Authentication method and device, digital key system, terminal device and storage medium

Abstract

The embodiment of the present invention relates to the field of vehicle safety technology, and discloses an authentication method and device, a digital key system, a terminal device and a storage medium. The method includes: the main module of the digital key system and the digital key device perform identity authentication based on the vehicle-side key information and the device-side key information and negotiate to generate a long-term key; after the identity authentication is passed, the main module synchronizes the vehicle-side long-term key to the slave module, and the main module and the slave module respectively store the vehicle-side long-term key securely; the digital key device securely stores the device-side long-term key; when the main module or any slave module receives an authentication request from the digital key device, the main module and the digital key device respectively implement vehicle control authentication based on their respective stored long-term keys. Each node performs vehicle control-related authentication through the negotiated long-term key, which not only has low cost and system complexity, but also reduces the communication link in the authentication process, reduces unnecessary overhead, and improves authentication efficiency.

Description

Technical Field

[0001] Embodiments of the present invention relate to the field of vehicle safety technology, and in particular, to an authentication method and apparatus, a digital key system, a terminal device, and a storage medium. Background Art

[0002] Digital car keys are currently developing rapidly. The digital car key system based on NFC (Near Field Communication) can meet different functional requirements. For example, users can place a digital key device with NFC function on a card reader device outside the car and swipe the card to unlock the door. They can also place the digital key device on a card reader device inside the car and swipe the card to start the engine.

[0003] The card swiping operation requires the completion of legal authentication between the device and the vehicle to confirm the legitimacy of the device and access control authority. The authentication method is conventionally based on a cryptographic algorithm to confirm whether the device has a legitimate key, which requires key data authentication interaction between the device and the vehicle.

[0004] The digital key system includes a main module and multiple card reader devices. The vehicle's key data is usually stored only on the main module. During key data authentication interaction, each card reader device is responsible for communicating with the key device and transparently transmitting the interactive data to the key device and the main module. The actual authentication process is completed by the key device and the main module, and the card reader device is responsible for data transmission. The key data authentication process often requires multiple data interactions to complete, such as Figure 1 As shown in the figure, the digital key device sends a key authentication request to the card reader device (also known as the slave module). The card reader device transparently transmits the key authentication request to the main module. The main module performs key authentication. After the authentication is completed, the key authentication result is returned to the card reader device in a transparent manner. The card reader device then returns the authentication result to the digital key device. When the key authentication is successful, the main module sends a control instruction to the corresponding control module. The control module executes the control instruction and returns the execution result to the main module. In the actual commonly used two-way authentication process, the number of data exchanges between the main module and the digital key device is not Figure 1 As shown in. Since all communication data between the main module and the digital key device needs to be transmitted through the card reader device, the long communication link will eventually affect the user's functional experience and will also bring unnecessary overhead.

[0005] However, storing key data in each module of the digital key system will increase costs and increase system complexity. Summary of the invention

[0006] In view of this, an embodiment of the present invention provides an authentication method and apparatus, a digital key system, a terminal device and a storage medium. While the key data is only stored in the main module, each node on the vehicle side performs vehicle control-related authentication through a negotiated long-term key. This not only reduces the cost and system complexity, but also reduces the communication links in the authentication process, reduces unnecessary overhead, and also improves authentication efficiency.

[0007] In a first aspect, an embodiment of the present invention provides an authentication method, which is applied to a digital key system on a vehicle side, wherein the digital key system is used to interact with a digital key device to implement authentication; the digital key system includes a master module and at least one slave module, the master module is communicatively connected to the at least one slave module, the master module is pre-installed with vehicle-side key information, and the digital key device stores device-side key information; the method includes:

[0008] The main module and the digital key device perform identity authentication based on the vehicle-side key information and the device-side key information and negotiate to generate a long-term key; the long-term key includes: a vehicle-side long-term key and a device-side long-term key;

[0009] After the identity authentication is passed, the master module synchronizes the vehicle-side long-term key to the slave module, and the master module and the slave module respectively securely store the vehicle-side long-term key; the digital key device securely stores the device-side long-term key;

[0010] When the main module or any slave module receives the authentication request of the digital key device, the main module and the digital key device respectively implement vehicle control authentication based on their respective stored long-term keys.

[0011] As an embodiment, the vehicle-side key information includes: a vehicle private key Vehicle.SK, a vehicle identity certificate and a digital key certificate; the device-side key information includes: a digital key private key DigitalKey.SK, a digital key certificate and a vehicle identity certificate; the vehicle identity certificate is pre-set with a vehicle public key Vehicle.PK, and the digital key certificate is pre-set with a digital key public key DigitalKey.PK; the Vehicle.SK and the Vehicle.PK are an asymmetric key pair, and the DigitalKey.SK and the DigitalKey.PK are an asymmetric key pair;

[0012] The main module and the digital key device perform identity authentication based on the vehicle-side key information and the device-side key information, including:

[0013] The main module randomly generates a temporary public and private key pair on the vehicle side;

[0014] The main module transmits the public key in the temporary public-private key pair on the vehicle side to the digital key device; the digital key device randomly generates a temporary public-private key pair on the device side, and transmits the public key in the temporary public-private key pair on the device side to the main module;

[0015] The main module generates vehicle authentication information, and uses the Vehicle.SK to sign the vehicle authentication information to obtain Vehicle.sig;

[0016] The main module sends the Vehicle.sig to the digital key device; the digital key device uses the Vehicle.PK to verify the signature of the Vehicle.sig. After the signature verification is passed, the digital key device calculates the security channel key between the digital key device and the vehicle terminal; the digital key device generates device authentication information, uses the DigitalKey.SK to sign the device authentication information to obtain Device.sig, and uses the security channel key to encrypt the Device.sig and then sends it to the main module;

[0017] The main module calculates the secure channel key, decrypts the encrypted Device.sig, and uses the DigitalKey.PK to verify the signature of the decrypted Device.sig. After the signature verification is passed, the identity authentication of the digital key device is completed.

[0018] As an embodiment, the main module and the digital key device negotiate to generate a long-term key, including:

[0019] The main module uses a preset negotiation algorithm to generate the vehicle-side long-term key based on the private key in the vehicle-side temporary public-private key pair and the public key in the device-side temporary public-private key pair; the digital key device uses the preset negotiation algorithm to generate the device-side long-term key based on the private key in the device-side temporary public-private key pair and the public key in the vehicle-side temporary public-private key pair.

[0020] In a second aspect, an embodiment of the present invention further provides an authentication method, which is applied to a digital key device, wherein the digital key device is used to interact with a digital key system on a vehicle side to achieve authentication; the digital key device is pre-installed with device-side key information; the digital key system includes a master module and at least one slave module; the master module is communicatively connected with the at least one slave module, and the master module is pre-installed with vehicle-side key information; the method includes:

[0021] The digital key device and the main module perform identity authentication based on the device-side key information and the vehicle-side key information and negotiate to generate a long-term key; the long-term key includes: a vehicle-side long-term key and a device-side long-term key;

[0022] After the identity authentication is passed, the digital key device securely stores the device-side long-term key; the master module synchronizes the vehicle-side long-term key to the slave module, and the master module and the slave module securely store the vehicle-side long-term key respectively;

[0023] The digital key device and the master module or any slave module are authenticated based on the device-side long-term key and the vehicle-side long-term key.

[0024] In a third aspect, an embodiment of the present invention further provides an authentication device, which is configured in a digital key system at a vehicle terminal, and the digital key system is used to interact with a digital key device to achieve authentication; the digital key system includes a main module and at least one slave module, the main module is communicatively connected with the at least one slave module, the main module is pre-set with vehicle terminal key information, and the digital key device stores device terminal key information; the authentication device includes:

[0025] An authentication negotiation module, used for the main module and the digital key device to perform identity authentication and negotiate to generate a long-term key based on the vehicle-side key information and the device-side key information; the long-term key includes: a vehicle-side long-term key and a device-side long-term key;

[0026] A key storage module, which is used for the master module to synchronize the vehicle-side long-term key to the slave module after the identity authentication is passed, and the master module and the slave module respectively store the vehicle-side long-term key securely; the digital key device securely stores the device-side long-term key;

[0027] The real-time authentication module is used to implement vehicle control authentication with the digital key device based on the long-term keys stored in each of them when the main module or any slave module receives an authentication request from the digital key device.

[0028] In a fourth aspect, an embodiment of the present invention provides an authentication device, which is configured in a digital key device, and the digital key device is used to interact with a digital key system on a vehicle side to achieve authentication; the digital key device is pre-installed with device-side key information; the digital key system includes a master module and at least one slave module; the master module is communicatively connected with the at least one slave module, and the master module is pre-installed with vehicle-side key information; the authentication device includes:

[0029] An authentication negotiation module, used for the digital key device and the main module to perform identity authentication and negotiate to generate a long-term key based on the device-side key information and the vehicle-side key information; the long-term key includes: a vehicle-side long-term key and a device-side long-term key;

[0030] A key storage module, which is used for the digital key device to securely store the device-side long-term key after the identity authentication is passed; the master module synchronizes the vehicle-side long-term key to the slave module, and the master module and the slave module securely store the vehicle-side long-term key respectively;

[0031] A real-time authentication module is used for the digital key device to authenticate with the main module or any slave module based on the device-side long-term key and the vehicle-side long-term key.

[0032] In a fifth aspect, an embodiment of the present invention provides a digital key system for interacting with a digital key device to achieve authentication, the digital key system comprising a master module and at least one slave module, the master module being communicatively connected to the at least one slave module, the master module being pre-installed with vehicle-side key information, and the digital key device storing device-side key information;

[0033] The main module and the digital key device perform identity authentication based on the vehicle-side key information and the device-side key information and negotiate to generate a long-term key; the long-term key includes: a vehicle-side long-term key and a device-side long-term key;

[0034] After the identity authentication is passed, the master module synchronizes the vehicle-side long-term key to the slave module, and the master module and the slave module respectively securely store the vehicle-side long-term key; the digital key device securely stores the device-side long-term key;

[0035] When the master module or any slave module receives an authentication request from the digital key device, the master module or any slave module performs authentication with the digital key device based on the long-term keys stored in each of them.

[0036] In a sixth aspect, an embodiment of the present invention provides a terminal device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the authentication method as described in the second aspect when executing the program.

[0037] In a seventh aspect, an embodiment of the present invention provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the authentication method as described in the first aspect or the second aspect.

[0038] Compared with the prior art, the technical solution provided by the embodiment of the present invention has at least the following positive effects:

[0039] In an embodiment of the present invention, the main module of the digital key system on the vehicle side and the digital key device perform identity authentication and long-term key negotiation based on the vehicle-side key information and the device-side key information. After the identity authentication is completed, the negotiated vehicle-side long-term key is synchronized to each slave module through the rear master module. Both the main module and the slave module securely store the vehicle-side long-term key, and the digital key device securely stores the negotiated device-side long-term key. While the key data is only stored in the main module, each node on the vehicle side performs vehicle control-related authentication through the negotiated long-term key. Not only is the cost and system complexity low, but the communication links in the authentication process can be reduced, unnecessary overhead can be reduced, and authentication efficiency can also be improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0041] Figure 1 A flowchart of a prior art authentication method is provided;

[0042] Figure 2 A schematic diagram of the structure of a digital key system provided in Embodiment 1 of the present invention;

[0043] Figure 3 A schematic diagram of a flow chart of an authentication method provided in Embodiment 1 of the present invention;

[0044] Figure 4 A schematic diagram of another process of the authentication method provided in the first embodiment of the present invention;

[0045] Figure 5 An exemplary flow chart of identity authentication and key negotiation of the authentication method provided in the first embodiment of the present invention;

[0046] Figure 6 A schematic diagram of the flow of the authentication method provided in the second embodiment of the present invention;

[0047] Figure 7 A schematic diagram of the structure of an authentication device provided in Embodiment 3 of the present invention;

[0048] Figure 8 A schematic diagram of the structure of an authentication device provided in Embodiment 4 of the present invention;

[0049] Fig. 9 A schematic diagram of the structure of a terminal device provided in Embodiment 6 of the present invention. DETAILED DESCRIPTION

[0050] The present invention will be further described in detail below in conjunction with the accompanying drawings and embodiments. It is to be understood that the specific embodiments described herein are only used to explain the present invention, rather than to limit the present invention. It should also be noted that, for ease of description, only parts related to the present invention, rather than all structures, are shown in the accompanying drawings.

[0051] The following describes the authentication method and device, digital key system, terminal device and storage medium of the embodiment of the present application with reference to the accompanying drawings. In view of the problem that the key information of the digital key system on the vehicle side mentioned in the background technology only exists in the main module of the digital key system, and the authentication interaction of the key data between the main module and the digital key device needs to be transmitted through the card reader device, resulting in a long communication link and affecting the authentication performance, the present application provides an authentication method, in which the main module of the digital key system on the vehicle side is pre-set with the vehicle side key information, and the digital key device stores the device side key information. The main module and the digital key device perform identity authentication based on the vehicle side key information and the device side key information and negotiate to generate a long-term key, and the long-term key includes: a vehicle side long-term key and a device side long-term key. After the identity authentication is passed, the main module synchronizes the vehicle side long-term key to each slave module, and the main module and the slave module respectively store the vehicle side long-term key securely, and the digital key device stores the device side long-term key securely. When the main module or any slave module receives the authentication request of the digital key device, it and the digital key device respectively implement vehicle control authentication based on the long-term keys stored by each of them. After the authentication is successful, the slave module directly sends a control instruction to the corresponding control module to control the vehicle. It can be seen that while the key data is only stored in the main module, each node on the vehicle side can perform vehicle control-related authentication through the negotiated long-term key, which not only reduces the cost and system complexity, but also reduces the communication links in the authentication process, reduces unnecessary overhead, and improves authentication efficiency.

[0052] Figure 2A structural diagram of a digital key system at the vehicle end provided in the first embodiment of the present invention. The digital key system is used to interact with a digital key device to achieve authentication. The digital key system includes a master module 201 and at least one slave module. The vehicle end also includes at least one control module, the master module 201 is communicatively connected to at least one slave module, and at least one slave module is communicatively connected to the corresponding control module. As an example and not a limitation, the slave module includes a first slave module 202, a second slave module 203 and a third slave module 204, and the control module includes: a left door controller 205, a right door controller 206 and an engine controller 207. The first slave module 202, the second slave module 203 and the third slave module 204 are all communicatively connected to the master module 201 through the vehicle body network. At the same time, the left door controller 205 and the first slave module 202, the right door controller 206 and the second slave module 203, and the engine controller 207 and the third slave module 204 are all connected through the vehicle body network, and the vehicle body network is, for example, a CAN communication network. The slave modules are configured to be able to communicate with the digital key device and interact with the digital key device to complete the authentication. It can be understood that this embodiment does not impose specific restrictions on the type and quantity of the slave modules and control modules, and can be configured according to actual needs. The main module 101 is pre-set with vehicle-side key information. The digital key device can be a portable smart terminal with near-field communication capabilities, such as a smart phone, a smart watch, etc., or it can be an NFC card. Correspondingly, the slave module can be an NFC reader device and have key data authentication capabilities.

[0053] Figure 3 This is a flow chart of an authentication method provided in Embodiment 1 of the present invention, which is used for the vehicle terminal to authenticate the digital key. This method can be applied to Figure 2 The digital key system of the vehicle terminal is shown. The method can be executed by an authentication device provided by an embodiment of the present invention, which can be implemented in software and configured in the digital key system of the vehicle terminal. The embodiment of the present invention specifically includes the following steps:

[0054] Step 301: The main module and the digital key device perform identity authentication based on the vehicle-side key information and the device-side key information and negotiate to generate a long-term key.

[0055] The main module is pre-installed with vehicle-side key information, which may include the vehicle's master key data or the vehicle's certificate data. The data content of the vehicle-side key information is determined by the authentication protocol of the digital car key. The mainstream authentication protocols include symmetric key architecture and asymmetric key architecture (or certificate system architecture). The vehicle-side key information can be filled into the main module through the filling production line or sent to the main module in real time in a remote and secure manner. Correspondingly, the digital key device can also use known methods to obtain the device-side key information, which will not be repeated here.

[0056] The embodiment of the present invention is applicable to a variety of digital key solutions. The main module and the digital key device can use known technologies for identity authentication, and can negotiate to generate long-term keys during the identity authentication process. The long-term keys include the vehicle-side long-term key and the device-side long-term key. The long-term key is a symmetric key, that is, the vehicle-side long-term key and the device-side long-term key are the same. The long-term key can be generated using a symmetric or asymmetric negotiation algorithm without excessive restrictions.

[0057] It is worth mentioning that the digital key device and the digital key system can configure a long-term key update strategy and update the long-term key according to the update strategy. For example, the long-term key is updated according to a preset period, and the preset period is, for example, 3 months, 6 months or 12 months, etc., without specific restrictions. Or when the long-term key is lost, step 301 to step 302 are executed in time to complete the long-term key update.

[0058] It is understandable that before identity authentication, the main module can also perform preliminary filtering on the digital key device to filter out obviously illegal devices. The preliminary filtering process may include receiving a vehicle control operation request from the digital key device from the module, obtaining the identification information of the device from the module, and judging whether the device is legal based on the identification information. The identification information is used to characterize the type of the device. For example, when the identification information indicates that the device is a bus IC card, the device is judged to be an illegal device. When the identification information indicates that the device is an NFC tag of the target type, it is judged to be a legal device.

[0059] Step 302: After the identity authentication is passed, the master module synchronizes the vehicle-side long-term key to the slave module, and the master module and the slave module respectively store the vehicle-side long-term key securely. The digital key device securely stores the device-side long-term key.

[0060] After the identity authentication is passed, the master module can transmit the generated vehicle-side long-term key to all slave modules of the digital key system in real time. The slave module stores the vehicle-side long-term key securely locally. After that, the digital key device can directly interact with any slave module for authentication to achieve vehicle authority control. Slave modules, such as card readers, can securely store long-term keys based on their own security mechanisms, without the need for additional software and hardware security mechanisms, and will not increase costs and increase system complexity.

[0061] Step 303: When the master module or any slave module receives an authentication request from the digital key device, the master module and the digital key device respectively implement vehicle control authentication based on their respective stored long-term keys.

[0062] The long-term key is a symmetric key. The master module or the slave module can authenticate each other's long-term key based on the symmetric key algorithm. This embodiment does not impose any specific restrictions on the authentication process.

[0063] It is understandable that the main module and the digital key device can perform more stringent re-authentication when negotiating the long-term key, and then use the long-term key for light authentication. Through two-level authentication, while ensuring security, it is also beneficial to improve authentication efficiency.

[0064] Combine the following Figure 4 The authentication method of the embodiment of the present application is described as follows. The authentication method of the present embodiment includes a key negotiation phase and a key usage phase.

[0065] The key negotiation phase includes: key authentication between the digital key device and the main module, during which both parties negotiate a long-term key. Please refer to the following for the key authentication and key negotiation process. Figure 5 As shown. The digital key device securely stores the negotiated device-side key, that is, stores the long-term key. The master module securely stores the negotiated vehicle-side long-term key. The master module also synchronizes the vehicle-side long-term key to all slave modules. All slave modules securely store the vehicle-side long-term key and return the synchronization result to the master module after storage is completed.

[0066] The key use phase includes: the digital key device and the main module or any slave module use the long-term key to authenticate and realize control. For example, the digital key device and slave module #1 use the long-term key to authenticate, and after the authentication is passed, the slave module #1 sends a control instruction to the corresponding control module, thereby realizing the corresponding control function of the slave module #1, such as unlocking the door.

[0067] Combine the following Figure 5 The identity authentication and long-term key negotiation of step 301 of the authentication method of the embodiment of the present application are described in detail. The vehicle-side key information includes: vehicle private key Vehicle.SK, vehicle identity certificate and digital key certificate; the device-side key information includes: digital key private key DigitalKey.SK, digital key certificate and vehicle identity certificate; the vehicle identity certificate is pre-set with the vehicle public key Vehicle.PK, and the digital key certificate is pre-set with the digital key public key DigitalKey.PK; Vehicle.SK and Vehicle.PK are asymmetric key pairs, and DigitalKey.SK and DigitalKey.PK are asymmetric key pairs. The digital key certificate can be sent from the device side to the vehicle side when the owner's key is activated. The vehicle public key certificate can be sent from the vehicle side to the device side during the activation process of the owner's key. An example process of identity authentication and long-term key negotiation includes:

[0068] Step 1: The main module randomly generates a temporary public and private key pair on the vehicle side.

[0069] The main module can randomly generate the vehicle-side ECC public and private key pair vehicle_ePK, vehicle_eSK.

[0070] It is understandable that before step 1, the vehicle machine and the digital key device first execute the owner key activation process and establish a data channel. The owner key activation process and the data channel establishment process are known in the art and will not be described here.

[0071] Step 2: Transfer the public key in the temporary public-private key pair on the vehicle side to the digital key device.

[0072] The main module passes vehicle_ePK to the digital key device.

[0073] Step 3: Randomly generate a temporary public and private key pair on the device.

[0074] The temporary public and private key pair on the device side can be generated using the ECC algorithm and recorded as device_ePK and device_eSK.

[0075] Step 4: Send the public key in the temporary public-private key pair on the device.

[0076] The digital key device passes device_ePK to the main module to complete the exchange of temporary public keys.

[0077] Step 5: Generate vehicle authentication information and sign it using Vehicle.SK to obtain vehicle.sig.

[0078] Vehicle authentication information may include vehicle identity information, such as vehicle machine number, etc., which is not limited here.

[0079] Step 6. Send vehicle.sig.

[0080] The digital key device then performs a series of processes:

[0081] Step 7.1. The device authenticates the vehicle: Use Vehicle.PK to verify the signature of Vehicle.sig.

[0082] Step 7.2: After verification, the channel encryption key is calculated, and the device-side long-term key is generated through negotiation. After the authentication is completed and passed, it is stored locally.

[0083] The channel encryption keys include, for example, Kenc, Kmac and Krmac. Kenc, Kmac and Krmac are channel encryption keys based on the CCC (Car Connectivity Consortium) protocol. The channel encryption keys can be determined according to the specific digital key protocol and are not specifically limited here.

[0084] The long-term key on the device side can be generated by negotiation using the ECDH (Elliptic Curve Diffie-Hellman) algorithm: ECDH (vehicle_ePK, device_eSK), and the parameters for negotiating the long-term key on the device side are vehicle_ePK and device_eSK. It is understandable that other asymmetric algorithms or symmetric algorithms can also be used to negotiate long-term keys, and there is no excessive restriction here.

[0085] Step 7.3: Generate device authentication information and use DigitalKey.SK to sign to obtain signature data device.sig.

[0086] The device authentication information may include, for example, the owner's mobile phone number, etc., which is not specifically limited here.

[0087] Step 7.4: Encrypt device.sig using the channel key.

[0088] Step 8: Send the encrypted device authentication information signature device.sig.

[0089] Step 9.1: Calculate the channel encryption key and negotiate to generate a long-term key. After the authentication is completed and passed, store it locally.

[0090] The vehicle-side long-term key can be generated by negotiation using the ECDH algorithm: ECDH (device_ePK, vehicle_eSK). The parameters for negotiating the vehicle-side long-term key are device_ePK and vehicle_eSK.

[0091] Step 9.2: Use the calculated channel key to decrypt the encrypted device.sig sent by the device.

[0092] Step 9.3: The vehicle authenticates the device: Use DigitalKey.PK to verify the signature of device.sig to complete the vehicle-to-device authentication.

[0093] After the two-way identity authentication is successful, the main module can securely store the vehicle-side long-term key and synchronize the vehicle-side long-term key to each slave module. Each slave module securely stores the vehicle-side long-term key, and the digital key device securely stores the device-side long-term key, so that both parties can authenticate based on the long-term key to determine access control permissions.

[0094] The above provides a method for the digital key device and the vehicle terminal to achieve identity authentication through two-way authentication, and negotiate to generate a long-term key during the identity authentication process. It is understandable that other suitable identity authentication methods and long-term key negotiation methods can also be used, and no excessive restrictions are made here.

[0095] Compared with the prior art, in the embodiment of the present invention, both the vehicle-side and the digital key device perform identity authentication based on the vehicle-side key information and the device-side key information and negotiate to generate a long-term key, and the main module and the slave module both securely store the vehicle-side long-term key, and the digital key device securely stores the device-side long-term key. The digital key device and the main module or any slave module perform authentication based on their respective stored long-term keys to achieve vehicle control operations. Therefore, while the key data is only stored in the main module, each node on the vehicle-side performs vehicle control-related authentication through the negotiated long-term key, which not only has low cost and system complexity, but also can reduce the communication links in the authentication process, reduce unnecessary overhead, and improve authentication efficiency.

[0096] Figure 6 The flowchart of the authentication method provided in the second embodiment of the present invention can be applied to a digital key device, and the digital key device is used to interact with the digital key system on the vehicle side to achieve authentication. The method can be executed by an authentication device provided in the embodiment of the present invention, and the device can be implemented in software and configured in the digital key device application. The digital key device is pre-installed with device-side key information; the digital key system includes a main module and at least one slave module; the main module is communicatively connected with at least one slave module, and the main module is pre-installed with vehicle-side key information. The embodiment of the present invention specifically includes the following steps:

[0097] Step 601: The digital key device and the main module perform identity authentication based on the device-side key information and the vehicle-side key information and negotiate to generate a long-term key. The long-term key includes: a vehicle-side long-term key and a device-side long-term key.

[0098] Among them, the identity authentication and long-term key negotiation process of the main module and the digital key device are the same as the corresponding processes in Example 1, and will not be repeated here.

[0099] Step 602: After identity authentication is passed, the digital key device securely stores the device-side long-term key. The master module synchronizes the vehicle-side long-term key to the slave module. The master module and the slave module securely store the vehicle-side long-term key respectively.

[0100] Step 603: The digital key device and the master module or any slave module are authenticated based on the device-side long-term key and the vehicle-side long-term key.

[0101] Steps 602-603 are the same or similar to the corresponding processes of steps 502-503 of the aforementioned embodiment, and are not described again here.

[0102] Compared with the prior art, in the embodiment of the present invention, both the vehicle-side and the digital key device perform identity authentication based on the vehicle-side key information and the device-side key information and negotiate to generate a long-term key, and the main module and the slave module both securely store the vehicle-side long-term key, and the digital key device securely stores the device-side long-term key. The digital key device and the main module or any slave module perform authentication based on their respective stored long-term keys to achieve vehicle control operations. Therefore, while the key data is only stored in the main module, each node on the vehicle-side performs vehicle control-related authentication through the negotiated long-term key, which not only has low cost and system complexity, but also can reduce the communication links in the authentication process, reduce unnecessary overhead, and improve authentication efficiency.

[0103] Embodiment 3 of the present invention provides an authentication device, which is configured in a digital key system at the vehicle end. The digital key system is used to interact with a digital key device to achieve authentication. The digital key system includes a main module and at least one slave module. The main module is communicatively connected to the at least one slave module. The main module is pre-installed with vehicle-end key information, and the digital key device stores device-end key information. The vehicle end also includes at least one control module. The main module is communicatively connected to the at least one slave module. The at least one slave module is communicatively connected to the corresponding control module. Figure 7 As shown, the device 700 includes: a derived module authentication negotiation module 702 , a key storage module 704 and a real-time authentication module 706 .

[0104] The authentication negotiation module 702 is used for the main module and the digital key device to perform identity authentication and negotiate to generate a long-term key based on the vehicle-side key information and the device-side key information. The long-term key includes: a vehicle-side long-term key and a device-side long-term key.

[0105] The key storage module 704 is used for synchronizing the vehicle-side long-term key to the slave module after identity authentication. The master module and the slave module store the vehicle-side long-term key securely. The digital key device stores the device-side long-term key securely.

[0106] The real-time authentication module 706 is used to implement vehicle control authentication with the digital key device based on the long-term keys stored in each of them when the main module or any slave module receives an authentication request from the digital key device.

[0107] Optionally, the vehicle-side key information includes: vehicle private key Vehicle.SK, vehicle identity certificate and digital key certificate. The device-side key information includes: digital key private key DigitalKey.SK, digital key certificate and vehicle identity certificate. The vehicle identity certificate is pre-set with vehicle public key Vehicle.PK, and the digital key certificate is pre-set with digital key public key DigitalKey.PK. Vehicle.SK and Vehicle.PK are an asymmetric key pair, and DigitalKey.SK and DigitalKey.PK are an asymmetric key pair.

[0108] The authentication negotiation module 702 is specifically used for: the main module randomly generates a temporary public-private key pair on the vehicle side, the main module passes the public key in the temporary public-private key pair on the vehicle side to the digital key device, the digital key device randomly generates a temporary public-private key pair on the device side, passes the public key in the temporary public-private key pair on the device side to the main module, the main module generates vehicle authentication information, and uses Vehicle.SK to sign the vehicle authentication information to obtain Vehicle.sig, and the main module sends Vehicle.sig to the digital key device. The digital key device uses Vehicle.PK to verify the signature of Vehicle.sig. After the signature verification is passed, the digital key device calculates the security channel key between the digital key device and the vehicle end, and the digital key device generates device authentication information. It uses DigitalKey.SK to sign the device authentication information to obtain Device.sig, and uses the security channel key to encrypt Device.sig and send it to the main module; the main module decrypts the encrypted Device.sig and uses DigitalKey.PK to verify the decrypted Device.sig. After the signature verification is passed, the identity authentication of the digital key device is completed.

[0109] Optionally, the authentication negotiation module 702 is specifically used for: the main module generates a vehicle-side long-term key based on the private key in the temporary public-private key pair on the vehicle side and the public key in the temporary public-private key pair on the device side using a preset negotiation algorithm; the digital key device generates a device-side long-term key based on the private key in the temporary public-private key pair on the device side and the public key in the temporary public-private key pair on the vehicle side using a preset negotiation algorithm.

[0110] Compared with the prior art, the authentication device of the embodiment of the present invention performs identity authentication and negotiates to generate a long-term key based on the vehicle-side key information and the device-side key information. The main module and the slave module both securely store the vehicle-side long-term key, and the digital key device securely stores the device-side long-term key. The digital key device and the main module or any slave module perform authentication based on their respective stored long-term keys to achieve vehicle control operations. Therefore, while the key data is only stored in the main module, each node on the vehicle-side performs vehicle control-related authentication through the negotiated long-term key. Not only is the cost and system complexity low, but the communication links in the authentication process can be reduced, unnecessary overhead can be reduced, and authentication efficiency can also be improved.

[0111] Embodiment 4 of the present invention provides an authentication device, which is configured in a digital key device, and the digital key device is used to interact with a digital key system on a vehicle side to achieve authentication. The digital key device is pre-installed with device-side key information, and the digital key system includes a master module and at least one slave module, and the master module is communicatively connected with the at least one slave module, and the master module is pre-installed with vehicle-side key information. Figure 8 As shown, the authentication device 800 includes: an authentication negotiation module 802 , a key storage module 804 and a real-time authentication module 806 .

[0112] The authentication negotiation module 802 is used for the digital key device and the main module to perform identity authentication and negotiate to generate a long-term key based on the device-side key information and the vehicle-side key information. The long-term key includes: a vehicle-side long-term key and a device-side long-term key.

[0113] The key storage module 804 is used for securely storing the long-term key of the device end by the digital key device after identity authentication is passed. The main module synchronizes the long-term key of the vehicle end to the slave module. The main module and the slave module securely store the long-term key of the vehicle end respectively.

[0114] The real-time authentication module 806 is used for the digital key device to authenticate with the main module or any slave module based on the device-side long-term key and the vehicle-side long-term key.

[0115] Optionally, the authentication negotiation module 802 is specifically used for: the main module sends the public key in the temporary public-private key pair to the digital key device, the digital key device randomly generates a temporary public-private key pair on the device side, sends the public key in the temporary public-private key pair on the device side to the main module, the main module generates vehicle authentication information, and uses Vehicle.SK to sign the vehicle authentication information to obtain vehicle.sig, the main module sends Vehicle.sig to the digital key device, the digital key device uses Vehicle.PK to verify the signature of vehicle.sig, after the signature verification is passed, the digital key device calculates the security channel key between the digital key device and the vehicle machine end, the digital key device generates device authentication information, uses DigitalKey.SK to sign the device authentication information to obtain device.sig, uses the security channel key to encrypt the device.sig and sends it to the main module, the main module decrypts the encrypted device.sig, uses DigitalKey.PK to verify the decrypted device.sig, and completes the authentication of the digital key device identity after the signature verification is passed.

[0116] Optionally, the authentication negotiation module 802 is specifically used for: the main module uses a preset negotiation algorithm to generate a vehicle-side long-term key based on the private key in the temporary public-private key pair on the vehicle side and the public key in the temporary public-private key pair on the device side, and the digital key device uses a preset negotiation algorithm to generate a device-side long-term key based on the private key in the temporary public-private key pair on the device side and the public key in the temporary public-private key pair on the vehicle side.

[0117] Compared with the prior art, the authentication device of the embodiment of the present invention performs identity authentication on the vehicle side and the digital key device based on the vehicle side key information and the device side key information and negotiates to generate a long-term key. The main module and the slave module both securely store the vehicle side long-term key, and the digital key device securely stores the device side long-term key. The digital key device and the main module or any slave module perform authentication based on their respective stored long-term keys to achieve vehicle control operations. Therefore, while the key data is only stored in the main module, each node on the vehicle side performs vehicle control-related authentication through the negotiated long-term key. Not only is the cost and system complexity low, but the communication links in the authentication process can be reduced, unnecessary overhead can be reduced, and authentication efficiency can also be improved.

[0118] Embodiment 5 of the present invention provides a digital key system, the structure of which is as follows: Figure 2 As shown. The system is used to interact with the digital key device to achieve authentication to control the control module of the vehicle end. The digital key system includes a master module and at least one slave module, and the master module is communicatively connected to the at least one slave module. The at least one slave module is communicatively connected to the corresponding control module. The master module is pre-set with vehicle-end key information, and the digital key device stores device-end key information.

[0119] The main module and the digital key device perform identity authentication based on the vehicle-side key information and the device-side key information and negotiate to generate a long-term key. The long-term key includes: the vehicle-side long-term key and the device-side long-term key.

[0120] After the identity authentication is passed, the main module synchronizes the vehicle-side long-term key to the slave module. The main module and the slave module securely store the vehicle-side long-term key respectively, and the digital key device securely stores the device-side long-term key.

[0121] When the master module or any slave module receives an authentication request from the digital key device, it performs authentication with the digital key device based on the long-term keys stored in each of them.

[0122] Compared with the prior art, the digital key system of the embodiment of the present invention performs identity authentication and negotiates to generate a long-term key based on the vehicle-side key information and the device-side key information. The main module and the slave module both securely store the vehicle-side long-term key, and the digital key device securely stores the device-side long-term key. The digital key device and the main module or any slave module perform authentication based on their respective stored long-term keys to achieve vehicle control operations. Therefore, while the key data is only stored in the main module, each node on the vehicle-side performs vehicle control-related authentication through the negotiated long-term key. Not only is the cost and system complexity low, but the communication links in the authentication process can be reduced, unnecessary overhead can be reduced, and authentication efficiency can also be improved.

[0123] Fig. 9 The terminal device 90 includes a memory 91, a processor 92, and a computer program stored in the memory 91 and executable on the processor 92. When the processor 92 executes the program, the technical solution described in the first or second embodiment is implemented.

[0124] Embodiment 7 of the present invention provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a computer processor, the computer program is used to execute the technical solution of any method embodiment.

[0125] Through the above description of the implementation methods, the technicians in the relevant field can clearly understand that the present invention can be implemented by means of software and necessary general hardware, and of course can also be implemented by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as a computer floppy disk, read-only memory (ROM), random access memory (RAM), flash memory (FLASH), hard disk or optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a grid device, etc.) to execute the methods described in each embodiment of the present invention.

[0126] It is worth noting that in the embodiment of the above-mentioned device, the various units and modules included are only divided according to functional logic, but are not limited to the above-mentioned division, as long as the corresponding functions can be achieved; in addition, the specific names of the functional units are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of the present invention.

[0127] Note that the above are only preferred embodiments of the present invention and the technical principles used. Those skilled in the art will understand that the present invention is not limited to the specific embodiments described herein, and that various obvious changes, readjustments and substitutions can be made by those skilled in the art without departing from the scope of protection of the present invention. Therefore, although the present invention has been described in more detail through the above embodiments, the present invention is not limited to the above embodiments, and may include more other equivalent embodiments without departing from the concept of the present invention, and the scope of the present invention is determined by the scope of the appended claims.

Claims

1. An authentication method, It is characterized in that A digital key system applied to a vehicle side, the digital key system is used to interact with a digital key device to achieve authentication; the digital key system comprises a master module and at least one slave module, the master module is communicatively connected with the at least one slave module, the master module is pre-installed with vehicle side key information, and the digital key device stores device side key information; the method comprises: The main module and the digital key device perform identity authentication based on the vehicle-side key information and the device-side key information and negotiate to generate a long-term key; the long-term key includes: a vehicle-side long-term key and a device-side long-term key; After the identity authentication is passed, the master module synchronizes the vehicle-side long-term key to the slave module, and the master module and the slave module respectively securely store the vehicle-side long-term key; the digital key device securely stores the device-side long-term key; When the master module or any slave module receives the authentication request of the digital key device, the master module and the digital key device respectively implement vehicle control authentication based on the long-term keys stored in each of them; The vehicle-side key information includes: a vehicle private key Vehicle.SK, a vehicle identity certificate and a digital key certificate; the device-side key information includes: a digital key private key DigitalKey.SK, a digital key certificate and a vehicle identity certificate; the vehicle identity certificate is pre-set with a vehicle public key Vehicle.PK, and the digital key certificate is pre-set with a digital key public key DigitalKey.PK; the Vehicle.SK and the Vehicle.PK are an asymmetric key pair, and the DigitalKey.SK and the DigitalKey.PK are an asymmetric key pair; The main module and the digital key device perform identity authentication based on the vehicle-side key information and the device-side key information, including: The main module randomly generates a temporary public and private key pair on the vehicle side; The main module transmits the public key in the temporary public-private key pair on the vehicle side to the digital key device; the digital key device randomly generates a temporary public-private key pair on the device side, and transmits the public key in the temporary public-private key pair on the device side to the main module; The main module generates vehicle authentication information, and uses the Vehicle.SK to sign the vehicle authentication information to obtain Vehicle.sig; The main module sends the Vehicle.sig to the digital key device; the digital key device uses the Vehicle.PK to verify the signature of the Vehicle.sig. After the signature verification is passed, the digital key device calculates the security channel key between the digital key device and the vehicle end; the digital key device generates device authentication information, uses the DigitalKey.SK to sign the device authentication information to obtain Device.sig, and uses the security channel key to encrypt the Device.sig and then sends it to the main module; The main module calculates the secure channel key, decrypts the encrypted Device.sig, and uses the DigitalKey.PK to verify the signature of the decrypted Device.sig. After the signature verification is passed, the identity authentication of the digital key device is completed; The main module and the digital key device negotiate to generate a long-term key, including: The main module uses a preset negotiation algorithm to generate the vehicle-side long-term key based on the private key in the vehicle-side temporary public-private key pair and the public key in the device-side temporary public-private key pair; the digital key device uses the preset negotiation algorithm to generate the device-side long-term key based on the private key in the device-side temporary public-private key pair and the public key in the vehicle-side temporary public-private key pair.

2. An authentication method, It is characterized in that Applied to a digital key device, the digital key device is used to interact with a digital key system on the vehicle side to achieve authentication; the digital key device is pre-installed with device-side key information; the digital key system includes a master module and at least one slave module; The master module is in communication connection with the at least one slave module, and the master module is pre-installed with vehicle-side key information; the method comprises: The digital key device and the main module perform identity authentication based on the device-side key information and the vehicle-side key information and negotiate to generate a long-term key; the long-term key includes: a vehicle-side long-term key and a device-side long-term key; After the identity authentication is passed, the digital key device securely stores the device-side long-term key; the master module synchronizes the vehicle-side long-term key to the slave module, and the master module and the slave module securely store the vehicle-side long-term key respectively; The digital key device and the master module or any slave module perform authentication based on the device-side long-term key and the vehicle-side long-term key; The vehicle-side key information includes: a vehicle private key Vehicle.SK, a vehicle identity certificate and a digital key certificate; the device-side key information includes: a digital key private key DigitalKey.SK, a digital key certificate and a vehicle identity certificate; the vehicle identity certificate is pre-set with a vehicle public key Vehicle.PK, and the digital key certificate is pre-set with a digital key public key DigitalKey.PK; the Vehicle.SK and the Vehicle.PK are an asymmetric key pair, and the DigitalKey.SK and the DigitalKey.PK are an asymmetric key pair; The main module and the digital key device perform identity authentication based on the vehicle-side key information and the device-side key information, including: The main module randomly generates a temporary public and private key pair on the vehicle side; The main module sends the public key in the temporary public-private key pair to the digital key device; the digital key device randomly generates a temporary public-private key pair on the device side, and sends the public key in the temporary public-private key pair on the device side to the main module; The main module generates vehicle authentication information, and uses the Vehicle.SK to sign the vehicle authentication information to obtain vehicle.sig. The main module sends the Vehicle.sig to the digital key device; the digital key device uses the Vehicle.PK to verify the signature of the vehicle.sig. After the signature verification is passed, the digital key device calculates the security channel key between the digital key device and the vehicle end, the digital key device generates device authentication information, uses the DigitalKey.SK to sign the device authentication information to obtain device.sig, uses the security channel key to encrypt the device.sig and sends it to the main module; The main module decrypts the encrypted device.sig, and uses the DigitalKey.PK to verify the signature of the decrypted device.sig. After the signature verification is passed, the identity of the digital key device is authenticated; The main module and the digital key device negotiate to generate a long-term key, including: The main module uses a preset negotiation algorithm to generate the vehicle-side long-term key based on the private key in the vehicle-side temporary public-private key pair and the public key in the device-side temporary public-private key pair; the digital key device uses the preset negotiation algorithm to generate the device-side long-term key based on the private key in the device-side temporary public-private key pair and the public key in the vehicle-side temporary public-private key pair.

3. An authentication device, It is characterized in that A digital key system configured at the vehicle end, the digital key system is used to interact with a digital key device to achieve authentication; the digital key system includes a master module and at least one slave module, the master module is communicatively connected with the at least one slave module, the master module is pre-installed with vehicle end key information, and the digital key device stores device end key information; The authentication device comprises: An authentication negotiation module, used for the main module and the digital key device to perform identity authentication and negotiate to generate a long-term key based on the vehicle-side key information and the device-side key information; the long-term key includes: a vehicle-side long-term key and a device-side long-term key; A key storage module, which is used for the master module to synchronize the vehicle-side long-term key to the slave module after the identity authentication is passed, and the master module and the slave module respectively store the vehicle-side long-term key securely; the digital key device securely stores the device-side long-term key; A real-time authentication module, used for realizing vehicle control authentication with the digital key device based on the long-term keys stored in each of them when the master module or any slave module receives an authentication request from the digital key device; The vehicle-side key information includes: vehicle private key Vehicle.SK, vehicle identity certificate and digital key certificate; the device-side key information includes: digital key private key DigitalKey.SK, digital key certificate and vehicle identity certificate; the vehicle identity certificate is pre-set with vehicle public key Vehicle.PK, and the digital key certificate is pre-set with digital key public key DigitalKey.PK; Vehicle.SK and Vehicle.PK are an asymmetric key pair, and DigitalKey.SK and DigitalKey.PK are an asymmetric key pair; The authentication negotiation module is specifically used for: the main module randomly generates a temporary public-private key pair on the vehicle side, the main module transfers the public key in the temporary public-private key pair on the vehicle side to the digital key device, the digital key device randomly generates a temporary public-private key pair on the device side, transfers the public key in the temporary public-private key pair on the device side to the main module, the main module generates vehicle authentication information, and uses Vehicle.SK to sign the vehicle authentication information to obtain Vehicle.sig, and the main module sends Vehicle.sig to the digital key device; the digital key device uses Vehicle.PK to verify the signature of Vehicle.sig, and after the signature verification is passed, the digital key device calculates the secure channel key between the digital key device and the vehicle side, the digital key device generates device authentication information, uses DigitalKey.SK to sign the device authentication information to obtain Device.sig, and uses the secure channel key to encrypt Device.sig and send it to the main module; the main module decrypts the encrypted Device.sig, and uses DigitalKey.PK to verify the decrypted Device.sig, and after the signature verification is passed, the identity authentication of the digital key device is completed; The main module uses a preset negotiation algorithm to generate a long-term key on the vehicle side based on the private key in the temporary public-private key pair on the vehicle side and the public key in the temporary public-private key pair on the device side; the digital key device uses a preset negotiation algorithm to generate a long-term key on the device side based on the private key in the temporary public-private key pair on the device side and the public key in the temporary public-private key pair on the vehicle side.

4. An authentication device, It is characterized in that Configured in a digital key device, the digital key device is used to interact with the digital key system on the vehicle side to achieve authentication; the digital key device is pre-installed with device-side key information; the digital key system includes a master module and at least one slave module; The master module is in communication connection with the at least one slave module, and the master module is pre-installed with vehicle-side key information; The authentication device comprises: An authentication negotiation module, used for the digital key device and the main module to perform identity authentication and negotiate to generate a long-term key based on the device-side key information and the vehicle-side key information; the long-term key includes: a vehicle-side long-term key and a device-side long-term key; A key storage module, which is used for the digital key device to securely store the device-side long-term key after the identity authentication is passed; the master module synchronizes the vehicle-side long-term key to the slave module, and the master module and the slave module securely store the vehicle-side long-term key respectively; A real-time authentication module, used for the digital key device to authenticate with the master module or any slave module based on the device-side long-term key and the vehicle-side long-term key; The vehicle-side key information includes: a vehicle private key Vehicle.SK, a vehicle identity certificate and a digital key certificate; the device-side key information includes: a digital key private key DigitalKey.SK, a digital key certificate and a vehicle identity certificate; the vehicle identity certificate is pre-set with a vehicle public key Vehicle.PK, and the digital key certificate is pre-set with a digital key public key DigitalKey.PK; the Vehicle.SK and the Vehicle.PK are an asymmetric key pair, and the DigitalKey.SK and the DigitalKey.PK are an asymmetric key pair; The authentication negotiation module is specifically used for: the main module sends the public key in the temporary public-private key pair to the digital key device, the digital key device randomly generates a temporary public-private key pair on the device side, sends the public key in the temporary public-private key pair on the device side to the main module, the main module generates vehicle authentication information, and uses Vehicle.SK to sign the vehicle authentication information to obtain vehicle.sig, the main module sends Vehicle.sig to the digital key device, the digital key device uses Vehicle.PK to verify the signature of vehicle.sig, after the signature verification is passed, the digital key device calculates the secure channel key between the digital key device and the vehicle side, the digital key device generates device authentication information, uses DigitalKey.SK to sign the device authentication information to obtain device.sig, uses the secure channel key to encrypt device.sig and sends it to the main module, the main module decrypts the encrypted device.sig, uses DigitalKey.PK to verify the decrypted device.sig, and completes the authentication of the digital key device identity after the signature verification is passed; The authentication negotiation module is specifically used for: the main module uses a preset negotiation algorithm to generate a vehicle-side long-term key based on the private key in the temporary public-private key pair on the vehicle side and the public key in the temporary public-private key pair on the device side; the digital key device uses a preset negotiation algorithm to generate a device-side long-term key based on the private key in the temporary public-private key pair on the device side and the public key in the temporary public-private key pair on the vehicle side.

5. A digital key system, It is characterized in that Used to interact with a digital key device to achieve authentication, the digital key system comprising a master module and at least one slave module, the master module being communicatively connected to the at least one slave module, the master module being pre-installed with vehicle-side key information, and the digital key device storing device-side key information; The main module and the digital key device perform identity authentication based on the vehicle-side key information and the device-side key information and negotiate to generate a long-term key; The long-term key includes: a vehicle-side long-term key and a device-side long-term key; After the identity authentication is passed, the master module synchronizes the vehicle-side long-term key to the slave module, and the master module and the slave module respectively securely store the vehicle-side long-term key; the digital key device securely stores the device-side long-term key; When the master module or any slave module receives an authentication request from the digital key device, the master module and the digital key device perform authentication based on their respective stored long-term keys; The vehicle-side key information includes: a vehicle private key Vehicle.SK, a vehicle identity certificate and a digital key certificate; the device-side key information includes: a digital key private key DigitalKey.SK, a digital key certificate and a vehicle identity certificate; the vehicle identity certificate is pre-set with a vehicle public key Vehicle.PK, and the digital key certificate is pre-set with a digital key public key DigitalKey.PK; the Vehicle.SK and the Vehicle.PK are an asymmetric key pair, and the DigitalKey.SK and the DigitalKey.PK are an asymmetric key pair; The main module and the digital key device perform identity authentication based on the vehicle-side key information and the device-side key information, including: The main module randomly generates a temporary public and private key pair on the vehicle side; The main module transmits the public key in the temporary public-private key pair on the vehicle side to the digital key device; the digital key device randomly generates a temporary public-private key pair on the device side, and transmits the public key in the temporary public-private key pair on the device side to the main module; The main module generates vehicle authentication information, and uses the Vehicle.SK to sign the vehicle authentication information to obtain Vehicle.sig; The main module sends the Vehicle.sig to the digital key device; the digital key device uses the Vehicle.PK to verify the signature of the Vehicle.sig. After the signature verification is passed, the digital key device calculates the security channel key between the digital key device and the vehicle end; the digital key device generates device authentication information, uses the DigitalKey.SK to sign the device authentication information to obtain Device.sig, and uses the security channel key to encrypt the Device.sig and then sends it to the main module; The main module calculates the secure channel key, decrypts the encrypted Device.sig, and uses the DigitalKey.PK to verify the signature of the decrypted Device.sig. After the signature verification is passed, the identity authentication of the digital key device is completed; The main module and the digital key device negotiate to generate a long-term key, including: The main module uses a preset negotiation algorithm to generate the vehicle-side long-term key based on the private key in the vehicle-side temporary public-private key pair and the public key in the device-side temporary public-private key pair; the digital key device uses the preset negotiation algorithm to generate the device-side long-term key based on the private key in the device-side temporary public-private key pair and the public key in the vehicle-side temporary public-private key pair.

6. A terminal device, It is characterized in that The method comprises a memory, a processor and a computer program stored in the memory and executable on the processor, wherein the processor implements the authentication method according to claim 1 or 2 when executing the program.

7. A computer-readable storage medium having a computer program stored thereon, It is characterized in that When the program is executed by a processor, the authentication method according to claim 1 or 2 is implemented.

Images