communication, the industry mainly uses TLS (Transport Layer Security) to provide technical support through identity authentication and communication key negotiation before communication, as well as information encryption and integrity verification during communication. However, in the special operation scenario of the vehicle, there may be special scenarios, such as being limited by the hardware performance of the in-vehicle network electronic control unit, or there are business scenarios where the background of the vehicle control actively sends messages and has high requirements for real-time communication. In such scenarios, it is not appropriate to directly use the TLS protocol to establish communication. Therefore, for the vehicle network communication scenario, how to provide a communication method with high security, little impact from hardware performance and strong timeliness has become an urgent problem to be solved in the Internet of Vehicles industry. Summary of the invention

[0003] In view of this, embodiments of the present application provide a vehicle-to-cloud communication method, device, and storage medium to at least or partially solve the above-mentioned problems.

[0004] In a first aspect, an embodiment of the present application provides a vehicle-cloud communication method, comprising: presetting a default key for a vehicle;

[0005] Importing the unique identification code and default key of the vehicle end into the cloud server;

[0006] When the vehicle is offline, in response to a diagnostic instruction of the vehicle-side electronic control unit, based on the unique identification code, using the default key, supporting the vehicle-side and the cloud server to perform key negotiation to determine a session key for the current period, wherein the session key for the current period is used to support communication between the vehicle-side and the cloud server in the current period;

[0007] Before the vehicle goes offline and the session key for the current time period expires, a new session key is generated based on the key negotiation process initiated by the electronic control unit of the vehicle to the cloud server, and the session key for the current time period is updated to support communication between the vehicle and the cloud server in the next time period through the new session key.

[0008] Optionally, in one embodiment of the present application, the vehicle-cloud communication method further includes: when the vehicle side decrypts the message transmitted by the cloud server, the session key at the current moment is used for decryption first, and if the decryption fails, the session key of the previous period is used for decryption.

[0009] Optionally, in one embodiment of the present application, the vehicle-cloud communication method further comprises: when sending a message to the networked vehicle terminal through the cloud server, encrypting the message using the session key of the current time period of the cloud server;

[0010] When the cloud server decrypts the message transmitted by the networked vehicle, it performs polling decryption in the order of the cloud server's current session key, the default key, and the new session key generated by key negotiation.

[0011] Optionally, in one embodiment of the present application, the vehicle-to-cloud communication method further includes:

[0012] When the polling decryption is successful, the session key of the cloud server in the current period is updated according to the key hit when the polling decryption is successful, and the updated session key is used to support the cloud server to communicate with the networked vehicle end.

[0013] Optionally, in one embodiment of the present application, the default keys of different vehicle terminals are different.

[0014] Optionally, in an embodiment of the present application, presetting a default key for the vehicle side includes: presetting a random number in an electronic control unit of a vehicle corresponding to the vehicle side as the default key.

[0015] Optionally, in an embodiment of the present application, the vehicle-to-cloud communication method further includes: at the vehicle side, using standard symmetric and asymmetric algorithms to implement a key negotiation process.

[0016] Optionally, in an embodiment of the present application, the vehicle-to-cloud communication method further includes: the key negotiation process is implemented using a standard national commercial cryptographic algorithm or an international cryptographic algorithm.

[0017] In a second aspect, based on the vehicle-to-cloud communication method provided in the first aspect of the present application, an embodiment of the present application further provides a vehicle-to-cloud communication device, including:

[0018] Configuration module, used to preset default keys for the vehicle end;

[0019] An import module, used to import the unique identification code and default key of the vehicle end into the cloud server;

[0020] A negotiation module, for responding to a diagnostic instruction of the vehicle-side electronic control unit when the vehicle is offline, based on the unique identification code, using the default key, supporting the vehicle-side and the cloud server to perform a key negotiation process to determine a session key for a current period, wherein the session key for the current period is used to support communication between the vehicle-side and the cloud server in the current period;

[0021] The key management module is used to generate a new session key according to the key negotiation process initiated by the electronic control unit of the vehicle to the cloud server before the vehicle goes offline and the session key of the current time period expires, and update the session key of the current time period to support the communication between the vehicle and the cloud server in the next time period through the new session key.

[0022] In a third aspect, an embodiment of the present application further provides a storage medium, on which computer executable instructions are stored, and when the computer executable instructions are executed, any one of the vehicle-cloud communication methods described in the first aspect of the present application is executed.

[0023] In a fourth aspect, an embodiment of the present application further provides an electronic device, comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, it implements any one of the vehicle-cloud communication methods described in the first aspect of the present application.

[0024] The present application provides a method, device and related equipment for vehicle-to-cloud communication, which pre-sets a default key for the vehicle end, imports the unique identification code and default key of the vehicle end into the cloud server; when the vehicle is offline, in response to the diagnostic instruction of the vehicle end electronic control unit, based on the unique identification code, the default key is used to support the vehicle end and the cloud server to negotiate keys to determine the session key of the current period, and the session key of the current period is used to support the communication between the vehicle end and the cloud server in the current period; before the vehicle is offline and the session key of the current period expires, a new session key is generated according to the key negotiation process initiated by the vehicle end electronic control unit to the cloud server, and the session key of the current period is updated to support the communication between the vehicle end and the cloud server in the next period through the new session key. This vehicle-to-cloud communication method, under the premise of ensuring that the keys of the vehicle-to-cloud communication are stored separately and securely, adopts a key update mechanism to ensure that the vehicle-to-cloud key is valid and available throughout the life cycle of the vehicle, and there is no need to perform a complex process of key negotiation before each communication. Communication security and timeliness are better. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the embodiments of the present application. For ordinary technicians in this field, other drawings can also be obtained based on these drawings.

[0026] Figure 1 A schematic diagram of a working process of a vehicle-to-cloud communication method provided in an embodiment of the present application;

[0027] Figure 2 A schematic diagram of the structure of a vehicle-to-cloud communication device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0028] In order to enable those skilled in the art to better understand the technical solutions in the embodiments of the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments in the embodiments of the present application should fall within the scope of protection of the embodiments of the present application.

[0029] It should be understood that the various steps described in the method implementation of the present application can be performed in different orders and / or performed in parallel. In addition, the method implementation may include additional steps and / or omit the steps shown. The scope of the present application is not limited in this respect.

[0030] Embodiment 1

[0031] The present application embodiment provides a vehicle-to-cloud communication method, such as Figure 1 As shown, Figure 1 A schematic diagram of a work flow of a vehicle-to-cloud communication method provided in an embodiment of the present application includes:

[0032] Step S101: presetting a default key for the vehicle side. In the embodiment of the present application, the default key cannot be modified or updated to avoid forgetting or losing the default key after the default key is modified or updated, resulting in the default key being unusable.

[0033] In an optional implementation method in the embodiment of the present application, the default key of each vehicle is different. By having one default key for each vehicle, the correspondence and security of different vehicles in the vehicle-cloud communication process are improved, and misencryption in other cloud servers or vehicle terminals may be avoided when using the default keys of different vehicles to encrypt or decrypt information.

[0034] Optionally, in an implementation of the embodiment of the present application, presetting a default key for the vehicle side includes presetting a random number in an electronic control unit of a vehicle corresponding to the vehicle side as the default key. Specifically, for example, the preset default key is stored in a hardware security module of the electronic control unit ECU of the vehicle to ensure the security of the default key.

[0035] Optionally, in an implementation process of an embodiment of the present application, the length of the default key is greater than or equal to 16 bytes to ensure the uniqueness of the default key and make it difficult to crack or tamper with.

[0036] In the embodiment of the present application, the default key is used as the encryption and decryption key for message encryption and decryption during the vehicle offline process and for remediation in extreme abnormal situations, such as when the vehicle-cloud message does not match, to encrypt or decrypt the communication data. The default key is only used when the vehicle diagnostic instrument triggers the communication key negotiation process with the cloud.

[0037] Step S102: import the unique identification code and default key of the vehicle end into the cloud server, wherein the unique identification code is used by the cloud server to determine the vehicle end object with which it communicates, and the default key is the initial key (i.e., the default key) used in the process of establishing communication between the vehicle end and the cloud server for key negotiation to ensure the correspondence of the two-end communication in the initial key negotiation process and the accuracy of encryption and decryption of the communication messages, so that the corresponding vehicle end and the cloud server can smoothly establish communication and complete the initial key negotiation process.

[0038] Step S103, when the vehicle is offline, in response to the diagnostic instruction of the vehicle-side electronic control unit, based on the unique identification code of the vehicle-side, using the default key, support the vehicle-side and the cloud server to negotiate the key, so as to determine the session key of the current period, which is used to support the communication between the vehicle-side and the cloud server in the current period. The communication data between the vehicle-side and the cloud server is encrypted and decrypted using the session key of the current period to be determined. In the embodiment of the present application, those skilled in the art should understand that the time period defined by the "current period" described in this step is specifically the communication period before the new key negotiation between the vehicle-side and the cloud server is completed when the vehicle is offline.

[0039] Step S104: before the vehicle goes offline and the session key of the current period expires, a new session key is generated based on the key negotiation process initiated by the vehicle-side electronic control unit to the cloud server, and the session key of the current period is updated using the new session key to support the communication between the vehicle-side and the cloud server in the next period through the new session key. That is, the communication data between the vehicle-side and the cloud server in the next period is encrypted and decrypted using the new session key. In the embodiment of the present application, a person skilled in the art should understand that the time period defined by the "next period" is specifically the communication period after the vehicle goes offline and the vehicle-side electronic control unit and the cloud server complete the key negotiation process. When the key negotiation process is completed, the new session key will be immediately enabled to support the encryption and decryption of communication data in the vehicle-cloud communication. The "session key of the current period" described in this step includes but is not limited to the session key generated by the key negotiation between the vehicle-side and the cloud server when the vehicle goes offline as described in step S103, and also includes the session key used in the time period corresponding to any key negotiation process between the vehicle-side and the cloud server after the vehicle goes offline, so as to ensure that the vehicle-cloud communication method described in the embodiment of the present application can be effective and available throughout the life cycle of the vehicle.

[0040] Through the above method, a lightweight security protection mechanism for vehicle-to-cloud communication is realized, which eliminates the need to perform a complex process of key negotiation before each communication. While ensuring the security of communication and the stability of normal communication services throughout the vehicle's entire life cycle, it also improves the timeliness of communication to a certain extent.

[0041] Optionally, in an implementation of the embodiment of the present application, the vehicle-to-cloud communication method described in the embodiment of the present application further includes: when the vehicle-side decrypts the message transmitted by the cloud server, the session key used at the current moment is preferentially used to decrypt the received message, and the session key of the previous time period is used to decrypt after the decryption fails. In this process, the session key used at the current moment may be the default key described in step S101, the session key of the current time period described in step S103, or the new session key described in step S104. It should be clear to those skilled in the art that the "at that moment" is only used to limit the corresponding moment when the vehicle-side decrypts the message transmitted by the cloud server, and is distinguished from any other "time period" described in this application. In this way, the embodiment of the present application can effectively prevent the decryption failure caused by the disorder of the message timing due to network instability and other conditions during any key negotiation process. Ensure the accuracy of vehicle-to-cloud communication.

[0042] Optionally, in an implementation of the embodiment of the present application, the vehicle-to-cloud communication method described in the embodiment of the present application further includes: when sending a message to a networked vehicle via a cloud server, encrypting it using the session key of the current time period of the cloud server; when decrypting a message transmitted by a networked vehicle via the cloud server, polling and decrypting are performed in the order of the session key of the current time period of the cloud server, the default key, and the new session key generated by the key negotiation. This is to further prevent decryption failures caused by message timing disorder due to network instability and other conditions during the key negotiation process. This ensures the accuracy of vehicle-to-cloud communication.

[0043] Optionally, in an implementation manner of an embodiment of the present application, the vehicle-cloud communication method described in the embodiment of the present application also includes: when the polling decryption is successful, the session key of the cloud server for the current period is updated according to the key hit when the polling decryption is successful, and the updated session key is used to support the cloud server to communicate with the networked vehicle.

[0044] Optionally, in an implementation of the embodiment of the present application, the vehicle-to-cloud communication method described in the embodiment of the present application further includes: on the vehicle side, using standard symmetric and asymmetric algorithms to implement a key negotiation process. The embodiment of the present application lists an implementation method to implement the key negotiation process for illustration:

[0045] The vehicle end encrypts the key negotiation information and the vehicle end random number and sends them to the cloud server;

[0046] After receiving the random number from the vehicle, the cloud server generates a random number from the server, and then sends the random number and the server identity certificate to the vehicle.

[0047] The vehicle receives the server certificate fed back by the cloud server and verifies the server identity certificate, wherein the verification process includes verifying the legitimacy and timeliness of the server identity certificate; when the server identity certificate passes the verification, a random number is generated as the first communication key, and the first communication key ciphertext is generated by encrypting the public key of the server identity certificate;

[0048] Use the private key of the vehicle to sign the random number of the vehicle and the random number of the server. The private key is included in the public-private key pair generated by the vehicle when applying for the identity certificate. The public key is used to apply for the identity certificate.

[0049] Send the signed vehicle-side random number and the server-side random number, the vehicle-side identity certificate, and the encrypted first communication key ciphertext to the cloud server;

[0050] The cloud server verifies the legitimacy of the vehicle-side identity certificate and the vehicle-side random number signature. After the legitimacy verification is passed, the encrypted first communication key ciphertext is restored to obtain the first communication key, completing the vehicle-cloud identity authentication and the exchange of the first communication key;

[0051] The cloud server then generates a new session key based on the vehicle-side random number, the server-side random number and the first communication key. At this point, the new session key is not officially activated and is only used for encryption, not for decryption;

[0052] The cloud server sends the vehicle-side identity certificate verification result and the new session key generation result to the vehicle-side;

[0053] After receiving the data, the vehicle generates a new session key and activates it according to the same data processing rules, and encrypts the activation result with the new session key and sends it to the cloud server. This completes the vehicle-cloud key negotiation process, and then the new session key and the negotiated algorithm can be enabled for vehicle-cloud encrypted communication. This ensures the security and timeliness of vehicle-cloud communication and avoids the need for key negotiation for each communication.

[0054] Optionally, in an implementation method of an embodiment of the present application, the vehicle-to-cloud communication method described in the embodiment of the present application also includes: the key negotiation process is implemented using a standard national commercial cryptographic algorithm or an international cryptographic algorithm to improve the security of the vehicle-to-cloud communication method provided in the embodiment of the present application.

[0055] Optionally, in one implementation of the embodiment of the present application, a key negotiation period is set according to business needs, and before the current session key expires, the vehicle actively initiates the key negotiation process to avoid the situation where expired keys participate in vehicle-to-cloud communication. This improves the stability of vehicle-to-cloud communication.

[0056] Optionally, in one implementation of an embodiment of the present application, the car-cloud key negotiation process is implemented with reference to the standard TLS protocol to further ensure the security of the key negotiation.

[0057] The present application provides a method for vehicle-to-cloud communication, by presetting a default key for the vehicle end, importing the unique identification code and default key of the vehicle end into a cloud server; when the vehicle is offline, in response to the diagnostic instruction of the vehicle end electronic control unit, based on the unique identification code, using the default key, supporting the vehicle end and the cloud server to negotiate keys to determine the session key of the current period, the session key of the current period is used to support the communication between the vehicle end and the cloud server in the current period; before the vehicle is offline and the session key of the current period expires, according to the key negotiation process initiated by the vehicle end electronic control unit to the cloud server, a new session key is generated, and the session key of the current period is updated to support the communication between the vehicle end and the cloud server in the next period through the new session key. This vehicle-to-cloud communication method, under the premise of ensuring that the keys of vehicle-to-cloud communication are stored separately and securely, adopts a mechanism of regular key update to ensure that the vehicle-to-cloud keys are valid and available throughout the life cycle of the vehicle, and there is no need to perform a complex process of key negotiation before each communication. Communication security and timeliness are better.

[0058] Embodiment 2

[0059] Based on the vehicle-to-cloud communication method described in the first embodiment of the present application, the present application also provides a vehicle-to-cloud communication device, such as Figure 2 As shown, Figure 2 The present invention provides a schematic diagram of a vehicle-to-cloud communication device 20 according to an embodiment of the present invention. The vehicle-to-cloud communication device 20 includes:

[0060] Configuration module 201, used to preset a default key for the vehicle end;

[0061] An import module 202, used to import the unique identification code and default key of the vehicle end into the cloud server;

[0062] The negotiation module 203 is used to respond to the diagnostic instruction of the vehicle-side electronic control unit when the vehicle is offline, based on the unique identification code, use the default key to support the vehicle-side and the cloud server to perform a key negotiation process to determine the session key of the current period, and the session key of the current period is used to support the communication between the vehicle-side and the cloud server in the current period;

[0063] The key management module 204 is used to generate a new session key according to the key negotiation process initiated by the electronic control unit of the vehicle to the cloud server before the vehicle goes offline and the session key of the current time period expires, and update the session key of the current time period to support the communication between the vehicle and the cloud server in the next time period through the new session key.

[0064] Optionally, in one implementation of the embodiment of the present application, the vehicle-cloud communication device also includes a first encryption and decryption module (not shown in the drawings), which is used to decrypt the message transmitted by the cloud server received on the vehicle side, preferably using the current session key for decryption, and using the session key of the previous period for decryption after the decryption fails.

[0065] Optionally, in an implementation method of the embodiment of the present application, the vehicle-cloud communication device also includes a second encryption and decryption module (not shown in the accompanying drawings). The first encryption and decryption module is used to encrypt the message when the cloud server sends the message to the networked vehicle end using the session key of the cloud server's current period; when the cloud server decrypts the message received from the networked vehicle end, it polls and decrypts in the order of the session key of the cloud server's current period, the default key, and the new session key generated by key negotiation.

[0066] Optionally, in one implementation of the embodiment of the present application, the key management module 204 is also used to update the session key of the cloud server for the current period according to the key hit when the polling decryption is successful, and use the updated session key to support communication between the cloud server and the networked vehicle.

[0067] Optionally, in an implementation of an embodiment of the present application, the default keys of different vehicle terminals are different.

[0068] Optionally, in an implementation of an embodiment of the present application, the configuration module 201 is also used to pre-set a random number in an electronic control unit of a vehicle corresponding to the vehicle end as the default key.

[0069] Optionally, in an embodiment of the present application, the negotiation module 203 is further configured to implement a key negotiation process at the vehicle end using standard symmetric and asymmetric algorithms.

[0070] Optionally, in an embodiment of the present application, the negotiation module 203 is further configured to implement the key negotiation process using a standard national commercial cryptographic algorithm or an international cryptographic algorithm in the key negotiation process.

[0071] The present application provides a vehicle-to-cloud communication device, which presets a default key for the vehicle side through a configuration module, imports the unique identification code and the default key of the vehicle side into the cloud server through an import module, and supports the vehicle side to negotiate keys with the cloud server based on the unique identification code and the default key when the vehicle is offline, so as to determine the session key of the current period, and the session key of the current period is used to support the communication between the vehicle side and the cloud server in the current period; before the vehicle is offline and the session key of the current period expires, a new session key is generated according to the key negotiation process initiated by the vehicle side's electronic control unit to the cloud server through the negotiation module, so as to update the session key of the current period, and use the new session key to support the communication between the vehicle side and the cloud server in the next period. This vehicle-to-cloud communication method, under the premise of ensuring that the keys of vehicle-to-cloud communication are stored separately and safely, adopts a mechanism of regular key update to ensure that the vehicle-to-cloud keys are valid and available throughout the life cycle of the vehicle, and there is no need to perform a complex process of key negotiation before each communication. The communication security and timeliness are better.

[0072] Embodiment 3

[0073] The embodiment of the present application further provides a storage medium on which a computer program is stored. When the program is executed by a processor, any one of the vehicle-to-cloud communication methods described in the first embodiment of the present application is implemented. The vehicle-to-cloud communication method includes but is not limited to:

[0074] Preset the default key for the vehicle end;

[0075] Importing the unique identification code and default key of the vehicle end into the cloud server;

[0076] When the vehicle is offline, in response to a diagnostic instruction of the vehicle-side electronic control unit, based on the unique identification code, using the default key, supporting the vehicle-side and the cloud server to perform key negotiation to determine a session key for the current period, wherein the session key for the current period is used to support communication between the vehicle-side and the cloud server in the current period;

[0077] Before the vehicle goes offline and the session key for the current time period expires, a new session key is generated based on the key negotiation process initiated by the electronic control unit of the vehicle to the cloud server, and the session key for the current time period is updated to support communication between the vehicle and the cloud server in the next time period through the new session key.

[0078] Embodiment 4:

[0079] The embodiment of the present application further provides an electronic device, including: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, any one of the vehicle management methods based on the vehicle software baseline as described in the first embodiment of the present application is implemented, and the vehicle management method based on the vehicle software baseline includes but is not limited to:

[0080] Preset the default key for the vehicle end;

[0081] Importing the unique identification code and default key of the vehicle end into the cloud server;

[0082] When the vehicle is offline, in response to a diagnostic instruction of the vehicle-side electronic control unit, based on the unique identification code, using the default key, supporting the vehicle-side and the cloud server to perform key negotiation to determine a session key for the current period, wherein the session key for the current period is used to support communication between the vehicle-side and the cloud server in the current period;

[0083] Before the vehicle goes offline and the session key for the current time period expires, a new session key is generated based on the key negotiation process initiated by the electronic control unit of the vehicle to the cloud server, and the session key for the current time period is updated to support communication between the vehicle and the cloud server in the next time period through the new session key.

[0084] So far, the application has described specific embodiments of the subject matter. Other embodiments are within the scope of the appended claims. In some cases, the actions recorded in the claims can be performed in a different order and still achieve the desired results. In addition, the processes depicted in the accompanying drawings do not necessarily require the specific order or sequential order shown to achieve the desired results. In some embodiments, multitasking and parallel processing can be advantageous.

[0085] In the 1990s, improvements to a technology could be clearly distinguished as hardware improvements (for example, improvements to the circuit structure of diodes, transistors, switches, etc.) or software improvements (improvements to the method flow). However, with the development of technology, many improvements to the method flow today can be regarded as direct improvements to the hardware circuit structure. Designers almost always obtain the corresponding hardware circuit structure by programming the improved method flow into the hardware circuit. Therefore, it cannot be said that an improvement in a method flow cannot be implemented using a hardware entity module. For example, a programmable logic device (PLD) (such as a field programmable gate array (FPGA)) is such an integrated circuit whose logical function is determined by the user's programming of the device. Designers can "integrate" a digital system layer on a PLD by programming it themselves, without having to ask a chip manufacturer to design and produce a dedicated integrated circuit chip. Moreover, nowadays, instead of manually making integrated circuit chips, this kind of programming is mostly implemented by "logic compiler" software, which is similar to the software compiler used when developing and writing programs, and the original code before compilation must also be written in a specific programming language, which is called hardware description language (HDL). There is not only one HDL, but many kinds, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, RHDL (Ruby Hardware Description Language), etc. The most commonly used ones are VHDL (Very-High-Speed ​​Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art should also know that it is only necessary to program the method flow slightly in the above-mentioned hardware description languages ​​and program it into the integrated circuit, and then it is easy to obtain the hardware circuit that implements the logic method flow.

[0086] The controller can be implemented in any appropriate manner, for example, the controller can take the form of a microprocessor or processor and a computer-readable medium storing a computer-readable program code (such as software or firmware) that can be executed by the (micro)processor, a logic gate, a switch, an application-specific integrated circuit (ASIC), a programmable logic controller, and an embedded microcontroller. Examples of controllers include, but are not limited to, the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicone Labs C8051F320. The memory controller can also be implemented as part of the control logic of the memory. Those skilled in the art also know that in addition to implementing the controller in a purely computer-readable program code manner, the controller can be implemented in the form of a logic gate, a switch, an application-specific integrated circuit, a programmable logic controller, and an embedded microcontroller by logically programming the method steps. Therefore, this controller can be considered as a hardware component, and the devices included therein for implementing various functions can also be regarded as structures within the hardware component. Or even, the devices for implementing various functions can be regarded as both software modules for implementing the method and structures within the hardware component.

[0087] The system layers, devices, modules or units described in the above embodiments may be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, the computer may be, for example, a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0088] For the convenience of description, the above device is described in various units according to their functions. Of course, when implementing the present application, the functions of each unit can be implemented in the same or multiple software and / or hardware.

[0089] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0090] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, system layers or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0091] The present application may be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific transactions or implement specific abstract data types. The present application may also be practiced in distributed computing environments where transactions are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules may be located in local and remote computer storage media, including storage devices.

[0092] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system layer embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0093] The above are only embodiments of the present application and are not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included within the scope of the claims of the present application.

Claims

1. A vehicle-to-cloud communication method, characterized in that: include: Presetting a default key for the vehicle end, presetting a random number in the electronic control unit of the vehicle corresponding to the vehicle end as the default key, and the default keys of different vehicle ends are different; Importing the unique identification code and default key of the vehicle end into the cloud server; When the vehicle is offline, in response to a diagnostic instruction of the vehicle-side electronic control unit, based on the unique identification code, using the default key, supporting the vehicle-side and the cloud server to perform key negotiation to determine a session key for the current period, wherein the session key for the current period is used to support communication between the vehicle-side and the cloud server in the current period; Before the vehicle goes offline and the session key of the current period expires, a new session key is generated according to the key negotiation process initiated by the vehicle-side electronic control unit to the cloud server, and the session key of the current period is updated to support the communication between the vehicle-side and the cloud server in the next period through the new session key; The method further comprises: When the vehicle end decrypts the message transmitted by the cloud server, the current session key is used for decryption first. If the decryption fails, the session key of the previous period is used for decryption. When sending a message to the connected vehicle via the cloud server, the message is encrypted using the current session key of the cloud server; When decrypting the message transmitted by the connected vehicle through the cloud server, polling and decrypting are performed in the order of the current session key of the cloud server, the default key, and the new session key generated by key negotiation; The key negotiation process includes: The vehicle end encrypts the key negotiation information and the vehicle end random number and sends them to the cloud server; After receiving the random number from the vehicle, the cloud server generates a random number from the server, and then sends the random number and the server identity certificate to the vehicle. The vehicle receives the server certificate fed back by the cloud server and verifies the server identity certificate, wherein the verification process includes verifying the legitimacy and timeliness of the server identity certificate; when the server identity certificate is verified, a random number is generated as the first communication key, and the server identity certificate public key is used for encryption to generate an encrypted first communication key ciphertext: Use the private key of the vehicle to sign the random number of the vehicle and the random number of the server. The private key is included in the public-private key pair generated by the vehicle when applying for the identity certificate. The public key is used to apply for the identity certificate. Send the signed vehicle-side random number and the server-side random number, the vehicle-side identity certificate, and the encrypted first communication key ciphertext to the cloud server; The cloud server verifies the legitimacy of the vehicle-side identity certificate and the vehicle-side random number signature. After the legitimacy verification is passed, the encrypted first communication key ciphertext is restored to obtain the first communication key, completing the vehicle-cloud identity authentication and the exchange of the first communication key; The cloud server then generates a new session key based on the vehicle-side random number, the server-side random number and the first communication key.

2. The vehicle-to-cloud communication method according to claim 1, characterized in that: The method further comprises: When the polling decryption is successful, the session key of the cloud server in the current period is updated according to the key hit when the polling decryption is successful, and the updated session key is used to support the cloud server to communicate with the networked vehicle end.

3. The vehicle-to-cloud communication method according to claim 1, characterized in that: The vehicle-side preset default key includes: A random number is preset in the electronic control unit of the vehicle corresponding to the vehicle end as the default key.

4. The vehicle-to-cloud communication method according to claim 1, characterized in that: The method further includes: at the vehicle end, using standard symmetric and asymmetric algorithms to implement a key negotiation process.

5. A vehicle-to-cloud communication device, characterized in that: include: A configuration module, used to preset a default key for a vehicle end, preset a random number in an electronic control unit of a vehicle corresponding to the vehicle end as the default key, and the default keys of different vehicle ends are different; An import module, used to import the unique identification code and default key of the vehicle end into the cloud server; A negotiation module, for responding to a diagnostic instruction of the vehicle-side electronic control unit when the vehicle is offline, based on the unique identification code, using the default key, supporting the vehicle-side and the cloud server to perform a key negotiation process to determine a session key for a current period, wherein the session key for the current period is used to support communication between the vehicle-side and the cloud server in the current period; The key negotiation process includes: The vehicle end encrypts the key negotiation information and the vehicle end random number and sends them to the cloud server; After receiving the random number from the vehicle, the cloud server generates a random number from the server, and then sends the random number and the server identity certificate to the vehicle. The vehicle receives the server certificate fed back by the cloud server and verifies the server identity certificate, wherein the verification process includes verifying the legitimacy and timeliness of the server identity certificate; when the server identity certificate is verified, a random number is generated as the first communication key, and the server identity certificate public key is used for encryption to generate an encrypted first communication key ciphertext: Use the private key of the vehicle to sign the random number of the vehicle and the random number of the server. The private key is included in the public-private key pair generated by the vehicle when applying for the identity certificate. The public key is used to apply for the identity certificate. Send the signed vehicle-side random number and the server-side random number, the vehicle-side identity certificate, and the encrypted first communication key ciphertext to the cloud server; The cloud server verifies the legitimacy of the vehicle-side identity certificate and the vehicle-side random number signature. After the legitimacy verification is passed, the encrypted first communication key ciphertext is restored to obtain the first communication key, completing the vehicle-cloud identity authentication and the exchange of the first communication key; The cloud server then generates a new session key based on the vehicle-side random number, the server-side random number, and the first communication key; A key management module, used to generate a new session key according to a key negotiation process initiated by the electronic control unit of the vehicle end to the cloud server before the vehicle goes offline and the session key of the current period expires, and update the session key of the current period to support communication between the vehicle end and the cloud server in the next period through the new session key; The first encryption module is used for: When the vehicle end decrypts the message transmitted by the cloud server, the current session key is used for decryption first. If the decryption fails, the session key of the previous period is used for decryption; The second encryption module is used for: When the cloud server sends a message to the connected vehicle, it uses the session key of the cloud server's current period to encrypt it; when the cloud server decrypts the message received from the connected vehicle, it polls and decrypts it in the order of the cloud server's current period session key, the default key, and the new session key generated by key negotiation.

6. A computer storage medium, characterized in that: The computer storage medium stores computer executable instructions, and when the computer executable instructions are executed, the vehicle-to-cloud communication method as described in any one of claims 1-4 is executed.

Images