Digital key security authentication method

Abstract

The application provides a digital key security authentication method, comprising: a second device sends authentication request information to a first device, and the first device obtains a first data packet according to the authentication request information and sends the first data packet to the second device. The second device decrypts first encrypted data, obtains first authentication information, and compares the first authentication information with stored first authentication information; the second device generates a second data packet and sends the second data packet to the first device. The first device decrypts second encrypted data, obtains second authentication information, compares the second authentication information with stored second authentication information, and sends a third data packet to the second device. The second device decrypts third encrypted data, obtains third authentication information, compares the third authentication information with stored third authentication information, and if the results are consistent, authentication is successful, a success notification request information is generated and sent to the first device; the first device accepts the success notification request information, generates a success notification reply information, and sends the success notification reply information to the second device. Thus, the security of digital key authentication is improved.

Description

Technical Field

[0001] This invention belongs to the field of Bluetooth digital key technology, and specifically relates to a digital key security authentication method. Background Technology

[0002] Bluetooth digital keys for mobile phones are becoming increasingly popular as a key carrier, enabling contactless unlocking and closing, and automatic welcoming functions.

[0003] Traditional Bluetooth keys have low security authentication methods. They use a proprietary authentication algorithm that is easy to crack and prevent relaying. In addition, the original Bluetooth digital keys are not implemented in accordance with internationally recognized standards. Summary of the Invention

[0004] The purpose of this invention is to solve the problems of low security in the traditional Bluetooth digital key authentication method in the prior art, which uses a private authentication algorithm and is easily cracked and has anti-relay issues.

[0005] To address the aforementioned problems, embodiments of the present invention disclose a digital key security authentication method, applied to a security authentication system including a first device and a second device; the first device includes a pre-stored first authentication key, and the second device includes a pre-stored second device master key; the authentication method includes:

[0006] S1: The first device establishes a communication connection with the second device; the second device sends authentication request information to the first device, the authentication request information including the first authentication information;

[0007] S2: The first device obtains a first data packet based on the received authentication request information and sends the first data packet to the second device; wherein, the first data packet includes second authentication information and first encrypted data, the first encrypted data includes the first authentication information encrypted with a first session key, and the first session key is obtained through the first authentication key;

[0008] S3: The second device decrypts the first encrypted data, obtains the decrypted first authentication information, and compares it with the first authentication information stored in the second device;

[0009] If the comparison results are consistent, the second device generates a second data packet based on the second authentication information and sends the second data packet to the first device; wherein, the second data packet includes third authentication information and second encrypted data, the second encrypted data includes second authentication information encrypted with a second session key, the second session key is obtained through the second authentication key, and the second authentication key is the same as the first authentication key;

[0010] S4: The first device decrypts the second encrypted data, obtains the decrypted second authentication information, and compares it with the second authentication information stored in the first device;

[0011] If the comparison results are consistent, a third data packet is sent to the second device; wherein the third data packet includes third encrypted data, and the third encrypted data includes third authentication information encrypted with the first session key;

[0012] S5; The second device decrypts the third encrypted data, obtains the decrypted third authentication information, and compares it with the third authentication information stored in the second device;

[0013] If the comparison results are consistent, the authentication is successful, the second device generates a success notification request message, and sends it to the first device;

[0014] S6: The first device receives the success notification request, generates a success notification receipt, and sends it to the second device.

[0015] Using the above technical solution, the first and second devices exchange authentication information, encrypting the information using their respective session keys. They then exchange the encrypted data, decrypt it using their session keys to obtain their own authentication information, and compare it with their stored authentication information. If both comparisons pass, authentication is successful. Throughout this process, the first and second devices use the same encryption key. Therefore, symmetric encryption technology is used in the data encryption process, resulting in better security. Furthermore, two-way verification between the first and second devices is required; only after successful two-way verification can the digital key be authenticated. This two-way authentication method further enhances authentication security.

[0016] According to another specific embodiment of the present invention, the digital key security authentication method disclosed in this embodiment includes a first authentication information comprising a second device random number and a second device identifier; in step S2, the first device obtains the first encrypted data including:

[0017] S21: The first device obtains digital key information based on the pre-stored correspondence between the second device identifier and digital key information, and generates a first device random number; the digital key information includes first device counter data and a first initial vector;

[0018] S22: Using the first authentication key, the first initialization vector, the first device random number, and the second device random number are calculated using the first algorithm to obtain the first session key;

[0019] S23: Using the first session key, encrypt the second device random number and the first device counter data using the first algorithm to obtain the first encrypted data.

[0020] The above technical solution utilizes a pre-stored first authentication key to calculate a first initialization vector, a first device random number, and a second device random number, yielding a first session key. This first session key is then used to encrypt the second device random number and the first device counter data. Notably, the first session key is not pre-stored but calculated using the first authentication key. Therefore, by using the first authentication key to calculate the first session key and then using it to encrypt data, multiple encryption steps are applied, increasing the security of the data encryption.

[0021] According to another specific embodiment of the present invention, the digital key security authentication method disclosed in this embodiment further includes a first device random number and pre-stored structure data of the first device in the first data packet, and the second authentication information includes the first device random number and the first device counter data; in step S3, the second device obtains the second encrypted data including:

[0022] S31: Calculate the second authentication key by using the second algorithm to combine the structure data and the second device master key;

[0023] S32: Using the second authentication key, the first algorithm is used to calculate the first device random number and the second device random number to obtain the second session key;

[0024] S33: Decrypt the first encrypted data using the second session key, obtain the second device random number and the first device counter data; and compare them with the second device random number stored on the second device. If the comparison result is consistent, proceed to step S34.

[0025] S34: Using the second session key, the second device authentication extension information, the first device random number, and the first device counter data are encrypted using the first algorithm to obtain the second encrypted data.

[0026] The above technical solution first calculates a second authentication key using the structure data and the second device master key. Then, using the second authentication key, a first algorithm is used to calculate a second session key using a first random number from the first device and a random number from the second device. The second session key is then used to decrypt the first encrypted data. When the second random number obtained from decrypting the first encrypted data matches the second random number stored on the second device, the second session key is used to encrypt the second device authentication extension information, the first device random number, and the first device counter data, resulting in the second encrypted data. Thus, by first calculating the second authentication key, then using the second authentication key to calculate the second session key, and then using the second session key to encrypt the data multiple times, the security of the data encryption is increased. Furthermore, the decrypted second device random number is compared; if the comparison results match, the next step is performed, increasing the reliability of information authentication.

[0027] According to another specific embodiment of the present invention, the digital key security authentication method disclosed in this embodiment obtains the second device authentication extension information by means of the following method: obtaining a preset number of bits of random sequence code pre-stored in the second device, and using a first algorithm to calculate the second device authentication extension information by using the second device master key pre-stored in the second device and the preset number of bits.

[0028] According to another specific embodiment of the present invention, in the digital key security authentication method disclosed in this embodiment, step S4, the first device acquiring the third encrypted data includes:

[0029] S41: Decrypt the second encrypted data using the first session key, obtain the first device random number and the first device counter data, and compare them with the first device random number and the first device counter data stored on the first device. If the comparison result is consistent, proceed to step S42.

[0030] S42: Increment the counter data of the first device by 1; and use the second algorithm to calculate the random number of the second device and the authentication extension information of the second device to obtain the third authentication information;

[0031] S43: Using the first session key, the third authentication information, the first device random number, and the second device random number are encrypted using the first algorithm to obtain the third encrypted data.

[0032] By using the above technical solution, the second encrypted data is decrypted using the first session key to obtain the first device random number and the first device counter data, and compared with the first device random number and the first device counter data stored on the first device. If the comparison result is consistent, the next step is performed, which increases the reliability of information authentication.

[0033] According to another specific embodiment of the present invention, the digital key security authentication method disclosed in this embodiment further includes a server in the security authentication system, and binds a first device and a second device through the following steps:

[0034] The first device obtains the second device and user information through a digital key account, and sends a request to the server to bind the second device.

[0035] The server verifies whether the user is bound to the second device;

[0036] If so, the information from the second device will be sent to the first device;

[0037] The first device checks whether the second device supports the digital key function. If the second device supports the digital key function, the first device performs an initialization operation. If the initialization is successful, the first device and the second device are successfully bound, and the user is prompted to activate the digital key function.

[0038] According to another specific embodiment of the present invention, the digital key security authentication method disclosed in this embodiment of the present invention includes the following initialization operation of the first device:

[0039] Generate the first device identification information; call the initialization interface of the dynamic white box of the first device to obtain the token, and send the first device identification information and the token to the server through the initialization interface of the dynamic white box;

[0040] The server stores the first device's identification information and user information, generates a white-box management key, and sends it to the first device;

[0041] The first device records the white-box management key and the first device identification information, and completes the initialization.

[0042] According to another specific embodiment of the present invention, the digital key security authentication method disclosed in this embodiment of the present invention, wherein establishing a communication connection between the first device and the second device includes:

[0043] The first device checks whether a digital key has been downloaded;

[0044] If so, then register the communication scanning service corresponding to the first device according to the first device model, and search for the target second device communication broadcast. If the target second device communicator is found, then send a connection request to the second device.

[0045] The second device accepts the connection request and checks whether it has completed pairing with the first device.

[0046] If so, then establish a communication connection;

[0047] If not, then send a security request message to the first device:

[0048] The first device calculates the pairing code based on the security request information and sends it to the second device;

[0049] The first and second devices calculate the long-term key and short-term key based on the pairing code, complete the pairing, and establish a communication connection.

[0050] By adopting the above technical solution, during the pairing process, the first device and the second device calculate a pairing code, and then calculate a long-term key and a short-term key based on the pairing code, and then complete the pairing and establish a communication connection, thereby increasing the security of the first device and the second device during the process of establishing a communication connection.

[0051] According to another specific embodiment of the present invention, the digital key security authentication method disclosed in this embodiment establishes a secure channel between a first device, a server, and a second device, including:

[0052] The first device and the second device complete communication pairing and send a request for a temporary public-private key pair to the server;

[0053] Based on the requested temporary public-private key pair information, the server generates a first temporary public key and a first temporary private key, and signs the first temporary public key using the server's pre-stored service public key to generate a first signature value. The server then sends the first signature value and the first temporary public key to the first device.

[0054] The first device receives the first signature value and the first temporary public key, and then sends the first signature value and the first temporary public key to the second device;

[0055] The second device uses the pre-stored service private key to verify the first signature value, and generates a second temporary public key and a second temporary private key. It uses the third session key to sign the first temporary public key and the second temporary public key to obtain the second signature value, and obtains the communicator number data of the second device. It then sends the second temporary public key, the second signature value, and the communicator number data to the first device.

[0056] The first device receives the second temporary public key, the second signature value, and the communicator number data and sends them to the server;

[0057] The server retrieves the relevant information of the second device from the preset correspondence between the communicator number data and the relevant information of the second device based on the communicator number data, and binds the first device and the second device; the server verifies the second signature value using the third session key. If the verification is successful, the secure channel between the first device, the server and the second device is successfully established.

[0058] Using the above technical solution, the first device and the second device generate a first temporary public key, a first temporary private key, a second temporary public key, and a second temporary private key, and exchange temporary public keys with each other. The first and second temporary public keys are then signed and verified by the second device and the server, with the same session key used for signing and verification. Therefore, symmetric encryption technology is employed during the establishment of the secure channel between the first device, the server, and the second device, ensuring the security of information encryption and transmission.

[0059] According to another specific embodiment of the present invention, in the digital key security authentication method disclosed in this embodiment, the third session key is calculated by using the first temporary private key and the second temporary public key.

[0060] According to another specific embodiment of the present invention, the digital key security authentication method disclosed in this embodiment of the present invention includes obtaining a first authentication key as follows:

[0061] The first device sends a request to the second device to obtain the activation conditions;

[0062] The second device receives the request information, detects the activation conditions, uses the second temporary private key to sign the activation conditions to obtain the third signature value, and uses the third session key to encrypt the activation conditions and the third signature value to obtain the fourth encrypted data, and sends the fourth encrypted data to the first device.

[0063] The first device receives the fourth encrypted data and sends the fourth encrypted data to the server;

[0064] The server uses the third session key to decrypt the fourth encrypted data and determines whether the activation conditions meet the preset conditions.

[0065] If the conditions are met, a random sequence code is generated, and the data of the random sequence code with a preset number of bits is used as the second device master key; the structure data is assembled, and the first authentication key is calculated using the second device master key and the structure data; the random sequence code is signed using the pre-stored service public key to obtain the fourth signature value; the random sequence code and the fourth signature value are encrypted using the third session key to obtain the fifth encrypted data; the structure data, the first authentication key and the fifth encrypted data are sent to the first device.

[0066] The first device stores the structure data, the first authentication key, and the fifth encrypted data.

[0067] According to another specific embodiment of the present invention, the digital key security authentication method disclosed in this embodiment of the present invention includes obtaining the second device master key as follows:

[0068] The second device obtains the fifth encrypted data stored in the first device, decrypts the fifth encrypted data using the third session key, obtains the random sequence code and the fourth signature value, and verifies the fourth signature value using the pre-stored service private key.

[0069] If successful, the random sequence code is saved, and the data of the random sequence code with a preset number of bits is taken as the master key of the second device.

[0070] The beneficial effects of this invention are:

[0071] The digital key security authentication method provided by this invention involves a first device and a second device exchanging authentication information. Each device encrypts its authentication information using its respective session key, then exchanges the encrypted data, and finally decrypts it using its session key to obtain its own authentication information. This information is then compared with the authentication information stored in the device. If both comparisons pass, authentication is successful. During this process, the first and second devices use the same encryption key. Therefore, symmetric encryption technology is used in the data encryption process, resulting in better security. Furthermore, two-way verification between the first and second devices is required; only when both verifications are successful can the digital key authenticate. This two-way authentication method further enhances the security of the authentication process. Attached Figure Description

[0072] Figure 1 This is a schematic diagram of one embodiment of the security authentication system provided in this invention;

[0073] Figure 2 yes Figure 1 A schematic diagram of the framework of one implementation method of digital key software in a mobile phone in a security authentication system;

[0074] Figure 3 yes Figure 2 A functional diagram of the white-box key in digital key software;

[0075] Figure 4 This is a flowchart illustrating the digital key authentication method provided in an embodiment of the present invention;

[0076] Figure 5 This is a schematic diagram of the process of obtaining the first encrypted data in the digital key authentication method provided in the embodiment of the present invention;

[0077] Figure 6 This is a schematic diagram of the process for obtaining the second encrypted data in the digital key authentication method provided in this embodiment of the invention;

[0078] Figure 7 This is a schematic diagram of the process for obtaining third encrypted data in the digital key authentication method provided in this embodiment of the invention;

[0079] Figure 8 This is a schematic diagram of the process of binding a mobile phone and a vehicle in the digital key authentication method provided in this embodiment of the invention;

[0080] Figure 9 This is a schematic diagram of the process of establishing a communication connection between a mobile phone and a vehicle in the digital key authentication method provided in this embodiment of the invention;

[0081] Figure 10 This is a schematic diagram illustrating the process of establishing a secure channel between a mobile phone, a vehicle, and a server in the digital key authentication method provided in this embodiment of the invention.

[0082] Figure 11 This is a schematic diagram of the process of the server sending the first authentication key to the mobile phone in the digital key authentication method provided in the embodiment of the present invention;

[0083] Figure 12 This is a schematic diagram of the process of obtaining the vehicle master key in the digital key authentication method provided in the embodiments of the present invention;

[0084] Figures 13A-13H This is a partial schematic diagram of the mobile phone interface during the initial activation of the digital key in the digital key authentication method provided in this embodiment of the invention.

[0085] Explanation of reference numerals in the attached figures:

[0086] 100: mobile phone; 200: vehicle; 300: server. Detailed Implementation

[0087] The following specific embodiments illustrate the implementation of the present invention. Those skilled in the art can easily understand other advantages and effects of the present invention from the content disclosed in this specification. Although the description of the present invention is presented in conjunction with preferred embodiments, this does not mean that the features of the invention are limited to these embodiments. On the contrary, the purpose of describing the invention in conjunction with embodiments is to cover other options or modifications that may be derived based on the claims of the present invention. To provide a deep understanding of the invention, many specific details will be included in the following description. The invention may also be implemented without using these details. Furthermore, to avoid confusion or obscuring the focus of the invention, some specific details will be omitted in the description. It should be noted that, unless otherwise specified, the embodiments and features in the embodiments of the present invention can be combined with each other.

[0088] The terms “first”, “second”, etc., are used only to distinguish descriptions and should not be interpreted as indicating or implying relative importance.

[0089] To make the objectives, technical solutions, and advantages of the present invention clearer, the embodiments of the present invention will be described in further detail below with reference to the accompanying drawings.

[0090] To address the low security of traditional Bluetooth digital key authentication methods in existing technologies, which employ proprietary authentication algorithms that are vulnerable to cracking and relay attacks, this invention discloses a digital key security authentication method applicable to a security authentication system comprising a first device, a second device, and a server. The method utilizes symmetric encryption technology during data encryption, and bidirectional authentication is required between the first and second devices, thereby enhancing the security of digital key authentication.

[0091] To clearly illustrate the digital key security authentication method of the present invention, the security authentication system will first be described in detail. The security authentication system includes a first device and a second device; in one specific embodiment of the present invention, such as... Figure 1 As shown, in the security authentication system, the first device can be a mobile phone 100, and the second device can be a vehicle 200.

[0092] In this embodiment, the first device, mobile phone 100, and the second device, vehicle 200, can establish a communication connection via Bluetooth; alternatively, they can also establish a connection via wireless local area network or other short-range communication technologies. This embodiment does not impose specific limitations on this. It should be noted that, in this embodiment, if... Figure 1 As shown, the security authentication system also includes server 300.

[0093] Specifically, digital key software is installed on the mobile phone. For example... Figure 2 As shown, the digital key software (APP) is designed with an interface, business modules, and security middleware. The security middleware communicates with the interface and business modules through an aggregation interface. To ensure the security of the digital key operation, the security middleware includes functions such as key decryption, white-box encryption, environmental monitoring, and device fingerprinting to prevent tampering and protect the operation.

[0094] Among them, such as Figure 3 As shown, the white-box key used for white-box encryption has the functions of software hardening-disassembly, software library encryption-anti-call / anti-replacement, integrity protection-anti-tampering / anti-repackaging, runtime dynamic protection-anti-debugging / anti-dynamic injection, local data encryption-anti-theft, and software library binding-decompilation.

[0095] Furthermore, the use of digital keys also involves data transmission. Therefore, in order to ensure the security of data transmission, the mobile phone 100 should also be designed with a digital key framework, security elements, and a trusted execution environment that enables the digital key to operate securely.

[0096] Vehicle 200 is used to receive signals sent by the digital key of mobile phone 100, and performs functions such as unlocking and locking based on the digital key signals sent by mobile phone 100. Therefore, in order to ensure the passage safety of vehicle 200 during the process of receiving information sent by digital key of mobile phone 100, vehicle 200 involves secure communication, vehicle white box, vehicle synchronization engineering, vehicle system, etc.

[0097] Furthermore, the vehicle's onboard computer security protection can include Joint Test Action Group (JTAG) interface password protection and Bluetooth port monitoring; the Bluetooth port monitoring can include replay protection and whitelisting.

[0098] Furthermore, Vehicle 200 can also be dynamically updated, including regular updates to keys, identity certificates, and security vulnerabilities.

[0099] Vehicle 200 can perform secure positioning and continuously monitor the degree of matching between signal strength changes and motion state characteristics to prevent replay attacks.

[0100] Vehicle 200 can receive a unique digital certificate issued to it, can perform end-to-end two-way identity authentication with mobile phone 100, can calculate dynamic session keys, and ensure the security of encrypted data.

[0101] Vehicle 200 has a security chip that enables secure encryption and secure storage.

[0102] Vehicle 200 also features a high-strength encryption algorithm. Data encryption based on this algorithm effectively prevents brute-force attacks.

[0103] Server 300 is used to issue white-box keys to mobile phone 100 and vehicle master keys and root keys to vehicle 200 during the download of digital key software on mobile phone 100. Furthermore, server 300 stores the keys of all vehicles with established communication connections, as well as the root master keys corresponding to the vehicle keys. Therefore, server 300 has extremely high requirements for communication security, data security, network security, and system security.

[0104] Specifically, to ensure the communication security of server 300, server 300 has a secure encrypted transmission channel based on Transport Layer Security (TLS) protocol, and can perform identity authentication based on OAuth / JWtuken.

[0105] To ensure the data security of Server 300, its key management system enables secure key management; during data encryption, it can encrypt and store sensitive data, interface with Public Key Infrastructure (PKI) for signing; it implements strict control over data access; and it records all data audits.

[0106] To ensure the network security of Server 300, its web-layer firewall can prevent web-layer packet attacks; its network-layer firewall can control network packets and prevent network attacks; it can perform situational attack and attack detection to promptly detect hacker attacks; and it can perform traffic scrubbing to filter out hacker attack traffic and defend against denial-of-service attacks.

[0107] To ensure the system security of Server 300, the host security protection of Server 300 enables flexible deployment, system backup, and rapid repair, achieving system-level security and reliability; it can perform system security hardening, strengthening security measures such as opening ports for system accounts by hackers and system patches to prevent network attacks; and it can prevent attacks caused by server vulnerabilities.

[0108] It should be noted that the first device can be a mobile phone, or it can be an electronic device such as a tablet or computer.

[0109] The second device can be a vehicle 200, or it can be a cabinet, door lock, etc.

[0110] Next, refer to Figures 4-12 , Figures 13A-13H The present invention provides a detailed description of the digital key security authentication method.

[0111] like Figure 4As shown, the digital key security authentication method provided by this invention is applied to a security authentication system including a first device and a second device. The following description uses a mobile phone 100 as the first device and a vehicle 200 as the second device as an example to illustrate the digital key security authentication method. The mobile phone 100 includes a pre-stored first authentication key, and the vehicle 200 includes a pre-stored vehicle master key.

[0112] Specifically, the authentication method is mainly executed through the digital key software on the mobile phone 100; and the pre-stored first authentication key is stored in the white box of the mobile phone 100, while the pre-stored vehicle master key is stored in the security chip of the vehicle 200.

[0113] Authentication methods include:

[0114] S1: Mobile phone 100 establishes a communication connection with vehicle 200; vehicle 200 sends authentication request information to mobile phone 100, the authentication request information including first authentication information.

[0115] The communication connection established between the mobile phone 100 and the vehicle 200 can be a Bluetooth connection, a wireless local area network connection, etc.

[0116] S2: Mobile phone 100 obtains the first data packet based on the received authentication request information and sends the first data packet to vehicle 200; wherein, the first data packet includes second authentication information and first encrypted data, the first encrypted data includes the first authentication information encrypted by the first session key, and the first session key is obtained by the first authentication key.

[0117] Specifically, after receiving the authentication request information, the mobile phone 100 will generate corresponding first authentication information based on the vehicle 200 identifier in the authentication request information. In order to ensure the security of information transmission, the first authentication information needs to be encrypted using the session key during the process of sending data to the vehicle 200.

[0118] In one specific implementation, the first authentication information includes a vehicle random number and a vehicle identifier. For example... Figure 5 As shown, the steps for mobile phone 100 to obtain the first encrypted data include:

[0119] S21: Mobile phone 100 obtains digital key information and generates a mobile phone random number based on the pre-stored correspondence between vehicle identification and digital key information; the digital key information includes mobile phone counter data and a first initial vector.

[0120] S22: Using the first authentication key, the first initial vector, the mobile phone random number, and the vehicle random number are calculated using the first algorithm to obtain the first session key.

[0121] S23: Using the first session key and the first algorithm, encrypt the vehicle 200 random number and the mobile phone 100 counter data to obtain the first encrypted data.

[0122] Specifically, vehicle identification may include vehicle model information, vehicle master key, vehicle extended fields, and the physical address of the vehicle communication module.

[0123] The correspondence between the vehicle identifier and the digital key information pre-stored in the mobile phone 100 is stored in the mobile phone 100 during the initial activation of the digital key.

[0124] The random number generated by vehicle 200 is generated during the process of sending authentication request information to mobile phone 100 after establishing a communication connection between vehicle 200 and mobile phone 100. It should be noted that when vehicle 200 sends the generated random number to mobile phone 100, it also stores it in vehicle 200's security chip for later use.

[0125] The first algorithm used for calculation here is the encryption algorithm pre-stored in mobile phone 100 and vehicle 200, which adopts Advanced Encryption Standard (AES). It can be AES-128, AES-192, AES-256, Data Encryption Standard (DES), etc. This implementation does not impose specific limitations on it.

[0126] S3: Vehicle 200 decrypts the first encrypted data, obtains the decrypted first authentication information, and compares it with the first authentication information stored in vehicle 200; if the comparison result is consistent, vehicle 200 generates a second data packet based on the second authentication information and sends the second data packet to mobile phone 100; wherein, the second data packet includes third authentication information and second encrypted data, the second encrypted data includes second authentication information encrypted by a second session key, the second session key is obtained through a second authentication key, and the second authentication key is the same as the first authentication key.

[0127] Specifically, if the information transmission channel between mobile phone 100 and vehicle 200 is secure, the first authentication information obtained by vehicle 200 after decrypting the first encrypted data should be the same as the first authentication information stored in the security chip of vehicle 200. Therefore, by comparing the decrypted first authentication information with the stored first authentication information, if the comparison result is the same, it can be preliminarily concluded that the information transmission channel between mobile phone 100 and vehicle 200 is secure. However, this only indicates that the process of vehicle 200 sending information to mobile phone 100 is secure. Therefore, it is necessary to further verify whether the process of mobile phone 100 sending information to vehicle 200 is secure. Vehicle 200 will encrypt the second authentication information sent by mobile phone 100, generate second encrypted data, and send it to mobile phone 100, waiting for mobile phone 100 to verify it.

[0128] In one specific implementation, the first data packet further includes a mobile phone random number and pre-stored structure data on the mobile phone 100, and the second authentication information includes the mobile phone random number and mobile phone counter data. For example... Figure 6 As shown, obtaining the second encrypted data includes:

[0129] S31: The second authentication key is obtained by using the second algorithm to calculate the structure data and the vehicle master key.

[0130] S32: Using the second authentication key, the first algorithm is used to calculate the random number of the mobile phone and the random number of the vehicle to obtain the second session key.

[0131] S33: Decrypt the first encrypted data using the second session key to obtain the vehicle random number and mobile phone counter data; and compare them with the vehicle random number stored on vehicle 200. If the comparison result is consistent, proceed to step S34.

[0132] It should be noted that if the comparison results are inconsistent, it indicates that the authentication has failed, and the user needs to be reminded to re-authenticate.

[0133] S34: Using the second session key, the vehicle authentication extension information, mobile phone random number, and mobile phone counter data are encrypted using the first algorithm to obtain the second encrypted data.

[0134] Specifically, the second algorithm can be a hash (SHA) encryption algorithm stored by mobile phone 100 and vehicle 200, which can be SHA-256, SHA-1, SHA-224, SHA-384, or SHA-512. During the adoption of the hash encryption algorithm, a hash-based message authentication code (HMAC) is also defined.

[0135] Furthermore, the security authentication system also includes a server 300. During the process of the server 300 sending the vehicle master key and the mobile phone first authentication key to the mobile phone 100 and the vehicle 200, the server 300 sends the generated structure number to the mobile phone 100, which stores it in a white box.

[0136] It should be noted that the second authentication key is calculated using the second algorithm on the structured data and the vehicle master key, and this second authentication key is generated in vehicle 200. The first authentication key is calculated by server 300 using the second algorithm on the structured data and the vehicle master key stored on server 300; therefore, the second authentication key is the same as the first authentication key. The first session key and second session key used in the data encryption and decryption process between mobile phone 100 and vehicle 200 are calculated using the first authentication key and the second authentication key. The authentication key remains the same during the calculation process, utilizing symmetric encryption technology to ensure the security of information encryption.

[0137] Furthermore, the digital key security authentication method of the present invention fully integrates the mobile phone 100, vehicle 200 and server 300, taking into account the security of the digital key throughout its entire lifecycle.

[0138] In one specific implementation, the vehicle authentication extension information is obtained by the following method: obtaining the preset number of bits of the random sequence code pre-stored in vehicle 200, and using a first algorithm to calculate the vehicle authentication extension information by combining the vehicle master key pre-stored in vehicle 200 and the preset number of bits.

[0139] Specifically, the random sequence code pre-stored in vehicle 200 is a random number generated by the cryptographic machine in server 300 and sent to vehicle 200 for storage. In the process of calculating vehicle authentication extension information, the high 16 bits of the random sequence code pre-stored in vehicle 200 can be used as vehicle authentication extension information, or other preset bit lengths of data can be used as vehicle authentication extension information as needed. This embodiment does not impose specific restrictions on this.

[0140] S4: Mobile phone 100 decrypts the second encrypted data, obtains the decrypted second authentication information, and compares it with the second authentication information stored in mobile phone 100;

[0141] If the comparison results are consistent, a third data packet is sent to vehicle 200; wherein the third data packet includes third encrypted data, and the third encrypted data includes third authentication information encrypted with the first session key.

[0142] Specifically, the second authentication information is generated by mobile phone 100 based on the authentication request information sent by vehicle 200 and sent to vehicle 200. Vehicle 200 encrypts the second authentication information and sends it to mobile phone 100. If the information transmission channel between mobile phone 100 and vehicle 200 is secure, the decrypted second authentication information should be consistent with the second authentication information stored on mobile phone 100. Therefore, comparing the decrypted second authentication information with the second authentication information stored in mobile phone 100, the result is the same, indicating that the information transmission channel is secure. Mobile phone 100 continues to send a third data packet to vehicle 200. During the sending of the third data packet, it needs to obtain the third encrypted data.

[0143] In one specific implementation, such as Figure 7 As shown, in step S4, the mobile phone 100 obtains the third encrypted data including:

[0144] S41: Decrypt the second encrypted data using the first session key, obtain the mobile phone random number and mobile phone counter data, and compare them with the mobile phone random number and mobile phone counter data stored on the mobile phone 100. If the comparison result is consistent, proceed to step S42.

[0145] It should be noted that if the comparison results are different, it means that the authentication has failed and the user needs to be reminded to re-authenticate.

[0146] S42: Increment the mobile phone 100 counter data by 1; and use the second algorithm to calculate the vehicle random number and vehicle authentication extension information to obtain the third authentication information.

[0147] S43: Using the first session key, the third authentication information, the mobile phone random number, and the vehicle random number are encrypted using the first algorithm to obtain the third encrypted data.

[0148] Specifically, the third authentication information is obtained by calculating the vehicle random number and vehicle authentication extension information using the second algorithm. When the second algorithm is a hash algorithm, the third authentication information can be a specific hash value.

[0149] S5: Vehicle 200 decrypts the third encrypted data, obtains the decrypted third authentication information, and compares it with the third authentication information stored in Vehicle 200; if the comparison result is consistent, the authentication is successful, Vehicle 200 generates a success notification request message and sends it to Mobile Phone 100.

[0150] S6: Mobile phone 100 receives the success notification request, generates a success notification receipt, and sends it to vehicle 200.

[0151] Through the above steps S1-S6, the authentication between mobile phone 100 and vehicle 200 is successful, and the vehicle 200 can be unlocked, locked and other control operations can be performed through the digital key software of mobile phone 100.

[0152] It should be noted that if the comparison results in any of steps S3-S5 above are inconsistent, it indicates authentication failure, and the digital key authentication fails. In this case, the user cannot control the vehicle using the digital key on their mobile phone. Users should be reminded to check if their authentication environment meets the requirements, adjust any non-compliant conditions, and then re-authenticate.

[0153] Using the above technical solution, the first and second devices exchange authentication information, encrypting the information using their respective session keys. They then exchange the encrypted data, decrypt it using their session keys to obtain their own authentication information, and compare it with their stored authentication information. If both comparisons pass, authentication is successful. Throughout this process, the first and second devices use the same encryption key. Therefore, symmetric encryption technology is used in the data encryption process, resulting in better security. Furthermore, two-way verification between the first and second devices is required; only after successful two-way verification can the digital key be authenticated. This two-way authentication method further enhances authentication security.

[0154] Furthermore, the digital key is software installed on the mobile phone 100. When the mobile phone 100 initially downloads the digital key software, it needs to be bound to and activated with the vehicle 200 to be controlled in order to control the vehicle 200 using the digital key in subsequent use.

[0155] It should be noted that the information of vehicle 200 and the user information corresponding to vehicle 200 are pre-stored in server 300, and the information of vehicle 200 and the user information corresponding to vehicle 200 can be retrieved from server 300.

[0156] In one specific implementation, such as Figure 8 As shown, the steps to bind user information to vehicle 200 are as follows:

[0157] Mobile phone 100 obtains vehicle 200 and user information through digital key account, and sends a request to server 300 to bind vehicle 200.

[0158] Server 300 verifies whether the user and vehicle are bound together.

[0159] If so, the information of vehicle 200 will be sent to mobile phone 100.

[0160] Specifically, users can manually enter user information and vehicle information through the digital key account interface; alternatively, users can enter only user information and the mobile phone 100 can retrieve the corresponding vehicle 200 information from the server 300; or users can enter only vehicle 200 information and the mobile phone 100 can retrieve the corresponding user information from the server 300. This implementation does not impose any specific restrictions on these methods.

[0161] Mobile phone 100 checks whether vehicle 200 supports digital key function. If vehicle 200 supports digital key function, mobile phone 100 performs initialization operation. If initialization is successful, user information is successfully bound to vehicle 200, and the user is reminded whether to activate digital key function.

[0162] It should be noted that if the server verifies that the user and vehicle are not bound together, the digital key software on the mobile phone will remind the user that the user and vehicle are not bound together and need to bind the user and vehicle. In this case, the digital key will not be activated.

[0163] Furthermore, if the vehicle does not support digital key functionality, the digital key on the mobile phone will not be activated.

[0164] In one specific implementation, the initialization operation of mobile phone 100 includes: generating mobile phone 100 identification information; calling the initialization interface of the dynamic white box of mobile phone 100 to obtain a token, and sending the mobile phone 100 identification information and the token to server 300 through the initialization interface of the dynamic white box.

[0165] Server 300 stores mobile phone 100's identification information and user information, generates a white-box management key, and sends it to mobile phone 100. Mobile phone 100 then completes the white-box management key loading.

[0166] Mobile phone 100 records the white-box management key and mobile phone 100 identification information, and completes initialization.

[0167] After mobile phone 100 is successfully bound to vehicle 200, a communication connection needs to be established before mobile phone 100 and vehicle 200 can perform authentication. Only after the communication connection between mobile phone 100 and vehicle 200 is successfully established can authentication be performed in subsequent use.

[0168] In one specific implementation, such as Figure 9 As shown, the steps for establishing a communication connection between mobile phone 100 and vehicle 200 include: mobile phone 100 detecting whether a digital key has been downloaded.

[0169] If so, then register the communication scanning service corresponding to mobile phone 100 according to the mobile phone model, and search for the communication broadcast of the target vehicle 200. If the communicator of the target vehicle 200 is found, then send a connection request to the vehicle 200.

[0170] If the mobile phone 100 has not downloaded the digital key, the user needs to be reminded to download the digital key. After the user downloads the digital key, the digital key is activated and a communication connection is established between the mobile phone 100 and the vehicle 200.

[0171] Vehicle 200 accepts the connection request and checks whether it has completed pairing with mobile phone 100.

[0172] If yes, a communication connection is established; otherwise, when vehicle 200 detects that there is no local pairing record with mobile phone 100, a security request message is sent to mobile phone 100.

[0173] Based on the security request information, mobile phone 100 initiates a pairing request to the backend. The backend calculates the pairing code based on the Bluetooth broadcast information and calls the backend interface to send the pairing code to the front-end interface of mobile phone 100. At the same time, vehicle 200 receives the pairing code.

[0174] Based on the pairing code, mobile phone 100 and vehicle 200 calculate the long-term key and short-term key, complete the pairing, and establish a communication connection.

[0175] Specifically, when the communication connection established between mobile phone 100 and vehicle 200 is a Bluetooth connection, the registered communication scanning service is the Bluetooth scanning service. Different Bluetooth scanning services need to be registered depending on the mobile phone model 100. Specifically, if mobile phone 100 is an O / M / V phone that supports Bluetooth activation, a Bluetooth whitelist service is registered; if mobile phone 100 is an Apple phone, iBeacon filtering conditions are registered based on the vehicle identification number (VIN) information, and event callback methods are defined.

[0176] When the mobile phone 100 turns on Bluetooth and performs Bluetooth scanning, it can filter out unwanted vehicle Bluetooth broadcast information based on the vehicle identification code, thereby obtaining the target vehicle's Bluetooth communication broadcast and establishing a Bluetooth connection with the target vehicle.

[0177] It should be noted that during the initial activation of the digital key, the mobile phone 100 and the vehicle 200 need to be paired first to complete the communication connection. When using the digital key later, if the mobile phone 100 and the vehicle 200 have already been paired, the digital key can be used directly; if the pairing relationship between the mobile phone 100 and the vehicle 200 is lost, the same steps need to be followed to re-pair the mobile phone 100 and the vehicle 200.

[0178] After the mobile phone 100 and vehicle 200 complete pairing and establish a communication connection, a secure channel needs to be established between the mobile phone 100, vehicle 200 and server 300 so that the server 300 can send the first authentication key, the vehicle 200 master key and related information to the mobile phone 100 and vehicle 200.

[0179] In one specific implementation, such as Figure 10 As shown, establishing a secure channel between mobile phone 100, server 300, and vehicle 200 includes the following steps:

[0180] Mobile phone 100 and vehicle 200 complete communication pairing and send a request for temporary public-private key pair information to server 300.

[0181] Based on the requested temporary public-private key pair information, server 300 generates a first temporary public key and a first temporary private key, and signs the first temporary public key using the service public key pre-stored by server 300 to generate a first signature value, and sends the first signature value and the first temporary public key to mobile phone 100.

[0182] Mobile phone 100 receives the first signature value and the first temporary public key, and sends the first signature value and the first temporary public key to vehicle 200.

[0183] Vehicle 200 verifies the first signature value using the pre-stored service private key, generates a second temporary public key and a second temporary private key, signs the first temporary public key and the second temporary public key using the third session key to obtain the second signature value, and obtains the communicator number data of vehicle 200. It then sends the second temporary public key, the second signature value, and the communicator number data to mobile phone 100.

[0184] Mobile phone 100 receives the second temporary public key, the second signature value, and the communicator number data and sends them to server 300.

[0185] Server 300 obtains vehicle 200 related information from the preset correspondence between communicator number data and vehicle 200 related information based on communicator number data, and binds mobile phone 100 and vehicle 200; server 300 verifies the second signature value using the third session key. If successful, the secure channel between mobile phone 100, server 300 and vehicle 200 is successfully established.

[0186] If the server fails to verify the second signature value using the third session key, it indicates that the secure channel has failed to be established, and the digital key activation has failed. The user should be reminded to check the activation environment conditions, adjust any unsatisfactory activation environment conditions, and then reactivate.

[0187] Specifically, when the communication connection established between mobile phone 100 and vehicle 200 is a Bluetooth connection, the communicator ID data is specifically the Bluetooth ID data of vehicle 200. The Bluetooth ID data of vehicle 200 and related information are pre-stored in server 300. Therefore, after mobile phone 100 sends the received Bluetooth ID data to server 300, server 300 can obtain relevant information about vehicle 200 and its Bluetooth physical address based on the Bluetooth ID data.

[0188] It should be noted that during the establishment of the secure channel between mobile phone 100, vehicle 200 and server 300, the third session key used for signing and verification is the same, and symmetric encryption technology is used, which has a relatively high level of security.

[0189] In one specific implementation, the third session key is calculated using the first temporary private key and the second temporary public key.

[0190] After the secure channel between mobile phone 100, vehicle 200 and server 300 is established, server 300 needs to send the first authentication key to mobile phone 100 and the vehicle 200 master key and other related information to vehicle 200 so as to facilitate mutual authentication between mobile phone 100 and vehicle 200 during the subsequent use of digital key.

[0191] In one specific implementation, such as Figure 11 As shown, obtaining the first authentication key for mobile phone 100 includes the following steps:

[0192] Mobile phone 100 sends a request to vehicle 200 to obtain activation conditions.

[0193] Vehicle 200 receives the request information, detects the activation conditions, uses the second temporary private key to sign the activation conditions to obtain the third signature value, and uses the third session key to encrypt the activation conditions and the third signature value to obtain the fourth encrypted data, and sends the fourth encrypted data to mobile phone 100.

[0194] Specifically, activation conditions include whether the mobile phone is inside the vehicle and whether the current ignition position is ON.

[0195] Mobile phone 100 receives the fourth encrypted data and sends the fourth encrypted data to server 300.

[0196] Server 300 uses the third session key to decrypt the fourth encrypted data and determines whether the activation conditions meet the preset conditions.

[0197] If the conditions are met, a random sequence code is generated, and the data of the random sequence code with a preset number of bits is taken as the vehicle 200 master key; the structure data is assembled, and the first authentication key is calculated using the vehicle 200 master key and the structure data; the random sequence code is signed using the pre-stored service public key to obtain the fourth signature value; the random sequence code and the fourth signature value are encrypted using the third session key to obtain the fifth encrypted data; the structure data, the first authentication key and the fifth encrypted data are sent to the mobile phone 100.

[0198] It should be noted that the random code sequence is randomly generated by the cryptographic machine in server 300 based on the received information.

[0199] If the activation conditions are not met, the digital key activation will fail. The user will be prompted to check the activation environment conditions, adjust any unsatisfactory conditions, and then reactivate.

[0200] The mobile phone 100 stores structured data, the first authentication key, and the fifth encrypted data.

[0201] It should be noted that if mobile phone 100 is an ICCE Huawei phone, the car key can be directly added to the Huawei Wallet on mobile phone 100, and server 300 does not need to send the first authentication key to mobile phone 100 when sending data. If mobile phone 100 is not an ICCE Huawei phone, then the first authentication key needs to be sent to mobile phone 100.

[0202] In one specific implementation, such as Figure 12 As shown, obtaining the vehicle master key includes the following steps:

[0203] Vehicle 200 obtains the fifth encrypted data stored in mobile phone 100, decrypts the fifth encrypted data using the third session key, obtains the random sequence code and the fourth signature value, and verifies the fourth signature value using the pre-stored service private key.

[0204] If successful, the random sequence code is saved, and the data of the random sequence code with a preset number of bits is taken as the vehicle 200 master key.

[0205] If the verification fails, the digital key activation will fail. The user will be prompted to check the activation environment conditions, adjust any unsuitable conditions, and then reactivate.

[0206] Specifically, the lower 16 bits of the random code sequence can be used as the vehicle 200 master key, or other bits of data can be used as the vehicle 200 master key as needed.

[0207] It should be noted that after the server 300 successfully sends the first authentication key, vehicle master key, and other information to the mobile phone 100 and vehicle 200, the server 300 will receive a success result from the digital key software. After the server 300 determines that the key has been successfully sent, it will mark the vehicle 200 status as having completed the key issuance and send the result to the digital key software on the mobile phone 100. The digital key software will then notify the user that the car key has been successfully activated. If the mobile phone 100 is an ICCE mobile phone 100, the user will need to be reminded to activate the car key.

[0208] Next, refer to Figures 13A-13H The diagram of the mobile phone interface describes the activation process of the digital key.

[0209] If the mobile phone 100 is not an ICCE mobile phone, after the user completes the vehicle binding authentication and activates the vehicle 200, the system will first enter the "My Car" page to determine if the vehicle 200 has a digital key function. If the vehicle 200 has a digital key function, it will check if the digital key has been activated. If it has been activated, it can be used directly. If it has not been activated, the system will proceed to... Figure 13A The interface shown.

[0210] like Figure 13A As shown, the interface displays a reminder box, a "Later" control, and an "Activate" control. The reminder box prompts the user, "You have a digital key to be activated. Do you want to activate it now?" The user can interact with the "Later" control and the "Activate" control. If the user's interaction with the "Later" control is detected, activation will not proceed temporarily. If the user's interaction with the "Activate" control is detected, a user agreement will pop up on the phone's interface for the user to confirm.

[0211] After the user confirms, it is determined whether the digital key is being activated for the first time. If it is, then proceed... Figure 13B The interface shown includes a "Next" control.

[0212] Figure 13B The interface shown pops up a reminder message, prompting the user to confirm whether the preset conditions are met. If it is not the first activation, it will directly check whether Bluetooth 100 of the phone is turned on.

[0213] User based Figure 13B The user can view the conditions displayed on the interface. When all conditions are met, the "Next" control is triggered. At this time, it is determined whether Bluetooth on the mobile phone 100 is turned on. If Bluetooth on the mobile phone 100 is not turned on, the user is prompted to turn on Bluetooth and perform Bluetooth pairing. If Bluetooth on the mobile phone 100 is turned on, the mobile phone 100 and the vehicle 200 will pair and connect via Bluetooth.

[0214] It should be noted that if the mobile phone 100 and the vehicle 200 have been paired via Bluetooth before, the mobile phone 100 and the vehicle 200 can directly connect via Bluetooth.

[0215] If the mobile phone 100 and the vehicle 200 have not been paired via Bluetooth, then proceed to... Figure 13C As shown in the interface, the phone's background calculates the pairing code based on the Bluetooth broadcast data and automatically displays it on the phone's 100 interface through the digital key software, reminding the user to pair via Bluetooth. Figure 13C The interface shown includes a "Confirm Pairing" control.

[0216] Users Figure 13CEnter the pairing code on the interface shown and operate the "Confirm Pairing" control. At this time, mobile phone 100 and vehicle 200 will pair via Bluetooth. Once successful Bluetooth pairing is detected, it will enter... Figure 13D The interface shown will prompt you to wait for key activation. Once the key is successfully activated, you will proceed to... Figure 13E The interface shown is Figure 13E The interface shown includes a "Next" control.

[0217] It should be noted that if Bluetooth pairing between mobile phone 100 and vehicle 200 fails during the pairing process, a message similar to "Pairing failed, you need to pair again" and related controls should be displayed on the mobile phone interface, allowing the user to select Bluetooth pairing again. Users can also try turning off Bluetooth on mobile phone 100 and then turning it back on, and then pairing again.

[0218] After detecting the user's interaction with the "Next" control, it is necessary to determine whether mobile phone 100 is an ICCE mobile phone. If it is an ICCE mobile phone, then proceed to... Figure 13F The interface shown will redirect you to Huawei Wallet to generate a key card. Alternatively, if your phone is an ICCE-compliant phone, you can directly add a car key in the car key section of Huawei Wallet, and then follow the steps... Figures 13A-13F The process shown in the interface activates the vehicle's 200 key.

[0219] If the phone is not an ICCE phone, then proceed to... Figure 13G The interface shown allows you to... Figure 13G Clicking on the various controls in the interface shown will control vehicle 200.

[0220] It should be noted that when digital key activation fails, access via mobile phone 100 will be possible. Figure 13H The interface shown is Figure 13H The interface shown includes a "reactivate" control, which the user can use to... Figure 13H Use the information displayed on the interface to check the reason for the activation failure and make adjustments. Then click the "Reactivate" control to reactivate.

[0221] It should be noted that, Figures 10-12 In the flowchart shown, if verification fails or activation conditions are not met, the words "Reactivate" will be displayed on the phone screen, requiring the user to follow the instructions. Figure 13H Use the information displayed on the interface to check the reason for the activation failure and make adjustments. Then click the "Reactivate" control to reactivate.

[0222] While the present invention has been illustrated and described with reference to certain preferred embodiments, those skilled in the art should understand that the above description is a further detailed explanation of the invention in conjunction with specific embodiments, and should not be construed as limiting the specific implementation of the invention to these descriptions. Various changes in form and detail can be made by those skilled in the art, including several simple deductions or substitutions, without departing from the spirit and scope of the invention.

Claims

1. A digital key security authentication method, characterized in that, An authentication system comprising a first device and a second device; the first device includes a pre-stored first authentication key, and the second device includes a pre-stored second device master key; the authentication method includes: S1: The first device establishes a communication connection with the second device; the second device sends authentication request information to the first device, the authentication request information including first authentication information; S2: The first device obtains a first data packet based on the received authentication request information and sends the first data packet to the second device; wherein, the first data packet includes second authentication information and first encrypted data, the first encrypted data includes the first authentication information encrypted with a first session key, and the first session key is obtained through the first authentication key; S3: The second device decrypts the first encrypted data, obtains the decrypted first authentication information, and compares it with the first authentication information stored in the second device; If the comparison result is consistent, the second device generates a second data packet based on the second authentication information and sends the second data packet to the first device; wherein, the second data packet includes third authentication information and second encrypted data, the second encrypted data includes the second authentication information encrypted by a second session key, the second session key is obtained by a second authentication key, and the second authentication key is the same as the first authentication key; S4: The first device decrypts the second encrypted data, obtains the decrypted second authentication information, and compares it with the second authentication information stored in the first device; If the comparison results are consistent, a third data packet is sent to the second device; wherein, the third data packet includes third encrypted data, and the third encrypted data includes the third authentication information encrypted with the first session key; S5: The second device decrypts the third encrypted data, obtains the decrypted third authentication information, and compares it with the third authentication information stored in the second device; If the comparison results are consistent, the authentication is successful, and the second device generates a success notification request message and sends it to the first device; S6: The first device receives the success notification request information, generates a success notification receipt, and sends it to the second device.

2. The digital key security authentication method as described in claim 1, characterized in that, The first authentication information includes a second device random number and a second device identifier; in step S2, the first device obtaining the first encrypted data includes: S21: The first device obtains digital key information based on the pre-stored correspondence between the second device identifier and digital key information, and generates a first device random number; the digital key information includes first device counter data and a first initial vector; S22: Using the first authentication key, the first initial vector, the first device random number, and the second device random number are calculated using the first algorithm to obtain the first session key; S23: Using the first session key, encrypt the second device random number and the first device counter data using the first algorithm to obtain the first encrypted data.

3. The digital key security authentication method as described in claim 2, characterized in that, The first data packet also includes a first device random number and pre-stored structure data of the first device; the second authentication information includes the first device random number and the first device counter data; in step S3, the second device obtaining the second encrypted data includes: S31: The second authentication key is obtained by calculating the structure data and the second device master key using the second algorithm; S32: Using the second authentication key, the first device random number and the second device random number are calculated using the first algorithm to obtain the second session key; S33: Decrypt the first encrypted data using the second session key, obtain the second device random number and the first device counter data; and compare them with the second device random number stored on the second device. If the comparison result is consistent, proceed to step S34. S34: Using the second session key, the second device authentication extension information, the first device random number, and the first device counter data are encrypted using the first algorithm to obtain the second encrypted data.

4. The digital key security authentication method as described in claim 3, characterized in that, The second device authentication extension information is obtained through the following methods: Obtain the preset bit length data of the random sequence code pre-stored in the second device, and use the first algorithm to calculate the second device authentication extension information by combining the second device master key pre-stored in the second device and the preset bit length data.

5. The digital key security authentication method as described in claim 4, characterized in that, In step S4, the first device acquires the third encrypted data including: S41: Decrypt the second encrypted data using the first session key, obtain the first device random number and the first device counter data, and compare them with the first device random number and the first device counter data stored on the first device. If the comparison result is consistent, proceed to step S42. S42: Increment the counter data of the first device by 1; and use the second algorithm to calculate the random number of the second device and the authentication extension information of the second device to obtain the third authentication information; S43: Using the first session key, the third authentication information, the first device random number, and the second device random number are encrypted using the first algorithm to obtain the third encrypted data.

6. The digital key security authentication method as described in any one of claims 1-5, characterized in that, The security authentication system also includes a server, and binds the first device and the second device through the following steps: The first device obtains the second device and user information through a digital key account, and sends a request to the server to bind the second device; The server verifies whether the user is bound to the second device; If so, the information of the second device will be sent to the first device; The first device detects whether the second device supports the digital key function. If the second device supports the digital key function, the first device performs an initialization operation. If the initialization is successful, the first device and the second device are successfully bound, and the user is reminded whether to activate the digital key function.

7. The digital key security authentication method as described in claim 6, characterized in that, The initialization operation of the first device includes: Generate first device identification information; call the initialization interface of the dynamic white box of the first device to obtain a token, and send the first device identification information and the token to the server through the initialization interface of the dynamic white box; The server stores the first device identification information and the user information, generates a white-box management key, and sends it to the first device; The first device records the white-box management key and the first device identification information to complete the initialization.

8. The digital key security authentication method as described in claim 7, characterized in that, Establishing a communication connection between the first device and the second device includes: The first device checks whether a digital key has been downloaded; If so, then register a communication scanning service corresponding to the first device according to the first device model, and search for the target second device communication broadcast. If the target second device communicator is found, then send a connection request to the second device. The second device accepts the connection request and checks whether it has completed pairing with the first device; If so, then establish a communication connection; If not, then a security request message is sent to the first device: The first device calculates a pairing code based on the security request information and sends it to the second device; The first device and the second device calculate a long-term key and a short-term key based on the pairing code, complete the pairing, and establish a communication connection.

9. The digital key security authentication method as described in claim 8, characterized in that, Establishing a secure channel between the first device, the server, and the second device includes: The first device and the second device complete communication pairing and send a request for a temporary public-private key pair to the server; The server generates a first temporary public key and a first temporary private key based on the requested temporary public-private key pair information, and signs the first temporary public key using the service public key pre-stored by the server to generate a first signature value, and sends the first signature value and the first temporary public key to the first device. The first device receives the first signature value and the first temporary public key, and sends the first signature value and the first temporary public key to the second device; The second device verifies the first signature value using a pre-stored service private key, generates a second temporary public key and a second temporary private key, signs the first temporary public key and the second temporary public key using a third session key to obtain a second signature value, obtains the communicator ID data of the second device, and sends the second temporary public key, the second signature value and the communicator ID data to the first device. The first device receives the second temporary public key, the second signature value, and the communicator number data and sends them to the server; The server obtains the second device information from a preset correspondence between the communicator number data and the second device information based on the communicator number data, and binds the first device and the second device; the server verifies the second signature value using the third session key, and if successful, the secure channel between the first device, the server and the second device is successfully established.

10. The digital key security authentication method as described in claim 9, characterized in that, The third session key is calculated using the first temporary private key and the second temporary public key.

11. The digital key security authentication method as described in claim 10, characterized in that, Obtaining the first authentication key includes: The first device sends a request to the second device to obtain activation conditions; The second device receives the request information, detects the activation conditions, uses the second temporary private key to sign the activation conditions to obtain a third signature value, and uses the third session key to encrypt the activation conditions and the third signature value to obtain fourth encrypted data, and sends the fourth encrypted data to the first device; The first device receives the fourth encrypted data and sends the fourth encrypted data to the server; The server uses the third session key to decrypt the fourth encrypted data and determines whether the activation condition meets the preset condition. If the conditions are met, a random sequence code is generated, and the data of the random sequence code with a preset number of bits is taken as the second device master key; the structure data is assembled, and the first authentication key is calculated using the second device master key and the structure data; the random sequence code is signed using the pre-stored service public key to obtain a fourth signature value; the random sequence code and the fourth signature value are encrypted using the third session key to obtain fifth encrypted data; and the structure data, the first authentication key, and the fifth encrypted data are sent to the first device. The first device stores the structure data, the first authentication key, and the fifth encrypted data.

12. The digital key security authentication method as described in claim 11, characterized in that, Obtaining the second device master key includes: The second device obtains the fifth encrypted data stored in the first device, decrypts the fifth encrypted data using the third session key, obtains the random sequence code and the fourth signature value, and verifies the fourth signature value using the pre-stored service private key; If successful, the random sequence code is saved, and the data of the random sequence code with a preset number of bits is taken as the second device master key.

Images