Secure communication method and device, storage medium and computer program product

Abstract

The invention discloses a secure communication method and device, a storage medium and a computer program product, and relates to the technical field of information security, and the method comprises the steps: receiving an activation instruction, and configuring activation information according to the activation instruction; the activation information is sent to the diagnostic box, so that the diagnostic box generates a diagnostic box security certificate and feeds back activation state information to the diagnostic equipment; generating a diagnostic equipment security certificate according to the activation state information; transmitting the diagnostic equipment security certificate through a pre-constructed communication channel, receiving a diagnostic box security certificate, and recording certificate transmission times; and periodically updating the diagnostic equipment security certificate and the diagnostic box security certificate based on the certificate transmission times. By periodically updating the security certificates, the security certificates of the diagnostic equipment and the diagnostic box are dynamically changed, so that the security and reliability of the certificates are enhanced, and the information security in the Bluetooth communication process of the diagnostic equipment and the diagnostic box is guaranteed.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and in particular to secure communication methods, devices, storage media and computer program products. Background Art

[0002] In order to ensure the information security of the Bluetooth communication process between the diagnostic device and the diagnostic box, after the diagnostic box is activated, the diagnostic device and the diagnostic box will generate an encryption certificate, which will be stored locally on the diagnostic device and the diagnostic box respectively. When the diagnostic device accesses the server, the server will verify the diagnostic device to determine the legitimacy of the security certificate. When the diagnostic box uses the diagnostic software, it will also verify the legitimacy of the local certificate. However, since the security certificates stored locally on the diagnostic device and the diagnostic box are fixed, the security certificates may be stolen over time, affecting the information security of the Bluetooth communication process between the diagnostic device and the diagnostic box.

[0003] Therefore, how to ensure the information security during the Bluetooth communication between the diagnostic equipment and the diagnostic box has become an urgent problem to be solved in this application.

[0004] The above contents are only used to assist in understanding the technical solution of the present application and do not constitute an admission that the above contents are prior art. Summary of the invention

[0005] The main purpose of this application is to provide a secure communication method, device, storage medium and computer program product, aiming to solve the technical problem of how to ensure the information security during Bluetooth communication between diagnostic equipment and diagnostic box.

[0006] To achieve the above objectives, the present application proposes a secure communication method, which is applied to a diagnostic device. The method comprises:

[0007] receiving an activation instruction and configuring activation information according to the activation instruction;

[0008] Sending the activation information to the diagnostic box so that the diagnostic box can generate a diagnostic box security certificate and feed back activation status information to the diagnostic device;

[0009] generating a diagnostic device security certificate according to the activation status information;

[0010] Transmitting the diagnostic device security certificate through a pre-built communication channel, receiving the diagnostic box security certificate, and recording the number of certificate transmissions;

[0011] The diagnostic device security certificate and the diagnostic box security certificate are periodically updated based on the number of certificate transmissions.

[0012] In one embodiment, before the steps of transmitting the diagnostic device security certificate through the pre-built communication channel, receiving the diagnostic box security certificate, and recording the number of certificate transmissions, the steps further include:

[0013] An encrypted transmission protocol is used to build a communication channel between the diagnostic device and the diagnostic box.

[0014] In one embodiment, the step of regularly updating the diagnostic device security certificate and the diagnostic box security certificate based on the number of certificate transmissions includes:

[0015] Determining a diagnostic device key value according to the diagnostic device security certificate;

[0016] storing the diagnostic device key value in a hidden file of the diagnostic device to determine a maximum number of transmissions;

[0017] When the certificate transmission times are greater than or equal to the maximum transmission times, a key certificate updating mechanism is triggered to receive a diagnostic box key value;

[0018] Extracting the diagnostic device key value from a hidden file of the diagnostic device;

[0019] The diagnostic device security certificate and the diagnostic box security certificate are updated according to the key certificate update mechanism, the diagnostic device key value, and the diagnostic box key value.

[0020] In one embodiment, after the step of regularly updating the diagnostic device security certificate and the diagnostic box security certificate based on the number of certificate transmissions, the step further includes:

[0021] Verifying and matching the diagnostic device security certificate and the diagnostic box security certificate, and recording the number of mismatches;

[0022] When the number of mismatches is greater than or equal to the preset maximum number of mismatches, a certificate revocation mechanism is triggered;

[0023] The diagnostic device security certificate and the diagnostic box security certificate are revoked according to the certificate revocation mechanism.

[0024] In one embodiment, after the step of regularly updating the diagnostic device security certificate and the diagnostic box security certificate based on the number of certificate transmissions, the step further includes:

[0025] Query the certificate information of the diagnostic device security certificate and the diagnostic box security certificate to obtain a query result;

[0026] Record the number of times no certificate information is queried according to the query result;

[0027] When the number of inquiries for certificate-free information is greater than or equal to a preset maximum number of inquiries, triggering the certificate revocation mechanism;

[0028] The diagnostic device security certificate and the diagnostic box security certificate are revoked according to the certificate revocation mechanism.

[0029] In addition, to achieve the above-mentioned purpose, the present application also proposes a secure communication method, which is applied to the diagnostic box, and the method comprises:

[0030] Receiving activation information configured according to the activation instruction;

[0031] generating a diagnostic box security certificate according to the activation information and feeding back activation status information to the diagnostic device, so that the diagnostic device can generate a diagnostic device security certificate according to the activation status information;

[0032] The diagnostic device security certificate is received through a pre-built communication channel, and the diagnostic box security certificate is sent to the diagnostic device, so that the diagnostic device can periodically update the diagnostic device security certificate and the diagnostic box security certificate according to the number of certificate transmissions.

[0033] In one embodiment, after the step of receiving the diagnostic device security certificate through the pre-established communication channel and sending the diagnostic box security certificate to the diagnostic device so that the diagnostic device can periodically update the diagnostic device security certificate and the diagnostic box security certificate according to the number of certificate transmissions, the step further includes:

[0034] Determining a diagnostic box key value according to the diagnostic box security certificate;

[0035] Storing the diagnostic box key value in a hidden file of the diagnostic box;

[0036] When the key certificate update mechanism is triggered, extracting the diagnostic box key value from the hidden file of the diagnostic box;

[0037] The diagnostic box key value is sent to the diagnostic device so that the diagnostic device can periodically update the diagnostic device security certificate and the diagnostic box security certificate.

[0038] In addition, to achieve the above-mentioned purpose, the present application also proposes a secure communication device, which includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program is configured to implement the steps of the secure communication method described above.

[0039] In addition, to achieve the above-mentioned purpose, the present application also proposes a storage medium, which is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, the steps of the secure communication method described above are implemented.

[0040] In addition, to achieve the above-mentioned purpose, the present application also provides a computer program product, which includes a computer program, and when the computer program is executed by a processor, it implements the steps of the secure communication method described above.

[0041] One or more technical solutions proposed in this application have at least the following technical effects:

[0042] Configure activation information according to the received activation instruction, send the activation information to the diagnostic box to activate the diagnostic box, and the activated diagnostic box generates a diagnostic box security certificate. The diagnostic device also generates a diagnostic device security certificate locally after the diagnostic box is activated. Record the number of times the diagnostic device transmits the diagnostic device security certificate through the pre-built communication channel and receives the diagnostic box security certificate. When the number of certificate transmissions reaches the preset upper limit, update the diagnostic device security certificate and the diagnostic box security certificate. By regularly updating security certificates, the security certificates of the diagnostic device and the diagnostic box are in a dynamic state rather than a fixed state. Regularly updating security certificates enhances the security and reliability of the certificates and avoids situations where security certificates are stolen and affect information security. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0044] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0045] Figure 1 A schematic diagram of a process flow provided for the first embodiment of the secure communication method of the present application;

[0046] Figure 2 A flowchart of the second embodiment of the secure communication method of the present application is provided;

[0047] Figure 3 A flowchart of the fourth embodiment of the secure communication method of the present application is provided;

[0048] Figure 4 A flowchart of the fifth embodiment of the secure communication method of the present application is provided;

[0049] Figure 5 A flowchart of the sixth embodiment of the secure communication method of the present application is provided;

[0050] Figure 6 A flowchart of the seventh embodiment of the secure communication method of the present application is provided;

[0051] Figure 7 This is a schematic diagram of the module structure of the secure communication device according to an embodiment of the present application;

[0052] Figure 8 Schematic diagram of the device structure of the hardware operating environment involved in the secure communication method in the embodiment of the present application.

[0053] The purpose, features and advantages of this application will be further described in conjunction with the embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0054] It should be understood that the specific embodiments described herein are only used to explain the technical solutions of the present application and are not used to limit the present application.

[0055] In order to better understand the technical solution of the present application, a detailed description will be given below in conjunction with the accompanying drawings and specific implementation methods.

[0056] The main solution of the embodiment of the present application is: configure the activation information including the serial number and the activation code through the activation instruction, and send the activation information to the diagnostic box. The diagnostic box is activated after receiving the activation information, and the activated diagnostic box generates a diagnostic box security certificate locally, and the diagnostic device generates a diagnostic device security certificate according to the activated diagnostic box. In order to enhance the security and reliability of the security certificate to ensure the information security during the Bluetooth communication between the diagnostic device and the diagnostic box, the number of transmissions of the diagnostic device security certificate transmitted by the diagnostic device through the pre-built communication channel and the number of transmissions of the diagnostic box security certificate received is recorded. When the number of certificate transmissions reaches the preset upper limit, the diagnostic device security certificate and the diagnostic box security certificate are updated. By means of the method of regularly updating the security certificate, the security certificates of the diagnostic device and the diagnostic box are in a dynamically changing situation, rather than being fixed certificates. Regularly updating the security certificate enhances the security and reliability of the certificate, and avoids the situation where the security certificate is stolen and affects information security.

[0057] The embodiments of the present application take into account: In order to ensure the information security of the Bluetooth communication process between the diagnostic device and the diagnostic box, after the diagnostic box is activated, the diagnostic device and the diagnostic box both generate an encryption certificate, which are stored locally on the diagnostic device and the diagnostic box, respectively. When the diagnostic device accesses the server, the server side will verify the diagnostic device to determine the legitimacy of the security certificate. When the diagnostic box uses the diagnostic software, the legitimacy of the local certificate will also be verified. However, since the security certificates stored locally on the diagnostic device and the diagnostic box are fixed, the security certificates may be stolen over time, affecting the information security of the diagnostic device and the diagnostic box during the Bluetooth communication process.

[0058] Therefore, the present application provides a solution to record the number of times the diagnostic device transmits the diagnostic device security certificate through a pre-built communication channel and receives the diagnostic box security certificate. When the number of certificate transmissions reaches a preset upper limit, the diagnostic device security certificate and the diagnostic box security certificate are updated. By regularly updating the security certificates, the security certificates of the diagnostic device and the diagnostic box are in a dynamically changing situation, rather than being fixed certificates. Regularly updating security certificates enhances the security and reliability of the certificates, and avoids the situation where the security certificates are stolen and affect information security.

[0059] Based on this, the embodiment of the present application provides a secure communication method, which is applied to diagnostic equipment, referring to Figure 1 , Figure 1 This is a flowchart of the first embodiment of the secure communication method of the present application.

[0060] In this embodiment, the secure communication method includes steps S10 to S50:

[0061] Step S10, receiving an activation instruction and configuring activation information according to the activation instruction;

[0062] Diagnostic equipment is a tool used to detect, diagnose and analyze automobile faults and performance conditions. The diagnostic box is used to connect to the VCI (Bluetooth connection box) of the car to detect, diagnose and repair the car. It should be noted that the diagnostic box acts as a wireless bridge between the diagnostic equipment and the vehicle. By connecting the VCI box via Bluetooth, the diagnostic equipment can communicate with the car without cables. Therefore, the diagnostic equipment needs to receive the activation instruction sent by the user terminal to activate the diagnostic box. The diagnostic equipment associates the activation code and serial number according to the activation instruction to complete the configuration of the activation information.

[0063] Step S20, sending the activation information to the diagnostic box, so that the diagnostic box can generate a diagnostic box security certificate and feed back activation status information to the diagnostic device;

[0064] The diagnostic device sends the activation information including the activation code and serial number to the diagnostic box, which verifies the activation information. When the activation information is verified, the diagnostic box is activated. After the activation, a pair of public and private keys are generated inside the diagnostic box. The private key will be securely stored inside the diagnostic box, and the public key will be used to generate a certificate.

[0065] The diagnostic box uses its public key and other information such as serial number and manufacturer information to generate a certificate signing request (CSR). Since the CSR is usually an encoded text file, it needs to be sent to a certificate authority (CA). The CA verifies the information in the CSR and determines the legitimacy of the diagnostic box. When the legitimacy of the diagnostic box is verified, the CA will use its private key to sign the information in the CSR and generate a digital certificate, namely the diagnostic box security certificate. The diagnostic box receives the security certificate issued by the CA and installs the security certificate into the diagnostic box so that it can be used in a secure communication session.

[0066] Step S30, generating a diagnostic device security certificate according to the activation status information;

[0067] After ensuring that the diagnostic box has been successfully activated and is in normal working condition, the diagnostic device receives the activation status information sent by the diagnostic box and generates a pair of public and private keys. The private key is stored securely for confidentiality, and the public key will be used to generate a security certificate.

[0068] Use the generated public key to create a CSR that contains the public key and other identification information of the diagnostic device. By sending the CSR to a certificate authority (CA), the CA verifies the information in the CSR and determines the legitimacy of the diagnostic device.

[0069] When the legitimacy of the diagnostic device is verified, the CA will use its private key to sign the information in the CSR and generate a digital certificate, namely the diagnostic device security certificate. The diagnostic device receives the security certificate issued by the CA and installs the security certificate into the diagnostic device so that it can be used in a secure communication session.

[0070] Step S40, transmitting the diagnostic device security certificate through a pre-built communication channel, receiving the diagnostic box security certificate, and recording the number of certificate transmissions;

[0071] Ensure that a stable communication connection has been established between the diagnostic device and the diagnostic box. The diagnostic device initializes the communication interface by specifying the communication channel type, communication parameters, etc., reads the security certificate file from the storage system of the diagnostic device, parses the certificate content, and ensures that the certificate is valid and within the validity period.

[0072] Construct a network packet containing the transmission request and security certificate data, and send the network packet to the preset IP address and port of the diagnostic box. The diagnostic device enters a waiting state and listens for the response from the diagnostic box; after receiving the response from the diagnostic box, the diagnostic box security certificate is stored in a temporary buffer. The diagnostic device uses the built-in public key or CA certificate to verify the validity of the diagnostic box security certificate, and stores the verified diagnostic box security certificate in the certificate library of the diagnostic device.

[0073] When the diagnostic device completes the transmission of the diagnostic device security certificate and the diagnostic box receives the security certificate, the diagnostic box updates the internal counter, records this certificate transmission, and writes the detailed transmission record to the log file.

[0074] Step S50: regularly updating the diagnostic device security certificate and the diagnostic box security certificate based on the number of certificate transmissions.

[0075] The diagnostic box operating system or dedicated service periodically checks the recorded certificate transmission times. When the certificate transmission times reach the upper threshold, the certificate update process is triggered. The diagnostic device generates a new key pair, creates a new certificate signing request (CSR), sends the CSR to the CA through a secure channel, receives and verifies the validity of the new certificate, and completes the update of the diagnostic device security certificate and the diagnostic box security certificate.

[0076] The present embodiment provides a secure communication method, which configures activation information according to the received activation instruction, sends the activation information to the diagnostic box to activate the diagnostic box, and generates a diagnostic box security certificate in the activated state. The diagnostic device also generates a diagnostic device security certificate locally after the diagnostic box is activated. The number of times the diagnostic device transmits the diagnostic device security certificate through a pre-built communication channel and receives the transmission of the diagnostic box security certificate is recorded. When the number of certificate transmissions reaches a preset upper limit, the diagnostic device security certificate and the diagnostic box security certificate are updated. By regularly updating security certificates, the security certificates of the diagnostic device and the diagnostic box are in a dynamically changing state rather than a fixed state. Regularly updating security certificates enhances the security and reliability of the certificates and avoids situations where security certificates are stolen and affect information security.

[0077] Based on the first embodiment of the present application, the second embodiment of the present application is proposed. In the second embodiment of the present application, the same or similar contents as those of the above-mentioned embodiment 1 can be referred to the above introduction, and will not be repeated in the following.

[0078] On this basis, please refer to Figure 2 , the step of transmitting the diagnostic device security certificate through the pre-built communication channel, receiving the diagnostic box security certificate, and recording the number of certificate transmissions also includes step S341 before step S40:

[0079] Step S341, using an encrypted transmission protocol to establish a communication channel between the diagnostic device and the diagnostic box.

[0080] First, when the network module of the diagnostic device is started, the network interface card is configured to prepare to establish a network connection, and the network port of the diagnostic device is initialized, the parameters of the encrypted transmission protocol, such as TLS version, encryption algorithm, authentication method, etc., are set.

[0081] Furthermore, a public-private key pair for encrypted communication is created through the encryption transmission protocol parameters set by the diagnostic device. Using the configured encryption parameters, a connection is established with the diagnostic box through the encryption transmission protocol.

[0082] Further, the diagnostic device sends an encrypted handshake request to initialize the secure session, and waits for and verifies the response of the diagnostic box to confirm that the secure session has been established.

[0083] It is understandable that in order to establish a two-way communication channel between the diagnostic box and the diagnostic device, the network module is also started at the diagnostic box port, the network interface card is configured to prepare for establishing a network connection, and the parameters of the encrypted transmission protocol are set to match the diagnostic device end. A public-private key pair for encrypted communication is created. Using the configured encryption parameters, a connection is established with the diagnostic device through the encrypted transmission protocol.

[0084] In this embodiment, an encrypted communication protocol is used to construct a communication channel between the diagnostic device and the diagnostic box. The encrypted communication protocol ensures the security of the communication channel, prevents data from being eavesdropped, tampered with, or forged during transmission, and ensures information security during Bluetooth communication between the diagnostic device and the diagnostic box.

[0085] Based on the first embodiment and / or the second embodiment of the present application, the third embodiment of the present application is proposed. In the third embodiment of the present application, the same or similar contents as those of the above-mentioned first and second embodiments can be referred to the above introduction, and will not be repeated in the following.

[0086] In this embodiment, the step S50 of regularly updating the diagnostic device security certificate and the diagnostic box security certificate based on the number of certificate transmissions may include steps S501 to S505:

[0087] Step S501, determining a diagnostic device key value according to the diagnostic device security certificate;

[0088] The diagnostic device reads the diagnostic device security certificate, reads certificate related information including the public key, certificate serial number, and validity period from the loaded diagnostic device security certificate, and determines the key value of the diagnostic device, that is, the diagnostic device KEY value, through the certificate related information.

[0089] Step S502, storing the diagnostic device key value in a hidden file of the diagnostic device to determine a maximum number of transmission times;

[0090] The diagnostic device searches for a suitable hidden file path in the storage system, creates a new hidden file in the selected hidden file location for storing the diagnostic device key value, writes the diagnostic device key value into the created hidden file, and ensures that the file is stored in an encrypted form to prevent unauthorized access.

[0091] After the diagnostic device key value is written to the hidden file to ensure data security, the maximum number of transmissions allowed is determined based on the diagnostic device key value written to the hidden file and the security policy or configuration file. The determined maximum number of transmissions is written to the hidden file for subsequent reference and execution.

[0092] To further protect the key value and the maximum number of transfers, the diagnostic device encrypts the hidden file. The diagnostic device further verifies that the hidden file has been successfully encrypted. The encryption key should be stored together with the key value and protected with the same security measures. The diagnostic device checks the key value and the maximum number of transfers in the hidden file before each transfer.

[0093] Step S503, when the certificate transmission times are greater than or equal to the maximum transmission times, triggering the key certificate update mechanism to receive the diagnostic box key value;

[0094] Since the diagnostic device periodically checks the transmission times record in the hidden file, if the current transmission times is greater than or equal to the maximum transmission times, the key certificate update mechanism is triggered, and the diagnostic box key value sent from the diagnostic box is received.

[0095] Step S504, extracting the diagnostic device key value from the hidden file of the diagnostic device;

[0096] Locate the location of the hidden file where the diagnostic device stores the key value, try to access the hidden file according to the hidden file location, extract the diagnostic device key value from the hidden file, and verify whether the diagnostic device key value is valid.

[0097] Step S505 : updating the diagnostic device security certificate and the diagnostic box security certificate according to the key certificate update mechanism, the diagnostic device key value, and the diagnostic box key value.

[0098] According to the key certificate update mechanism, a new key value is generated to replace the original diagnostic device key value and diagnostic box key value, thereby creating a new diagnostic device security certificate and diagnostic box security certificate to update the diagnostic box security certificate and diagnostic device security certificate. After completing the update of the diagnostic box security certificate and the diagnostic device security certificate, the number of certificate transmissions is reset to zero and the certificate transmission is recorded again.

[0099] In this embodiment, the diagnostic device security certificate and the diagnostic box security certificate are updated according to the key certificate update mechanism, the diagnostic device key value, and the diagnostic box key value, thereby improving the security and reliability of the security certificate, so that the security certificates of the diagnostic device and the diagnostic box are in a dynamically changing situation, rather than being fixed certificates. Regularly updating the security certificate strengthens the security and reliability of the certificate, and avoids the situation where the security certificate is stolen and affects information security.

[0100] Based on the above embodiments of the present application, a fourth embodiment of the present application is proposed. In the fourth embodiment of the present application, the same or similar contents as those of the above embodiments can be referred to the above introduction, and will not be described in detail later.

[0101] On this basis, please refer to Figure 3 , Figure 3 A flowchart of a fourth embodiment of the secure communication method provided in the present application.

[0102] In this embodiment, the step S50 of regularly updating the diagnostic device security certificate and the diagnostic box security certificate based on the number of certificate transmissions further includes steps S51 to S53:

[0103] Step S51, verifying and matching the diagnostic device security certificate and the diagnostic box security certificate, and recording the number of mismatches;

[0104] On the basis of ensuring that the diagnostic device and the diagnostic box have network communication capabilities, the diagnostic device reads the diagnostic device security certificate file from its storage system and verifies it with the diagnostic box security certificate received from the pre-built communication channel. The verification includes: verifying the certificate chain, verifying the certificate content, and matching verification.

[0105] Among them, the verification certificate chain is used to ensure that each certificate is signed by the private key of its upper-level certificate until the root certificate, and check whether the certificate is issued by a trusted certificate authority (CA); the verification certificate content is used to check whether the certificate is expired, verify the signature of the certificate, and confirm the purpose of the certificate (such as client authentication, server authentication); the matching verification is used to compare the certificate contents of the diagnostic device and the diagnostic box, including but not limited to the issuer, user, public key, etc. of the certificate, to ensure that the purpose and level of the two certificates match.

[0106] Additionally, a logging function is implemented in the system to record key information and results during the verification process. If a mismatch is found during the verification process, the event is recorded and the mismatch count is increased. The specific information of the mismatch is recorded, such as the mismatched certificate fields, timestamps, etc.

[0107] Step S52, when the number of mismatches is greater than or equal to a preset maximum number of mismatches, triggering a certificate revocation mechanism;

[0108] When the number of mismatches exceeds the preset maximum mismatch threshold, the certificate revocation mechanism is triggered. The certificate revocation mechanism is an important part of digital certificate management, which is used to ensure that when a certificate is no longer secure or trustworthy, it can be removed from the valid certificate list.

[0109] Step S53: revoke the diagnostic device security certificate and the diagnostic box security certificate according to the certificate revocation mechanism.

[0110] First, the certificates that need to be revoked are identified according to the certificate revocation mechanism, namely the diagnostic device security certificate and the diagnostic box security certificate. After the certificate authority (CA) adds the diagnostic device security certificate and the diagnostic box security certificate to the revocation list (CRL), the certificate authority (CA) updates the OCSP response to reflect the new status of the security certificate, so that the diagnostic device security certificate and the diagnostic box security certificate are removed from the valid certificate list.

[0111] It should be noted that the revocation list is a list maintained by a certificate authority (CA) that lists all revoked certificates and their related information. When a certificate is revoked, the CA will update the CRL.

[0112] Additionally, it should be noted that the Online Certificate Status Protocol (OCSP) is a real-time protocol that allows clients to query the CA to obtain the status of a certificate. OCSP reduces the need to rely on CRLs, and real-time queries avoid the problem of CRLs being outdated.

[0113] In this embodiment, the diagnostic device security certificate and the diagnostic box security certificate are verified and matched, and the number of mismatches is recorded. When the number of mismatches is greater than or equal to the preset maximum number of mismatches, the certificate revocation mechanism is triggered. Revoking the diagnostic device security certificate and the diagnostic box security certificate according to the certificate revocation mechanism can effectively protect the security of network communications and prevent unauthorized use or potential attacks, thereby further ensuring the information security of the diagnostic device and the diagnostic box during Bluetooth communication.

[0114] Based on the above embodiments of the present application, a fifth embodiment of the present application is proposed. In the fifth embodiment of the present application, the same or similar contents as those of the above embodiments can be referred to the above introduction, and will not be described in detail later.

[0115] On this basis, please refer to Figure 4 , Figure 4 A flowchart of the fifth embodiment of the secure communication method provided in the present application.

[0116] In this embodiment, the step S50 of regularly updating the diagnostic device security certificate and the diagnostic box security certificate based on the number of certificate transmissions further includes steps S54 to S57:

[0117] Step S54, querying the certificate information of the diagnostic device security certificate and the diagnostic box security certificate to obtain a query result;

[0118] First, determine the storage location of the security certificate file of the diagnostic device and the diagnostic box, and load the certificate file content into the memory for query. Further, extract the certificate information. The steps of extracting the certificate information include: obtaining the holder (Subject) information of the certificate, including the name and organization of the certificate owner; obtaining the issuer (Issuer) information of the certificate, that is, the name of the certificate authority; obtaining the certificate serial number, which is a unique identifier; obtaining the validity period of the certificate, including the effective date and expiration date; obtaining the public key information, the public key contained in the certificate is used to encrypt data. Format the extracted security certificate information into an easy-to-understand format, such as a dictionary, a JSON object, or a simple text output to obtain the query result.

[0119] Step S55, recording the number of times the certificateless information is queried according to the query result;

[0120] The number of queries during which no relevant security certificates were found is recorded according to the query results.

[0121] Step S56, when the number of inquiries for certificateless information is greater than or equal to the preset maximum number of inquiries, triggering the certificate revocation mechanism;

[0122] When the number of queries without finding the relevant security certificate exceeds the preset maximum query threshold, the certificate revocation mechanism is triggered. The certificate revocation mechanism is an important part of digital certificate management, which is used to ensure that when a certificate is no longer secure or trustworthy, it can be removed from the valid certificate list.

[0123] Step S57: revoke the diagnostic device security certificate and the diagnostic box security certificate according to the certificate revocation mechanism.

[0124] First, the certificates that need to be revoked are identified according to the certificate revocation mechanism, namely the diagnostic device security certificate and the diagnostic box security certificate. After the certificate authority (CA) adds the diagnostic device security certificate and the diagnostic box security certificate to the revocation list (CRL), the certificate authority (CA) updates the OCSP response to reflect the new status of the security certificate, so that the diagnostic device security certificate and the diagnostic box security certificate are removed from the valid certificate list.

[0125] In this embodiment, the certificate information of the diagnostic device security certificate and the diagnostic box security certificate is queried to obtain the query result, and the number of times the certificate information is not queried is recorded according to the query result. When the number of times the certificate information is not queried is greater than or equal to the preset maximum number of queries, the certificate revocation mechanism is triggered. Secure communication relies on valid certificates to ensure identity authentication and data encryption. Querying certificate information is to verify the validity and credibility of the certificate. When the number of times the certificate information is not queried reaches a certain threshold, the diagnostic device security certificate and the diagnostic box security certificate are revoked based on the certificate revocation mechanism, effectively protecting the security of network communications and preventing unauthorized use or potential attacks, thereby further ensuring the information security of the diagnostic device and the diagnostic box during Bluetooth communication.

[0126] The sixth embodiment of the present application proposes a secure communication method applied to a diagnostic box, referring to Figure 5 , Figure 5 This is a flow chart of the sixth embodiment of the secure communication method of the present application.

[0127] In this embodiment, the secure communication method includes steps A10 to A30:

[0128] Step A10, receiving activation information configured according to the activation instruction;

[0129] After the diagnostic box performs a self-test procedure to ensure that all hardware components are working properly, the network interface is activated and ready to receive network data. The diagnostic box continuously monitors the specific port used to receive activation instructions. When the activation information is sent to the diagnostic box through a secure channel (such as a TLS / SSL encrypted connection), the network interface receives the data. The diagnostic box parses the received data packets and extracts the relevant activation information. After verifying that the activation information is correct, the diagnostic box is activated and feedbacks the activation status to the diagnostic device.

[0130] Step A20, generating a diagnostic box security certificate according to the activation information and feeding back activation status information to the diagnostic device, so that the diagnostic device can generate a diagnostic device security certificate according to the activation status information;

[0131] The diagnostic box determines the information required for the diagnostic box security certificate based on the activation information, such as the common name (CommonName, CN), organization name (Organization, O), organization unit (Organization Unit, OU), country (Country, C), etc.

[0132] The diagnostic box generates a private key based on the activation information, which will be used to encrypt the certificate signing request (CSR). The CSR is sent to the CA so that the CA can sign it and generate the final diagnostic box security certificate. The diagnostic box security certificate sent by the CA is received and stored in the diagnostic box local storage.

[0133] Step A30, receiving the diagnostic device security certificate through a pre-established communication channel, and sending the diagnostic box security certificate to the diagnostic device, so that the diagnostic device can regularly update the diagnostic device security certificate and the diagnostic box security certificate according to the number of certificate transmissions.

[0134] The diagnostic box listens on the preset port and waits for the diagnostic device to send a security certificate. When the diagnostic device sends a security certificate, the network interface of the diagnostic box receives the data packet. The diagnostic box parses the received data packet, extracts the content of the diagnostic device security certificate, and serializes the diagnostic box security certificate into a standard format, such as PEM or DER. The serialized diagnostic box security certificate is packaged into a data format suitable for sending over the network. The diagnostic box security certificate is sent to the diagnostic device through a pre-built communication channel.

[0135] The diagnostic box receives the diagnostic device security certificate and sends the diagnostic box security certificate, so that the diagnostic device can regularly update the diagnostic device security certificate and the diagnostic box security certificate according to the number of certificate transmissions. By regularly updating the security certificate, the security certificates of the diagnostic device and the diagnostic box are in a dynamic state instead of being fixed. Regularly updating the security certificate strengthens the security and reliability of the certificate and avoids the situation where the security certificate is stolen and affects information security.

[0136] This embodiment provides a secure communication method, which receives the security certificate of the diagnostic device through a pre-built communication channel, and sends the pre-configured diagnostic box security certificate to the diagnostic device. The communication channel using the encryption protocol ensures the security of the transmission of the diagnostic box security certificate and the diagnostic device security certificate, thereby improving the security of the communication process. By regularly updating the security certificates, the security certificates of the diagnostic device and the diagnostic box are in a dynamically changing state rather than a fixed state. Regularly updating the security certificates strengthens the security and reliability of the certificates, and avoids the situation where the security certificates are stolen and affect information security.

[0137] The seventh embodiment of the present application is proposed based on the sixth embodiment of the present application. In the seventh embodiment of the present application, the same or similar contents as those in the above embodiments can be referred to the above introduction, and will not be described in detail later.

[0138] On this basis, please refer to Figure 6 , Figure 6 A flowchart of the seventh embodiment of the secure communication method provided in the present application.

[0139] In this embodiment, after step A30 of receiving the diagnostic device security certificate through a pre-established communication channel and sending the diagnostic box security certificate to the diagnostic device so that the diagnostic device can periodically update the diagnostic device security certificate and the diagnostic box security certificate according to the number of certificate transmissions, steps A40 to A70 are also included:

[0140] Step A40, determining a diagnostic box key value according to the diagnostic box security certificate;

[0141] Use appropriate tools or libraries to load the diagnostic box security certificate in PEM or DER file format, and extract key value-related information from the certificate. The key value-related information may include the hash value of the public key, private key, or key pair. Determine the diagnostic box key value through the hash value of the public key, private key, or key pair.

[0142] Step A50, storing the diagnostic box key value in a hidden file of the diagnostic box;

[0143] The diagnostic box searches for a suitable hidden file path in the storage system and creates a new hidden file in the selected hidden file location to store the diagnostic device key value. The diagnostic box key value is written to the created hidden file and ensures that the file is stored in encrypted form to prevent unauthorized access.

[0144] Step A60, when the key certificate update mechanism is triggered, extracting the diagnostic box key value from the hidden file of the diagnostic box;

[0145] When the diagnostic device triggers the key certificate update mechanism, it locates the hidden file where the diagnostic box stores the key value, tries to access the hidden file according to the hidden file location, extracts the diagnostic box key value from the hidden file, and verifies whether the diagnostic box key value is valid.

[0146] Step A70: Send the diagnostic box key value to the diagnostic device, so that the diagnostic device can periodically update the diagnostic device security certificate and the diagnostic box security certificate.

[0147] After ensuring that the diagnostic box key value has been extracted and is ready to be sent, a connection is established with the diagnostic device through a pre-established communication channel, the diagnostic box key value is packaged into a data format suitable for sending over the network, and the key value is sent to the diagnostic device through the communication channel. The diagnostic device parses the received data packet and extracts the diagnostic box key value.

[0148] In this embodiment, the diagnostic box key value is stored in a hidden file of the diagnostic box to ensure the information security of the diagnostic box security certificate stored locally in the diagnostic box. When the key certificate update mechanism is triggered, the diagnostic box key value is extracted from the hidden file of the diagnostic box, and the diagnostic box key value is sent to the diagnostic device so that the diagnostic device can regularly update the diagnostic device security certificate and the diagnostic box security certificate. By regularly updating the security certificate, the security certificates of the diagnostic device and the diagnostic box are in a dynamically changing state rather than a fixed state. Regularly updating the security certificate strengthens the security and reliability of the certificate, and avoids the situation where the security certificate is stolen and affects information security.

[0149] It should be noted that the above examples are only used to understand the present application and do not constitute a limitation on the secure communication method of the present application. More simple transformations based on this technical concept are all within the scope of protection of the present application.

[0150] This application also provides a secure communication device, please refer to Figure 7 , the secure communication device comprises:

[0151] An activation information configuration module 10, configured to receive an activation instruction and configure activation information according to the activation instruction;

[0152] The diagnostic device receives an activation instruction for activating the diagnostic box sent by the user terminal, and the diagnostic device associates the activation code and the serial number according to the activation instruction to complete the configuration of the activation information.

[0153] An activation information sending module 20 sends the activation information to the diagnostic box so that the diagnostic box generates a diagnostic box security certificate and feeds back activation status information to the diagnostic device;

[0154] The diagnostic device sends the activation information including the activation code and serial number to the diagnostic box, which verifies the activation information. When the activation information is verified, the diagnostic box is activated. After the activation, a pair of public and private keys are generated inside the diagnostic box. The private key will be securely stored inside the diagnostic box, and the public key will be used to generate a certificate.

[0155] A diagnostic device security certificate generating module 30, generating a diagnostic device security certificate according to the activation status information;

[0156] After ensuring that the diagnostic box has been successfully activated and is in normal working condition, the diagnostic device will generate a pair of public and private keys. The private key is stored securely for confidentiality, and the public key will be used to generate a security certificate.

[0157] The security certificate transmission module 40 transmits the diagnostic device security certificate through a pre-built communication channel, receives the diagnostic box security certificate, and records the number of certificate transmissions;

[0158] When the diagnostic device completes the transmission of the diagnostic device security certificate through the pre-built communication channel, the diagnostic box receives the security certificate, and the diagnostic box updates the internal counter, records this certificate transmission, and writes the detailed transmission record to the log file.

[0159] The security certificate updating module 50 is configured to periodically update the diagnostic device security certificate and the diagnostic box security certificate based on the number of certificate transmissions.

[0160] The diagnostic box operating system or dedicated service periodically checks the recorded certificate transmission times. When the certificate transmission times reaches the upper threshold, the certificate update process is triggered.

[0161] The secure communication device provided by the present application adopts the secure communication method in the above embodiment to solve the technical problem of secure communication. Compared with the prior art, the beneficial effects of the secure communication device provided by the present application are the same as the beneficial effects of the secure communication method provided by the above embodiment, and the other technical features in the secure communication device are the same as the features disclosed in the above embodiment method, which will not be repeated here.

[0162] The present application provides a secure communication device, which includes: at least one processor; and a memory that is communicatively connected to the at least one processor; wherein the memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the secure communication method in the above-mentioned embodiment one.

[0163] Reference below Figure 8 , which shows a schematic diagram of the structure of a secure communication device suitable for implementing the embodiment of the present application. The secure communication device in the embodiment of the present application may include but is not limited to mobile terminals such as mobile phones, laptop computers, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Descriptions), PMPs (Portable Media Players), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. Figure 8 The security communication device shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0164] like Figure 8As shown, the security communication device may include a processing device 1001 (e.g., a central processing unit, a graphics processor, etc.), which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM: Read Only Memory) 1002 or a program loaded from a storage device 1003 to a random access memory (RAM: Random Access Memory) 1004. In RAM1004, various programs and data required for the operation of the security communication device are also stored. The processing device 1001, ROM1002, and RAM1004 are connected to each other through a bus 1005. An input / output (I / O) interface 1006 is also connected to the bus. Generally, the following systems can be connected to the I / O interface 1006: an input device 1007 including, for example, a touch screen, a touch pad, a keyboard, a mouse, an image sensor, a microphone, an accelerometer, a gyroscope, etc.; an output device 1008 including, for example, a liquid crystal display (LCD: Liquid Crystal Display), a speaker, a vibrator, etc.; a storage device 1003 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 1009. The communication device 1009 can allow the safety communication device to communicate with other devices wirelessly or by wire to exchange data. Although the figure shows a safety communication device with various systems, it should be understood that it is not required to implement or have all the systems shown. More or fewer systems can be implemented or have alternatively.

[0165] In particular, according to the embodiments disclosed in the present application, the process described above with reference to the flowchart can be implemented as a computer software program. For example, the embodiments disclosed in the present application include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication device, or installed from a storage device 1003, or installed from a ROM 1002. When the computer program is executed by the processing device 1001, the above-mentioned functions defined in the method of the embodiment disclosed in the present application are executed.

[0166] The secure communication device provided by the present application adopts the secure communication method in the above embodiment to solve the technical problem of secure communication. Compared with the prior art, the beneficial effects of the secure communication device provided by the present application are the same as the beneficial effects of the secure communication method provided by the above embodiment, and the other technical features in the secure communication device are the same as the features disclosed in the method of the previous embodiment, which will not be repeated here.

[0167] It should be understood that the various parts disclosed in this application can be implemented by hardware, software, firmware or a combination thereof. In the description of the above embodiments, specific features, structures, materials or characteristics can be combined in any one or more embodiments or examples in a suitable manner.

[0168] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

[0169] The present application provides a computer-readable storage medium having computer-readable program instructions (ie, computer programs) stored thereon, wherein the computer-readable program instructions are used to execute the secure communication method in the above-mentioned embodiment.

[0170] The computer-readable storage medium provided in the present application may be, for example, a USB flash drive, but is not limited to electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, systems or devices, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In this embodiment, the computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, system or device. The program code contained on the computer-readable storage medium may be transmitted using any appropriate medium, including but not limited to: wires, optical cables, RF (Radio Frequency), etc., or any suitable combination of the above.

[0171] The computer-readable storage medium may be included in the secure communication device; or may exist independently without being installed in the secure communication device.

[0172] The above-mentioned computer-readable storage medium carries one or more programs. When the above-mentioned one or more programs are executed by the security communication device, the security communication device: receives an activation instruction and configures activation information according to the activation instruction; sends the activation information to the diagnostic box so that the diagnostic box generates a diagnostic box security certificate and feeds back activation status information to the diagnostic device; generates a diagnostic device security certificate according to the activation status information; transmits the diagnostic device security certificate through a pre-built communication channel, receives the diagnostic box security certificate, and records the number of certificate transmissions; and regularly updates the diagnostic device security certificate and the diagnostic box security certificate based on the number of certificate transmissions.

[0173] Computer program code for performing the operations of the present application may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0174] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present application. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0175] The modules involved in the embodiments described in the present application may be implemented by software or hardware, wherein the name of the module does not constitute a limitation on the unit itself in some cases.

[0176] The readable storage medium provided in this application is a computer-readable storage medium, which stores computer-readable program instructions (i.e., computer programs) for executing the above-mentioned secure communication method, and can solve the technical problems of secure communication. Compared with the prior art, the beneficial effects of the computer-readable storage medium provided in this application are the same as the beneficial effects of the secure communication method provided in the above-mentioned embodiment, and will not be repeated here.

[0177] The present application also provides a computer program product, including a computer program, wherein when the computer program is executed by a processor, the steps of the above-mentioned secure communication method are implemented.

[0178] The computer program product provided by this application can solve the technical problem of secure communication. Compared with the prior art, the beneficial effects of the computer program product provided by this application are the same as the beneficial effects of the secure communication method provided by the above embodiment, which will not be repeated here.

[0179] The above descriptions are only some embodiments of the present application, and are not intended to limit the patent scope of the present application. All equivalent structural changes made using the contents of the present application specification and drawings under the technical concept of the present application, or direct / indirect applications in other related technical fields are included in the patent protection scope of the present application.

Claims

1. A secure communication method, characterized in that: Applied to diagnostic equipment, the method comprises: receiving an activation instruction and configuring activation information according to the activation instruction; Sending the activation information to the diagnostic box so that the diagnostic box can generate a diagnostic box security certificate and feed back activation status information to the diagnostic device; generating a diagnostic device security certificate according to the activation status information; Transmitting the diagnostic device security certificate through a pre-built communication channel, receiving the diagnostic box security certificate, and recording the number of certificate transmissions; The diagnostic device security certificate and the diagnostic box security certificate are periodically updated based on the number of certificate transmissions.

2. The method according to claim 1, characterized in that Before the step of transmitting the diagnostic device security certificate through the pre-built communication channel, receiving the diagnostic box security certificate, and recording the number of certificate transmissions, the step also includes: An encrypted transmission protocol is used to build a communication channel between the diagnostic device and the diagnostic box.

3. The method according to claim 1, characterized in that The step of regularly updating the diagnostic device security certificate and the diagnostic box security certificate based on the number of certificate transmissions comprises: Determining a diagnostic device key value according to the diagnostic device security certificate; storing the diagnostic device key value in a hidden file of the diagnostic device to determine a maximum number of transmissions; When the certificate transmission times are greater than or equal to the maximum transmission times, a key certificate updating mechanism is triggered to receive a diagnostic box key value; Extracting the diagnostic device key value from a hidden file of the diagnostic device; The diagnostic device security certificate and the diagnostic box security certificate are updated according to the key certificate update mechanism, the diagnostic device key value, and the diagnostic box key value.

4. The method according to claim 1, characterized in that After the step of regularly updating the diagnostic device security certificate and the diagnostic box security certificate based on the number of certificate transmissions, the following step is further included: Verifying and matching the diagnostic device security certificate and the diagnostic box security certificate, and recording the number of mismatches; When the number of mismatches is greater than or equal to the preset maximum number of mismatches, a certificate revocation mechanism is triggered; The diagnostic device security certificate and the diagnostic box security certificate are revoked according to the certificate revocation mechanism.

5. The method according to claim 4, characterized in that After the step of regularly updating the diagnostic device security certificate and the diagnostic box security certificate based on the number of certificate transmissions, the following step is further included: Query the certificate information of the diagnostic device security certificate and the diagnostic box security certificate to obtain a query result; Record the number of times no certificate information is queried according to the query result; When the number of inquiries for certificate-free information is greater than or equal to a preset maximum number of inquiries, triggering the certificate revocation mechanism; The diagnostic device security certificate and the diagnostic box security certificate are revoked according to the certificate revocation mechanism.

6. A secure communication method, characterized in that: Applied to a diagnostic box, the method comprises: Receiving activation information configured according to the activation instruction; generating a diagnostic box security certificate according to the activation information and feeding back activation status information to the diagnostic device, so that the diagnostic device can generate a diagnostic device security certificate according to the activation status information; The diagnostic device security certificate is received through a pre-built communication channel, and the diagnostic box security certificate is sent to the diagnostic device, so that the diagnostic device can periodically update the diagnostic device security certificate and the diagnostic box security certificate according to the number of certificate transmissions.

7. The method according to claim 6, characterized in that After the step of receiving the diagnostic device security certificate through the pre-built communication channel and sending the diagnostic box security certificate to the diagnostic device so that the diagnostic device can periodically update the diagnostic device security certificate and the diagnostic box security certificate according to the number of certificate transmissions, the step further includes: Determining a diagnostic box key value according to the diagnostic box security certificate; Storing the diagnostic box key value in a hidden file of the diagnostic box; When the key certificate update mechanism is triggered, extracting the diagnostic box key value from the hidden file of the diagnostic box; The diagnostic box key value is sent to the diagnostic device so that the diagnostic device can periodically update the diagnostic device security certificate and the diagnostic box security certificate.

8. A secure communication device, characterized in that: The device comprises: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program is configured to implement the steps of the secure communication method according to any one of claims 1 to 7.

9. A storage medium, characterized in that: The storage medium is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, the steps of the secure communication method according to any one of claims 1 to 7 are implemented.

10. A computer program product, characterized in that The computer program product comprises a computer program, and when the computer program is executed by a processor, the steps of the secure communication method according to any one of claims 1 to 7 are implemented.

Images