Identity authentication method, device, storage medium and electronic device

Abstract

The present application discloses an identity authentication method, device, storage medium, electronic device and computer program product, which belong to the field of automobile technology. The identity authentication method is applied to automobiles, including: when the automobile receives an identity authentication request sent by a device to be authenticated, seed data is generated and sent to the device to be authenticated, so that the device to be authenticated returns a ciphertext and a target authorization certificate according to the seed data; the device to be authenticated is authenticated according to the target authorization certificate, the root certificate, the ciphertext and the seed data, thereby eliminating the need to fix the symmetric password into the code programs of the two parties to the authentication, reducing the risk of password leakage and improving the reliability and security of the authentication.

Description

Technical Field

[0001] The present application belongs to the field of automobile technology, and in particular relates to an identity authentication method, device, storage medium, electronic device and computer program product. Background Art

[0002] As cars become more and more popular in daily life and their functions become more and more powerful, there is a greater demand for the quantity and quality of on-board ECU (Electronic Control Unit) systems. As a result, there is an increasing demand for access and debugging of detection equipment such as diagnostic instruments.

[0003] At present, traditional electronic architecture systems are directly connected to the OBD diagnostic port through the diagnostic instrument. In the vehicle development stage, factory assembly stage and after-sales stage, there are detection scenarios where the diagnostic instrument accesses the ECU in the vehicle system. The UDS protocol (Unified Diagnostic Services) is a standardized standard for diagnostic services, such as reading fault data and configuring related business data. The diagnostic instrument can access car-related services through the UDS protocol. Considering the safety of the car, when the diagnostic instrument performs high-risk operations on the car, the car needs to authenticate the identity of the diagnostic instrument first. Only after the identity authentication is passed, the diagnostic instrument is allowed to perform high-risk operations on the car, otherwise the high-risk operations will be rejected. However, the existing identity authentication method of the diagnostic instrument has a relatively high risk of password leakage, and the reliability and security of the identity authentication are low. Summary of the invention

[0004] The present application aims to solve at least one of the technical problems existing in the prior art. To this end, the present application proposes an identity authentication method, device, storage medium, electronic device and computer program product, which can improve the reliability and security of identity authentication.

[0005] In a first aspect, the present application provides an identity authentication method, which is applied to a car, and the method comprises:

[0006] When receiving an identity authentication request sent by a device to be authenticated, generating seed data and sending the seed data to the device to be authenticated, so that the device to be authenticated returns a ciphertext and a target authorization certificate according to the seed data;

[0007] The identity of the device to be authenticated is authenticated according to the target authorization certificate, the root certificate, the ciphertext and the seed data.

[0008] In some embodiments, the performing identity authentication on the device to be authenticated according to the target authorization certificate, the root certificate, the ciphertext and the seed data includes:

[0009] Verifying the target authorization certificate according to the root certificate;

[0010] When the target authorization certificate passes verification, verifying the ciphertext according to the public key in the target authorization certificate and the seed data;

[0011] When the ciphertext verification passes, it is determined that the identity authentication of the device to be authenticated passes;

[0012] When the ciphertext verification fails or the target authorization certificate verification fails, it is determined that the identity authentication of the device to be authenticated fails.

[0013] In some embodiments, verifying the ciphertext according to the public key in the target authorization certificate and the seed data includes:

[0014] Decrypting the ciphertext using the public key in the target authorization certificate to obtain decrypted data;

[0015] When the decrypted data and the seed data are the same, it is determined that the ciphertext verification passes;

[0016] When the decrypted data and the seed data are not identical, it is determined that the ciphertext verification fails.

[0017] In some embodiments, verifying the target authorization certificate according to the root certificate includes:

[0018] Determining the certificate level of the target authorization certificate;

[0019] The target authorization certificate is verified according to the certificate level and the root certificate.

[0020] In some embodiments, the verifying the target authorization certificate according to the certificate level and the root certificate includes:

[0021] When the certificate level indicates that the target authorization certificate is a first-level authorization certificate, verifying the target authorization certificate according to the root certificate;

[0022] When the certificate level indicates that the target authorization certificate is a level 2 authorization certificate, a level 1 authorization certificate is parsed from the target authorization certificate, and the target authorization certificate is verified based on a root certificate and the parsed level 1 authorization certificate.

[0023] In some embodiments, verifying the target authorization certificate according to the root certificate includes:

[0024] Verifying the signature in the target authorization certificate using the public key in the root certificate;

[0025] When the signature verification in the target authorization certificate passes, it is determined that the target authorization certificate verification passes;

[0026] When the signature verification in the target authorization certificate fails, it is determined that the verification of the target authorization certificate fails.

[0027] In some embodiments, the verifying the target authorization certificate according to the root certificate and the parsed primary authorization certificate includes:

[0028] Verify the parsed signature in the primary authorization certificate using the public key in the root certificate;

[0029] When the signature verification in the parsed first-level authorization certificate passes, verifying the signature in the target authorization certificate using the public key in the parsed first-level authorization certificate;

[0030] When the signature verification in the target authorization certificate passes, it is determined that the target authorization certificate verification passes;

[0031] When the signature verification in the primary authorization certificate fails or the signature verification in the target authorization certificate fails, it is determined that the verification of the target authorization certificate fails.

[0032] In some embodiments, the identity authentication method further includes:

[0033] According to the target authorization certificate and the preset certificate table, the identity information of the target authorization certificate is determined, and the identity information is used to instruct the vehicle to determine the identity authority of the device to be authenticated.

[0034] In some embodiments, the target authorization certificate includes at least one controlled object and the authority control level of each controlled object, and the identity authentication method further includes:

[0035] When the identity authentication of the device to be authenticated is passed, matching the device information of the at least one controlled object and the vehicle;

[0036] Taking the authority control level of the successfully matched controlled object as the target level;

[0037] The target level of authority is granted to the device to be authenticated.

[0038] In a second aspect, the present application provides another identity authentication method, which is applied to a device to be authenticated, and the identity authentication method includes:

[0039] Sending an identity authentication request to the car, so that the car returns seed data according to the identity authentication request;

[0040] The ciphertext and the target authorization certificate are sent to the car, so that the car performs identity authentication on the device to be authenticated according to the ciphertext and the target authorization certificate.

[0041] In some embodiments, before sending the ciphertext and the target authorization certificate to the car, the method further includes:

[0042] Obtaining a target authorization certificate corresponding to the automobile and a private key corresponding to the target authorization certificate;

[0043] Generate ciphertext according to the private key and the returned seed data.

[0044] In some embodiments, generating ciphertext according to the private key and the returned seed data includes:

[0045] The returned seed data is encrypted using the private key to obtain a ciphertext.

[0046] In some embodiments, obtaining the target authorization certificate corresponding to the automobile and the private key of the target authorization certificate includes:

[0047] Obtain a target authorization certificate corresponding to the automobile and a private key corresponding to the target authorization certificate from a local storage area or a manufacturer server of the device to be authenticated.

[0048] In a third aspect, the present application provides an identity authentication device, which is applied to a car, and the identity authentication device includes:

[0049] A generating unit, configured to generate seed data and send the seed data to the device to be authenticated when receiving an identity authentication request sent by the device to be authenticated, so that the device to be authenticated returns a ciphertext and a target authorization certificate according to the seed data;

[0050] An authentication unit is used to perform identity authentication on the device to be authenticated according to the target authorization certificate, the root certificate, the ciphertext and the seed data.

[0051] In some embodiments, the authentication unit is specifically used to:

[0052] Verifying the target authorization certificate according to the root certificate;

[0053] When the target authorization certificate passes verification, verifying the ciphertext according to the public key in the target authorization certificate and the seed data;

[0054] When the ciphertext verification passes, it is determined that the identity authentication of the device to be authenticated passes;

[0055] When the ciphertext verification fails or the target authorization certificate verification fails, it is determined that the identity authentication of the device to be authenticated fails.

[0056] In some embodiments, the authentication unit is specifically used to:

[0057] Decrypting the ciphertext using the public key in the target authorization certificate to obtain decrypted data;

[0058] When the decrypted data matches the seed data, it is determined that the ciphertext verification passes;

[0059] When the decrypted data and the seed data do not match, it is determined that the ciphertext verification fails.

[0060] In some embodiments, the authentication unit is specifically used to:

[0061] Determining the certificate level of the target authorization certificate;

[0062] The target authorization certificate is verified according to the certificate level and the root certificate.

[0063] In some embodiments, the authentication unit is specifically used to:

[0064] When the certificate level indicates that the target authorization certificate is a first-level authorization certificate, verifying the target authorization certificate according to the root certificate;

[0065] When the certificate level indicates that the target authorization certificate is a level 2 authorization certificate, a level 1 authorization certificate is parsed from the target authorization certificate, and the target authorization certificate is verified according to the root certificate and the parsed level 1 authorization certificate.

[0066] In some embodiments, the authentication unit is specifically used to:

[0067] Verifying the signature in the target authorization certificate using the public key in the root certificate;

[0068] When the signature verification in the target authorization certificate passes, it is determined that the target authorization certificate verification passes;

[0069] When the signature verification in the target authorization certificate fails, it is determined that the verification of the target authorization certificate fails.

[0070] In some embodiments, the authentication unit is specifically used to:

[0071] Verify the parsed signature in the primary authorization certificate using the public key in the root certificate;

[0072] When the signature verification in the parsed first-level authorization certificate passes, verifying the signature in the target authorization certificate using the public key in the parsed first-level authorization certificate;

[0073] When the signature verification in the target authorization certificate passes, it is determined that the target authorization certificate verification passes;

[0074] When the signature verification in the primary authorization certificate fails or the signature verification in the target authorization certificate fails, it is determined that the verification of the target authorization certificate fails.

[0075] In some embodiments, the authentication unit is further configured to:

[0076] According to the target authorization certificate and the preset certificate table, the identity information of the target authorization certificate is determined, and the identity information is used to instruct the vehicle to determine the identity authority of the device to be authenticated.

[0077] In some embodiments, the target authorization certificate includes at least one controlled object and the authority control level of each controlled object, and the identity authentication device further includes an authorization unit for:

[0078] When the identity authentication of the device to be authenticated is passed, matching the device information of the at least one controlled object and the vehicle;

[0079] Taking the authority control level of the successfully matched controlled object as the target level;

[0080] The target level of authority is granted to the device to be authenticated.

[0081] In a fourth aspect, the present application provides an identity authentication device, which is applied to a device to be authenticated, and the identity authentication device includes:

[0082] A first sending unit, configured to send an identity authentication request to the automobile, so that the automobile returns seed data according to the identity authentication request;

[0083] The second sending unit is used to send the ciphertext and the target authorization certificate to the car, so that the car performs identity authentication on the device to be authenticated according to the ciphertext and the target authorization certificate.

[0084] In some embodiments, before sending the ciphertext and the target authorization certificate to the car, the second sending unit is further used to:

[0085] Obtaining a target authorization certificate corresponding to the automobile and a private key corresponding to the target authorization certificate;

[0086] Generate ciphertext according to the private key and the returned seed data.

[0087] In some embodiments, the second sending unit is specifically configured to:

[0088] The returned seed data is encrypted using the private key to obtain a ciphertext.

[0089] In some embodiments, the second sending unit is specifically configured to:

[0090] Obtain a target authorization certificate corresponding to the automobile and a private key corresponding to the target authorization certificate from a local storage area or a manufacturer server of the device to be authenticated.

[0091] In a fifth aspect, the present application provides a non-transitory computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the identity authentication method described in any one of the above items is implemented.

[0092] In a sixth aspect, the present application provides an electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements any of the above-described identity authentication methods when executing the program.

[0093] In a seventh aspect, the present application provides a computer program product, including a computer program, which, when executed by a processor, implements any of the above-mentioned identity authentication methods.

[0094] The identity authentication method, apparatus, storage medium, electronic device and computer program product provided in the embodiments of the present application, when a car receives an identity authentication request sent by a device to be authenticated, seed data is generated and sent to the device to be authenticated, so that the device to be authenticated returns a ciphertext and a target authorization certificate according to the seed data; the identity authentication of the device to be authenticated is performed on the target authorization certificate, the root certificate, the ciphertext and the seed data, that is, an authentication management method based on the PKI system is adopted to realize the identity authentication of the device to be authenticated by the car, thereby eliminating the need to fix the symmetric password into the code programs of the two parties to the authentication, reducing the risk of password leakage and improving the reliability and security of the authentication. BRIEF DESCRIPTION OF THE DRAWINGS

[0095] The above and / or additional aspects and advantages of the present application will become apparent and easily understood from the description of the embodiments in conjunction with the following drawings, in which:

[0096] Figure 1 It is a flowchart of the identity authentication method provided in the embodiment of the present application;

[0097] Figure 2 It is a schematic diagram showing the target authorization certificate provided in the embodiment of the present application;

[0098] Figure 3 is another schematic diagram showing the target authorization certificate provided in an embodiment of the present application;

[0099] Figure 4 is another flow chart of the identity authentication method provided in the embodiment of the present application;

[0100] Figure 5is another flow chart of the identity authentication method provided in the embodiment of the present application;

[0101] Figure 6 is a schematic diagram of the structure of an identity authentication device provided in an embodiment of the present application;

[0102] Figure 7 is another structural schematic diagram of the identity authentication device provided in an embodiment of the present application;

[0103] Figure 8 is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application;

[0104] Fig. 9 It is a schematic diagram of the hardware structure of the electronic device provided in the embodiment of the present application. DETAILED DESCRIPTION

[0105] The embodiments of the present application are described in detail below, and examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present application, and cannot be understood as limiting the present application.

[0106] In the vehicle development stage, factory assembly stage and after-sales stage, there are detection scenarios where the diagnostic instrument accesses the ECU in the vehicle system. The diagnostic instrument can access car-related services through the UDS (Unified Diagnostic Services) protocol. Considering the safety of the car, when the diagnostic instrument performs high-risk operations on the car, the car needs to authenticate the identity of the diagnostic instrument first. Only after the identity authentication is passed, the diagnostic instrument is allowed to perform high-risk operations on the car, otherwise the high-risk operations are rejected. In one embodiment of identity authentication, the diagnostic instrument side first requests a secure random number (seed) from the car side that needs to be diagnosed. After the car side returns the seed to the diagnostic instrument side, the diagnostic instrument side uses a symmetric encryption algorithm to encrypt the data generated according to the seed and sends it to the car side as a key. The car side verifies based on the seed and the key sent by the diagnostic instrument side. Only after the verification is passed can the service be accessed.

[0107] However, this authentication method requires, on the one hand, that the symmetric password be fixedly written into the authentication code program in advance on the diagnostic instrument side and the car side, and the risk of password leakage through the code program is relatively high. Once leaked, criminals may maliciously access or tamper with important data in the car, the owner's private data, etc., endangering the user's privacy and even personal safety, resulting in low security and reliability of identity authentication. On the other hand, considering that there are many car controllers on the market, for each car controller that needs to be diagnosed, an authentication code program containing the corresponding password must be written on the diagnostic device side and the car side. Different car controllers need to write different authentication code programs, which is less flexible.

[0108] To solve at least one of the above technical problems, the embodiments of the present application provide an identity authentication method, device, storage medium, electronic device and computer program product.

[0109] See also Figure 1 , Figure 1 1 is a flow chart of an identity authentication method provided in an embodiment of the present application. The identity authentication method is applied in a car. The identity authentication method may include the following steps 101 and 102, wherein:

[0110] 101. When receiving an identity authentication request sent by the device to be authenticated, generating seed data and sending it to the device to be authenticated, so that the device to be authenticated returns a ciphertext and a target authorization certificate according to the seed data;

[0111] 102. Perform identity authentication on the device to be authenticated according to the target authorization certificate, the root certificate, the ciphertext and the seed data.

[0112] The identity authentication method provided in the embodiment of the present application, when the automobile receives the identity authentication request sent by the device to be authenticated, authenticates the identity by introducing an authorization certificate, that is, adopts an authentication management method based on the PKI (Public Key Infrastructure) system to realize the identity authentication of the automobile to the device to be authenticated. Therefore, not only is there no need to fix the symmetric password into the code program of the two parties to the authentication, reducing the risk of password leakage and improving the reliability and security of authentication, but different controllers use a unified authentication code program, and there is no need to write a separate authentication code program for each controller separately. The method has high flexibility and a wide range of applications.

[0113] The above steps 101 and 102 will be described in detail below.

[0114] 101. When receiving an identity authentication request sent by the device to be authenticated, generate seed data and send it to the device to be authenticated, so that the device to be authenticated returns a ciphertext and a target authorization certificate according to the seed data.

[0115] Among them, the devices to be authenticated include but are not limited to electronic devices such as diagnostic equipment and sensors that need to communicate with the car. The diagnostic equipment is a professional instrument used to detect the vehicle, which can detect the performance of the vehicle in real time and detect vehicle faults, including but not limited to diagnostic instruments. This embodiment will take the device to be authenticated as a diagnostic device as an example to introduce the identity authentication method in detail, and the identity authentication methods corresponding to other devices to be authenticated will not be repeated. For example, when the diagnostic device needs to be connected to the car to access the car controller or even perform high-risk operations, it is necessary to first request operation permission from the car. At this time, the diagnostic device will generate an identity authentication request and send it to the car.

[0116] The seed data is a secure random number generated by the car. When the diagnostic device gets the secure random number sent by the car, it will download the authorized digital certificate (i.e., target authorization certificate) and the private key corresponding to the certificate from the diagnostic device manufacturer's server or obtain it from its local security area. The private key is used to encrypt the secure random number to obtain the ciphertext. Since the data in the manufacturer's server and the local security area are difficult to be read and tampered by a third party, the risk of private key leakage is greatly reduced. A digital certificate is also called a public key certificate, which is used to encrypt the ownership of the public key with the owner entity. The digital certificate contains the basic information of the user (issuer), public key information, and signature information. The distribution, authentication, and revocation of digital certificates are the main functions of the public key infrastructure (PKI), which is a system for distributing and authenticating public keys. The basic architecture of digital certificates is public key PKI, which uses a pair of keys to implement encryption and decryption. The keys include private keys and public keys. The private key is defined by the user and only known by the user himself, and the public key can be shared by multiple users.

[0117] The target authorization certificate can be a first-level authorization certificate or a non-first-level authorization certificate. The first-level authorization certificate is usually a certificate issued based on the root certificate, that is, an authorization certificate signed using the private key of the root certificate. The root certificate is the starting point of the certificate chain. In the field of cryptography and computer security, the root certificate refers to an unsigned public key certificate or a self-signed certificate. It is a certificate issued by a certificate authority (CA) to itself as the starting point of the trust chain. The root certificate contains the user's (i.e., the car manufacturer's) information and the user's public key, and can also include a self-signature. The root certificate can be stored in the car manufacturer's backend server, or in the car's local storage area (for example, including but not limited to the security area provided by dedicated security hardware). The data in the security area and the manufacturer's server is difficult to be tampered with and read by a third party. Accordingly, the car can download the root certificate from the backend server, or directly obtain the root certificate from the security area, or other acquisition methods are also available, which are not limited here.

[0118] A non-first-level authorization certificate is a next-level certificate issued on the basis of the previous-level certificate. For example, a second-level authorization certificate is a certificate signed using the private key of a first-level authorization certificate, and a third-level authorization certificate is a certificate signed using the private key of a second-level authorization certificate. Generally, the authority of a next-level certificate issued on the basis of a previous-level certificate cannot be higher than that of the previous-level certificate. When the target authorization certificate is a first-level authorization certificate, it is an authorization certificate applied for by the diagnostic equipment manufacturer to which the diagnostic equipment belongs to the automobile manufacturer to which the automobile belongs. Different diagnostic equipment manufacturers can apply for authorization certificates for the same automobile from the same automobile manufacturer, and different automobile manufacturers can issue authorization certificates for different automobiles under their own to the same diagnostic equipment manufacturer. When the target authorization certificate is a non-first-level authorization certificate, it is an authorization certificate applied for by the diagnostic equipment manufacturer to which the diagnostic equipment belongs to other diagnostic equipment manufacturers.

[0119] In the process of issuing digital certificates, the certificate requester first generates a pair of asymmetric keys (including private key and public key), and generates a certificate issuance request based on the public key and other relevant information (such as its own domain name, organization name, etc.), and sends it to the certificate issuer, while the private key is stored by itself. After receiving the certificate issuance request, the certificate issuer first determines the metadata related to the digital certificate, and signs the metadata based on the received public key and its own private key (for different digital certificates, the certificate issuer sets different private keys). After that, the certificate issuer generates a digital certificate based on the received public key, metadata and signature information, and returns the digital certificate to the certificate requester, and the certificate requester will store the digital certificate in association with the private key generated by itself.

[0120] For example, if the device to be authenticated is a diagnostic device, see Figure 2 and Figure 3 , Figure 2 is a schematic diagram showing a target authorization certificate provided in an embodiment of the present application, Figure 3 is another schematic diagram showing the target authorization certificate provided in the embodiment of the present application, wherein: Figure 2 The target authorization certificate in the above example is a first-level authorization certificate. The first-level authorization certificate mainly includes the diagnostic device public key, diagnostic device manufacturer information, and automobile manufacturer signature. The diagnostic device manufacturer information is used to identify the manufacturer of the diagnostic device, including the manufacturer name and number. The diagnostic device public key is the public key of the current diagnostic device. Figure 3The target authorization certificate in the is a secondary authorization certificate, which is an authorization certificate issued by a primary diagnostic equipment manufacturer to a secondary diagnostic equipment manufacturer. A primary diagnostic equipment manufacturer is a diagnostic equipment manufacturer that directly issues a primary authorization certificate to an automobile manufacturer. The secondary authorization certificate mainly includes the secondary diagnostic equipment public key, secondary diagnostic equipment manufacturer information, primary authorization certificate, and primary diagnostic equipment manufacturer signature. A secondary diagnostic equipment manufacturer is a diagnostic equipment manufacturer that is granted a secondary authorization certificate by a primary diagnostic equipment manufacturer. The secondary diagnostic equipment public key is the public key of the current diagnostic equipment (i.e., the diagnostic equipment that is granted a secondary authorization certificate).

[0121] 102. Perform identity authentication on the device to be authenticated based on the target authorization certificate, root certificate, ciphertext and seed data.

[0122] In some embodiments, see Figure 4 , Figure 4 1 is another flow chart of the identity authentication method provided in the embodiment of the present application, wherein the above step 102 specifically includes:

[0123] 1021. Verify the target authorization certificate according to the root certificate; when the target authorization certificate verification passes, execute the following step 1022; when the target authorization certificate verification fails, execute the following step 1023;

[0124] 1022. Verify the ciphertext according to the public key in the target authorization certificate and the seed data; when the ciphertext verification passes, execute the following step 1024; when the ciphertext verification fails, execute the following step 1023;

[0125] 1023. Determine that the identity authentication of the device to be authenticated fails;

[0126] 1024. Determine whether the identity authentication of the device to be authenticated is successful.

[0127] Among them, during identity authentication, the car first verifies the target authorization certificate, and only when the target authorization certificate is verified, it continues to verify the ciphertext. Only when both the ciphertext and the target authorization certificate are verified, the identity authentication of the device to be authenticated is determined to be successful, otherwise it is determined that the identity authentication of the device to be authenticated has failed. By setting up two verification processes, the reliability and security of identity authentication can be effectively improved.

[0128] In some embodiments, the "verifying the target authorization certificate according to the root certificate" in the above step 1021 may specifically include:

[0129] Determine the certificate level of the target authorization certificate;

[0130] The target authorization certificate is verified according to the certificate level and the root certificate.

[0131] Among them, the certificate level is determined according to the total number of all certificates contained in the target authorization certificate. For example, if the total number is 0, the certificate level indicates that the target authorization certificate is a first-level authorization certificate. If the total number is 1, the certificate level indicates that the target authorization certificate is a second-level authorization certificate. If the total number is 2, the certificate level indicates that the target authorization certificate is a third-level authorization certificate, and so on.

[0132] When determining the total number of all certificates contained in the target authorization certificate, first parse the target authorization certificate to determine whether the certificate contains the next-level certificate. If not, the total number is 0. If it is contained, continue to parse the next-level certificate it contains to determine whether the next-level certificate contains a lower-level certificate. If not, the total number is 1. If it is contained, continue to parse the lower-level certificate in the same way until all certificates are counted.

[0133] In some embodiments, the above step of "verifying the target authorization certificate according to the certificate level and the root certificate" may specifically include:

[0134] When the certificate level indicates that the target authorization certificate is a first-level authorization certificate, the target authorization certificate is verified according to the root certificate;

[0135] When the certificate level indicates that the target authorization certificate is a second-level authorization certificate, the first-level authorization certificate is parsed from the target authorization certificate, and the target authorization certificate is verified based on the root certificate and the parsed first-level authorization certificate.

[0136] Among them, when the target authorization certificate does not contain other authorization certificates, it is a first-level authorization certificate, such as the above Figure 2 When the target authorization certificate contains other authorization certificates, it is a non-primary authorization certificate, such as the above Figure 3 In the second-level authorization certificate. When it is not a first-level authorization certificate, it is necessary to parse out the other authorization certificates, and determine the verification result of the target authorization certificate based on all the parsed authorization certificates. For example, the root certificate can verify the correctness of the first-level authorization certificate, the first-level authorization certificate can verify the correctness of the second-level authorization certificate, and so on. Only when the correctness verification of all certificates passes, can the target authorization certificate be determined to have passed the verification.

[0137] It is easy to understand that the embodiment of the present application can realize the application scenario of authorized diagnostic equipment manufacturers authorizing other diagnostic equipment manufacturers by introducing first-level authorization certificates and non-first-level authorization certificates based on the existing issuance process and verification process of authorization certificates, effectively enriching the use scenarios of the authorization authentication method in this solution. At the same time, by setting different authorization authority information in the authorization certificates of different diagnostic equipment manufacturers, hierarchical authorization of diagnostic equipment manufacturers can be realized, thereby realizing refined management of authority.

[0138] In some embodiments, the above step of "verifying the target authorization certificate according to the root certificate" specifically includes:

[0139] Verifying the signature in the target authorization certificate using the public key in the root certificate;

[0140] When the signature verification in the target authorization certificate passes, it is determined that the target authorization certificate verification passes;

[0141] When the signature verification in the target authorization certificate fails, it is determined that the target authorization certificate verification fails.

[0142] Among them, when the target authorization certificate is a first-level authorization certificate, the signature in the first-level authorization certificate is directly verified using the public key in the root certificate to verify the correctness of the first-level authorization certificate. If the signature verification passes, the target authorization certificate verification is determined to have passed, otherwise the verification is determined to have failed.

[0143] In some embodiments, the above step of "verifying the target authorization certificate according to the root certificate and the parsed primary authorization certificate" specifically includes:

[0144] Use the public key in the root certificate to verify the signature in the parsed primary authorization certificate;

[0145] When the signature verification in the parsed primary authorization certificate passes, the signature in the target authorization certificate is verified using the public key in the parsed primary authorization certificate;

[0146] When the signature verification in the target authorization certificate passes, it is determined that the target authorization certificate verification passes;

[0147] When the signature verification in the primary authorization certificate fails or the signature verification in the target authorization certificate fails, it is determined that the target authorization certificate verification fails.

[0148] Among them, when the target authorization certificate is a second-level authorization certificate, it is necessary to first parse the first-level authorization certificate from the second-level authorization certificate, and use the public key in the root certificate to verify the signature in the first-level authorization certificate. Only when the signature verification of the first-level authorization certificate is passed, the public key in the first-level authorization certificate is used to verify the signature of the second-level authorization certificate to verify the correctness of the second-level authorization certificate. Only when the signatures of the first-level authorization certificate and the second-level authorization certificate are both verified, the target authorization certificate is judged to have passed the verification, otherwise the verification is judged to have failed.

[0149] In some embodiments, the “verifying the ciphertext according to the public key and seed data in the target authorization certificate” in the above step 1022 may specifically include:

[0150] Decrypt the ciphertext using the public key in the target authorization certificate to obtain the decrypted data;

[0151] When the decrypted data and the seed data match, the ciphertext verification is determined to have passed;

[0152] When the decrypted data and the seed data do not match, the ciphertext verification is determined to have failed.

[0153] Among them, when the target authorization certificate is a first-level authorization certificate, the public key of the first-level authorization certificate is used to decrypt the ciphertext. If the target authorization certificate is a second-level authorization certificate, the public key of the second-level authorization certificate is used to decrypt the ciphertext. The decryption algorithm and the encryption algorithm are corresponding. Afterwards, the decrypted data and the seed data are judged to match according to the set matching rules, such as directly comparing the decrypted data and the seed data to see if the two are completely consistent, or converting the decrypted data and / or the seed data through the set conversion algorithm, and then seeing if the two are completely consistent. If they are consistent, they are determined to match, otherwise they are determined to be mismatched.

[0154] In addition, in some embodiments, the identity authentication method further includes:

[0155] According to the target authorization certificate and the preset certificate table, the identity information of the target authorization certificate is determined, and the identity information is used to instruct the vehicle to determine the identity authority of the device to be authenticated. Among them, the preset certificate table can be a revocation certificate table or a trust certificate table. The revocation certificate table is used to manage the authorization certificates that need to be revoked, and the trust certificate table is used to manage the authorization certificates that need to be trusted. For example, if the private key of a certain authorization certificate is leaked, the authorization certificate can be added to the revocation certificate table, or the authorization certificate can be removed from the trust certificate table. The revocation certificate table and the trust certificate table can be stored in the car manufacturer's server. When the car is performing authorization authentication on the device to be authenticated, the list can be downloaded online from the car manufacturer's server. The revocation certificate table and the trust certificate table can also be downloaded to the car's security area in advance. When the car is performing authorization authentication on the device to be authenticated, it can be directly obtained from the security area.

[0156] Specifically, when the preset certificate table is a revoked certificate table, if the match is successful, it is determined that the identity authentication of the device to be authenticated has failed. If the match fails, the verification results of the above-mentioned certificate verification and ciphertext verification are used. When the preset certificate table is a trusted certificate table, if the match fails, it is determined that the identity authentication of the device to be authenticated has failed. If the match is successful, the verification results of the above-mentioned certificate verification and ciphertext verification are used. By setting up a revoked certificate table or a trusted certificate table, subsequent cars can identify the authorization certificate when performing identity authentication on a diagnostic device that was originally installed with an authorization certificate with a leaked private key, prevent the granting of operating permissions to the diagnostic device, and effectively prevent criminals from illegally using the authorization certificate with a leaked private key.

[0157] It should be pointed out that automobile manufacturers or authorized equipment manufacturers can update and maintain the revoked certificate table and the trusted certificate table. For example, automobile manufacturers regularly check whether there is any private key leakage incident of the authorization certificate. Once a private key leakage incident occurs, the corresponding authorization certificate will be added to the revoked certificate table or removed from the trusted certificate table, thereby realizing dynamic management of the authorization certificate.

[0158] In addition, please continue to see Figure 2 and Figure 3 , each authorization certificate includes authorization authority information, and the authorization authority information includes information such as the authorized controlled objects and the corresponding authority control levels. The controlled objects may be controllers in some or all cars produced by a single automobile manufacturer. Since different automobile controllers may belong to different car series, families and / or models of cars, for example, different automobile controllers may belong to cars of different car series, or cars of different families in the same car series, or cars of different models in the same car series and family. And since there are many controllers in a single car, for example, according to the functional division, the automobile controller may include an intelligent driving controller, an intelligent cabin controller, etc., and according to the regional division, the automobile controller may include a left domain controller, a right domain controller, a whole vehicle controller, etc., so for different authority control levels, different controllers or different numbers of controllers can be set as controlled objects, and the controlled objects can be expressed as xx controllers of xx car series xx family xx model.

[0159] Normally, the authority control level that the certificate issuer can grant to other users does not exceed the authority control level granted to itself. For example, for a diagnostic equipment manufacturer with a first-level authorization certificate, if it has been granted authority a for a controller in car A, then if it issues a second-level authorization certificate to other diagnostic equipment manufacturers, the second-level authorization certificate is also an authorization certificate for the controller in car A, and the authority control level in the second-level authorization certificate is not higher than the level of authority a. Authorization authority information can also include other information such as authorization validity period information, such as the validity period of 2030.1.1 or permanent, which is not limited here.

[0160] In some embodiments, when the target authorization certificate includes at least one controlled object and the authority control level of each controlled object, the identity authentication method may further include:

[0161] When the identity authentication of the device to be authenticated is passed, matching the device information of the at least one controlled object and the vehicle;

[0162] Taking the authority control level of the successfully matched controlled object as the target level;

[0163] The target level of authority is granted to the device to be authenticated.

[0164] Among them, the device information of the car mainly includes the identification information of all car controllers in the car, which includes the above-mentioned information for identifying the series, family, and model of different cars, as well as the controller name for identifying different car controllers in the same car. The controlled object is the identification information of the authorized car controller. Since a single car generally includes multiple car controllers, different operation permissions can be granted to different car controllers in the same car or car controllers in different cars by setting the permission control level and the controlled object in the target authorization certificate. The operation permissions include data query, data modification and control of the controller. For example, if the permission control level is from high to low, it is level 1, level 2 and level 3, then the level 1 permission can allow all operations such as data query, data modification and control, the level 2 permission only allows data query and data modification operations, and the level 3 permission only allows data query operations, etc. Of course, before authorization, in addition to matching the controlled object, it is also necessary to confirm that the authorization period is within the validity period.

[0165] From the above, it can be seen that the identity authentication method provided in the embodiment of the present application is applied to a car. When an identity authentication request sent by the device to be authenticated is received, seed data is generated and sent to the device to be authenticated, so that the device to be authenticated returns a ciphertext and a target authorization certificate according to the seed data; the device to be authenticated is authenticated according to the target authorization certificate, the root certificate, the ciphertext and the seed data, that is, an authentication management method based on the PKI system is adopted to realize the identity authentication of the device to be authenticated by the car, so that not only is there no need to fix the symmetric password into the code program of the two parties to the authentication, reducing the risk of password leakage, and improving the reliability and security of authentication, but different controllers use a unified authentication code program, and there is no need to write their own authentication code program for each controller separately, which has high flexibility and a wide range of applications.

[0166] Based on the method described in the above embodiment, the embodiment of the present application also provides an identity authentication method, which is applied to the device to be authenticated, and the device to be authenticated includes but is not limited to diagnostic equipment and sensors and other electronic devices that need to establish a communication connection with the above-mentioned car. The diagnostic equipment is a professional instrument used to detect the vehicle, which can detect the performance of the vehicle in real time and detect vehicle faults, including but not limited to diagnostic instruments. Please refer to Figure 5 , Figure 5 201 and 202 are another flowchart of the identity authentication method provided in the embodiment of the present application. Specifically, the identity authentication method includes the following steps 201 and 202, wherein:

[0167] 201. Send an identity authentication request to the car, so that the car returns seed data according to the identity authentication request;

[0168] 202. Send the ciphertext and the target authorization certificate to the car, so that the car performs identity authentication on the device to be authenticated according to the ciphertext and the target authorization certificate.

[0169] In some embodiments, before executing the above step 202, the identity authentication method further includes:

[0170] Obtain the target authorization certificate corresponding to the car and the private key corresponding to the target authorization certificate;

[0171] Generate ciphertext based on the private key and the returned seed data.

[0172] In some embodiments, the above step of "obtaining a target authorization certificate corresponding to the car, and a private key corresponding to the target authorization certificate" specifically includes:

[0173] Obtain the target authorization certificate corresponding to the car and the private key corresponding to the target authorization certificate from the local storage area or the manufacturer server of the device to be authenticated.

[0174] When the device to be authenticated gets the secure random number sent by the car, it will download the authorized digital certificate (i.e., target authorization certificate) and the private key corresponding to the certificate from the manufacturer's server or its local security area, and use the private key to encrypt the seed data to obtain the ciphertext. Since the data in the manufacturer's server and local security area is difficult to be read and tampered by a third party, the risk of private key leakage is greatly reduced.

[0175] In some embodiments, the above step of "generating ciphertext according to the private key and the returned seed data" specifically includes:

[0176] The returned seed data is encrypted using the private key to obtain ciphertext.

[0177] Among them, the device to be authenticated can use the agreed encryption algorithm and use its own private key to encrypt the seed data. The seed data is a secure random number generated by the car. In this embodiment, the target authorization certificate contains the public key of the device to be authenticated, and the device to be authenticated uses the private key corresponding to the public key to encrypt the seed data to generate a ciphertext. The target authorization certificate can be a first-level authorization certificate or a non-first-level authorization certificate. The first-level authorization certificate is usually a certificate issued based on a root certificate, that is, an authorization certificate signed using the private key of the root certificate. The root certificate is the starting point of the certificate chain. In the field of cryptography and computer security, a root certificate refers to an unsigned public key certificate or a self-signed certificate. It is a certificate issued by a certificate authority (CA) to itself as the starting point of the trust chain. The root certificate contains the user's (i.e., the car manufacturer's) information and the user's public key, and can also include a self-signature.

[0178] A non-first-level authorization certificate is a next-level certificate issued on the basis of the previous-level certificate. For example, a second-level authorization certificate is a certificate signed using the private key of a first-level authorization certificate, and a third-level authorization certificate is a certificate signed using the private key of a second-level authorization certificate. When the target authorization certificate is a first-level authorization certificate, it is an authorization certificate applied for by the diagnostic equipment manufacturer to which the diagnostic equipment belongs to the automobile manufacturer to which the automobile belongs. Different diagnostic equipment manufacturers can apply for authorization certificates for the same automobile from the same automobile manufacturer, and different automobile manufacturers can issue authorization certificates for different automobiles under their own to the same diagnostic equipment manufacturer. When the target authorization certificate is a non-first-level authorization certificate, it is an authorization certificate applied for by the diagnostic equipment manufacturer to which the diagnostic equipment belongs to other diagnostic equipment manufacturers.

[0179] Each authorization certificate includes authorization authority information, which includes information such as the authorized controlled objects and the corresponding authority control levels, and also includes authorization validity period information, such as the validity period of 2030.1.1 or permanent. The controlled objects can be controllers in some or all cars produced by a single automobile manufacturer. Since different automobile controllers may correspond to different car series, families and / or models, for example, automobile controllers in different cars may belong to different car series, or different families in the same car series, or different models in the same family of the same car series. And since there are many controllers in the car, for example, according to the functional division, the automobile controller may include an intelligent driving controller, an intelligent cabin controller, etc., and according to the regional division, the automobile controller may include a left domain controller, a right domain controller, a whole vehicle controller, etc., so for different authority control levels, different controllers or different numbers of controllers can be set as controlled objects, and the controlled object can be expressed as xx controller of xx car series xx family xx model.

[0180] Specifically, when the device to be authenticated needs to be connected to the car and access the car controller or even perform high-risk operations, it needs to request operation permissions from the car first. At this time, the device to be authenticated will generate an identity authentication request and send it to the car. The car returns a secure random number based on the identity authentication request. After the device to be authenticated gets the secure random number, it will use its own private key to encrypt the secure random number to obtain a ciphertext, and return the target authorization certificate and ciphertext to the car for identity authentication. Only when the identity authentication is passed, the device to be authenticated has certain permissions to operate the car controller, such as querying, modifying, and controlling the car controller.

[0181] It should be noted that the specific details of the above-mentioned identity authentication method applied to the device to be authenticated have been described in detail in the embodiment of the above-mentioned identity authentication method applied to the automobile, and will not be repeated here.

[0182] According to the method described in the above embodiment, the present application embodiment also provides an identity authentication device for executing the steps in the above identity authentication method applied to a car. Figure 6 , Figure 6 300 is a schematic diagram of the structure of the identity authentication device provided in the embodiment of the present application. The identity authentication device 300 is applied in a car. Specifically, the identity authentication device 300 includes a generation unit 301 and an authentication unit 302, wherein:

[0183] The generating unit 301 is used for generating seed data and sending it to the device to be authenticated when receiving an identity authentication request sent by the device to be authenticated, so that the device to be authenticated returns a ciphertext and a target authorization certificate according to the seed data;

[0184] The authentication unit 302 is used to perform identity authentication on the device to be authenticated according to the target authorization certificate, the root certificate, the ciphertext and the seed data.

[0185] In some embodiments, the authentication unit 302 is specifically used to:

[0186] Verify the target authorization certificate based on the root certificate;

[0187] When the target authorization certificate passes the verification, the ciphertext is verified according to the public key seed data in the target authorization certificate;

[0188] When the ciphertext verification passes, it is determined that the identity authentication of the device to be authenticated passes;

[0189] When the ciphertext verification fails or the target authorization certificate verification fails, it is determined that the identity authentication of the device to be authenticated fails.

[0190] In some embodiments, the authentication unit 302 is specifically used to:

[0191] Decrypt the ciphertext using the public key in the target authorization certificate to obtain decrypted data;

[0192] When the decrypted data matches the seed data, it is determined that the ciphertext verification passes;

[0193] When the decrypted data and the seed data do not match, it is determined that the ciphertext verification has failed.

[0194] In some embodiments, the authentication unit 302 is specifically used to:

[0195] Determine the certificate level of the target authorization certificate;

[0196] The target authorization certificate is verified according to the certificate level and the root certificate.

[0197] In some embodiments, the authentication unit 302 is specifically used to:

[0198] When the certificate level indicates that the target authorization certificate is a first-level authorization certificate, verifying the target authorization certificate according to the root certificate;

[0199] When the certificate level indicates that the target authorization certificate is a second-level authorization certificate, a first-level authorization certificate is parsed from the target authorization certificate, and the target authorization certificate is verified based on the root certificate and the parsed first-level authorization certificate.

[0200] In some embodiments, the authentication unit 302 is specifically used to:

[0201] Verify the signature in the target authorization certificate using the public key in the root certificate;

[0202] When the signature verification in the target authorization certificate passes, it is determined that the target authorization certificate verification passes;

[0203] When the signature verification in the target authorization certificate fails, it is determined that the verification of the target authorization certificate fails.

[0204] In some embodiments, the authentication unit 302 is specifically used to:

[0205] Use the public key in the root certificate to verify the signature in the parsed primary authorization certificate;

[0206] When the signature verification in the parsed first-level authorization certificate passes, the signature in the target authorization certificate is verified using the public key in the parsed first-level authorization certificate;

[0207] When the signature verification in the target authorization certificate passes, it is determined that the target authorization certificate verification passes;

[0208] When the signature verification in the primary authorization certificate fails or the signature verification in the target authorization certificate fails, it is determined that the verification of the target authorization certificate fails.

[0209] In some embodiments, the authentication unit 302 is further configured to:

[0210] According to the target authorization certificate and the preset certificate table, the identity information of the target authorization certificate is determined, and the identity information is used to instruct the car to determine the identity authority of the device to be authenticated.

[0211] In some embodiments, the target authorization certificate includes at least one controlled object and the authority control level of each controlled object, and the identity authentication device 300 further includes an authorization unit for:

[0212] When the identity authentication of the device to be authenticated is passed, matching the device information of the at least one controlled object and the vehicle;

[0213] The permission control level of the controlled object that is matched successfully is used as the target level;

[0214] The device to be authenticated is granted the target level of authority.

[0215] It should be noted that the specific details of each module unit in the above-mentioned identity authentication device 300 applied to a vehicle have been described in detail in the embodiment of the above-mentioned identity authentication method applied to a vehicle, and will not be repeated here.

[0216] According to the method described in the above embodiment, the present application embodiment also provides an identity authentication device for executing the steps in the above identity authentication method applied to the device to be diagnosed. Figure 7 , Figure 7 400 is a schematic diagram of the structure of the identity authentication device provided in the embodiment of the present application. The identity authentication device 400 is applied to the device to be diagnosed. Specifically, the identity authentication device 400 includes a first sending unit 401 and a second sending unit 402, wherein:

[0217] The first sending unit 401 is used to send an identity authentication request to the car, so that the car returns seed data according to the identity authentication request;

[0218] The second sending unit 402 is used to send the ciphertext and the target authorization certificate to the car, so that the car performs identity authentication on the diagnostic device according to the ciphertext and the target authorization certificate.

[0219] In some embodiments, before sending the ciphertext and the target authorization certificate to the car, the second sending unit 402 is further used to:

[0220] Obtain the target authorization certificate corresponding to the car and the private key corresponding to the target authorization certificate;

[0221] Generate ciphertext based on the private key and the returned seed data.

[0222] In some embodiments, the second sending unit 402 is specifically used to:

[0223] The returned seed data is encrypted using the private key to obtain ciphertext.

[0224] In some embodiments, the second sending unit 402 is specifically used to:

[0225] Obtain a target authorization certificate corresponding to the automobile and a private key corresponding to the target authorization certificate from a local storage area or a manufacturer server of the device to be authenticated.

[0226] It should be noted that the specific details of each module unit in the above-mentioned identity authentication device 400 applied to the device to be authenticated have been described in detail in the above-mentioned embodiment of the identity authentication method applied to the device to be authenticated, and will not be repeated here.

[0227] In some embodiments, the identity authentication device in the embodiments of the present application may be an electronic device, or a component in an electronic device, such as an integrated circuit or a chip. The electronic device may be a device to be authenticated or a car.

[0228] In some embodiments, Figure 8 As shown, an embodiment of the present application also provides an electronic device 500, including a processor 501, a memory 502, and a computer program stored in the memory 502 and executable on the processor 501. When the program is executed by the processor 501, each process of the above-mentioned identity authentication method embodiment is implemented, and the same technical effect can be achieved. To avoid repetition, it will not be described here.

[0229] It should be noted that the electronic devices in the embodiments of the present application include the mobile electronic devices and non-mobile electronic devices mentioned above.

[0230] Fig. 9 A schematic diagram of the hardware structure of an electronic device 600 provided for implementing an embodiment of the present application.

[0231] The electronic device 600 includes but is not limited to: a radio frequency unit 601, a network module 602, an audio output unit 603, an input unit 604, a sensor 605, a display unit 606, a user input unit 607, an interface unit 608, a memory 609, a processor 610 and other components.

[0232] Those skilled in the art will appreciate that the electronic device 600 may also include a power source (such as a battery) for supplying power to various components, and the power source may be logically connected to the processor 610 through a power management system, thereby implementing functions such as managing charging, discharging, and power consumption management through the power management system. Fig. 9 The electronic device structure shown in the figure does not constitute a limitation on the electronic device. The electronic device may include more or fewer components than shown in the figure, or combine certain components, or arrange the components differently, which will not be described in detail here.

[0233] It should be understood that in the embodiment of the present application, the input unit 604 may include a graphics processor (GPU) 6041 and a microphone 6042, and the graphics processor 6041 processes the image data of the static picture or video obtained by the image capture device (such as a camera) in the video capture mode or the image capture mode. The display unit 606 may include a display panel 6061, and the display panel 6061 may be configured in the form of a liquid crystal display, an organic light emitting diode, etc. The user input unit 607 includes a touch panel 6071 and at least one of other input devices 6072. The touch panel 6071 is also called a touch screen. The touch panel 6071 may include two parts: a touch detection device and a touch controller. Other input devices 6072 may include, but are not limited to, a physical keyboard, function keys (such as a volume control key, a switch key, etc.), a trackball, a mouse, and a joystick, which will not be repeated here.

[0234] The memory 609 can be used to store software programs and various data. The memory 609 may mainly include a first storage area for storing programs or instructions and a second storage area for storing data, wherein the first storage area may store an operating system, an application program or instructions required for at least one function (such as a sound playback function, an image playback function, etc.), etc. In addition, the memory 609 may include a volatile memory or a non-volatile memory, or the memory 609 may include both volatile and non-volatile memories. Among them, the non-volatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory may be a random access memory (RAM), a static random access memory (SRAM), a dynamic random access memory (DRAM), a synchronous dynamic random access memory (SDRAM), a double data rate synchronous dynamic random access memory (DDRSDRAM), an enhanced synchronous dynamic random access memory (ESDRAM), a synchronous link dynamic random access memory (SLDRAM) and a direct memory bus random access memory (DRRAM). The memory 609 in the embodiment of the present application includes but is not limited to these and any other suitable types of memory.

[0235] The processor 610 may include one or more processing units; the processor 610 integrates an application processor and a modem processor, wherein the application processor mainly processes operations related to an operating system, a user interface, and application programs, and the modem processor mainly processes wireless communication signals, such as a baseband processor. It is understandable that the modem processor may not be integrated into the processor 610.

[0236] An embodiment of the present application also provides a non-transitory computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the various processes of the above-mentioned identity authentication method embodiment are implemented, and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.

[0237] The processor is the processor in the electronic device described in the above embodiment. The readable storage medium includes a computer readable storage medium, such as a computer read-only memory ROM, a random access memory RAM, a magnetic disk or an optical disk.

[0238] An embodiment of the present application also provides a computer program product, including a computer program, which implements the above-mentioned identity authentication method when executed by a processor.

[0239] The processor is the processor in the electronic device described in the above embodiment. The readable storage medium includes a computer readable storage medium, such as a computer read-only memory ROM, a random access memory RAM, a magnetic disk or an optical disk.

[0240] It should be noted that, in this article, the terms "comprise", "include" or any other variant thereof are intended to cover non-exclusive inclusion, so that the process, method, article or device including a series of elements includes not only those elements, but also includes other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise one..." do not exclude the presence of other identical elements in the process, method, article or device including the element. In addition, it should be pointed out that the scope of the methods and devices in the embodiments of the present application is not limited to performing functions in the order shown or discussed, and may also include performing functions in a substantially simultaneous manner or in reverse order according to the functions involved, for example, the described method may be performed in an order different from that described, and various steps may also be added, omitted, or combined. In addition, the features described with reference to certain examples may be combined in other examples.

[0241] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a computer software product, which is stored in a storage medium (such as ROM / RAM, a magnetic disk, or an optical disk), and includes a number of instructions for enabling a terminal (which can be a mobile phone, a computer, a server, or a network device, etc.) to execute the methods described in each embodiment of the present application.

[0242] The embodiments of the present application are described above in conjunction with the accompanying drawings, but the present application is not limited to the above-mentioned specific implementation methods. The above-mentioned specific implementation methods are merely illustrative and not restrictive. Under the guidance of the present application, ordinary technicians in this field can also make many forms without departing from the purpose of the present application and the scope of protection of the claims, all of which are within the protection of the present application.

[0243] The terms "first", "second", etc. in the specification and claims of the present application are used to distinguish similar objects, and are not used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable under appropriate circumstances, so that the embodiments of the present application can be implemented in an order other than those illustrated or described here, and the objects distinguished by "first", "second", etc. are generally of one type, and the number of objects is not limited. For example, the first object can be one or more. In addition, "and / or" in the specification and claims represents at least one of the connected objects, and the character " / " generally indicates that the objects associated with each other are in an "or" relationship.

[0244] In the description of the present application, “plurality” means two or more.

[0245] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "illustrative embodiments", "examples", "specific examples", or "some examples" means that the specific features, structures, materials, or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present application. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials, or characteristics described may be combined in any one or more embodiments or examples in a suitable manner.

[0246] Although the embodiments of the present application have been shown and described, those skilled in the art will appreciate that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present application, and that the scope of the present application is defined by the claims and their equivalents.

Claims

1. An identity authentication method, characterized in that: Applied to automobiles, the identity authentication method includes: When receiving an identity authentication request sent by a device to be authenticated, seed data is generated and sent to the device to be authenticated, so that the device to be authenticated returns a ciphertext and a target authorization certificate according to the seed data, wherein the target authorization certificate is a certificate issued by the device manufacturer to which the device to be authenticated belongs to the automobile manufacturer to which the automobile belongs or the device manufacturer to which other devices belong, wherein the device manufacturer to which the other devices belong is a device manufacturer to which a certificate has been issued by the automobile manufacturer, and the target authorization certificate includes basic information, a public key and a signature of the issuer; Performing identity authentication on the device to be authenticated according to the target authorization certificate, the root certificate, the ciphertext and the seed data, wherein the root certificate is a certificate issued by the automobile manufacturer to itself; The target authorization certificate includes at least one controlled object and the authority control level of each controlled object, and the authority control level granted by the certificate issuer to other users does not exceed the authority control level granted to itself, and the identity authentication method also includes: When the identity authentication of the device to be authenticated is passed, matching the device information of the at least one controlled object and the vehicle; Taking the authority control level of the successfully matched controlled object as the target level; The target level of authority is granted to the device to be authenticated.

2. The identity authentication method according to claim 1, characterized in that: The performing identity authentication on the device to be authenticated according to the target authorization certificate, the root certificate, the ciphertext and the seed data includes: Verifying the target authorization certificate according to the root certificate; When the target authorization certificate passes verification, verifying the ciphertext according to the public key in the target authorization certificate and the seed data; When the ciphertext verification passes, it is determined that the identity authentication of the device to be authenticated passes; When the ciphertext verification fails or the target authorization certificate verification fails, it is determined that the identity authentication of the device to be authenticated fails.

3. The identity authentication method according to claim 2, characterized in that: The verifying the ciphertext according to the public key in the target authorization certificate and the seed data includes: Decrypting the ciphertext using the public key in the target authorization certificate to obtain decrypted data; When the decrypted data matches the seed data, it is determined that the ciphertext verification passes; When the decrypted data and the seed data do not match, it is determined that the ciphertext verification fails.

4. The identity authentication method according to claim 2, characterized in that: The verifying the target authorization certificate according to the root certificate includes: Determining the certificate level of the target authorization certificate; The target authorization certificate is verified according to the certificate level and the root certificate.

5. The identity authentication method according to claim 4, characterized in that: The verifying the target authorization certificate according to the certificate level and the root certificate includes: When the certificate level indicates that the target authorization certificate is a first-level authorization certificate, verifying the target authorization certificate according to the root certificate; When the certificate level indicates that the target authorization certificate is a level 2 authorization certificate, a level 1 authorization certificate is parsed from the target authorization certificate, and the target authorization certificate is verified according to the root certificate and the parsed level 1 authorization certificate.

6. The identity authentication method according to claim 5, characterized in that: The verifying the target authorization certificate according to the root certificate includes: Verifying the signature in the target authorization certificate using the public key in the root certificate; When the signature verification in the target authorization certificate passes, it is determined that the target authorization certificate verification passes; When the signature verification in the target authorization certificate fails, it is determined that the verification of the target authorization certificate fails.

7. The identity authentication method according to claim 5, characterized in that: The verifying the target authorization certificate according to the root certificate and the parsed primary authorization certificate includes: Verify the parsed signature in the primary authorization certificate using the public key in the root certificate; When the signature verification in the parsed first-level authorization certificate passes, verifying the signature in the target authorization certificate using the public key in the parsed first-level authorization certificate; When the signature verification in the target authorization certificate passes, it is determined that the target authorization certificate verification passes; When the signature verification in the primary authorization certificate fails or the signature verification in the target authorization certificate fails, it is determined that the verification of the target authorization certificate fails.

8. The identity authentication method according to claim 1, characterized in that: Also includes: According to the target authorization certificate and the preset certificate table, the identity information of the target authorization certificate is determined, and the identity information is used to instruct the car to determine the identity authority of the device to be authenticated.

9. An identity authentication method, characterized in that: Applied to the device to be authenticated, the identity authentication method includes: Sending an identity authentication request to the car, so that the car returns seed data according to the identity authentication request; Sending a ciphertext and a target authorization certificate to the automobile so that the automobile performs identity authentication on the device to be authenticated according to the ciphertext, the root certificate, the seed data and the target authorization certificate, wherein the target authorization certificate includes at least one controlled object and the authority control level of each controlled object, and the authority control level granted to other users by the certificate issuer does not exceed the authority control level granted to itself; the automobile is further used for: when the identity authentication of the device to be authenticated is passed, matching the device information of the at least one controlled object with that of the automobile; taking the authority control level of the successfully matched controlled object as the target level; and granting the authority of the target level to the device to be authenticated; Among them, the target authorization certificate is a certificate that the device manufacturer to which the device to be authenticated belongs applies for issuance from the automobile manufacturer to which the car belongs or the equipment manufacturer to which other devices belong. The equipment manufacturer to which the other devices belong is the equipment manufacturer that has been issued a certificate by the automobile manufacturer. The target authorization certificate includes the basic information, public key and signature of the issuer, and the root certificate is a certificate issued by the automobile manufacturer to itself.

10. The identity authentication method according to claim 9, characterized in that: Before sending the ciphertext and the target authorization certificate to the car, the method further includes: Obtaining a target authorization certificate corresponding to the automobile and a private key corresponding to the target authorization certificate; Generate ciphertext according to the private key and the returned seed data.

11. The identity authentication method according to claim 10, characterized in that: The generating ciphertext according to the private key and the returned seed data comprises: The returned seed data is encrypted using the private key to obtain a ciphertext.

12. The identity authentication method according to claim 10, characterized in that: The obtaining of the target authorization certificate corresponding to the automobile and the private key corresponding to the target authorization certificate includes: Obtain a target authorization certificate corresponding to the automobile and a private key corresponding to the target authorization certificate from a local storage area or a manufacturer server of the device to be authenticated.

13. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the identity authentication method as described in any one of claims 1-8 or 9-12 is implemented.

14. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, it implements the identity authentication method as described in any one of claims 1-8 or 9-12.

15. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the identity authentication method as described in any one of claims 1-8 or 9-12 is implemented.

Images