Diagnosis method, device for diagnosis and intelligent equipment

Abstract

The invention discloses a diagnosis method, a device for diagnosis and intelligent equipment. The method comprises the following steps: a diagnosis agent node receives a first diagnosis instruction aiming at a node to be diagnosed from a diagnosis node; according to the first diagnosis instruction, verifying whether a diagnosis node has an access control authority for the to-be-diagnosed node; and when the verification is passed, a second diagnosis instruction is sent to the node to be diagnosed, and the second diagnosis instruction is obtained according to the first diagnosis instruction. The technical scheme can be applied to intelligent equipment such as electric vehicles and new energy vehicles, isolation between the diagnosis node and the to-be-diagnosed node in the intelligent equipment can be achieved, and therefore the risk that the to-be-diagnosed node is attacked in the diagnosis process is reduced. Moreover, communication unification of remote diagnosis and near-end diagnosis can be realized by the technical scheme of the application, and external communication of the intelligent equipment for diagnosis is normalized to the diagnosis agent node, so that management and maintenance of the diagnosis system are facilitated.

Description

Technical Field

[0001] The present application relates to the field of security, and more specifically, to a diagnostic method, a device for diagnosis, and an intelligent device. Background Art

[0002] The on-board diagnostics (OBD) system is an online diagnostic system used to monitor vehicle conditions and control emissions. The on-board diagnostics system may include a diagnostic instrument and a diagnostic module in the vehicle. The diagnostic module receives diagnostic instructions sent by the diagnostic instrument through a diagnostic interface. The diagnostic instructions are used to diagnose the target electronic control unit (ECU). When the on-board diagnostics system receives the diagnostic instructions, it will directly send the diagnostic instructions to the target ECU.

[0003] It can be seen that in the current technical solution, since the diagnostic instrument can directly diagnose different ECUs, it is easy to introduce attacks against the ECUs inside the vehicle, threatening the safety of the vehicle. Summary of the invention

[0004] The present application provides a diagnostic method, a device for diagnosis and an intelligent device. By setting a diagnostic proxy node, isolation between a diagnostic device such as a proximal diagnostic device and a node to be diagnosed in the intelligent device can be achieved, thereby reducing the risk of the node to be diagnosed being attacked during the diagnostic process.

[0005] In a first aspect, a diagnostic method is provided, which can be executed by a smart device; or, it can also be executed by a computing platform of the smart device; or, it can also be executed by a chip or circuit used for the smart device, which is not limited in the present application.

[0006] The method comprises: receiving a first diagnosis instruction for a first node to be diagnosed from a diagnosis node; and verifying, according to the first diagnosis instruction, whether the diagnosis node has access control authority for the first node to be diagnosed.

[0007] In some possible implementations, when the verification is passed, a second diagnostic instruction is sent to the first node to be diagnosed, and the second diagnostic instruction is associated with the first diagnostic instruction.

[0008] In some possible implementations, after verifying whether the diagnosis node has the access control authority for the first node to be diagnosed, the verification result is sent to the diagnosis node.

[0009] It should be noted that the result of the verification includes a positive response or a negative response. The positive response is used to indicate that the diagnosis node can access the first node to be diagnosed, and the negative response is used to indicate that the diagnosis node cannot access the first node to be diagnosed.

[0010] Exemplarily, the diagnosis node may access the first node to be diagnosed, including: the diagnosis node may send a diagnosis service to the first node to be diagnosed via the diagnosis agent node.

[0011] Exemplarily, the diagnosis node may include a proximal diagnosis device and a remote diagnosis server, wherein the proximal diagnosis device may include a diagnosis instrument, an electrical testing device, and other devices that can be connected to the diagnosis interface.

[0012] In one example, the first node to be diagnosed is set in a smart device, and the first diagnostic instruction may include information indicating diagnostic services that may threaten the security of the smart device. For example, the diagnostic services that threaten the security of the smart device may include one or more of writing data, reading data, and flashing software, or may also include other diagnostic services that threaten the security of the smart device.

[0013] In yet another example, the first diagnostic instruction may also be information of an authentication request for secure access.

[0014] Exemplarily, when the first diagnostic instruction includes information indicating a diagnostic service that may threaten vehicle safety, the second diagnostic instruction is associated with the first diagnostic instruction, which can be understood as: the first diagnostic instruction is converted to the second diagnostic instruction by a communication protocol. Alternatively, the first diagnostic instruction is information for an authentication request for secure access, and the second diagnostic instruction is associated with the first diagnostic instruction, which can be understood as: after the security authentication is passed according to the first diagnostic instruction, the second diagnostic instruction is obtained from the diagnostic node; or, after the security authentication is passed according to the first diagnostic instruction, the diagnostic instruction obtained from the diagnostic node is converted to the second diagnostic instruction by a communication protocol.

[0015] Exemplarily, the method may be executed by a controller of an intelligent device (such as a vehicle), for example, may be executed by a controller serving as a diagnostic agent node.

[0016] In the above technical scheme, through the diagnostic proxy node, not only can the isolation between diagnostic devices such as proximal diagnostic devices and the nodes to be diagnosed in smart devices be achieved, thereby reducing the risk of the nodes to be diagnosed being attacked during the diagnosis process; but also, the communication unification of remote diagnosis and proximal diagnosis can be achieved, and the external communication used by smart devices for diagnosis can be unified to the diagnostic proxy node, which is convenient for the management and maintenance of the diagnostic system, and helps to further improve the equipment security during the diagnosis process.

[0017] In combination with the first aspect, in certain implementations of the first aspect, the method of verifying whether the diagnostic node has access control authority for the first node to be diagnosed is based on the first diagnostic instruction, including: obtaining a first random number related to the first node to be diagnosed according to the first diagnostic instruction; obtaining a first encrypted value, which is associated with the first random number and a first diagnostic key, wherein the first diagnostic key is associated with the first diagnostic node; sending the first encrypted value to the first node to be diagnosed; and receiving response information related to the first encrypted value from the first node to be diagnosed, wherein the response information is used to determine whether the verification is successful.

[0018] Exemplarily, the first random number associated with the first node to be diagnosed may include: a first random number generated by the first node to be diagnosed. Obtaining the first random number associated with the first node to be diagnosed may include: obtaining the first random number from the first node to be diagnosed; or obtaining the first random number from a cloud server.

[0019] Exemplarily, the first diagnosis key is associated with the first node to be diagnosed, which can be understood as: the first diagnosis key is a key pre-stored in the smart device for authenticating with the first node to be diagnosed; or, the first diagnosis key is a temporarily generated key for authenticating with the first node to be diagnosed. The first encryption value is associated with the first random number and the first diagnosis key, which can include: calculating the first encryption value based on the first random number and the first diagnosis key.

[0020] It is understandable that the first diagnostic instruction may include an identifier related to the first node to be diagnosed. Exemplarily, according to the first diagnostic instruction, obtaining a first random number related to the first node to be diagnosed may include: upon receiving the first diagnostic instruction, sending a random number request message to the first node to be diagnosed to request the first random number.

[0021] Exemplarily, the response information may include a positive response and a negative response. When a positive response is received, it is determined that the verification is passed; when a negative response is received, it is determined that the verification is not passed. The first node to be diagnosed verifies the first encrypted value based on the first random number and the encrypted value calculated by the diagnosis key related to the legitimate diagnosis agent node. When the encrypted value calculated by the first node to be diagnosed is equal to the first encrypted value, the diagnosis agent node can receive a positive response sent by the first node to be diagnosed; when the encrypted value calculated by the first node to be diagnosed is not equal to the first encrypted value, the diagnosis agent node can receive a negative response sent by the first node to be diagnosed.

[0022] In the above technical solution, the diagnostic proxy node sends an encrypted value to the first node to be diagnosed to obtain response information related to the encrypted value fed back by the first node to be diagnosed, and then determines whether the verification is passed. The diagnostic proxy node performs verification based on the authentication principle in the current diagnostic process, which helps to reduce the deployment difficulty of the diagnostic method of the present application.

[0023] In combination with the first aspect, in some implementations of the first aspect, obtaining the first encrypted value includes: determining the first diagnostic key according to the first diagnostic instruction; and calculating the first encrypted value according to the first diagnostic key and the first random number.

[0024] In some possible implementations, determining the first diagnostic key according to the first diagnostic instruction includes: determining the first diagnostic key from diagnostic keys associated with multiple nodes to be diagnosed according to the first diagnostic instruction, the multiple nodes to be diagnosed including the first node to be diagnosed.

[0025] Exemplarily, diagnosis keys related to multiple nodes to be diagnosed are stored in the diagnosis agent node.

[0026] In the above technical solution, the diagnosis keys of multiple nodes to be diagnosed are stored at the diagnosis proxy node rather than at the diagnosis node, which helps to reduce the risk of key leakage and thus improve the security of smart devices.

[0027] In combination with the first aspect, in certain implementations of the first aspect, obtaining the first encrypted value includes: sending the first random number and the identity information of the first node to be diagnosed to a key storage node, the identity information is used by the key storage node to determine the first diagnostic key; receiving the first encrypted value from the key storage node, the first encrypted value is calculated based on the first diagnostic key and the first random number; wherein the key storage node is used to store a diagnostic key related to at least one node to be diagnosed in the first device, and the at least one node to be diagnosed includes the first node to be diagnosed.

[0028] Exemplarily, the identity information of the first node to be diagnosed may be determined according to a data identifier (DID) in the first diagnosis instruction.

[0029] In the above technical solution, the operation of calculating the encryption value is performed by the key storage node, which helps to reduce the complexity of the diagnosis agent node in the verification process; storing the diagnosis keys of multiple nodes to be diagnosed in key storage nodes other than the diagnosis agent node can further increase the difficulty for attackers to obtain the key, thereby reducing the risk of key leakage and improving the security of smart devices.

[0030] In combination with the first aspect, in certain implementations of the first aspect, the first diagnostic instruction includes a first diagnostic service, and based on the first diagnostic instruction, verifying whether the diagnostic node has access control authority for the first node to be diagnosed includes: when the security level corresponding to the first diagnostic service is greater than or equal to a preset level threshold, verifying whether the diagnostic node has access control authority for the first node to be diagnosed.

[0031] For example, taking the node to be diagnosed as an ECU, there may be multiple security levels inside the ECU, each security level is associated with at least one function or diagnostic service, and only when a certain security level is unlocked can the associated function or diagnostic service be allowed to execute. The security level corresponding to the first diagnostic service can be understood as: the security level associated with the first diagnostic service.

[0032] In some possible implementations, when the security level associated with the first diagnostic service is greater than or equal to a preset level threshold, the verification process is performed. Otherwise, the verification process is not performed, and when the diagnostic proxy node receives the first diagnostic instruction, it directly sends the second diagnostic instruction to the diagnostic node.

[0033] Exemplarily, the first node to be diagnosed stores three security levels, security level 1 to security level 3, wherein the larger the value, the higher the security threat to the smart device when the function or diagnostic service associated with the security level is executed, and therefore a higher security protection means is required. In the above example, the preset level threshold can be security level 2, or other values ​​can be taken.

[0034] In the above technical solution, the verification process is performed only when the security level corresponding to the first diagnostic service meets the conditions, which helps to save the signaling overhead required for the diagnostic process and improve the diagnostic speed.

[0035] In combination with the first aspect, in certain implementations of the first aspect, the verification of whether the diagnostic node has access control authority to the first node to be diagnosed is based on the first diagnostic instruction, including: obtaining a policy file; performing a policy check based on the policy file, the policy check including checking at least one of the following: the validity period of the policy file, whether the diagnostic service included in the first diagnostic instruction is authorized, and whether the first node to be diagnosed is authorized; when the policy check passes, verifying whether the diagnostic node has access control authority to the first node to be diagnosed.

[0036] In the above technical solution, the access control authority is verified after the policy check is passed, which helps to further improve the robustness of the diagnostic system and thus ensure the security of the smart device.

[0037] In combination with the first aspect, in certain implementations of the first aspect, the diagnostic node is a proximal diagnostic device, the first diagnostic instruction includes an authentication request, and the method further includes: sending a second random number to the diagnostic node based on the authentication request; receiving a second encrypted value from the diagnostic node; and verifying the second encrypted value based on the second random number and a temporary key, wherein the temporary key is related to a legitimate proximal diagnostic device.

[0038] In some possible implementations, the diagnostic node is a proximal diagnostic device, and the method includes: receiving an authentication request, sending a second random number to the diagnostic node according to the authentication request; receiving a second encrypted value from the diagnostic node; verifying the second encrypted value according to the second random number and a temporary key, and the temporary key is related to a legitimate proximal diagnostic device. Wherein, the authentication request is generated according to the first diagnostic instruction. For example, after the diagnostic node sends the first diagnostic instruction to the diagnostic proxy node, it generates an authentication request and sends the authentication request to the diagnostic proxy node.

[0039] Exemplarily, the temporary key may be generated through a Diffie-Hellman (DH) key exchange protocol, or may be generated through other methods.

[0040] In the above technical solution, the diagnosis node and the diagnosis proxy node are authenticated based on a temporary key, and when the key used for authentication with the diagnosis proxy node at the diagnosis node is leaked, the security of the smart device will not be threatened.

[0041] In a second aspect, a diagnostic method is provided, which can be executed by a smart device; or, it can also be executed by a computing platform of the smart device; or, it can also be executed by a chip or circuit used for the smart device, which is not limited in this application.

[0042] The method includes: receiving a first encrypted value from a diagnostic proxy node, the first encrypted value being associated with a first random number and a first diagnostic key, the first random number and the first diagnostic key both being associated with the first node to be diagnosed; verifying the legitimacy of the first encrypted value based on the first random number and the first diagnostic key; and sending a response message to the diagnostic proxy node based on the verification result of the legitimacy of the first encrypted value.

[0043] In some possible implementations, the response information is used by the diagnosis agent node to determine whether the diagnosis node has access control authority for the first node to be diagnosed, and / or the response information is used to indicate that the diagnosis node has access control authority for the first node to be diagnosed.

[0044] Exemplarily, the method may be executed by a controller of the smart device, for example, by a controller to be diagnosed, that is, the node to be diagnosed. The smart device includes a diagnosis agent node and a node to be diagnosed.

[0045] In the above technical solution, the node to be diagnosed receives and verifies the encrypted value from the diagnostic proxy node, rather than directly receiving the relevant encrypted value from the diagnostic node. This helps to achieve isolation between the diagnostic node and the node to be diagnosed in the smart device through the diagnostic proxy node, thereby reducing the risk of introducing attacks to the node to be diagnosed during the diagnosis process.

[0046] In some possible implementations, the method includes: receiving a first encrypted value from a diagnostic proxy node, the first encrypted value being associated with a first random number and a first diagnostic key, the first random number and the first diagnostic key both being associated with a node to be diagnosed that the diagnostic node is to access; verifying the legitimacy of the first encrypted value based on a third random number and a second diagnostic key, wherein the third random number and the second diagnostic key are both associated with the first node to be diagnosed; and sending a response message to the diagnostic proxy node based on the verification result of the legitimacy of the first encrypted value, the response message being used by the diagnostic proxy node to determine that the diagnostic node has access control authority for the first node to be diagnosed.

[0047] In some possible implementations, the response information is used to indicate whether the diagnosis node has access control authority for the first node to be diagnosed.

[0048] It can be understood that when the node to be diagnosed to be accessed by the diagnostic node is the first node to be diagnosed, the first random number is the same as the third random number, and the first diagnostic key is the same as the second diagnostic key, then the response information can indicate that the legitimacy verification of the first encrypted value has passed; otherwise, the response information will indicate that the legitimacy verification of the first encrypted value has failed.

[0049] In combination with the second aspect, in some implementations of the second aspect, the method further includes: sending the first random number to the diagnosis agent node.

[0050] In combination with the second aspect, in some implementations of the second aspect, the method further includes: receiving a second diagnostic instruction from the diagnostic agent node, the second diagnostic instruction being associated with a first diagnostic instruction sent by the diagnostic node to the first node to be diagnosed.

[0051] On the third aspect, a diagnostic method is provided, which can be executed by a smart device; or, it can also be executed by a computing platform of the smart device; or, it can also be executed by a chip or circuit used for the smart device, which is not limited in this application.

[0052] The method includes: receiving a first random number from a diagnostic proxy node and identity information of a first node to be diagnosed, the first random number being associated with the first node to be diagnosed; determining a first diagnostic key related to the first node to be diagnosed based on the identity information; calculating a first encryption value based on the first diagnostic key and the first random number, the first encryption value being used to verify whether the diagnostic node has access control authority for the first node to be diagnosed; and sending the first encryption value to the diagnostic proxy node.

[0053] Exemplarily, the method may be executed by a controller of the smart device, for example, may be executed by a controller serving as a key storage node.

[0054] In the above technical solution, the key storage node stores the key used by the diagnostic agent node to authenticate with the node to be diagnosed, which helps to reduce the risk of leakage of the diagnostic key related to the node to be diagnosed, thereby improving the security of the smart device.

[0055] In combination with the third aspect, in certain implementations of the third aspect, the method is executed by a key storage node, which stores a diagnosis key related to at least one node to be diagnosed, and the at least one node to be diagnosed includes a first node to be diagnosed.

[0056] In combination with the third aspect, in certain implementations of the third aspect, the key storage node is disposed in a first device, and the first device also includes the first node to be diagnosed.

[0057] In a fourth aspect, a device for diagnosis is provided, comprising: a transceiver unit for receiving a first diagnostic instruction for a first node to be diagnosed from a diagnostic node; a processing unit for verifying whether the diagnostic node has access control authority for the first node to be diagnosed based on the first diagnostic instruction; the transceiver unit is also used to: when the verification is passed, send a second diagnostic instruction to the first node to be diagnosed, the second diagnostic instruction being associated with the first diagnostic instruction; and / or, send the verification result to the diagnostic node.

[0058] In combination with the fourth aspect, in certain implementations of the fourth aspect, the processing unit is used to: obtain a first random number related to the first node to be diagnosed according to the first diagnostic instruction; obtain a first encryption value, which is associated with the first random number and a first diagnostic key, wherein the first diagnostic key is associated with the first diagnostic node; control the transceiver unit to send the first encrypted value to the first node to be diagnosed; control the transceiver unit to receive response information related to the first encrypted value from the first node to be diagnosed, and the response information is used to determine whether the verification is passed.

[0059] In combination with the fourth aspect, in certain implementations of the fourth aspect, the processing unit is used to: determine the first diagnostic key according to the first diagnostic instruction; and calculate the first encryption value according to the first diagnostic key and the first random number.

[0060] In combination with the fourth aspect, in certain implementations of the fourth aspect, the processing unit is used to: control the transceiver unit to send the first random number and the identity information of the first node to be diagnosed to the key storage node, the identity information is used by the key storage node to determine the first diagnostic key; control the transceiver unit to receive the first encrypted value from the key storage node, the first encrypted value is calculated based on the first diagnostic key and the first random number; wherein the key storage node is used to store a diagnostic key related to at least one node to be diagnosed in the first device, and the at least one node to be diagnosed includes the first node to be diagnosed.

[0061] In combination with the fourth aspect, in certain implementations of the fourth aspect, the first diagnostic instruction includes a first diagnostic service, and the processing unit is used to: when the security level corresponding to the first diagnostic service is greater than or equal to a preset level threshold, verify whether the diagnostic node has access control authority for the first node to be diagnosed.

[0062] In combination with the fourth aspect, in certain implementations of the fourth aspect, the processing unit is used to: obtain a policy file; perform a policy check based on the policy file, the policy check including checking at least one of the following: the validity period of the policy file, whether the diagnostic service included in the first diagnostic instruction is authorized, and whether the first node to be diagnosed is authorized; when the policy check passes, verify whether the diagnostic node has access control authority for the first node to be diagnosed.

[0063] In combination with the fourth aspect, in certain implementations of the fourth aspect, the first diagnostic instruction includes an authentication request, the diagnostic node is a proximal diagnostic device, and the transceiver unit is also used to: send a second random number to the diagnostic node according to the authentication request; receive a second encrypted value from the diagnostic node; the processing unit is also used to: verify the second encrypted value based on the second random number and a temporary key, and the temporary key is related to a legitimate proximal diagnostic device.

[0064] In a fifth aspect, a device for diagnosis is provided, comprising: a transceiver unit for receiving a first encrypted value from a diagnostic agent node, the first encrypted value being associated with a first random number and a first diagnostic key, the first random number and the first diagnostic key both being associated with the first node to be diagnosed; a processing unit for verifying the legitimacy of the first encrypted value based on the first random number and the first diagnostic key; the processing unit is also used to control the transceiver unit to send a response message to the diagnostic agent node based on the verification result of the legitimacy of the first encrypted value, the response message being used by the diagnostic agent node to determine that the diagnostic node has access control authority for the first node to be diagnosed.

[0065] In combination with the fifth aspect, in certain implementations of the fifth aspect, the transceiver unit is further used to: send the first random number to the diagnosis agent node.

[0066] In combination with the fifth aspect, in certain implementations of the fifth aspect, the transceiver unit is further used to: receive a second diagnostic instruction from the diagnostic agent node, where the second diagnostic instruction is associated with a first diagnostic instruction sent by the diagnostic node to the first node to be diagnosed.

[0067] In a sixth aspect, a device for diagnosis is provided, comprising: a transceiver unit for receiving a first random number from a diagnostic agent node and identity information of a first node to be diagnosed, the first random number being associated with the first node to be diagnosed; a processing unit for determining a first diagnostic key related to the first node to be diagnosed based on the identity information; the processing unit is also used to calculate a first encryption value based on the first diagnostic key and the first random number, the first encryption value being used to verify whether the diagnostic node has access control authority for the first node to be diagnosed; the transceiver unit is also used to send the first encrypted value to the diagnostic agent node.

[0068] In combination with the sixth aspect, in certain implementations of the sixth aspect, the device stores a diagnosis key associated with at least one node to be diagnosed, and the at least one node to be diagnosed includes the first node to be diagnosed.

[0069] In combination with the sixth aspect, in certain implementations of the sixth aspect, the apparatus is disposed in a first device, and the first device also includes the first node to be diagnosed.

[0070] In a seventh aspect, a diagnostic system is provided, the system comprising a device as in any possible implementation of the fourth aspect, and a device as in any possible implementation of the fifth aspect.

[0071] In combination with the seventh aspect, in certain implementations of the seventh aspect, the system also includes a device as in any possible implementation of the sixth aspect.

[0072] In combination with the seventh aspect, in certain implementations of the seventh aspect, the system further includes a diagnosis node, which is used to send a diagnosis instruction to the node to be diagnosed.

[0073] In an eighth aspect, a device for diagnosis is provided, the device comprising: a memory for storing a computer program; and a processor for executing the computer program stored in the memory, so that the device performs a method in any possible implementation of the first to third aspects.

[0074] In a ninth aspect, a smart device is provided, which includes an apparatus as in any possible implementation of aspects 4 to 6; or, the smart device includes a system in the first two possible implementations of aspect 7.

[0075] In combination with the ninth aspect, in certain implementations of the ninth aspect, the smart device is a vehicle.

[0076] In a tenth aspect, a computer program product is provided, the computer program product comprising: a computer program code, when the computer program code is run on a computer, the computer executes a method in any possible implementation of the first to third aspects.

[0077] It should be noted that the above-mentioned computer program code may be stored in whole or in part on a first storage medium, wherein the first storage medium may be packaged together with the processor or may be packaged separately from the processor.

[0078] In the eleventh aspect, a computer-readable medium is provided, wherein the computer-readable medium stores instructions, and when the instructions are executed by a processor, the processor implements the method in any possible implementation of the first to third aspects.

[0079] In a twelfth aspect, a chip is provided, the chip comprising a circuit, the circuit being used to execute the method in any possible implementation of the first to third aspects above. BRIEF DESCRIPTION OF THE DRAWINGS

[0080] Figure 1 is a schematic diagram of a diagnostic system provided in an embodiment of the present application;

[0081] Figure 2 is a schematic block diagram of a diagnostic agent module provided in an embodiment of the present application;

[0082] Figure 3 is a schematic flow chart of the diagnostic method provided in the embodiments of the present application;

[0083] Figure 4 is another schematic flow chart of the diagnostic method provided in the embodiments of the present application;

[0084] Figure 5 is another schematic flow chart of the diagnostic method provided in the embodiment of the present application;

[0085] Figure 6 is a schematic block diagram of a device for diagnosis provided in an embodiment of the present application;

[0086] Figure 7 This is another schematic block diagram of the apparatus for diagnosis provided in an embodiment of the present application. DETAILED DESCRIPTION

[0087] The technical solution in this application will be described below in conjunction with the accompanying drawings.

[0088] On-board diagnosis refers to the inspection of the vehicle's technical condition and the location and cause of the fault without disassembling the vehicle. On-board diagnosis generally includes: vehicle power detection and diagnosis, vehicle chassis detection and diagnosis, vehicle body and accessories detection and diagnosis, vehicle exhaust pollutant and noise detection, and ECU firmware flashing and upgrading.

[0089] On-board diagnosis includes remote diagnosis and proximal diagnosis. Among them, remote diagnosis means that the diagnostic platform sends diagnostic instructions to the device that communicates with the vehicle and the external equipment through the wireless communication network, such as the communication box (telematics box, T-Box), and then the T-Box forwards the diagnostic instructions to the target ECU for diagnosis. Proximal diagnosis means that the diagnostic instrument is connected to the diagnostic interface, and the diagnostic instructions are sent directly to the target ECU through the diagnostic interface for diagnosis.

[0090] As mentioned above, in the current proximal diagnosis, the diagnostic instrument directly diagnoses different ECUs, which is easy to introduce attacks against each ECU of the vehicle, and the risk of being easily attacked during the diagnosis process is relatively large. In addition, when the operation requested by the diagnostic instruction may threaten the safety of the vehicle, the diagnostic instrument needs to perform a challenge-response authentication based on the diagnostic key of the target ECU stored in it. After the authentication is passed, the target ECU will execute the relevant diagnostic instructions. In other words, the diagnostic instrument stores the diagnostic keys of each ECU, which are easy to leak, thus seriously threatening the safety of the vehicle.

[0091] In view of this, the embodiments of the present application provide a diagnostic method, an apparatus for diagnosis, and an intelligent device. Through the diagnostic agent module in the intelligent device, it is verified whether the proximal diagnostic instrument or the remote diagnostic server has access control authority for the first node to be diagnosed in the intelligent device. After the verification is passed, the diagnosis of the first node to be diagnosed is completed based on the diagnostic instruction sent by the proximal diagnostic instrument or the remote diagnostic server. Through the diagnostic agent module, the isolation of the proximal diagnostic instrument and the first node to be diagnosed in the intelligent device can be achieved, thereby reducing the risk of the intelligent device being attacked during the diagnostic process. Furthermore, the diagnostic agent module can also save the key required in the diagnostic process, that is, the key of the first node to be diagnosed is no longer saved at the diagnostic instrument, which helps to reduce the risk of key leakage.

[0092] Figure 1 The diagnostic system provided by the embodiment of the present application is shown. Figure 1 As shown, taking the smart device as a vehicle as an example, the system 100 includes a diagnostic platform 110, a diagnostic instrument 120 and a vehicle 140. Among them, the vehicle 140 includes a diagnostic agent module 130 and a plurality of devices to be diagnosed, such as device 1 to be diagnosed and device 2 to be diagnosed. Specifically, the diagnostic platform 110 can be a physical server or a virtual server. When the diagnostic platform 110 is a virtual server, it can be located all over the world to provide services for vehicles in different countries and regions. The diagnostic platform 111 can be connected to the diagnostic agent module 130 through a wireless communication network, and the diagnosis of the device to be diagnosed in the vehicle 140 is realized through the diagnostic agent module 130. The diagnostic instrument can be connected to the diagnostic agent module 130 through the diagnostic interface of the vehicle 140, and the diagnosis of the device to be diagnosed in the vehicle 140 is realized through the diagnostic agent module 130.

[0093] In some possible implementations, the diagnostic agent module 130 includes a key storage module 131 and a diagnostic module 132. Figure 2 As shown. Among them, the key storage module 131 is used to store diagnostic keys related to the device to be diagnosed and used for security authentication of the diagnostic process. In one example, when the diagnostic module 131 receives a diagnostic instruction for a first device to be diagnosed among multiple devices to be diagnosed, the diagnostic key related to the first device to be diagnosed is obtained from the key storage module 131 according to the diagnostic instruction, and the encryption value related to the first device to be diagnosed is calculated according to the diagnostic key. In another example, when the diagnostic module 131 receives a diagnostic instruction for a first device to be diagnosed among multiple devices to be diagnosed, the key storage module 131 is notified according to the diagnostic instruction to determine the diagnostic key related to the first device to be diagnosed, and the key storage module 131 calculates the encryption value related to the first device to be diagnosed according to the diagnostic key. The above-mentioned encrypted value is used to verify whether the source device of the diagnostic instruction has access control authority to the first device to be diagnosed. After the verification is passed, the diagnostic module 131 sends the diagnostic instruction to the first device to be diagnosed so that the first device to be diagnosed executes the diagnostic instruction.

[0094] Exemplarily, in the embodiment of the present application, the device to be diagnosed may include but is not limited to: ECU, domain control unit (DCU).

[0095] In some possible implementations, the diagnostic agent module 130 may be set in a device. For example, the diagnostic agent module 130 may be set in any one of a vehicle domain controller (VDC), an advanced driving domain controller (ADC), and a cockpit domain controller (CDC). For another example, the diagnostic agent module 130 may also be set in any one of an in-car application-server (ICAS) controller, a body domain controller (BDC), a special equipment system (SAS), a media graphics unit (MGU), a body super core (BSC), and an advanced driving assistant system super core (ADAS super core), and this application does not limit this. Among them, ICAS may include at least one of the following: a vehicle control server ICAS1, an intelligent driving server ICAS2, an intelligent cockpit server ICAS3, and an infotainment server ICAS4.

[0096] In some possible implementations, the diagnostic agent module 130 may be provided in different devices of the above examples. For example, the key storage module 131 and the diagnostic module 132 are provided in two devices respectively. Among them, the security capability of the device where the key storage module 131 is located may be stronger.

[0097] The following combination Figure 3 The specific process of the diagnostic method provided in the embodiment of the present application is described.

[0098] Figure 3 A schematic flow chart of a diagnostic method provided in an embodiment of the present application is shown. The method 300 may be performed by Figure 1 Executed by the diagnostic system 100 shown, the method 300 may include:

[0099] S301, after the authentication between the diagnosis node and the diagnosis agent node is passed, a connection relationship is established.

[0100] Exemplarily, the diagnosis node may include at least one of the diagnosis platform 110 and the diagnosis instrument 120. The diagnosis agent node may include the diagnosis agent module 130, or the diagnosis agent node may include the diagnosis module 132.

[0101] Exemplarily, when diagnosis is required, the diagnosis platform sends a connection request to the diagnosis agent node. Alternatively, when the diagnosis instrument is connected to the diagnosis interface, the diagnosis instrument sends a connection request to the diagnosis agent node.

[0102] Furthermore, the diagnosis proxy node triggers identity authentication of the diagnosis node according to the connection request. Exemplarily, the identity authentication may be based on transport layer security (TLS), or the above identity authentication may also be implemented through other authentication methods.

[0103] In the specific implementation process, S301 may be skipped and S302 may be directly executed.

[0104] S302: The diagnosis node sends a first diagnosis instruction for a first node to be diagnosed to the diagnosis agent node.

[0105] Exemplarily, the first node to be diagnosed may include one or more devices to be diagnosed in the above embodiments, for example, may include the first device to be diagnosed.

[0106] It should be noted that the first device includes a diagnosis agent node and a first node to be diagnosed. Exemplarily, the first device may be the vehicle 140 described above, or may also be other IoT devices.

[0107] S303: The diagnosis agent node verifies, according to the first diagnosis instruction, whether the diagnosis node has access control authority for the first node to be diagnosed.

[0108] Exemplarily, the first diagnostic instruction may be information indicating a diagnostic service that may threaten the security of the first device, for example, the first diagnostic instruction may be information indicating a diagnostic service for reading data in the first node to be diagnosed; or, the first diagnostic instruction may also be information for an authentication request, for example, the first diagnostic instruction may be the sub-function "27 01" of the request seed in the 0x27 service (hereinafter referred to as UDS 27) in the unified diagnostic services (UDS) protocol.

[0109] In some possible implementations, when the first diagnostic instruction is information for an authentication request, the diagnostic proxy node verifies whether the diagnostic node has access control authority for the first node to be diagnosed, which may include: verifying whether the diagnostic node has access control authority for the first node to be diagnosed based on a challenge response mechanism.

[0110] In some possible implementations, when the first diagnostic instruction is information indicating a diagnostic service that may threaten the security of the first device, the diagnostic agent node verifies whether the diagnostic node has access control authority for the first node to be diagnosed, including the following two steps:

[0111] S1, the diagnosis agent node performs a policy check based on a first diagnosis instruction.

[0112] S2, when the policy check passes, the diagnosis agent node can verify whether the diagnosis node has access control authority for the first node to be diagnosed based on a challenge response mechanism. For example, the diagnosis agent node can perform verification based on the principle of UDS 27.

[0113] Exemplarily, the diagnostic proxy node can generate a temporary key related to a legitimate diagnostic node, and the legitimacy of the diagnostic node can be verified based on the temporary key. Further, the diagnostic proxy node can determine the diagnostic key related to the first node to be diagnosed according to the first diagnostic instruction, and generate an identity credential, such as an encrypted value, based on the diagnostic key, so that the first node to be diagnosed can verify the legitimacy of the diagnostic proxy node.

[0114] S304: When the verification is passed, the diagnosis agent node sends a second diagnosis instruction to the first node to be diagnosed.

[0115] Exemplarily, the second diagnostic instruction and the first diagnostic instruction may be the same instruction, or may be different instructions.

[0116] In some possible implementations, the first diagnostic instruction is information indicating a diagnostic service that may threaten the safety of the first device, for example, the first diagnostic instruction is information indicating a diagnostic service that reads or writes data from the first node to be diagnosed. If the communication protocol used by the diagnostic proxy node to receive the diagnostic instruction is different from the communication protocol used by the diagnostic proxy node to send the diagnostic instruction to the first node to be diagnosed, the second diagnostic instruction is obtained by converting the communication protocol of the first diagnostic instruction. If the communication protocol used by the diagnostic proxy node to receive the diagnostic instruction is the same as the communication protocol used by the diagnostic proxy node to send the diagnostic instruction to the first node to be diagnosed, the second diagnostic instruction is the first diagnostic instruction.

[0117] In some possible implementations, the first diagnostic instruction is information for authentication request, such as 27 01 (request seed), and the second diagnostic instruction may be information sent by the diagnostic node to the diagnostic agent node after S303 verification is passed to indicate a diagnostic service that may threaten the security of the first device.

[0118] Exemplarily, when the verification of the legitimacy of the diagnosis node by the diagnosis agent node and the verification of the legitimacy of the diagnosis agent node by the first node to be diagnosed are both passed, the diagnosis agent node sends a second diagnosis instruction to the first node to be diagnosed.

[0119] In some possible implementations, the diagnostic service indicated by the second diagnostic instruction that may threaten the security of the first device may include, but is not limited to: reading data, writing data, and firmware flashing and upgrading.

[0120] Furthermore, the first node to be diagnosed executes the second diagnosis instruction, implements the diagnosis service, and obtains the diagnosis result.

[0121] In order to make readers understand the above verification process, the following Figure 4 and Figure 5 The specific implementation method of verification is illustrated with examples.

[0122] Figure 4 A schematic flow chart of the diagnostic method provided by the embodiment of the present application is shown. The method 400 can be understood as an extension of S303 in the method 300, and is used to explain the detailed process of the diagnostic agent node verifying the access control authority of the diagnostic node. The method 400 may include:

[0123] S401: A diagnosis node sends an authentication request to a diagnosis agent node.

[0124] Exemplarily, the authentication request may carry an identifier of the first node to be diagnosed, for example, the identifier may be a DID.

[0125] Exemplarily, the authentication request may be in the form of "request seed (requestSeed)", or may also be other information for requesting a random number from the first node to be diagnosed.

[0126] In some possible implementations, when the diagnostic service indicated by the diagnostic instruction is different, the security level associated with the authentication request may be different. For example, security level 1 corresponds to 27 01 (request seed) and 27 02 (send key); security level 2 corresponds to 27 05 (request seed) and 27 06 (send key).

[0127] S402: The diagnosis agent node performs a status check according to the authentication request.

[0128] Exemplarily, the status check performed by the diagnostic agent node includes: checking whether the driving speed of the vehicle is less than or equal to a preset threshold. When it is determined that the driving speed of the vehicle is less than or equal to the preset threshold, it is determined that the status check passes, and S403 is executed. The preset threshold may be 3 km / h, or may be other values.

[0129] It is understandable that since the vehicle needs to call certain resources when performing diagnostic tasks, performing diagnostic tasks when the vehicle is traveling at high speed may affect other functions of the vehicle. Therefore, the above-mentioned status check may also include other types of status checks.

[0130] S403: After the status check passes, the diagnosis agent node sends an authentication request to the first node to be diagnosed.

[0131] Exemplarily, the authentication request includes an identifier of the first node to be diagnosed, and the diagnosis agent node determines the first node to be diagnosed according to the identifier in the authentication request.

[0132] S404: The first node to be diagnosed generates a random number 1.

[0133] Exemplarily, the random number 1 is recorded as seed_ecu.

[0134] S405: The first node to be diagnosed sends a random number 1 to the diagnosis agent node.

[0135] Exemplarily, the first node to be diagnosed sends a random number 1 to the diagnosis agent node via a diagnosis response.

[0136] S406: The diagnosis agent node generates a random number 2.

[0137] Exemplarily, the random number 2 is recorded as seed_agent.

[0138] S407: The diagnosis agent node sends a random number 2 to the diagnosis node.

[0139] S408 , the diagnosis node encrypts the random number 2 based on the temporary key 1 to obtain an encrypted value 1.

[0140] Exemplarily, the encrypted value 1 may be calculated based on the CMAC algorithm. For example, the temporary key 1 is recorded as key_agent, and the encrypted value 1 may be CMAC (key_agent, seed_agent).

[0141] S409, the diagnosis node sends the encrypted value 1 to the diagnosis agent node.

[0142] Exemplarily, the diagnosis node sends an encrypted value 1 based on 27 02 (send key).

[0143] S410, the diagnosis agent node calculates an encryption value according to the temporary key 2 and the random number 2 to verify the legitimacy of the diagnosis node.

[0144] Exemplarily, the diagnostic proxy node can generate a temporary key related to a legitimate diagnostic node, such as temporary key 2. If the encryption value calculated by the diagnostic proxy node based on temporary key 2 and random number 2 is the same as encryption value 1, it is determined that temporary key 1 and temporary key 2 are a pair of symmetric keys or the same key, and then the diagnostic node is determined to be legitimate, and the diagnostic proxy node maintains the session with the diagnostic node and continues to execute S411. Otherwise, the diagnostic proxy node terminates the session with the diagnostic node.

[0145] In some possible implementations, the diagnostic proxy node and the legitimate diagnostic node can calculate a temporary key through the Diffie-Hellman (DH) key exchange protocol. Exemplarily, the legitimate diagnostic node generates a random value as a secret key, and generates a first temporary public key based on the secret key; the diagnostic proxy node generates a random value as a secret key, and generates a second temporary public key based on the secret key. The diagnostic proxy node and the legitimate diagnostic node exchange each other's temporary public keys, and use the temporary public key and their own secret key to calculate the same temporary key.

[0146] S411 , the diagnosis agent node encrypts the random number 1 based on the pre-shared key 1 to obtain an encrypted value 2.

[0147] Exemplarily, the diagnosis agent node stores a diagnosis key related to the first node to be diagnosed, such as pre-shared key 1.

[0148] In some possible implementations, when the diagnostic proxy node receives the diagnostic instruction, it obtains the diagnostic key related to the first node to be diagnosed. Alternatively, when the diagnostic proxy node passes the legitimacy verification of the diagnostic node, it obtains the diagnostic key related to the first node to be diagnosed. Wherein, obtaining the diagnostic key related to the first node to be diagnosed includes: the diagnostic module in the diagnostic proxy node obtains the diagnostic key related to the first node to be diagnosed from the key storage module.

[0149] Exemplarily, the encryption value 2 may be calculated based on the CMAC algorithm. For example, the pre-shared key 1 is recorded as key_ecu, and the encryption value 2 may be CMAC (key_ecu, seed_ecu).

[0150] S412: The diagnosis agent node sends the encrypted value 2 to the first node to be diagnosed.

[0151] Exemplarily, the diagnosis agent node sends the encrypted value 2 based on 27 02 (send key).

[0152] S413, the first node to be diagnosed calculates an encryption value according to the pre-shared key 2 and the random number 1 to verify the legitimacy of the diagnosis agent node.

[0153] If the encryption value calculated by the first node to be diagnosed according to the pre-shared key 2 and the random number 1 is the same as the encryption value 2, it is determined that the pre-shared key 1 and the pre-shared key 2 are a pair of symmetric keys or the same key, and then the diagnosis agent node is determined to be legal, and S414 is continued. Otherwise, the first node to be diagnosed sends a negative response to the diagnosis agent node.

[0154] S414, when the verification is passed, the first node to be diagnosed sends a positive response to the diagnosis agent node.

[0155] Exemplarily, the first node to be diagnosed sends a positive response based on 67 02.

[0156] S415, the diagnosis agent node forwards the positive response to the diagnosis node.

[0157] Exemplarily, the diagnostic agent node sends a positive response based on 67 02.

[0158] It should be noted that, taking the first device as a vehicle as an example: in one example, when the diagnostic agent node is set in a device of the vehicle, for example, when the diagnostic agent node is set in a CDC or a VDC, the action performed by the above diagnostic agent node is performed by the CDC or the VDC. In another example, the diagnostic module and the key storage module in the diagnostic agent node are respectively set in two devices of the vehicle, for example, the diagnostic module is set in the VDC, and the key storage module is set in the CDC. Then the above-mentioned operations related to the calculation of the encrypted value can be performed by the CDC, and the CDC forwards the calculation results to the VDC, and the VDC performs the encrypted value comparison operation and communicates with the diagnostic node and the first node to be diagnosed.

[0159] It should also be noted that in the specific implementation process, it is not necessary to execute Figure 4 For example, only S403 to S405 and S411 to S414 may be performed. Figure 4 The operations shown may also not be executed in the order shown in the figure, for example, S407 to S410 may be executed simultaneously with S411 to S413.

[0160] Figure 5 Another schematic flow chart of the diagnostic method provided by the embodiment of the present application is shown. The method 500 can be understood as an extension of the method 300, and is used to explain the detailed process of the diagnostic agent node performing policy checking. The method 500 can be executed by the diagnostic agent node, and the method 500 includes:

[0161] S501, when receiving a first diagnosis instruction, calling a strategy file.

[0162] Exemplarily, the diagnosis node automatically generates a policy file based on the target node to be diagnosed and the diagnosis service included in the first diagnosis instruction and sends it to the vehicle. The diagnosis agent node can call the policy file from a node in the vehicle that stores the policy file.

[0163] Exemplarily, the policy file may include at least the following contents: vehicle identification, validity period, identification of the node to be diagnosed, and identification of the diagnostic service.

[0164] S502, determining whether the policy file validity period verification passes.

[0165] Specifically, when the policy file validity period verification passes, execute S503; otherwise, execute S506.

[0166] Exemplarily, when the policy file is valid, the policy file is used to detect the diagnostic instruction, and if the policy file is invalid, the diagnostic process is terminated.

[0167] S503, determining whether the diagnostic service authority verification is passed.

[0168] Specifically, when the diagnostic service verification passes, S504 is executed; otherwise, S506 is executed.

[0169] Exemplarily, the diagnosis agent node verifies whether the diagnosis service identifier in the diagnosis instruction is consistent with the diagnosis service identifier in the policy file. If they are consistent, it is determined that the verification is passed; otherwise, the verification fails.

[0170] S504, determining whether the authorization verification of the node to be diagnosed is passed.

[0171] Specifically, when the authorization verification of the node to be diagnosed passes, S505 is executed; otherwise, S506 is executed.

[0172] Exemplarily, the diagnosis agent node verifies whether the vehicle identification and the node identification to be diagnosed in the diagnosis instruction are consistent with the vehicle identification and the node identification to be diagnosed in the strategy file. If they are consistent, it is determined that the verification is passed; otherwise, the verification is failed.

[0173] S505: Maintain the session with the diagnosis node.

[0174] S506, end the session.

[0175] It should be noted that in the specific implementation process, it is not necessary to execute Figure 5 For example, only one or more of S502 to S504 may be performed. Figure 5 The operations shown may also not be executed in the order shown in the figure. For example, S504 may be executed before S502 and S503.

[0176] When the technical solution of the present application is applied to a vehicle, two or more diagnostic proxy nodes may be set in the vehicle. Taking into account the specific implementation process, the electrical / electronic architecture (EEA) of the vehicle may exist in two forms, namely, a domain-centralized architecture and a centrally centralized architecture. Among them, the domain-centralized architecture is to divide the intelligent driving function of the vehicle into domains, and centrally control the intelligent driving function in a single domain through a domain controller, and the above-mentioned domain controller may include a vehicle domain controller, an autonomous driving domain controller, and a cockpit domain controller. Further, the domain controller controls the ECU in a single domain to implement the corresponding functions. The centrally centralized architecture is to centrally process the computing function as much as possible, and control the zone controller (zonal ECU) through the central computing platform, so as to realize the corresponding intelligent driving function. Exemplarily, the two or more diagnostic proxy nodes in the vehicle are two or more domain controllers, or the two or more diagnostic proxy nodes are also two or more zone controllers. Assume that two diagnostic proxy nodes, node 1 and node 2, are set in the vehicle, among which node 1 to be diagnosed is the ECU in the single domain responsible for node 2. Then, when node 1 receives the diagnostic instruction for node 1 to be diagnosed, node 1 authenticates with the diagnostic node and forwards the diagnostic instruction for node 1 to be diagnosed to node 2. Node 2 executes the verification process with node 1 to be diagnosed, that is, S303 to S304, S403 to S405 and S411 to S414 in the above embodiment.

[0177] In the various embodiments of the present application, unless otherwise specified or logically conflicting, the terms and / or descriptions between the various embodiments are consistent and can be referenced to each other, and the technical features in different embodiments can be combined to form new embodiments according to their inherent logical relationships.

[0178] Combined with the above Figures 1 to 5 The method provided in the embodiment of the present application is described in detail. Figure 6 and Figure 7 The device provided in the embodiment of the present application is described in detail. It should be understood that the description of the device embodiment corresponds to the description of the method embodiment, so the contents not described in detail can be referred to the method embodiment above, and for the sake of brevity, they will not be repeated here.

[0179] Figure 6 A schematic block diagram of a device 2000 for diagnosis provided in an embodiment of the present application is shown. The device 2000 includes a transceiver unit 2010 and a processing unit 2020.

[0180] The apparatus 2000 may include a Figures 3 to 5 Furthermore, each unit in the device 2000 is respectively for implementing Figures 3 to 5For the contents not described in detail on the device side, reference can be made to the description in the above method embodiment.

[0181] Exemplarily, the device 2000 may be disposed in the diagnosis agent module 130 . For example, the device 2000 may be the diagnosis module 132 in the diagnosis agent module 130 , or the device 2000 may also be the key storage module 131 in the diagnosis agent module 130 .

[0182] Exemplarily, when the device 2000 is arranged in the diagnostic agent module 130 and is used to execute the method 300, the transceiver unit 2010 is used to receive a first diagnostic instruction for a first node to be diagnosed from a diagnostic node; the processing unit 2020 is used to verify whether the diagnostic node has access control authority for the first node to be diagnosed based on the first diagnostic instruction; the transceiver unit 2010 is also used to: when the verification is passed, send a second diagnostic instruction to the first node to be diagnosed, and the second diagnostic instruction is associated with the first diagnostic instruction.

[0183] In some possible implementations, the processing unit 2020 is used to: obtain a first random number related to a first node to be diagnosed according to a first diagnostic instruction; obtain a first encryption value, the first encryption value is associated with the first random number and a first diagnostic key, wherein the first diagnostic key is associated with the first diagnostic node; control the transceiver unit 2010 to send the first encrypted value to the first node to be diagnosed; control the transceiver unit 2010 to receive response information related to the first encrypted value from the first node to be diagnosed, and the response information is used to determine whether the verification is passed.

[0184] Exemplarily, the first random number may include the random number 1 mentioned above, and the first encrypted value may include the encrypted value 2 mentioned above.

[0185] In some possible implementations, the processing unit 2020 is used to: determine a first diagnostic key according to a first diagnostic instruction; and calculate a first encryption value according to the first diagnostic key and a first random number.

[0186] In some possible implementations, the first node to be diagnosed is set in the first device, and the processing unit 2020 is used to: control the transceiver unit 2010 to send a first random number and identity information of the first node to be diagnosed to the key storage node, and the identity information is used by the key storage node to determine the first diagnostic key; control the transceiver unit 2010 to receive a first encrypted value from the key storage node, and the first encrypted value is calculated based on the first diagnostic key and the first random number; wherein the key storage node is used to store a diagnostic key related to at least one node to be diagnosed in the first device, and the at least one node to be diagnosed includes the first node to be diagnosed.

[0187] In some possible implementations, the first diagnostic instruction includes a first diagnostic service, and the processing unit 2020 is used to verify whether the diagnostic node has access control authority for the first node to be diagnosed when the security level corresponding to the first diagnostic service is greater than or equal to a preset level threshold.

[0188] In some possible implementations, the processing unit 2020 is used to: obtain a policy file; perform a policy check based on the policy file, the policy check including checking at least one of the following: the validity period of the policy file, whether the diagnostic service included in the first diagnostic instruction is authorized, and whether the first node to be diagnosed is authorized; when the policy check passes, verify whether the diagnostic node has access control authority for the first node to be diagnosed.

[0189] Exemplarily, the policy file may include the policy file in the above method 500. The detailed process of obtaining the policy file and performing policy checking can refer to the description in method 500, which will not be repeated here.

[0190] In some possible implementations, the first diagnostic instruction includes an authentication request, the diagnostic node is a proximal diagnostic device, and the transceiver unit 2010 is also used to: send a second random number to the diagnostic node according to the authentication request; receive a second encrypted value from the diagnostic node; the processing unit 2020 is also used to: verify the second encrypted value based on the second random number and a temporary key, and the temporary key is related to a legitimate proximal diagnostic device.

[0191] Exemplarily, the second random number may include the random number 2 mentioned above, and the second encrypted value may include the encrypted value 1 mentioned above.

[0192] Exemplarily, the authentication request may include 27 01 (request seed) in the above embodiment, the temporary key may include the above temporary key 1, and the generation method of the temporary key can refer to the description in S410, which will not be repeated here.

[0193] Exemplarily, the device 2000 can also be set in the node to be diagnosed. When the device 2000 is set in the first node to be diagnosed and used to execute the method 300, the transceiver unit 2010 is used to receive the first encrypted value from the diagnostic agent node, the first encrypted value is associated with the first random number and the first diagnostic key, and the first random number and the first diagnostic key are both associated with the first node to be diagnosed; the processing unit 2020 is used to verify the legitimacy of the first encrypted value according to the first random number and the first diagnostic key; the processing unit 2020 is also used to: control the transceiver unit to send a response message to the diagnostic agent node according to the verification result of the legitimacy of the first encrypted value, and the response message is used by the diagnostic agent node to determine that the diagnostic node has access control authority for the first node to be diagnosed.

[0194] In some possible implementations, the transceiver unit 2010 is further configured to: send a first random number to the diagnosis agent node.

[0195] In some possible implementations, the transceiver unit 2010 is further used to: receive a second diagnostic instruction from the diagnostic agent node, where the second diagnostic instruction is associated with a first diagnostic instruction sent by the diagnostic node to the first node to be diagnosed.

[0196] Exemplarily, the device 2000 may also be arranged in the key storage module 131. When the device 2000 is arranged in the key storage module 131 and is used to execute the method 300, the transceiver unit 2010 is used to receive a first random number from the diagnosis agent node and the identity information of the first node to be diagnosed, and the first random number is associated with the first node to be diagnosed; the processing unit 2020 is used to determine the first diagnosis key related to the first node to be diagnosed according to the identity information; the processing unit 2020 is also used to: calculate the first encryption value according to the first diagnosis key and the first random number, and the first encryption value is used to verify whether the diagnosis node has the access control authority for the first node to be diagnosed; the transceiver unit 2010 is also used to: send the first encryption value to the diagnosis agent node.

[0197] In some possible implementations, the apparatus 2000 stores a diagnosis key associated with at least one node to be diagnosed, and the at least one node to be diagnosed includes a first node to be diagnosed.

[0198] In some possible implementations, the apparatus 2000 is disposed in a first device, and the first device further includes a first node to be diagnosed.

[0199] For example, the operations performed by the transceiver unit 2010 and the processing unit 2020 may be performed by one processor, or may be performed by different processors. Figure 1 A processor in the vehicle 140 is shown; alternatively, the device 2000 may be a chip disposed in the vehicle 140 .

[0200] In the embodiment of the present application, the processor is a circuit with the ability to process signals. In one implementation, the processor can be a circuit with the ability to read and run instructions, such as a central processing unit (CPU), a microprocessor, a graphics processing unit (GPU) (which can be understood as a microprocessor), or a digital signal processor (DSP); in another implementation, the processor can realize certain functions through the logical relationship of the hardware circuit, and the logical relationship of the hardware circuit is fixed or reconfigurable, such as a hardware circuit implemented by a processor as an application-specific integrated circuit (ASIC) or a programmable logic device (PLD), such as a field programmable gate array (FPGA). In a reconfigurable hardware circuit, the process of the processor loading a configuration document to implement the hardware circuit configuration can be understood as the process of the processor loading instructions to implement the functions of some or all of the above units. In addition, it can also be a hardware circuit designed for artificial intelligence, which can be understood as an ASIC, such as a neural network processing unit (NPU), a tensor processing unit (TPU), a deep learning processing unit (DPU), etc.

[0201] In the specific implementation process, all or part of the units in the above device can be integrated together, or can be implemented independently. In one implementation, these units are integrated together and implemented in the form of a system-on-a-chip (SoC).

[0202] Figure 7 It is a schematic block diagram of a device for diagnosis provided in an embodiment of the present application. Figure 7 The device 2100 shown may include: a processor 2110, a transceiver 2120, and a memory 2130. The processor 2110, the transceiver 2120, and the memory 2130 are connected via an internal connection path, the memory 2130 is used to store instructions, and the processor 2110 is used to execute the instructions stored in the memory 2130 to implement the methods in the above embodiments. Optionally, the memory 2130 may be coupled to the processor 2110 via an interface, or may be integrated with the processor 2110.

[0203] It should be noted that the transceiver 2120 may include but is not limited to a transceiver device such as an input / output interface to achieve communication between the device 2100 and other devices or a communication network.

[0204] The memory 2130 may be a read only memory (ROM), a static storage device, a dynamic storage device or a random access memory (RAM).

[0205] The transceiver 2120 uses a transceiver device such as but not limited to a transceiver to implement communication between the device 2100 and other devices or a communication network to receive / send data / information used to implement the methods in the above embodiments.

[0206] In the specific implementation process, the device 2100 can be set at Figure 1 The vehicle 140 is shown.

[0207] An embodiment of the present application further provides a diagnostic system, which includes the diagnostic agent node and the first node to be diagnosed in the above embodiment; or, the diagnostic system may further include a key storage module (or a key storage node).

[0208] In some possible implementations, the diagnostic system further includes a diagnostic node, and the diagnostic node is used to send a diagnostic instruction to the first node to be diagnosed.

[0209] An embodiment of the present application further provides a smart device, which includes the above-mentioned apparatus 2000, or the above-mentioned apparatus 2100; or, the smart device includes the above-mentioned diagnostic system.

[0210] In some possible implementations, the smart device may be a vehicle 140 .

[0211] The smart devices involved in this application may include road vehicles, water vehicles, air vehicles, industrial equipment, agricultural equipment, or entertainment equipment, etc. For example, the smart device may be a vehicle, which is a vehicle in a broad sense, and may be a vehicle (such as a commercial vehicle, a passenger car, a motorcycle, a flying car, a train, etc.), an industrial vehicle (such as a forklift, a trailer, a tractor, etc.), an engineering vehicle (such as an excavator, a bulldozer, a crane, etc.), agricultural equipment (such as a lawn mower, a harvester, etc.), amusement equipment, a toy vehicle, etc. The embodiments of this application do not specifically limit the type of vehicle.

[0212] An embodiment of the present application further provides a computer program product, which includes a computer program code. When the computer program code runs on a computer, the computer implements the methods in the above embodiments of the present application.

[0213] An embodiment of the present application further provides a computer-readable storage medium, which stores computer instructions. When the computer instructions are executed on a computer, the computer implements the methods in the above embodiments of the present application.

[0214] An embodiment of the present application also provides a chip, including a circuit, for executing the methods in the above embodiments of the present application.

[0215] In the implementation process, each step of the above method can be completed by an integrated logic circuit of hardware in a processor or an instruction in the form of software. The method disclosed in conjunction with the embodiment of the present application can be directly embodied as a hardware processor for execution, or a combination of hardware and software modules in a processor for execution. The software module can be located in a storage medium mature in the art such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory, or a power-on erasable programmable memory, a register, etc. The storage medium is located in a memory, and the processor reads the information in the memory and completes the steps of the above method in conjunction with its hardware. To avoid repetition, it is not described in detail here.

[0216] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0217] In the description of the embodiments of the present application, unless otherwise specified, " / " means or, for example, A / B can mean A or B; "and / or" in this article is a kind of association relationship that describes associated objects, indicating that three relationships can exist, for example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. In this application, "at least one" means one or more, and "multiple" means two or more. "At least one of the following items" or similar expressions refers to any combination of these items, including any combination of single items or plural items. For example, at least one of a, b, or c can mean: a, b, c, ab, ac, bc, or abc, where a, b, c can be single or multiple.

[0218] The prefixes such as "first" and "second" used in the embodiments of the present application are only used to distinguish different description objects, and have no limiting effect on the position, order, priority, quantity or content of the described objects. The use of prefixes such as ordinal numbers used to distinguish description objects in the embodiments of the present application does not constitute a limitation on the described objects. For the statement of the described objects, please refer to the description in the context of the claims or embodiments, and the use of such prefixes should not constitute an unnecessary limitation.

[0219] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0220] In the various embodiments of the present application, unless otherwise specified or logically conflicting, the terms and / or descriptions between the various embodiments are consistent and can be referenced to each other, and the technical features in different embodiments can be combined to form new embodiments according to their inherent logical relationships.

[0221] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0222] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0223] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A diagnostic method, characterized in that: include: receiving a first diagnosis instruction for a first node to be diagnosed from a diagnosis node; Verifying, according to the first diagnosis instruction, whether the diagnosis node has access control authority for the first node to be diagnosed; When the verification is passed, a second diagnostic instruction is sent to the first node to be diagnosed, where the second diagnostic instruction is associated with the first diagnostic instruction.

2. The method according to claim 1, characterized in that The verifying, according to the first diagnosis instruction, whether the diagnosis node has access control authority for the first node to be diagnosed includes: According to the first diagnosis instruction, obtaining a first random number related to the first node to be diagnosed; Obtaining a first encrypted value, where the first encrypted value is associated with the first random number and a first diagnosis key, wherein the first diagnosis key is associated with the first node to be diagnosed; Sending the first encrypted value to the first node to be diagnosed; Response information related to the first encrypted value is received from the first node to be diagnosed, where the response information is used to determine whether the verification is successful.

3. The method according to claim 2, characterized in that The obtaining of the first encrypted value comprises: determining the first diagnostic key according to the first diagnostic instruction; The first encrypted value is calculated based on the first diagnosis key and the first random number.

4. The method according to claim 2, characterized in that: The obtaining of the first encrypted value comprises: Sending the first random number and the identity information of the first node to be diagnosed to a key storage node, wherein the identity information is used to determine the first diagnosis key; receiving the first encrypted value from the key storage node, where the first encrypted value is calculated based on the first diagnostic key and the first random number; The key storage node stores a diagnosis key associated with at least one node to be diagnosed, and the at least one node to be diagnosed includes the first node to be diagnosed.

5. The method according to any one of claims 1 to 4, characterized in that The first diagnostic instruction includes a first diagnostic service, and the verifying, according to the first diagnostic instruction, whether the diagnostic node has access control authority for the first node to be diagnosed includes: When the security level corresponding to the first diagnostic service is greater than or equal to a preset level threshold, verifying whether the diagnostic node has access control authority for the first node to be diagnosed.

6. The method according to any one of claims 1 to 5, characterized in that The verifying, according to the first diagnosis instruction, whether the diagnosis node has access control authority for the first node to be diagnosed includes: Get the policy file; Performing a policy check according to the policy file, the policy check comprising checking at least one of the following: a validity period of the policy file, whether the diagnostic service included in the first diagnostic instruction is authorized, and whether the first node to be diagnosed is authorized; When the policy check passes, it is verified whether the diagnosis node has access control authority for the first node to be diagnosed.

7. The method according to any one of claims 1 to 6, characterized in that The first diagnostic instruction includes an authentication request, the diagnostic node is a proximal diagnostic device, and the method further includes: sending a second random number to the diagnostic node according to the authentication request; receiving a second encrypted value from the diagnostic node; The second encrypted value is verified based on the second random number and a temporary key, the temporary key being associated with a legitimate proximal diagnostic device.

8. A diagnostic method, characterized in that: include: Receiving a first encrypted value from a diagnosis agent node, wherein the first encrypted value is associated with a first random number and a first diagnosis key, and the first random number and the first diagnosis key are both associated with the first node to be diagnosed; verifying the legitimacy of the first encrypted value according to the first random number and the first diagnostic key; A response message is sent to the diagnosis proxy node according to the verification result of the legitimacy of the first encrypted value, and the response message is used by the diagnosis proxy node to determine that the diagnosis node has the access control authority for the first node to be diagnosed.

9. The method according to claim 8, characterized in that The method further comprises: The first random number is sent to the diagnosis agent node.

10. The method according to claim 8 or 9, characterized in that: The method further comprises: A second diagnosis instruction is received from the diagnosis agent node, where the second diagnosis instruction is associated with a first diagnosis instruction sent by the diagnosis node and directed to the first node to be diagnosed.

11. A diagnostic method, characterized in that: include: Receiving a first random number from a diagnosis agent node and identity information of a first node to be diagnosed, wherein the first random number is associated with the first node to be diagnosed; Determining a first diagnosis key related to the first node to be diagnosed according to the identity information; Calculating a first encrypted value according to the first diagnosis key and the first random number, wherein the first encrypted value is used to verify whether the diagnosis node has access control authority for the first node to be diagnosed; The first encrypted value is sent to the diagnostic agent node.

12. The method according to claim 11, characterized in that The method is executed by a key storage node, wherein the key storage node stores a diagnosis key associated with at least one node to be diagnosed, wherein the at least one node to be diagnosed includes the first node to be diagnosed.

13. The method according to claim 12, characterized in that The key storage node is arranged in a first device, and the first device further comprises the first node to be diagnosed.

14. A device for diagnosis, characterized in that include: A transceiver unit, configured to receive a first diagnosis instruction from a diagnosis node for a first node to be diagnosed; A processing unit, configured to verify, according to the first diagnosis instruction, whether the diagnosis node has access control authority for the first node to be diagnosed; The transceiver unit is further configured to: when verification is passed, send a second diagnostic instruction to the first node to be diagnosed, wherein the second diagnostic instruction is associated with the first diagnostic instruction.

15. The device according to claim 14, characterized in that The processing unit is used for: According to the first diagnosis instruction, obtaining a first random number related to the first node to be diagnosed; Obtaining a first encrypted value, where the first encrypted value is associated with the first random number and a first diagnosis key, wherein the first diagnosis key is associated with the first node to be diagnosed; Controlling the transceiver unit to send the first encrypted value to the first node to be diagnosed; The transceiver unit is controlled to receive response information related to the first encrypted value from the first node to be diagnosed, wherein the response information is used to determine whether the verification is passed.

16. The device according to claim 15, characterized in that The processing unit is used for: determining the first diagnostic key according to the first diagnostic instruction; The first encrypted value is calculated based on the first diagnosis key and the first random number.

17. The device according to claim 15, characterized in that The processing unit is used for: Controlling the transceiver unit to send the first random number and the identity information of the first node to be diagnosed to the key storage node, wherein the identity information is used by the key storage node to determine the first diagnosis key; Controlling the transceiver unit to receive the first encrypted value from the key storage node, where the first encrypted value is calculated based on the first diagnostic key and the first random number; The key storage node stores a diagnosis key associated with at least one node to be diagnosed, and the at least one node to be diagnosed includes the first node to be diagnosed.

18. The device according to any one of claims 14 to 17, characterized in that The first diagnostic instruction includes a first diagnostic service, and the processing unit is configured to: When the security level corresponding to the first diagnostic service is greater than or equal to a preset level threshold, verifying whether the diagnostic node has access control authority for the first node to be diagnosed.

19. The device according to any one of claims 14 to 18, characterized in that The processing unit is used for: Get the policy file; Performing a policy check according to the policy file, the policy check comprising checking at least one of the following: a validity period of the policy file, whether the diagnostic service included in the first diagnostic instruction is authorized, and whether the first node to be diagnosed is authorized; When the policy check passes, it is verified whether the diagnosis node has access control authority for the first node to be diagnosed.

20. The device according to any one of claims 14 to 19, characterized in that The first diagnostic instruction includes an authentication request, the diagnostic node is a proximal diagnostic device, and the transceiver unit is further used for: sending a second random number to the diagnostic node according to the authentication request; receiving a second encrypted value from the diagnostic node; The processing unit is further configured to verify the second encrypted value based on the second random number and a temporary key, wherein the temporary key is associated with a legitimate proximal diagnostic device.

21. A device for diagnosis, characterized in that include: A transceiver unit, configured to receive a first encrypted value from a diagnosis agent node, wherein the first encrypted value is associated with a first random number and a first diagnosis key, and the first random number and the first node to be diagnosed are both associated with the first node to be diagnosed; a processing unit, configured to verify the legitimacy of the first encrypted value according to the first random number and the first diagnostic key; The processing unit is also used to: control the transceiver unit to send response information to the diagnosis agent node according to the verification result of the legitimacy of the first encrypted value, and the response information is used by the diagnosis agent node to determine that the diagnosis node has access control authority for the first node to be diagnosed.

22. The device according to claim 21, characterized in that The transceiver unit is also used for: The first random number is sent to the diagnosis agent node.

23. The device according to claim 21 or 22, characterized in that The transceiver unit is also used for: A second diagnosis instruction is received from the diagnosis agent node, where the second diagnosis instruction is associated with a first diagnosis instruction sent by the diagnosis node and directed to the first node to be diagnosed.

24. A device for diagnosis, characterized in that include: A transceiver unit, configured to receive a first random number from a diagnosis agent node and identity information of a first node to be diagnosed, wherein the first random number is associated with the first node to be diagnosed; a processing unit, configured to determine a first diagnosis key associated with the first node to be diagnosed according to the identity information; The processing unit is further used to: calculate a first encryption value according to the first diagnosis key and the first random number, wherein the first encryption value is used to verify whether the diagnosis node has access control authority for the first node to be diagnosed; The transceiver unit is further used to send the first encrypted value to the diagnosis agent node.

25. The device according to claim 24, characterized in that The device stores a diagnosis key associated with at least one node to be diagnosed, and the at least one node to be diagnosed includes the first node to be diagnosed.

26. The device according to claim 24 or 25, characterized in that The apparatus is arranged in a first device, and the first device also includes the first node to be diagnosed.

27. A diagnostic system, characterized in that: Comprising the device as claimed in any one of claims 14 to 20, and the device as claimed in any one of claims 21 to 23.

28. The system according to claim 27, characterized in that The system further comprises an apparatus as claimed in any one of claims 24 to 26.

29. The system according to claim 27 or 28, characterized in that The system further comprises a diagnosis node, and the diagnosis node is used to send a diagnosis instruction to the node to be diagnosed.

30. A device for diagnosis, characterized in that include: Memory for storing computer programs; A processor, configured to execute a computer program stored in the memory so that the apparatus performs the method according to any one of claims 1 to 7, or the method according to any one of claims 8 to 10, or the method according to any one of claims 11 to 13.

31. A smart device, characterized in that: The smart device comprises the apparatus according to any one of claims 14 to 20 and the apparatus according to any one of claims 21 to 23; or the smart device further comprises the apparatus according to any one of claims 24 to 26; Alternatively, the smart device includes the system as claimed in claim 27 or 28.

32. A computer-readable storage medium, characterized in that: Instructions are stored thereon, and when the instructions are executed by a processor, the processor implements the method as claimed in any one of claims 1 to 7, or executes the method as claimed in any one of claims 8 to 10, or executes the method as claimed in any one of claims 11 to 13.

Images