Application identity authentication method, device, storage medium and vehicle

Abstract

The present invention discloses an identity authentication method, device, storage medium and vehicle for an application. The method comprises: obtaining a client random number from a client application and a server random number from a server application; generating a communication key based on the client random number and the server random number, wherein the communication key is used to enable secure communication between the client application and the server application; obtaining a first token information from the client application and a second token information from the server application when the communication key is successfully generated; comparing the first token information and the second token information to obtain a comparison result; in response to the comparison result that the first token information is the same as the second token information, determining that the identity authentication of the client application and the server application is successful. The present invention solves the technical problem that two-way identity authentication cannot be performed between applications, resulting in low vehicle safety.

Description

Technical Field

[0001] The present invention relates to the field of vehicles, and in particular to an identity authentication method, device, storage medium and vehicle for an application. Background Art

[0002] At present, a large number of client applications are deployed on the vehicle system, and these client applications need to connect and interact with the server applications. However, since the server application does not have an operation process to verify the identity of the client application, it is easy for attackers to impersonate the client application to attack the server application. Once the server application is breached, it is easy to attack the connected vehicle through the server application, resulting in the problem of two-way identity authentication between applications, resulting in low vehicle safety.

[0003] Currently, no effective solution has been proposed to address the problem of low vehicle safety due to the inability to perform two-way identity authentication between the above-mentioned applications. Summary of the invention

[0004] The embodiments of the present invention provide an application identity authentication method, device, storage medium and vehicle, so as to at least solve the technical problem that two-way identity authentication cannot be performed between applications, resulting in low vehicle safety.

[0005] According to one aspect of an embodiment of the present invention, a method for authenticating an application is provided. The method may include: obtaining a client random number from a client application and a server random number from a server application; generating a communication key based on the client random number and the server random number, wherein the communication key is used to enable secure communication between the client application and the server application; obtaining first token information from the client application and second token information from the server application when the communication key is successfully generated; comparing the first token information and the second token information to obtain a comparison result; in response to the comparison result that the first token information is the same as the second token information, determining that the authentication of the identity of the client application and the identity of the server application is successful.

[0006] Optionally, the method further includes: in response to the comparison result being that the first token information is different from the second token information, determining that authentication of the identity of the client application and the identity of the server application has failed.

[0007] Optionally, before obtaining the client random number from the client application and the server random number from the server application, the method also includes: when a connection is successfully established between the client application and the server application, controlling the client application to send request data to the server application, wherein the request data at least includes the client random number; in response to the server application receiving the request data, controlling the server application to send response data and an electronic certificate to the client application, wherein the response data at least includes the server random number, and the electronic certificate is used to represent the identity information of the server application.

[0008] Optionally, a communication key is generated based on a client random number and a server random number, including: in response to the client application receiving response data and an electronic certificate, and the client application successfully verifying the electronic certificate, controlling the client application to generate a communication key based on the client random number and the server random number, and controlling the server application to generate a communication key based on the client random number and the server random number.

[0009] Optionally, before obtaining the first token information from the client application and the second token information from the server application, the method also includes: obtaining key information set between the client application and the server application, and obtaining business data to be sent from the client application to the server application, wherein the key information includes at least the client identifier and the token key, and the business data includes at least the target business information.

[0010] Optionally, when the communication key is successfully generated, obtaining first token information from the client application includes: when the communication key is successfully generated, controlling the client application to determine a first original string based on the client identification and target business information; controlling the client application to encode the first original string to obtain a first encoding result; controlling the client application to determine first token information based on the first encoding result and the token key; obtaining the first token information from the client application.

[0011] Optionally, when the communication key is successfully generated, second token information is obtained from the server application, including: when the communication key is successfully generated, controlling the server application to determine a second original string based on the client identifier and target business information; controlling the server application to encode the second original string to obtain a second encoding result; controlling the server application to determine second token information based on the second encoding result and the token key; and obtaining the second token information from the server application.

[0012] Optionally, before comparing the first token information and the second token information to obtain a comparison result, the method further includes: controlling the client application to add the first token information to the business data, and sending the business data with the first token information added to the server application.

[0013] Optionally, the first token information and the second token information are compared to obtain a comparison result, including: in response to the server application receiving business data with the first token information added, controlling the server application to obtain the first token information from the business data, and comparing the first token information and the second token information to obtain a comparison result.

[0014] According to another aspect of an embodiment of the present invention, an identity authentication device for an application is also provided. The device may include: a first acquisition unit, used to acquire a client random number from a client application and a server random number from a server application; a generation unit, used to generate a communication key based on the client random number and the server random number, wherein the communication key is used to enable secure communication between the client application and the server application; a second acquisition unit, used to acquire the first token information from the client application and the second token information from the server application when the communication key is successfully generated; a comparison unit, used to compare the first token information and the second token information to obtain a comparison result; a first determination unit, used to determine that the identity authentication of the client application and the server application is successful in response to the comparison result that the first token information and the second token information are the same.

[0015] According to another aspect of an embodiment of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium includes a stored program, wherein when the program is executed, the device where the computer-readable storage medium is located is controlled to execute the identity authentication method of the application of the embodiment of the present invention.

[0016] According to another aspect of an embodiment of the present invention, a vehicle is further provided, wherein the vehicle is used to execute the identity authentication method of the application of the embodiment of the present invention.

[0017] According to another aspect of the embodiment of the present application, a computer program product is further provided. The computer program product may include a computer program, wherein the computer program is configured to execute any one of the above-mentioned identity authentication methods for applications when running.

[0018] According to another aspect of the embodiment of the present application, a computer program product is also provided. The computer program product may include a non-volatile computer-readable storage medium, wherein the non-volatile computer-readable storage medium stores a computer program, and the computer program is configured to execute any of the above-mentioned identity authentication methods for applications when running.

[0019] According to another aspect of the embodiment of the present application, a computer program is further provided, which is configured to execute any one of the above-mentioned identity authentication methods for applications when running.

[0020] In an embodiment of the present invention, a client random number from a client application and a server random number from a server application are obtained; a communication key is generated based on the client random number and the server random number, wherein the communication key is used to enable secure communication between the client application and the server application; when the communication key is successfully generated, a first token information from the client application and a second token information from the server application are obtained; the first token information and the second token information are compared to obtain a comparison result; in response to the comparison result that the first token information and the second token information are the same, it is determined that the identity authentication of the client application and the server application is successful. That is to say, the embodiment of the present invention compares the first token information from the client application with the second token information from the server application, and when the first token information and the second token information are the same, it is determined that the identity authentication of the client application and the server application is successful, thereby achieving a technical effect of two-way authentication between applications and improving vehicle safety, and solving the technical problem that two-way authentication between applications cannot be performed, resulting in low vehicle safety. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] The drawings described herein are used to provide a further understanding of the present invention and constitute a part of the present invention. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the drawings:

[0022] Figure 1 is a flow chart of an identity authentication method for an application according to an embodiment of the present invention;

[0023] Figure 2 It is a flow chart of a token-based two-way identity authentication between a vehicle-side networking application and a cloud service according to an embodiment of the present invention;

[0024] Figure 3 is a schematic diagram of an identity authentication device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0025] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0026] It should be noted that the terms "first", "second", etc. in the specification of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0027] Example 1

[0028] According to an embodiment of the present invention, an embodiment of an identity authentication method for an application is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0029] Figure 1 is a flow chart of an identity authentication method for an application according to an embodiment of the present invention. Figure 1 As shown, the method may include the following steps:

[0030] Step S102, obtaining a client random number from a client application and a server random number from a server application.

[0031] In the technical solution provided in the above step S102 of the present invention, a client random number can be obtained from a client application, and a server random number can be obtained from a server application. The client application can be a vehicle-side networking application. The client random number can be a random value generated by the client. The server application can be a cloud service. The server random number can be a random value generated by the server.

[0032] Optionally, after the vehicle-side networking application establishes a connection with the cloud service, the vehicle-side networking application sends a request to the cloud service, and the request may at least include a client random number. After the cloud service receives the request sent by the vehicle-side networking application, the cloud service sends a response to the vehicle-side networking application, and the response may at least include a server random number, so that the client random number from the client application and the server random number from the server application can be obtained.

[0033] Step S104, generating a communication key based on the client random number and the server random number, wherein the communication key is used to enable secure communication between the client application and the server application.

[0034] In the technical solution provided in the above step S104 of the present invention, after obtaining the client random number from the client application and the server random number from the server application, a communication key can be generated based on the obtained client random number and server random number. The communication key can be used to enable secure communication between the client application and the server application, and can be called a temporary communication key.

[0035] Optionally, after the vehicle-side networking application sends the client random number to the cloud service, and the cloud service sends the server random number to the vehicle-side networking application, the vehicle-side networking application can generate a temporary communication key based on its own client random number and the server random number received from the cloud service. In addition, the cloud service can also generate a temporary communication key based on its own server random number and the client random number received from the vehicle-side networking application.

[0036] Step S106, when the communication key is successfully generated, obtain the first token information from the client application and the second token information from the server application.

[0037] In the technical solution provided in the above step S106 of the present invention, after the communication key is generated based on the client random number and the server random number, if the above communication key is successfully generated, the first token information from the client application and the second token information from the server application can be obtained. The first token information can be a token calculated by the client application for identity authentication, and the token can be called a token. The second token information can be a token calculated by the server application for identity authentication.

[0038] Optionally, after the vehicle-side networking application and the cloud service generate a temporary communication key using random numbers sent by both parties, a token calculated by the vehicle-side networking application and a token calculated by the cloud service can be obtained.

[0039] Step S108: compare the first token information and the second token information to obtain a comparison result.

[0040] In the technical solution provided in the above step S108 of the present invention, after obtaining the first token information from the client application and the second token information from the server application, the obtained first token information and the second token information can be compared to obtain a comparison result.

[0041] Optionally, after obtaining the token calculated by the vehicle-side networking application and the token calculated by the cloud service, the token calculated by the vehicle-side networking application and the token calculated by the cloud service can be compared to obtain a comparison result.

[0042] Step S110 , in response to the comparison result that the first token information is identical to the second token information, determining that the identity authentication of the client application and the server application is successful.

[0043] In the technical solution provided in the above step S110 of the present invention, after comparing the first token information and the second token information to obtain the comparison result, when the comparison result is that the first token information is the same as the second token information, in response to the comparison result that the first token information is the same as the second token information, it can be determined that the identity authentication of the client application and the server application is successful.

[0044] Optionally, when the token calculated by the vehicle-side networking application is consistent with the token calculated by the cloud service, it means that the two-way identity authentication between the vehicle-side networking application and the cloud service is passed, and the vehicle-side networking application and the cloud service can perform normal business interaction.

[0045] In the above steps S102 to S110 of the present invention, a client random number from a client application and a server random number from a server application are obtained; a communication key is generated based on the client random number and the server random number, wherein the communication key is used to enable secure communication between the client application and the server application; when the communication key is successfully generated, a first token information from the client application and a second token information from the server application are obtained; the first token information and the second token information are compared to obtain a comparison result; in response to the comparison result that the first token information and the second token information are the same, it is determined that the identity authentication of the client application and the server application is successful. That is to say, the embodiment of the present invention compares the first token information from the client application with the second token information from the server application, and when the first token information and the second token information are the same, it is determined that the identity authentication of the client application and the server application is successful, thereby achieving a technical effect of two-way identity authentication between applications and improving vehicle safety, and solving the technical problem that two-way identity authentication cannot be performed between applications, resulting in low vehicle safety.

[0046] The above method of this embodiment is further introduced below.

[0047] As an optional embodiment, the method further includes: in response to the comparison result that the first token information is different from the second token information, determining that the authentication of the identity of the client application and the identity of the server application has failed.

[0048] In this embodiment, after comparing the first token information and the second token information to obtain the comparison result, when the comparison result is that the first token information is different from the second token information, in response to the comparison result that the first token information is different from the second token information, it can be determined that the identity authentication of the client application and the server application has failed.

[0049] Optionally, when the token calculated by the vehicle-side networking application is inconsistent with the token calculated by the cloud service, it means that the two-way identity authentication between the vehicle-side networking application and the cloud service has failed. At this time, the current log information is recorded and the connection between the vehicle-side networking application and the cloud service is disconnected to protect the normal operation of the cloud service.

[0050] As an optional implementation manner, in step S102, before obtaining the client random number from the client application and the server random number from the server application, the method also includes: when a connection is successfully established between the client application and the server application, controlling the client application to send request data to the server application, wherein the request data at least includes the client random number; in response to the server application receiving the request data, controlling the server application to send response data and an electronic certificate to the client application, wherein the response data at least includes the server random number, and the electronic certificate is used to represent the identity information of the server application.

[0051] In this embodiment, when a connection is successfully established between the client application and the server application, the client application can be controlled to send request data to the server application. After the server application receives the request data sent by the client application, in response to the server application receiving the request data, the server application can be controlled to send response data and an electronic certificate to the client application. Among them, the request data may at least include information such as a list of encryption suites supported by the client and a client random number, which can be represented by Client Hello. The response data may at least include information such as a list of encryption suites supported by the cloud service and a server random number, which can be represented by Sever Hello. The electronic certificate can be used to characterize the identity information of the server application, which can be represented by Certificate.

[0052] Optionally, after the vehicle-side networking application and the cloud service complete the three-way handshake of the Transmission Control Protocol (TCP) and establish a TCP connection, the vehicle-side networking application sends a request Client Hello to the cloud service, which may at least include a list of encryption suites supported by the client, a client random number, and other information. After receiving the request, the cloud service sends a response Sever Hello to the vehicle-side networking application, which may at least include a list of encryption suites supported by the cloud service, a server random number, and other information. Furthermore, the cloud service sends its own electronic certificate Certificate to the client to prove its identity.

[0053] As an optional implementation method, step S104 generates a communication key based on the client random number and the server random number, including: in response to the client application receiving the response data and the electronic certificate, and the client application successfully verifies the electronic certificate, controlling the client application to generate a communication key based on the client random number and the server random number, and controlling the server application to generate a communication key based on the client random number and the server random number.

[0054] In this embodiment, after obtaining the client random number from the client application and the server random number from the server application, when the client application receives the response data and the electronic certificate sent by the server application, and the client application successfully verifies the received electronic certificate, in response to the client application receiving the response data and the electronic certificate, and the client application successfully verifies the electronic certificate, the client application can be controlled to generate a communication key based on the client random number and the server random number, and the server application can be controlled to generate a communication key based on the client random number and the server random number.

[0055] Optionally, after the vehicle-side networking application receives the response Sever Hello and the electronic certificate Certificate sent by the cloud service, the vehicle-side networking application can verify the electronic certificate Certificate sent by the cloud service. When the verification fails, the connection between the vehicle-side networking application and the cloud service is disconnected. When the verification is successful, that is, after passing the verification, the vehicle-side networking application can generate a temporary communication key based on its own client random number and the server random number sent by the received cloud service. In addition, the cloud service can also generate a temporary communication key based on its own server random number and the client random number sent by the received vehicle-side networking application. In other words, the vehicle-side networking application and the cloud service use the random numbers sent by both parties to generate a temporary communication key.

[0056] As an optional implementation method, in step S106, before obtaining the first token information from the client application and the second token information from the server application, the method also includes: obtaining key information set between the client application and the server application, and obtaining business data to be sent from the client application to the server application, wherein the key information includes at least the client identifier and the token key, and the business data includes at least the target business information.

[0057] In this embodiment, the key information set between the client application and the server application can be obtained, and the business data to be sent from the client application to the server application can be obtained. Among them, the key information can be the key information preset by the vehicle-side networking application and the cloud service synchronization, and the preset key information can at least include the client identifier (ClientIdentifier, referred to as the client ID) and the token key (Security Key, referred to as the token key). The business data at least includes the target business information, and the target business information can be the necessary business information in the business data.

[0058] Optionally, using a preset token key and client ID, an authentication algorithm (for example, HMAC-SHA256) is performed on specific data to calculate the token value of the vehicle-side networking application. The original string of the data to be calculated contains at least the client ID, vehicle identification number (VIN), serial number (SN), timestamp, and other necessary business-related information. The necessary business-related information can be temporarily defined according to the different vehicle-side networking applications. For example, taking the Hypertext Transfer Protocol (http) business as an example, the query parameter (query parameter) on the http request header is the necessary information for the http business, while the request body (body) of the submitted request (POST request) is not involved in the calculation.

[0059] As an optional implementation method, step S106, when the communication key is successfully generated, obtains the first token information from the client application, including: when the communication key is successfully generated, controlling the client application to determine the first original string based on the client identification and target business information; controlling the client application to encode the first original string to obtain a first encoding result; controlling the client application to perform calculations based on the first encoding result and the token key to determine the first token information; obtaining the first token information from the client application.

[0060] In this embodiment, when the communication key is successfully generated, the client application can be controlled to determine the first original string based on the client identifier and the target business information. The client application can further be controlled to encode the determined first original string to obtain a first encoding result. Finally, the client application can be controlled to calculate the obtained first encoding result and the token key to obtain the first token information, so that the first token information from the client application can be obtained. Among them, the first original string can be an original string generated by the client application based on the client identifier and the target business information. The first encoding result can be an encoding value generated by the client application based on the first original string.

[0061] For example, taking http service as an example, the target service information can be necessary information for http service. After obtaining the client ID, necessary information for http service and timestamp, the original string of data to be calculated for http service is client ID + necessary information for http service + timestamp (in seconds). After the original string is calculated, the encoding value (BASE64 encoding value) of the original string can be calculated. The BASE64 encoding value is a string consisting of 64 characters, which can be represented by base64String, that is, base64String=BASE64 (original string). After the string base64String is calculated, based on the obtained token key, the algorithm HMAC-SHA256 can be used to calculate the token value of the vehicle-side networking application, that is, token=HMAC-SHA256 (base64String, token key).

[0062] As an optional implementation method, step S106, when the communication key is successfully generated, obtains the second token information from the server application, including: when the communication key is successfully generated, controlling the server application to determine the second original string based on the client identifier and target business information; controlling the server application to encode the second original string to obtain a second encoding result; controlling the server application to determine the second token information based on the second encoding value and the token key; obtaining the second token information from the server application.

[0063] In this embodiment, when the communication key is successfully generated, the server application can be controlled to determine the second original string based on the client identifier and the target business information. The server application can further be controlled to encode the determined second original string to obtain a second encoding result. Finally, the server application can be controlled to calculate the obtained second encoding result and the token key to obtain the second token information, so that the second token information from the server application can be obtained. Among them, the second original string can be the original string generated by the server application based on the client identifier and the target business information. The second encoding result can be a coded value generated by the server application based on the second original string.

[0064] Optionally, after receiving the business data sent by the vehicle-side networking application, the cloud service can calculate the token value based on the parameters of the business data. The calculation method of the token value is consistent with the calculation method of the vehicle-side networking application. After the token is calculated, it is compared with the token sent by the vehicle-side networking application. If they are consistent, the verification is passed. If they are inconsistent, the log is recorded and the connection is disconnected.

[0065] As an optional implementation method, in step S108, before comparing the first token information and the second token information to obtain the comparison result, the method also includes: controlling the client application to add the first token information to the business data, and sending the business data with the added first token information to the server application.

[0066] In this embodiment, after the client application generates the first token information, the client application can be controlled to add the first token information to the business data, and send the business data with the first token information added to the server application.

[0067] Optionally, after calculating the token value, the vehicle-side networking application sends business data to the cloud service, and the calculated token value is added to the business data.

[0068] As an optional implementation method, step S108, compares the first token information and the second token information to obtain a comparison result, including: in response to the server application receiving business data with the first token information added, controlling the server application to obtain the first token information from the business data, and comparing the first token information and the second token information to obtain a comparison result.

[0069] In this embodiment, when the server application receives business data for adding the first token information, in response to the server application receiving the business data for adding the first token information, the server application can be controlled to obtain the first token information from the business data, and compare the first token information with the second token information to obtain a comparison result.

[0070] Optionally, after the cloud service receives the business data sent by the vehicle-side networking application and the token value calculated by the vehicle-side networking application, the cloud service can extract the token value calculated by the vehicle-side networking application from the business data, and compare the token value with the token value calculated by itself to obtain a comparison result, that is, the cloud service verifies whether the token value sent by the vehicle-side networking application is consistent with the token value calculated by itself.

[0071] This embodiment obtains a client random number from a client application and a server random number from a server application; generates a communication key based on the client random number and the server random number, wherein the communication key is used to enable secure communication between the client application and the server application; when the communication key is successfully generated, obtains a first token information from the client application and a second token information from the server application; compares the first token information and the second token information to obtain a comparison result; in response to the comparison result that the first token information is the same as the second token information, determines that the identity of the client application and the server application are successfully authenticated. That is, the embodiment of the present invention compares the first token information from the client application with the second token information from the server application, and when the first token information is the same as the second token information, determines that the identity of the client application and the server application are successfully authenticated, thereby achieving a technical effect of two-way authentication between applications and improving vehicle safety, and solves the technical problem that two-way authentication cannot be performed between applications, resulting in low vehicle safety.

[0072] Example 2

[0073] The technical solution of the embodiment of the present invention is illustrated below in conjunction with preferred implementation modes.

[0074] At present, a large number of networked applications are deployed on the vehicle system, and these networked applications need to connect and interact with cloud services. Although the cloud service has deployed certificates, the vehicle-to-cloud communication also uses the Transport Layer Security (TLS) secure channel for protection. However, since the networked applications on the vehicle side do not have their own certificates, the TLS secure channel of the vehicle-to-cloud communication only uses a single certificate authentication.

[0075] Since the cloud service does not have an operation process to verify the identity of the vehicle-side network application, it is easy for attackers to impersonate the vehicle-side network application to attack the cloud service. Once the attacker breaks into the cloud service, it is easy to attack all connected vehicles through the cloud service, thereby threatening the life, property and safety of drivers and passengers.

[0076] As an optional example, an initialization and authentication method and device of an identity authenticator are proposed. The method is for the authentication of a controller system. Since the method does not involve two-way authentication between the vehicle-side network application and the cloud service, two-way authentication cannot be performed between applications, resulting in a problem of low vehicle safety. As another optional example, an identity authentication system and its authentication method are also proposed. The method uses a certificate for authentication, and does not involve authentication based on a calculated token value. As another optional example, a method for generating an identity authentication key, an identity authentication method, device and system are also proposed. The method is a key generation method. Since the method does not involve two-way authentication between the vehicle-side network application and the cloud service, two-way authentication cannot be performed between applications, resulting in a problem of low vehicle safety.

[0077] To solve the above problem, this embodiment proposes a two-way identity authentication method based on token calculation. In this method, the vehicle-side networking application calculates the token through a pre-made key and sends it to the cloud service through an authentication message. The cloud service receives the authentication message sent by the vehicle-side networking application, captures the token, and verifies it with the locally calculated token. When the verification is consistent, the authentication is passed and the two parties communicate normally; when the verification is inconsistent, it is considered to be an attacker, and the log is recorded and the connection is disconnected to protect the normal operation of the cloud service.

[0078] This embodiment performs two-way identity authentication by pre-making keys on the vehicle-side networking application and the cloud service, which can effectively identify man-in-the-middle attacks against cloud services, and implements a two-way identity authentication security mechanism by using token calculation for authentication and identification.

[0079] Figure 2 is a flowchart of a token-based two-way identity authentication between a vehicle-side networking application and a cloud service according to an embodiment of the present invention, such as Figure 2 As shown, the token-based two-way identity authentication process between the vehicle-side networking application 21 and the cloud service 22 may include the following steps:

[0080] Step S201: Establish a TCP connection between the vehicle-side networking application and the cloud service.

[0081] In the above step S201, the vehicle-side networking application and the cloud service complete the TCP three-way handshake to establish a TCP connection.

[0082] Step S202: The vehicle-side networking application sends a request to the cloud service.

[0083] In the above step S202, after the vehicle-side networking application establishes a TCP connection with the cloud service, the vehicle-side networking application sends a Client Hello request to the cloud service, and the request includes information such as a list of encryption suites supported by the client and a client random number.

[0084] Step S203: The cloud service sends a response to the vehicle-side networking application.

[0085] In the above step S203, after the cloud service receives the request sent by the vehicle-side networking application, the cloud service sends a response Sever Hello to the vehicle-side networking application, and the response includes information such as a list of encryption suites supported by the cloud service and a server random number.

[0086] Step S204: The cloud service sends an electronic certificate to the vehicle-side networking application.

[0087] In the above step S204, the cloud service sends its own electronic certificate to the client to prove its identity.

[0088] Step S205: The vehicle-side networking application and the cloud service generate a temporary communication key.

[0089] In the above step S205, after the vehicle-side networking application receives the response and electronic certificate sent by the cloud service, the vehicle-side networking application verifies the electronic certificate sent by the cloud service. After passing the verification, the vehicle-side networking application and the cloud service use the random numbers sent by both parties to generate a temporary communication key.

[0090] Step S206: The vehicle-side networking application sends a token value to the cloud service.

[0091] In the above step S206, after the vehicle-side networking application and the cloud service use the random numbers sent by both parties to generate a temporary communication key, the vehicle-side networking application calculates a token and sends business data to the cloud service, in which the token value is added.

[0092] Step S207: The vehicle-side networking application interacts with the cloud service.

[0093] In the above step S207, after the cloud service receives the service data with the token value added, the cloud service verifies whether the token value sent by the vehicle-side networking application is consistent with the token value calculated by itself. If the verification is consistent, it means that the verification is passed, and the vehicle-side networking application and the cloud service perform normal business interaction. If the verification is inconsistent, it is considered to be an attacker, and the log is recorded and the connection is disconnected to protect the normal operation of the cloud service.

[0094] The token value calculation in this embodiment adopts the HMAC-SHA256 standard algorithm, based on the preset key information synchronized between the vehicle-side networking application and the cloud service. The preset key information may at least include the client ID (Client Id) and the token key (Security Key).

[0095] The token value calculation of the vehicle-side networking application uses the preset token key and client ID to perform HMAC-SHA256 calculation on specific data. The original string of the data to be calculated contains at least the client ID, vehicle frame number VIN, device number SN, timestamp and other necessary information related to the business. The necessary information related to the business is temporarily defined according to different vehicle-side networking applications. The following takes the http business as an example to illustrate. The query parameter (query parameter) on the http request header is the necessary information of the http business, and the body of the POST request does not participate in the calculation. The token value calculation process is: first calculate the original string. The original string of the data to be calculated for the http business is the client ID + necessary information for the http business + timestamp. Secondly, calculate the BASE64 encoding value base64String=BASE64 (original string). Finally, calculate the token value, token=HMAC-SHA256 (base64String, token key).

[0096] After the vehicle-side networking application calculates the token value, the cloud service verifies the token value. After the cloud service receives the business data sent by the vehicle-side networking application, it calculates the token value based on the parameters of the business data. The token calculation method is consistent with the calculation method of the vehicle-side networking application. After calculating the token, the calculated token value is compared with the token sent by the vehicle-side networking application. When the verification is consistent, the authentication is passed and the two parties communicate normally; when the verification is inconsistent, it is considered to be an attacker, and the log is recorded and the connection is disconnected to protect the normal operation of the cloud service.

[0097] In this embodiment, use Model used to create a secure connection between two applications over a network to prevent eavesdropping and tampering when exchanging data. The advantage is that it can be used with higher-level application layer protocols, such as , File Transfer Protocol (abbreviated as ) etc. . It can run transparently on top of the TLS protocol, which performs the negotiation and authentication required to create an encrypted channel. The data transmitted by the application layer protocol will be encrypted when passing through the TLS protocol, thus ensuring the communication .

[0098] The vehicle-side networking application in this embodiment calculates the token using a pre-made key and sends it to the cloud service through an authentication message. The cloud service receives the authentication message sent by the vehicle-side networking application, grabs the token, and verifies it with the locally calculated token. If the verification is consistent, the authentication is passed and the two parties communicate normally; if the verification is inconsistent, it is considered to be an attacker, and the log is recorded and the connection is disconnected to protect the normal operation of the cloud service.

[0099] This embodiment obtains a client random number from a client application and a server random number from a server application; generates a communication key based on the client random number and the server random number, wherein the communication key is used to enable secure communication between the client application and the server application; when the communication key is successfully generated, obtains a first token information from the client application and a second token information from the server application; compares the first token information and the second token information to obtain a comparison result; in response to the comparison result that the first token information is the same as the second token information, determines that the identity of the client application and the server application are successfully authenticated. That is, the embodiment of the present invention compares the first token information from the client application with the second token information from the server application, and when the first token information is the same as the second token information, determines that the identity of the client application and the server application are successfully authenticated, thereby achieving a technical effect of two-way authentication between applications and improving vehicle safety, and solves the technical problem that two-way authentication cannot be performed between applications, resulting in low vehicle safety.

[0100] Example 3

[0101] According to an embodiment of the present invention, an application identity authentication device is also provided. It should be noted that the application identity authentication device can be used to execute the application identity authentication method in Example 1.

[0102] Figure 3 is a schematic diagram of an identity authentication device according to an embodiment of the present invention. Figure 3 As shown, the identity authentication device 300 of the application may include: a first acquisition unit 302 , a generation unit 304 , a second acquisition unit 306 , a comparison unit 308 and a first determination unit 310 .

[0103] The first acquisition unit 302 is used to acquire a client random number from a client application and a server random number from a server application.

[0104] The generating unit 304 is used to generate a communication key based on the client random number and the server random number, wherein the communication key is used to enable secure communication between the client application and the server application.

[0105] The second acquisition unit 306 is used to acquire the first token information from the client application and the second token information from the server application when the communication key is successfully generated.

[0106] The comparison unit 308 is used to compare the first token information with the second token information to obtain a comparison result.

[0107] The first determining unit 310 is configured to determine that authentication of the identity of the client application and the identity of the server application is successful in response to the comparison result that the first token information is identical to the second token information.

[0108] Optionally, the device further includes: a second determining unit, configured to determine that authentication of the identity of the client application and the identity of the server application has failed in response to a comparison result that the first token information is different from the second token information.

[0109] Optionally, before the first acquisition unit 302 is used to obtain the client random number from the client application and the server random number from the server application, the device also includes: a first control unit, used to control the client application to send request data to the server application when a connection is successfully established between the client application and the server application, wherein the request data at least includes the client random number; a second control unit, used to control the server application to send response data and an electronic certificate to the client application in response to the server application receiving the request data, wherein the response data at least includes the server random number, and the electronic certificate is used to represent the identity information of the server application.

[0110] Optionally, the generation unit 304 includes: a control module, used to control the client application to generate a communication key based on the client random number and the server random number in response to the client application receiving the response data and the electronic certificate and the client application successfully verifying the electronic certificate, and to control the server application to generate a communication key based on the client random number and the server random number.

[0111] Optionally, before the first acquisition unit 302 is used to obtain the first token information from the client application and the second token information from the server application, the device also includes: a third acquisition unit, used to obtain key information set between the client application and the server application, and obtain business data to be sent from the client application to the server application, wherein the key information includes at least the client identifier and the token key, and the business data includes at least the target business information.

[0112] Optionally, the second acquisition unit 306 includes: a first determination module, used to control the client application to determine the first original string based on the client identification and target business information when the communication key is successfully generated; a first encoding module, used to control the client application to encode the first original string to obtain a first encoding result; a first calculation module, used to control the client application to determine the first token information based on the first encoding result and the token key; and a first acquisition module, used to obtain the first token information from the client application.

[0113] Optionally, the second acquisition unit 306 includes: a second determination module, used to control the server application to determine the second original string based on the client identifier and target business information when the communication key is successfully generated; a second encoding module, used to control the server application to encode the second original string to obtain a second encoding result; a second calculation module, used to control the server application to determine the second token information based on the second encoding result and the token key; and a second acquisition module, used to obtain the second token information from the server application.

[0114] Optionally, before the comparison unit 308 is used to compare the first token information and the second token information and obtain a comparison result, the device also includes: a third control unit, used to control the client application to add the first token information to the business data, and send the business data with the first token information added to the server application.

[0115] Optionally, the comparison unit 308 includes: a comparison module, which is used to control the server application to obtain the first token information from the business data in response to the server application receiving the business data with the first token information added, and compare the first token information with the second token information to obtain a comparison result.

[0116] In an embodiment of the present invention, a client random number from a client application and a server random number from a server application are obtained by a first acquisition unit 302. A communication key is generated by a generation unit 304 based on the client random number and the server random number, wherein the communication key is used to enable secure communication between the client application and the server application. When the communication key is successfully generated, the first token information from the client application and the second token information from the server application are obtained by a second acquisition unit 306. The first token information and the second token information are compared by a comparison unit 308 to obtain a comparison result. In response to the comparison result that the first token information and the second token information are the same, the authentication unit 310 determines that the identity of the client application and the identity of the server application are successfully authenticated. That is, the embodiment of the present invention compares the first token information from the client application with the second token information from the server application. When the first token information and the second token information are the same, it is determined that the identity of the client application and the identity of the server application are successfully authenticated, thereby achieving a technical effect of bidirectional authentication between applications and improving vehicle safety, and solving the technical problem that bidirectional authentication cannot be performed between applications, resulting in low vehicle safety.

[0117] Example 4

[0118] According to an embodiment of the present invention, a computer-readable storage medium is further provided. The storage medium includes a stored program, wherein the program executes the identity authentication method of the application in Embodiment 1.

[0119] Example 5

[0120] According to an embodiment of the present invention, a vehicle is also provided, which is used to execute the identity authentication method of any application in Example 1.

[0121] Example 6

[0122] According to an embodiment of the present invention, a computer program product is further provided. The computer program product may include a computer program, wherein the computer program is configured to execute the identity authentication method of any application in the above-mentioned embodiment 1 when running.

[0123] According to another aspect of the embodiment of the present application, a computer program product is also provided. The computer program product may include a non-volatile computer-readable storage medium, wherein the non-volatile computer-readable storage medium stores a computer program, and the computer program is configured to execute the identity authentication method of any application in the above-mentioned embodiment 1 when running.

[0124] According to another aspect of the embodiment of the present application, a computer program is further provided, which is configured to execute the identity authentication method of any application in the above-mentioned embodiment 1 when running.

[0125] The serial numbers of the above embodiments of the present invention are only for description and do not represent the advantages or disadvantages of the embodiments.

[0126] In the above embodiments of the present invention, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0127] In the several embodiments provided by the present invention, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of the units can be a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0128] The units determined as separate components may or may not be physically separated, and the components determined as unit displays may or may not be physical units, that is, they may be located in one place or distributed on multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0129] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0130] If the integrated unit is implemented in the form of a software functional unit and determined to be sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, server or network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, disk or optical disk, etc., which can store program code.

[0131] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principle of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. An identity authentication method for an application, characterized in that: include: Get the client random number from the client application and the server random number from the server application; In response to the client application successfully verifying the electronic certificate of the server application, generating a communication key based on the client random number and the server random number, wherein the communication key is used to enable secure communication between the client application and the server application, and the electronic certificate is used to represent the identity information of the server application; When the communication key is successfully generated, obtaining first token information from the client application and second token information from the server application; Comparing the first token information with the second token information to obtain a comparison result; In response to the comparison result being that the first token information is identical to the second token information, determining that the identity of the client application and the identity of the server application are successfully authenticated; The method further includes: obtaining key information set between the client application and the server application, and obtaining business data to be sent by the client application to the server application, wherein the key information includes at least a client identifier and a token key, and the business data includes at least target business information; In the case where the communication key is successfully generated, obtaining the first token information from the client application, including: in the case where the communication key is successfully generated, controlling the client application to determine a first original string based on the client identifier and the target business information; controlling the client application to encode the first original string to obtain a first encoding result; controlling the client application to determine the first token information based on the first encoding result and the token key; obtaining the first token information from the client application.

2. The method according to claim 1, characterized in that The method further comprises: In response to the comparison result being that the first token information is different from the second token information, it is determined that authentication of the identity of the client application and the identity of the server application has failed.

3. The method according to claim 1, characterized in that Before obtaining the client random number from the client application and the server random number from the server application, the method further includes: In the case where a connection is successfully established between the client application and the server application, controlling the client application to send request data to the server application, wherein the request data at least includes the client random number; In response to the server application receiving the request data, controlling the server application to send response data and the electronic certificate to the client application, wherein the response data at least includes the server random number.

4. The method according to claim 3, characterized in that In response to the client application successfully verifying the electronic certificate of the server application, generating a communication key based on the client random number and the server random number, including: In response to the client application receiving the response data and the electronic certificate, and the client application successfully verifying the electronic certificate, the client application is controlled to generate the communication key based on the client random number and the server random number, and the server application is controlled to generate the communication key based on the client random number and the server random number.

5. The method according to claim 1, characterized in that When the communication key is successfully generated, obtaining second token information from the server application includes: When the communication key is successfully generated, controlling the server application to determine a second original character string based on the client identifier and the target service information; Controlling the server application to encode the second original character string to obtain a second encoding result; Controlling the server application to determine the second token information based on the second encoding result and the token key; Obtain the second token information from the server application.

6. The method according to claim 1, characterized in that Before comparing the first token information and the second token information to obtain a comparison result, the method further includes: The client application is controlled to add the first token information to the business data, and the business data with the first token information added is sent to the server application.

7. The method according to claim 6, characterized in that The first token information and the second token information are compared to obtain a comparison result, including: In response to the server application receiving the business data to which the first token information is added, the server application is controlled to obtain the first token information from the business data, and compares the first token information with the second token information to obtain the comparison result.

8. An identity authentication device for an application, characterized in that: include: A first acquisition unit, used to acquire a client random number from a client application and a server random number from a server application; a generating unit, configured to generate a communication key based on the client random number and the server random number in response to the client application successfully verifying the electronic certificate of the server application, wherein the communication key is used to enable secure communication between the client application and the server application, and the electronic certificate is used to represent the identity information of the server application; A second acquisition unit, configured to acquire, when the communication key is successfully generated, first token information from the client application and second token information from the server application; a comparing unit, configured to compare the first token information with the second token information to obtain a comparison result; A first determining unit, configured to determine that authentication of the identity of the client application and the identity of the server application is successful in response to the comparison result that the first token information is the same as the second token information; The device is further used to: obtain key information set between the client application and the server application, and obtain business data to be sent by the client application to the server application, wherein the key information at least includes a client identifier and a token key, and the business data at least includes target business information; A second acquisition unit is used to acquire the first token information from the client application when the communication key is successfully generated, including: when the communication key is successfully generated, controlling the client application to determine a first original string based on the client identifier and the target business information; controlling the client application to encode the first original string to obtain a first encoding result; controlling the client application to determine the first token information based on the first encoding result and the token key; and acquiring the first token information from the client application.

9. An electronic device, characterized in that: include: A memory storing an executable program; A processor, configured to run the program, wherein the program executes the method according to any one of claims 1 to 7 when running.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium includes a stored program, wherein when the program is executed by a processor, the device where the storage medium is located is controlled to execute the method according to any one of claims 1 to 7.

11. A computer program product, characterized in that The computer program product comprises a computer program, wherein the computer program is configured to perform the method according to any one of claims 1 to 7 when executed by a processor.

12. A vehicle, characterized in that: Used to perform the method according to any one of claims 1 to 7.

Images