Certificate downloading method and device, vehicle and storage medium

Abstract

The invention provides a certificate downloading method and device, a vehicle and a storage medium, and the method comprises the steps: generating a part safety identification number which uniquely identifies target equipment based on a part identification number, a supplier code and a supplier production factory code of the target equipment in the vehicle; generating a public and private key pair of the target equipment in the trusted execution environment; wherein the public and private key pair comprises a public key and a private key; downloading a certificate of the target equipment based on the vehicle identification number, the part identification number, the part security identification number and the public key of the vehicle; and deploying the certificate and the private key in a replay protection memory partition of the target device, so that the target device performs bidirectional authentication communication with a third party based on the certificate and the private key. According to the method, the certificate can be downloaded for the target equipment based on the generated part security identification number which uniquely identifies the target equipment, so that the target equipment can realize bidirectional authentication communication based on the certificate, and a network security attack event caused by illegal use of the vehicle-mounted equipment is avoided.

Description

Technical Field

[0001] The present application relates to the field of vehicles, and more specifically, to a method, device, vehicle and storage medium for downloading a certificate in the field of vehicles. Background Art

[0002] With the popularization of the Internet of Vehicles, the connection between cars and the Internet is becoming closer and closer, which not only brings convenience but also brings new network security challenges.

[0003] In the prior art, vehicles connect to the Internet based on the certificate system of traditional Internet browsers. When the cloud server is set up, the certificate system of traditional Internet browsers will apply for a certificate from an authoritative certificate application agency, and the vehicle will store the certificate chain of the cloud server. When establishing a connection, the vehicle will request the cloud server to provide its certificate, and verify the validity of the cloud server certificate based on the stored certificate chain. After the verification is passed, the vehicle and the cloud server will establish a connection.

[0004] However, the certificate system of traditional Internet browsers has the problem that the vehicle side can only verify the authenticity of the cloud side, but the cloud side cannot verify the authenticity of the vehicle side. This can easily lead to the illegal use of onboard networking devices on the vehicle side, causing network security attacks. Summary of the invention

[0005] The present application provides a method, device, vehicle and storage medium for downloading certificates. The method can download certificates to a target device based on a component security identification number that is generated to uniquely identify the target device, so that the target device can achieve two-way authentication communication with a third party based on the certificate, thereby avoiding network security attacks caused by illegal impersonation of the vehicle-mounted device.

[0006] In a first aspect, a method for downloading a certificate is provided, the method comprising: generating a component security identification number that uniquely identifies a target device based on a component identification number, a supplier code, and a supplier production plant code of a target device in a vehicle; generating a public-private key pair for the target device in a trusted execution environment; wherein the public-private key pair includes a public key and a private key; downloading a certificate for the target device based on the vehicle identification number, component identification number, component security identification number, and public key of the vehicle; and deploying the certificate and private key in a replay-protected memory partition of the target device so that the target device can perform two-way authentication communication with a third party based on the certificate and the private key.

[0007] In the above technical solution, based on the component identification number, supplier code, and supplier production plant code of the vehicle target device, a component security identification number that uniquely identifies the target device is generated, and the certificate is downloaded based on the component security identification number and the public key, thereby achieving the uniformity of the certificate downloading solution. In addition, a public-private key pair is generated in a trusted execution environment, which provides an isolated operating environment, can protect key data and operations from attacks at the operating system level, ensure the security and credibility of the public-private key pair, and reduce the probability of the public-private key pair being stolen, thereby ensuring the security and credibility of the subsequent certificate of the target device downloaded based on the vehicle identification number, component identification number, component security identification number, and public key. The replay protection memory partition is an area that cannot be tampered with and can only be accessed by authorized applications. The downloaded certificate and private key are stored in the replay protection memory partition, which can ensure that the certificate and private key of the target device are not illegally read or modified. By downloading the certificate to the target device, it is ensured that when the target device of the vehicle is connected to the Internet, the third party to be connected to the Internet can verify the target device based on the certificate of the target device, realize two-way authentication communication, improve network security, and avoid the target device from being illegally used, causing network security attacks.

[0008] In combination with the first aspect, in some possible implementations, based on the vehicle identification number, component identification number, component safety identification number and public key of the vehicle, downloading the certificate of the target device includes: generating a certificate signing request based on the vehicle identification number, component identification number, component safety identification number and public key; wherein the certificate signing request contains information required to generate the certificate of the target device; and downloading the certificate of the target device based on the certificate signing request and the public key.

[0009] In combination with the first aspect and the above-mentioned implementation methods, in some possible implementation methods, the certificate of the target device is downloaded based on the certificate signing request and the public key, including: based on the vehicle identification number, the component identification number and the component safety identification number, verifying whether the vehicle has downloaded the certificate for the target device; when it is determined that the vehicle has not downloaded the certificate for the target device, instructing the certificate authority to generate a certificate for the target device based on the certificate signing request and the public key; and downloading the certificate of the target device from the certificate authority.

[0010] In combination with the first aspect and the above-mentioned implementation methods, in some possible implementation methods, based on the vehicle identification number, the component identification number and the component safety identification number, verifying whether the vehicle has downloaded a certificate for the target device includes: sending the vehicle identification number, the component identification number and the component safety identification number to a remote service provider so that the remote service provider checks the binding relationship between the vehicle identification number, the component identification number and the component safety identification number; when the remote service provider determines that there is no binding relationship between the vehicle identification number, the component identification number and the component safety identification number, determining that the target device has not downloaded the certificate.

[0011] In the above technical solution, the remote service provider, as a trusted third-party organization, can provide authoritative verification services to ensure the reliability and accuracy of the verification results. The remote service provider can automatically verify the binding relationship between VIN, SN and UIN, and efficiently and accurately determine whether the target device of the vehicle has downloaded the certificate. Before downloading the certificate, verify whether the target device of the vehicle has downloaded the certificate, which can avoid the security risks caused by the repeated issuance of certificates.

[0012] In combination with the first aspect and the above-mentioned implementation methods, in some possible implementation methods, in a trusted execution environment, generating a public-private key pair for a target device includes: detecting whether a valid certificate already exists in the target device based on an automatic certificate issuance service application; when it is determined that no valid certificate exists in the target device, controlling the automatic certificate issuance service application to send a target instruction to a program in the trusted execution environment through a hardware abstraction layer, so that the program in the trusted execution environment generates a public-private key pair for the target device when receiving the target instruction; wherein the hardware abstraction layer includes a trusted execution environment service, and the trusted execution environment service is used to provide the automatic certificate issuance service application with an interface for interacting with the program in the trusted execution environment.

[0013] In the above technical solution, before issuing the certificate, it is detected whether a valid certificate already exists in the target device, thereby avoiding repeated downloading of the certificate. The automatic certificate downloading service application is designed to realize automatic detection of whether a valid certificate already exists in the target device and automatic certificate downloading, which reduces the manual operation of the tester and greatly saves manpower. In addition, the generation of the public and private key pairs in a secure environment effectively avoids the problem of public and private key pair leakage and improves the security of certificate downloading.

[0014] In combination with the first aspect and the above-mentioned implementation methods, in some possible implementation methods, a component safety identification number that uniquely identifies the target device is generated based on the component identification number, supplier code, and supplier production plant code of the target device in the vehicle, including: selecting characters of a first preset byte from the supplier code; selecting characters of a second preset byte from the supplier production plant code; selecting characters of a third preset byte from the component identification number; generating a check code based on the characters of the first preset byte, the characters of the second preset byte, and the characters of the third preset byte; and combining the characters of the first preset byte, the characters of the second preset byte, the characters of the third preset byte and the check code to obtain the component safety identification number.

[0015] In the above technical solution, a component security identification number UIN that uniquely identifies the target device is generated based on the supplier code, the supplier production plant code and some bytes in the component identification number. The generated UIN can include the above three types of information, which is helpful for tracking the source and production history of the target device based on the UIN. In addition, the above method for generating UIN provides a standardized way. Even if different suppliers use component identification numbers of different lengths, component security identification numbers of the same length can be generated to download certificates, reducing the impact of component identification numbers of different lengths in the certificate download process, facilitating communication and data sharing across systems and organizations, and achieving the uniformity of certificate download solutions. The UIN also includes a verification code, which increases the difficulty of forgery, ensures the uniqueness and authenticity of the UIN, and thus ensures the security and reliability of certificates downloaded based on the UIN.

[0016] In combination with the first aspect and the above-mentioned implementation methods, in some possible implementation methods, after generating a component security identification number that uniquely identifies the target device, the method also includes: based on a trusted execution environment, writing the component security identification number into a non-volatile storage area of ​​the target device for storage, and when using the component security identification number, reading the component security identification number from the non-volatile storage area through the trusted execution environment; wherein the non-volatile storage area can only be written once.

[0017] In the above technical solution, the generated component security identification number that uniquely identifies the target device is stored in a non-volatile storage area that can only be written once. Since it can only be written once, once the data is written, it cannot be changed, which improves the security of the stored data and ensures that the component security identification number will not be tampered with. In addition, the component security identification number is stored in the non-volatile storage area based on the trusted execution environment, and then the component security identification number is read based on the trusted execution environment, which ensures that the process of writing and reading the component security identification number can be safely executed without being accessed or tampered with by the outside, thereby ensuring the security of the component security identification number.

[0018] In summary, the present application provides a standardized method to generate a component security identification number that uniquely identifies the target device in a unified format based on the supplier code, the supplier production plant code and the component identification number. The uniformity of the certificate download scheme is achieved based on the component security identification number, and the impact of component identification numbers of different lengths in the certificate download process is reduced. Before downloading the certificate, a double check is performed on whether the certificate has been downloaded in the target device based on the automatic certificate download service application and the remote service provider, which ensures the security and validity of the downloaded certificate and avoids the security impact caused by repeated downloading of the certificate. The generated component security identification number that uniquely identifies the target device is stored in a non-volatile storage area that can only be written once, which ensures that the component security identification number will not be tampered with, and improves the security of the downloaded certificate. Storing the certificate and private key in the replay protection memory partition can ensure that the certificate and private key of the target device are not illegally read or modified, and ensure that when the target device of the vehicle is connected to the network, the third party to be connected to the network can verify the target device based on the certificate of the target device, realize two-way authentication communication, improve network security, and avoid the target device from being illegally used, causing network security attacks.

[0019] In a second aspect, a device for downloading a certificate is provided, the device comprising: a first generation module, for generating a component security identification number that uniquely identifies a target device based on the component identification number, supplier code, and supplier production plant code of the target device in a vehicle; a second generation module, for generating a public-private key pair for the target device in a trusted execution environment; wherein the public-private key pair comprises a public key and a private key; a download module, for downloading a certificate for the target device based on the vehicle identification number, component identification number, component security identification number, and public key of the vehicle; and a deployment module, for deploying the certificate and private key in a replay-protected memory partition of the target device, so that the target device can perform two-way authentication communication with a third party based on the certificate and private key.

[0020] In combination with the second aspect, in some possible implementations, the download module is specifically used to generate a certificate signing request based on the vehicle identification number, component identification number, component safety identification number and public key; wherein the certificate signing request contains information required to generate a certificate for the target device; and based on the certificate signing request and the public key, download the certificate of the target device.

[0021] In combination with the second aspect and the above-mentioned implementation methods, in some possible implementation methods, the download module is specifically used to verify whether the vehicle has downloaded a certificate for the target device based on the vehicle identification number, the component identification number and the component safety identification number; when it is determined that the vehicle has not downloaded a certificate for the target device, instruct the certificate authority to generate a certificate for the target device based on the certificate signing request and the public key; and download the certificate of the target device from the certificate authority.

[0022] In combination with the second aspect and the above-mentioned implementation methods, in some possible implementation methods, the download module is specifically used to send the vehicle identification number, the component identification number and the component safety identification number to the remote service provider, so that the remote service provider can check the binding relationship between the vehicle identification number, the component identification number and the component safety identification number; when the remote service provider determines that there is no binding relationship between the vehicle identification number, the component identification number and the component safety identification number, it is determined that the target device has not downloaded the certificate.

[0023] In combination with the second aspect and the above-mentioned implementation methods, in some possible implementation methods, the second generation module is specifically used to detect whether a valid certificate already exists in the target device based on the automatic certificate issuance service application; when it is determined that there is no valid certificate in the target device, control the automatic certificate issuance service application to send a target instruction to the program in the trusted execution environment through the hardware abstraction layer, so that the program in the trusted execution environment generates a public and private key pair for the target device when receiving the target instruction; wherein the hardware abstraction layer includes a trusted execution environment service, and the trusted execution environment service is used to provide the automatic certificate issuance service application with an interface for interacting with the program in the trusted execution environment.

[0024] In combination with the second aspect and the above-mentioned implementation methods, in some possible implementation methods, the first generation module is specifically used to select characters of a first preset byte from the supplier code; select characters of a second preset byte from the supplier production plant code; select characters of a third preset byte from the component identification number; generate a check code based on the characters of the first preset byte, the characters of the second preset byte, and the characters of the third preset byte; combine the characters of the first preset byte, the characters of the second preset byte, the characters of the third preset byte and the check code to obtain the component safety identification number.

[0025] In combination with the second aspect and the above-mentioned implementation methods, in some possible implementation methods, the device also includes a writing module, which is used to write the component security identification number into the non-volatile storage area of ​​the target device for storage based on a trusted execution environment, and when the component security identification number is used, read the component security identification number from the non-volatile storage area through the trusted execution environment; wherein the non-volatile storage area can only be written once.

[0026] In a third aspect, a vehicle is provided, comprising a memory and a processor. The memory is used to store executable program code, and the processor is used to call and run the executable program code from the memory, so that the vehicle executes the method in the first aspect or any possible implementation of the first aspect.

[0027] In a fourth aspect, a computer program product is provided, comprising: a computer program code, which, when executed on a computer, enables the computer to execute the method in the first aspect or any possible implementation of the first aspect.

[0028] In a fifth aspect, a computer-readable storage medium is provided, which stores a computer program code. When the computer program code runs on a computer, the computer executes the method in the above-mentioned first aspect or any possible implementation manner of the first aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] Figure 1 It is a structural diagram of a certificate issuance system provided in an embodiment of the present application.

[0030] Figure 2 It is a schematic flowchart of a method for downloading a certificate provided in an embodiment of the present application.

[0031] Figure 3 It is a flowchart of an EOL diagnostic device writing into a HUT provided by an embodiment of the present application.

[0032] Figure 4 It is a flowchart of another EOL diagnostic device writing into HUT provided by an embodiment of the present application.

[0033] Figure 5 It is a schematic diagram of calculating UIN provided in an embodiment of the present application.

[0034] Figure 6 It is a flowchart of downloading a certificate provided in an embodiment of the present application.

[0035] Figure 7 It is a structural diagram of a device for downloading a certificate provided in an embodiment of the present application.

[0036] Figure 8 It is a structural schematic diagram of a vehicle provided in an embodiment of the present application. DETAILED DESCRIPTION

[0037] The technical solution in the present application will be described clearly and in detail below in conjunction with the accompanying drawings. In the description of the embodiments of the present application, unless otherwise specified, " / " means or, for example, A / B can mean A or B: "and / or" in the text is only a description of the association relationship of associated objects, indicating that there can be three relationships, for example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. In addition, in the description of the embodiments of the present application, "multiple" means two or more than two.

[0038] In the following, the terms "first" and "second" are used for descriptive purposes only and are not to be understood as suggesting or implying relative importance or implicitly indicating the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of the features.

[0039] Figure 1 It is a structural diagram of a certificate issuance system provided in an embodiment of the present application.

[0040] For example, Figure 1 As shown, the system 100 includes an End of Line (EOL) diagnostic device 101 , a target device 102 , a Certificate Authority Management System (CAMS) 103 , and a Telematics Service Provider (TSP) 104 .

[0041] The EOL diagnostic device 101 is used to diagnose and write data such as the vehicle identification number (VIN), the serial number (SN), the unique identification number (UIN), the supplier code, and the supplier production plant code to the target device 102.

[0042] The target device 102 is a vehicle-mounted networking device that can connect to the network to implement corresponding functions. The target device 102 can specifically be any one of a smart cockpit domain controller (Head Unit, HUT), an electronic control unit (Electronic Control Unit, ECU) or a remote communication terminal (Terminal Box, T-BOX). In the embodiment of the present application, the target device 102 is taken as an example of a HUT in a vehicle.

[0043] The CAMS103 certificate issuing authority is the cloud-based certificate issuing center, responsible for generating, distributing and managing digital certificates to ensure the security of network communications.

[0044] TSP 104: used to provide Internet connection services and support vehicle telematics and communications. In some embodiments, TSP 104 can also verify the binding relationship between UIN, VIN, and SN, and feed back the result to CAMS 103.

[0045] In some embodiments, Figure 1As shown, the target device 102 specifically includes: a microcontroller unit (MCU) 1021, an Android system 1022, a QNX system 1023, a hypervisor 1024, a trusted execution environment (TEE) 1025 and a system on chip (SOC) 1026.

[0046] Among them, MCU 1021 is used to control and coordinate various electronic devices and sensors inside the car.

[0047] The Android system 1022 is used to provide a user interface and application programs, and usually has a network connection requirement. In some embodiments, the Android system 1022 can also provide a certificate download service, specifically including applying for or downloading a certificate.

[0048] QNX system 1023 is mainly responsible for instrument-related functions. QNX system 1023 usually has no networking requirements.

[0049] Hypervisor 1024 is a simulator, which is software, firmware, or hardware that creates or runs virtual machines. It allows multiple operating systems to run simultaneously on the same physical host, with each operating system running independently in its own virtual environment without interfering with each other. Figure 1 In the embodiment, the Hypervisor 1024 can be used to isolate the Android system 1022 and the QNX system 1023, so that they can coexist on the same hardware platform and run independently of each other.

[0050] TEE 1025 is used to provide a secure and isolated area to store sensitive data and execute secure applications. In some embodiments, TEE 1025 can also provide a certification service.

[0051] SOC 1026 is used to run two operating systems: QNX system 1022 and Android system 1023.

[0052] Figure 2 1 is a schematic flow chart of a method for downloading a certificate provided in an embodiment of the present application. The method is applied to a vehicle, and specifically can be applied to a target device of the vehicle, such as a HUT, an ECU, a T-BOX, etc.

[0053] For example, Figure 2 As shown, the method 200 includes:

[0054] Step 201, based on the component identification number, supplier code, and supplier production plant code of the target device in the vehicle, generate a component safety identification number that uniquely identifies the target device;

[0055] Step 202, generating a public and private key pair of the target device in a trusted execution environment;

[0056] The public-private key pair includes a public key and a private key.

[0057] Step 203, downloading the certificate of the target device based on the vehicle identification number, component identification number, component security identification number and public key of the vehicle;

[0058] Step 204: deploy the certificate and the private key in the replay protection memory partition of the target device, so that the target device can perform two-way authentication communication with a third party based on the certificate and the private key.

[0059] exist Figure 2 In the illustrated embodiment, based on the component identification number, supplier code, and supplier production plant code of the vehicle target device, a component security identification number that uniquely identifies the target device is generated, and the certificate is downloaded based on the component security identification number and the public key, thereby achieving the uniformity of the certificate downloading scheme. In addition, a public-private key pair is generated in a trusted execution environment, which provides an isolated operating environment, can protect key data and operations from attacks at the operating system level, ensure the security and credibility of the public-private key pair, and reduce the probability of the public-private key pair being stolen, thereby ensuring the security and credibility of the subsequent certificate of the target device downloaded based on the vehicle identification number, component identification number, component security identification number, and public key. The replay protection memory partition is an area that cannot be tampered with and can only be accessed by authorized applications. The downloaded certificate and private key are stored in the replay protection memory partition, which can ensure that the certificate and private key of the target device are not illegally read or modified. By downloading the certificate to the target device, it is ensured that when the target device of the vehicle is connected to the network, the third party to be connected to the network can verify the target device based on the certificate of the target device, realize two-way authentication communication, improve network security, and avoid the target device from being illegally used, causing network security attacks.

[0060] Below Figure 2 The specific implementation methods of each step in the embodiment shown are described as follows:

[0061] In step 201, the part identification number can also be recorded as SN, which is usually a unique number assigned by the manufacturer to each produced part for tracking and management. The supplier code is a unique code representing the supplier of the part, used to identify different suppliers. Supplier production plant code: refers to the factory code of the supplier that specifically produces the part, used to distinguish different factories of the same supplier.

[0062] It is understandable that different parts have different part identification numbers SN, and different suppliers of the same part may have different part identification numbers SN. Different suppliers of the same part may also have part identification numbers SN of different lengths.

[0063] The target device may be, for example, a HUT in a vehicle. When the vehicle is on the production line, the HUT may generate a component safety identification number uniquely identifying the HUT, recorded as UIN, based on the component identification number, supplier code, and supplier production plant code written by the EOL diagnostic device.

[0064] In some embodiments, the EOL diagnostic device can generate a UIN that uniquely identifies the HUT based on the component identification number SN, the supplier code, and the supplier production plant code. After the EOL diagnostic device generates the UIN, the SN, the supplier code, the supplier production plant code, the UIN and the vehicle identification number VIN of the vehicle are written into the HUT of the vehicle.

[0065] Figure 3 It is a flowchart of an EOL diagnostic device writing into a HUT provided by an embodiment of the present application.

[0066] For example, Figure 3 As shown, the process includes:

[0067] Step 301 : The EOL diagnostic device generates a UIN based on the SN, the supplier code, and the supplier production plant code, and triggers EOL diagnosis.

[0068] It is understandable that at the end of the production line, that is, after all the assembly of the vehicle is completed, the vehicle needs to pass a series of tests to verify whether its functions and performance meet the specifications. The conditions for triggering the diagnostic test can be: the data to be written is ready, including the component identification number SN, the supplier code, the supplier production plant code, the generated component safety identification number UIN, and the vehicle identification number VIN. When all the necessary data are ready, the EOL diagnostic equipment will trigger the EOL diagnostic procedure.

[0069] EOL diagnostics include checking whether the vehicle's electronic systems are functioning properly, verifying that all ECUs and other electronic components are responsive, and writing necessary information to the ECUs or other storage units.

[0070] Step 302, the HUT enters the extended mode.

[0071] It can be understood that the extended mode provides deeper access rights to the target device. After determining that the EOL diagnosis is triggered, controlling the HUT to enter the extended mode can facilitate subsequent writing of data to the HUT.

[0072] Step 303: Use 0x27 service to perform security authentication with the HUT.

[0073] Among them, the 0x27 service refers to the security access control service in the automotive diagnostic communication, and 0x27 represents a specific diagnostic service ID. The use of the 0x27 service for security authentication is to ensure that only authorized diagnostic devices can access and operate the functions of the HUT in the extended mode, thereby enhancing the safety and reliability of the vehicle electronic system.

[0074] The steps of security authentication specifically include: the EOL diagnostic device sends an authentication request to the HUT, requesting access to specific services or functions of the HUT. After receiving the authentication request, the HUT exchanges keys with the diagnostic device to verify the identities of both parties. If the authentication is successful, the HUT will allow the EOL diagnostic device to perform further communication or operations.

[0075] Step 303: Use 0x2E service to write VIN, SN and UIN to the HUT.

[0076] Among them, the 0x2E service is a service for writing data identifiers in automotive diagnostic communications. 0x2E represents a specific diagnostic service ID used to perform write operations. The 0x2E service allows the EOL diagnostic device to write data to the HUT. This data can be any type of configuration information, parameter settings, status flags, etc.

[0077] Step 304, determine whether the writing is successful, if so, end, otherwise execute step 303.

[0078] It is understandable that after writing data to the HUT, the EOL diagnostic device can also determine whether the writing is successful. If it is determined that the writing is unsuccessful, step 303 is executed repeatedly to write VIN, SN and UIN to the HUT until the writing is successful.

[0079] Figure 4 It is a flowchart of another EOL diagnostic device writing into HUT provided by an embodiment of the present application.

[0080] For example, Figure 4 As shown, the HUT 102 specifically includes an MCU 1021 , a QNX system 1022 , an Android system 1023 , and a SOC 1026 . The SOC 1026 is used to run two operating systems: the QNX system 1022 and the Android system 1023 .

[0081] After the EOL diagnostic device 101 calculates the UIN, it writes the VIN, SN, UIN, supplier code, and supplier factory code into the MCU 1021 of the HUT 102 based on the diagnostic instruction. The MCU 1021 transmits the written VIN, SN, UIN, supplier code, and supplier factory code to the QNX system 1022 through the internal interface. The QNX system 1022 transmits the VIN, SN, UIN, supplier code, and supplier factory code to the Android system 1023 through the internal interface. The Android system 1023 saves the written VIN, SN, UIN, supplier code, and supplier factory code in a fixed disk partition.

[0082] In some embodiments, after calculating the UIN, the EOL diagnostic device 101 needs to access the diagnostic controller area network (CAN) of the HUT 102 and write the VIN, SN, UIN, vendor code, and vendor factory code into the MCU 1021 chip of the HUT 102 after passing the access authentication.

[0083] In one possible implementation, a component safety identification number that uniquely identifies the target device is generated based on the component identification number, supplier code, and supplier production plant code of the target device in the vehicle, including: selecting characters of a first preset byte from the supplier code; selecting characters of a second preset byte from the supplier production plant code; selecting characters of a third preset byte from the component identification number; generating a check code based on the characters of the first preset byte, the characters of the second preset byte, and the characters of the third preset byte; and combining the characters of the first preset byte, the characters of the second preset byte, the characters of the third preset byte, and the check code to obtain the component safety identification number.

[0084] Specifically, the required target characters can be determined from the component identification number SN, the supplier code and the supplier production plant code based on the preset screening rules, and then the required target characters are combined according to certain combination rules to obtain the component safety identification number.

[0085] The preset screening rules may be, for example, selecting characters of a first preset byte from the supplier code, selecting characters of a second preset byte from the supplier production plant code, selecting characters of a third preset byte number from the SN, and generating a check code based on the multiple bytes of characters determined previously.

[0086] Among them, the first preset byte, the second preset byte, and the third preset byte are set in advance based on the format of UIN, and the embodiment of the present application does not limit this.

[0087] The combination rule may be, for example, to use the characters of the first preset byte as the value of the first few bytes of the UIN, the characters of the second preset byte as the value of the next few bytes of the UIN, the characters of the third preset byte as the value of the next few bytes of the UIN, and the check code as the value of the last few bytes of the UIN. The characters of the first preset byte, the characters of the second preset byte, the characters of the third preset byte and the check code are combined according to the above combination rule to obtain the UIN that uniquely identifies the target device (i.e., HUT).

[0088] Figure 5 It is a schematic diagram of calculating UIN provided in an embodiment of the present application.

[0089] For example, Figure 5 As shown, the unified standard format of the UIN is designed to be 20 bytes (Bytes), which is ASCII code. The first preset byte is designed to be 5 bytes, the second preset byte is 2 bytes, the third preset byte is 11 preset bytes, and the generated check code is two bytes. The preset screening rules are: select the first 5 bytes of characters from the supplier code, select the first 2 bytes of characters from the supplier production plant code, select the last 11 bytes of characters from the SN, and use the Longitudinal Redundancy Check (LRC) algorithm for the first 18 bytes to generate a 2-byte check code.

[0090] The combination rule is: use the 5-byte characters selected from the supplier code as the value of the 0th to 4th bytes of UIN, the 2-byte characters selected from the supplier's production plant code as the value of the 5th to 6th bytes of UIN, the 11-byte characters selected from the SN as the value of the 7th to 17th bytes of UIN, and the check code as the value of the 18th to 19th bytes of UIN.

[0091] Assuming that the supplier code is 01234567 (8 bytes), the supplier production plant code is ABCDEF (6 bytes), and the SN is 12345678901234567890 (20 bytes), the first 5 bytes of characters selected from the supplier code are: 01234, the first two bytes of characters selected from the supplier production plant code are: AB, and the last 11 bytes of characters selected from the SN are: 01234567890. For example, the two-byte check code generated by the LRC algorithm for the first 18 bytes is: 52. Based on the combination rule, the above characters and check code are combined to obtain the UIN: 01234AB0123456789052.

[0092] In the above method, a component security identification number UIN that uniquely identifies the target device is generated based on the supplier code, the supplier production plant code and some bytes in the component identification number. The generated UIN can include the above three types of information, which is helpful for tracking the source and production history of the target device based on the UIN. In addition, the above method for generating UIN provides a standardized way. Even if different suppliers use component identification numbers of different lengths, component security identification numbers of the same length can be generated to download certificates, reducing the impact of component identification numbers of different lengths in the certificate download process, facilitating communication and data sharing across systems and organizations, and achieving the uniformity of certificate download solutions. The UIN also includes a verification code, which increases the difficulty of forgery, ensures the uniqueness and authenticity of the UIN, and thus ensures the security and reliability of the certificate downloaded based on the UIN.

[0093] In one possible implementation, after generating a component security identification number that uniquely identifies the target device, the method further includes: based on a trusted execution environment, writing the component security identification number into a non-volatile storage area of ​​the target device for storage, and when using the component security identification number, reading the component security identification number from the non-volatile storage area through the trusted execution environment; wherein the non-volatile storage area can only be written once.

[0094] Among them, the trusted execution environment TEE is a secure environment running on the target device HUT. It can provide isolation and protection so that sensitive data and applications can be executed securely without being accessed or tampered with by the outside.

[0095] The non-volatile storage area is specifically the efuse partition. The characteristic of the efuse partition is that it can only be written once, and once the data is written, it cannot be changed, which improves the security of the stored data. The efuse partition is usually integrated in the SOC chip of the HUT.

[0096] As in the above embodiment, after the VIN, SN, and UIN are passed to the Android system, the Android system saves the written VIN and SN in a fixed disk partition. A diagnostic application can also be deployed in the Android system. After the Android system receives the UIN, it passes the UIN to the diagnostic application. The diagnostic application receives the UIN, connects to the security library such as PKISDK, prepares for the write operation, and writes the UIN to the efuse partition in the SOC through the TEE. When using the UIN, the UIN is read from the efuse partition in the SOC through the TEE.

[0097] Figure 6 It is a flowchart of downloading a certificate provided in an embodiment of the present application.

[0098] For example, Figure 6As shown, the Android system 1022 includes: an Android application (APPlication, APP) layer and a hardware abstraction layer (Hardware Abstract Layer, HAL).

[0099] Among them, the Android APP layer is designed with upper-level applications, such as Figure 6 Shown: manual download application PKIMaintain and automatic certificate download service application PKIFactory.

[0100] HAL is designed with diagnostic applications, three dynamic runtime libraries: PKISDK.so, CAPKI.so, and TEE.so, and a trusted execution environment service TEEService.

[0101] PKISDK.so integrates the PKISDK used in conjunction with the cloud and the Software Development Kit (SDK) called by upper-level applications (PKIMaintain, PKIFactory, etc.), and provides a series of standard interfaces unified with the cloud for certificate download, which are used to read Certificate Signing Request (CSR) files, read certificates, write certificates, etc.

[0102] CAPKI.so is the SDK called by PKISDK.so and is part of the Hardware Interface Definition Language (HIDL), mainly used to communicate with HIDL services.

[0103] TEEService is a service of HAL, which mainly provides communication interfaces related to TEE, which are implemented by TEE.so. TEEService is a server for upper-layer applications, which receives requests from applications and forwards them to TEE. For trusted applications (TA) in TEE, TEEService is a client, which communicates with TA in TEE, sends requests and receives responses. TEEService starts automatically after HUT is powered on and keeps running.

[0104] The TEE 1025 runs the application TEEapp, which is responsible for generating key pairs and providing specific implementations of upper-level interfaces such as reading public keys, writing certificates, and signature verification during subsequent two-way authentication communications, as well as the Replay Protected Memory Block (RPMB) certificate management function.

[0105] The SOC 1026 includes an efuse partition for storing the UIN.

[0106] like Figure 6 As shown, the EOL diagnostic device 101 writes UIN, SN, and VIN into the MCU 1021 of the HUT 102, and the MCU 1021 passes the UIN, SN, and VIN to the SOC 1026. The SOC 1026 passes the UIN, SN, and VIN to the QNX system 1023. The QNX system 1023 passes the UIN, SN, and VIN to the Android system 1022. The Android system 1022 passes the UIN, SN, and VIN to the diagnostic application in the HAL. After the diagnostic application obtains the UIN, SN, and VIN, it passes the UIN to PKISDK.so, which is then passed by PKISDK.so to CAPKI.so, which is then passed by CAPKI.so to TEEService, which is then passed by TEEService to TEE.so, which is then passed by TEE.so to TEEapp running in TEE 1025, and TEEapp writes the UIN into the efuse partition in the SOC 1026. When the UIN is needed, the stored UIN can be read from the efuse partition in the SOC 1026 through the TEEapp in the TEE 1025, and the reading order is opposite to the writing order.

[0107] In the above method, the generated component security identification number that uniquely identifies the target device is stored in a non-volatile storage area that can only be written once. Since it can only be written once, once the data is written, it cannot be changed, which improves the security of the stored data and ensures that the component security identification number will not be tampered with. And based on the trusted execution environment, the component security identification number is stored in the non-volatile storage area, and then the component security identification number is read based on the trusted execution environment, which ensures that the process of writing and reading the component security identification number can be safely executed without external access or tampering, thereby ensuring the security of the component security identification number.

[0108] In step 202, the trusted execution environment TEE is the above-mentioned secure environment running on the target device HUT. The public-private key pair specifically includes a public key and a private key, which are used for subsequent identity authentication.

[0109] Specifically, the encryption library provided by TEE can be used to generate public and private key pairs to ensure that the key generation process will not be interfered with by the external environment.

[0110] In a possible implementation, in a trusted execution environment, generating a public-private key pair for a target device includes: detecting whether a valid certificate already exists in the target device based on an automatic certificate issuance service application; when it is determined that no valid certificate exists in the target device, controlling the automatic certificate issuance service application to send a target instruction to a program in the trusted execution environment through a hardware abstraction layer, so that the program in the trusted execution environment generates a public-private key pair for the target device when receiving the target instruction; wherein the hardware abstraction layer includes a trusted execution environment service, and the trusted execution environment service is used to provide the automatic certificate issuance service application with an interface for interacting with the program in the trusted execution environment.

[0111] Among them, the specific application of automatic certificate issuance service can be Figure 6 The PKIFactory shown can be used to design an automatic certificate download service application PKIFactory in advance in the Android APP layer of the target device Android system 1022 to automatically detect whether there is a valid certificate in the target device. Figure 6 The HAL shown is part of the Android system 1022 and can provide a standard interface for upper-layer software (such as PKIFactory), such as an interface implemented based on PKISDK.so, for upper-layer applications to call SDK. The trusted execution environment service, i.e., TEEService in the HAL, is used to provide a communication interface for interacting with TEE 1025, such as an interface implemented based on TEE.so. The program in the trusted execution environment is Figure 6 The TEEapp in the TEE 1025 shown is used to generate a public-private key pair.

[0112] It is understandable that before downloading the certificate to the target device of the vehicle, it is necessary to first determine that no valid certificate exists in the target device. Only when it is determined that no valid certificate exists in the target device, it is necessary to download the certificate to the target device.

[0113] The Android APP layer of the Android system of the HUT can be designed with the above-mentioned automatic certificate service application PKIFactory. When running, PKIFactory can automatically detect whether there is a valid certificate in the HUT. When it is determined that there is no valid certificate in the HUT, it automatically generates a control instruction and transmits the control instruction to the program TEEapp in the trusted execution environment through the hardware abstraction layer HAL link. When TEEapp receives the control instruction, it generates a public-private key pair for the target device.

[0114] like Figure 6 As shown, the HAL of the Android system 1022 includes three dynamic runtime libraries, PKISDK.so, CAPKI.so, and TEE.so, and a trusted execution environment service TEEService. After PKIFactory generates a control instruction, it passes the control instruction to PKISDK.so of the HAL, and PKISDK.so passes the control instruction to TEEService through CAPKI.so. TEEService passes the control instruction to TEE.so, and TEE.so passes the control instruction to TEEapp in TEE 1025. After TEEapp obtains the control instruction, it generates a public and private key pair for the target device.

[0115] In some embodiments, the vehicle starts the HUT at the certification station under the production line and connects to the factory wireless LAN (Wireless Fidelity, WiFi) based on the HUT. After the HUT is connected to the network, PKIFactory starts and runs automatically, and relies on the PKISDK.so related interface to realize the automatic detection of the HUT certificate and the automatic application for installation and activation when there is no certificate.

[0116] It is understandable that after the vehicle HUT writes SN and UIN in the production line diagnosis and writes VIN in the vehicle production line, it will usually connect to the factory's WIFI network at the certificate downloading station to start downloading the certificate. When the HUT is connected to the factory's WIFI network, it can be determined that the HUT is ready to start downloading the certificate, and at this time, it can be determined whether there is a valid certificate in the HUT.

[0117] In some embodiments, the Android APP layer of the Android system of the HUT is also designed with PKIMaintain, which is a manual certificate application in the public key infrastructure (PKI) engineering mode. It can provide manual certificate service to testers when the automatic certificate service application fails to download the certificate, ensuring the redundancy of the certificate download function. PKIMaintain can also provide a certificate download entry for testers to download certificates during the development phase and for market vehicles to re-download certificates after replacing the HUT.

[0118] PKIMaintain also relies on PKISDK.so related interfaces. The certificate download process is similar to PKIFactory and will not be described here. The functions implemented by PKIMaintain include: PKI reset initialization to generate certificate application files, certificate download, installation and activation, PKI version information query, vehicle parameter detection, vehicle certificate detection, vehicle attribute file query, PKI log file export, etc.

[0119] In the above method, before issuing the certificate, it is detected whether a valid certificate already exists in the target device, thereby avoiding repeated downloading of the certificate. The automatic certificate download service application is designed to realize automatic detection of whether a valid certificate already exists in the target device and automatic certificate download, which reduces the manual operation of the tester and greatly saves manpower. In addition, the generation of the public and private key pairs in a secure environment effectively avoids the problem of public and private key pair leakage and improves the security of certificate download.

[0120] In step 203, the vehicle identification number VIN is used to uniquely identify a vehicle. A certificate refers to a digital certificate issued by an authority, which usually contains information such as a public key, VIN, SN, and UIN, and is used to verify the identity of the target device. The authority can usually be called a certificate authority, and a certificate can be requested and downloaded from the certificate authority based on information such as VIN, SN, UIN, and public key.

[0121] In one possible implementation, based on the vehicle identification number, component identification number, component safety identification number and public key of the vehicle, a certificate of a target device is downloaded, including: generating a certificate signing request based on the vehicle identification number, component identification number, component safety identification number and public key; wherein the certificate signing request includes information required to generate a certificate for the target device; and downloading the certificate of the target device based on the certificate signing request and the public key.

[0122] Among them, the certificate signing request, that is, the above-mentioned CSR file, is used to request a digital certificate. The certificate signing request may include the vehicle identification number, component identification number, component safety identification number, public key and other relevant information required to generate the target device certificate.

[0123] Specifically, after TEEapp generates a public-private key pair, it can provide the public key, VIN, SN, and UIN in the public-private key pair to PKISDK.so, which will generate a CSR. Then PKISDK.so downloads the certificate based on the generated CSR and public key.

[0124] For example, Figure 6 As shown, after TEEapp generates a public-private key pair, it reads the UIN stored in the efuse partition in SOC 1026, passes the UIN and the public key in the public-private key pair to TEE.so, TEE.so passes the UIN and public key to TEEService, and TEEService passes the UIN and public key to PKISDK.so through CAPKI.so. PKISDK.so includes the VIN and SN passed by the diagnostic application. PKISDK.so generates a CSR based on the VIN, SN, UIN and public key, and downloads the certificate based on the generated CSR and public key.

[0125] In one possible implementation, the certificate of the target device is downloaded based on the certificate signing request and the public key, including: verifying whether the vehicle has downloaded the certificate for the target device based on the vehicle identification number, the component identification number and the component safety identification number; if it is determined that the vehicle has not downloaded the certificate for the target device, instructing the certificate authority to generate a certificate for the target device based on the certificate signing request and the public key; and downloading the certificate of the target device from the certificate authority.

[0126] Before downloading the certificate of the target device, it is also necessary to verify whether the vehicle has downloaded the certificate to the target device. If the vehicle has not downloaded the certificate to the target device, download the certificate to the target device to avoid repeated downloading of the certificate.

[0127] Specifically, based on the VIN, SN and UIN of the above-mentioned HUT, it can be verified whether the vehicle has downloaded the certificate for the HUT. The Android system may include a database for storing and managing the certificate information of the vehicle and its related components (including: HUT, ECU, T-BOX, etc.). After the Android side receives the written VIN, SN and UIN, it can query the database through the VIN, SN and UIN whether there is a valid certificate record associated with the VIN, SN and UIN. If there is a valid record, it is determined that the certificate has been issued for the HUT of the vehicle, so there is no need to download the certificate repeatedly. If there is no valid record, it is determined that the certificate has not been downloaded for the HUT of the vehicle, and the download of the certificate for the HUT of the vehicle can continue at this time.

[0128] The Certificate Authority Management System (CAMS) is an authority for downloading certificates. In some embodiments, CAMS can also be referred to as a cloud-based certificate download center. When it is determined that the certificate for the HUT of the vehicle has not been downloaded, PKISDK.so provides the CSR and public key to CAMS. After receiving the above data, CAMS generates a certificate based on the CSR and public key to obtain the certificate of the HUT. Afterwards, PKISDK.so downloads the generated certificate from CAMS, or, after CAMS generates the certificate, it transmits the certificate to PKISDK.so, and the HUT completes the download of the certificate.

[0129] In some embodiments, it is possible to verify whether the vehicle has downloaded a certificate to the HUT based on the TSP. The following embodiment illustrates this situation:

[0130] In one possible implementation, based on the vehicle identification number, the component identification number and the component safety identification number, verifying whether the vehicle has downloaded a certificate to the target device includes: sending the vehicle identification number, the component identification number and the component safety identification number to a remote service provider so that the remote service provider checks the binding relationship between the vehicle identification number, the component identification number and the component safety identification number; and determining that the target device has not downloaded the certificate when the remote service provider determines that there is no binding relationship between the vehicle identification number, the component identification number and the component safety identification number.

[0131] Among them, HUT can establish a connection with TSP, HUT uploads the written VIN, SN and UIN to TSP, and TSP verifies whether the vehicle has downloaded the certificate to the target device based on VIN, SN and UIN.

[0132] In some embodiments, Figure 6 As shown, CAMS 103 and TSP 104 establish a connection. After PKISDK.so generates CSR, PKISDK.so provides VIN, SN, UIN, CSR and public key to CAMS 103. After receiving the above data, CAMS 103 first uploads VIN, SN and UIN to TSP 104, and TSP 104 verifies whether the vehicle has downloaded the certificate for the target device based on VIN, SN and UIN.

[0133] TSP 104 can verify whether the vehicle has downloaded a certificate for the target device HUT 102 by determining whether there is a binding relationship between VIN, SN and UIN. Specifically, when TSP 104 determines that there is no binding relationship between VIN, SN and UIN, it determines that the vehicle has not downloaded a certificate for HUT 102. At this time, TSP 104 feeds back to CAMS 103 that there is no binding relationship, and CAMS 103 starts to generate a certificate for HUT 102 based on CSR and public key.

[0134] It is understandable that when there is no binding relationship between VIN, SN and UIN, it usually indicates that the target device is installed on the vehicle for the first time and no binding has been established between VIN, SN and UIN, including two situations: replacement of parts and newly produced vehicles. In this case, the target device has not been bound to the VIN, SN and UIN of the vehicle, so no certificate has been issued for the device. When there is a binding relationship between VIN, SN and UIN, it usually indicates that the target device is not installed on the vehicle for the first time and the target device may have downloaded a certificate.

[0135] In some embodiments, after the TSP determines that there is a binding relationship between the VIN, SN and UIN, it can also search in the cloud database maintained by the TSP for recording vehicle-related data to see whether there are certificate records bound to the identifiers such as VIN, SN and UIN. When the bound certificate records are found, it is determined that the target device has downloaded the certificate, and the download of the certificate is stopped at this time.

[0136] In the above method, the remote service provider, as a trusted third-party organization, can provide authoritative verification services to ensure the reliability and accuracy of the verification results. The remote service provider can automatically verify the binding relationship between VIN, SN and UIN, and efficiently and accurately determine whether the target device of the vehicle has downloaded the certificate. Before downloading the certificate, verify whether the target device of the vehicle has downloaded the certificate, which can avoid the security risks caused by the repeated issuance of certificates.

[0137] In step 204, the replay protection memory partition may be denoted as RPMB, which is a non-volatile storage area for storing sensitive data to prevent replay attacks. After obtaining the certificate, the certificate and private key may be written into the RPMB partition using a specific interface to ensure that they can only be accessed by authorized applications.

[0138] In some embodiments, after generating a public-private key pair, TEEapp stores the private key in RMBB, keeping the private key secret and not sharing it with the certificate authority or other third parties. The private key is used to sign messages sent to other entities to prove the source of the message. After receiving the certificate transmitted by CAMS, PKISDK.so passes the certificate to TEEapp, which then stores the certificate in RMBB.

[0139] like Figure 6 As shown, HUT 102 also includes a replay protection memory partition RPMB 1027. As in the above-mentioned embodiment, TEEapp in TEE 1025 generates a public-private key pair. After generating the public-private key pair, TEEapp stores the private key in RPMB 1027, that is, Figure 6 After receiving the certificate issued by CAMS 103, PKISDK.so passes the certificate to TEEapp in TEE1025 through the HAL link, and TEEapp stores the certificate in RPMB 1027, that is, Figure 6 KPI certificate in.

[0140] Storing certificates (including public keys) and private keys in a replay-protected memory partition (RPMB) protects certificates and private keys from unauthorized access. When encrypted communication or digital signature is required, the private key is taken from the RPMB for encryption or signing operations.

[0141] Furthermore, the target device can use the private key to sign the data sent to prove its identity, or use the certificate to prove its identity when connecting to the target device with a third party. The target device can use the public key in the certificate to verify the data received from the third party to verify the identity of the third party, or verify the identity of the third party through the third party's certificate, thereby achieving two-way authentication communication. The third party can be other devices other than the target device, or the cloud.

[0142] In some embodiments, when there are multiple intermediate certificate authorities, there may also be a certificate authority (CA) root certificate chain, and the CA root certificate chain can also be passed to TEEapp, which stores the CA root certificate chain in RPMB 1027.

[0143] The CA root certificate chain refers to a series of certificates involved in the digital certificate verification process, starting from the target device's certificate, through the intermediate certificates of multiple intermediate agencies, all the way back to the root certificate of the top certificate authority. This chain ensures that all certificates from the target device to the root certificate are valid, and each certificate is trusted by the previous certificate.

[0144] In some embodiments, Figure 6 As shown, the HUT 102 further includes a universal flash storage partition (Universal Flash Storage, UFS) 1028 for storing data such as an operating system, application programs, and multimedia contents of the HUT 102 .

[0145] In summary, the present application provides a standardized method to generate a component security identification number that uniquely identifies the target device in a unified format based on the supplier code, the supplier production plant code and the component identification number. The uniformity of the certificate download scheme is achieved based on the component security identification number, and the impact of component identification numbers of different lengths in the certificate download process is reduced. Before downloading the certificate, a double check is performed on whether the certificate has been downloaded in the target device based on the automatic certificate download service application and the remote service provider, which ensures the security and validity of the downloaded certificate and avoids the security impact caused by repeated downloading of the certificate. The generated component security identification number that uniquely identifies the target device is stored in a non-volatile storage area that can only be written once, which ensures that the component security identification number will not be tampered with, and improves the security of the downloaded certificate. Storing the certificate and private key in the replay protection memory partition can ensure that the certificate and private key of the target device are not illegally read or modified, and ensure that when the target device of the vehicle is connected to the network, the third party to be connected to the network can verify the target device based on the certificate of the target device, realize two-way authentication communication, improve network security, and avoid the target device from being illegally used, causing network security attacks.

[0146] Figure 7 It is a structural diagram of a device for downloading a certificate provided in an embodiment of the present application.

[0147] For example, Figure 7 As shown, the device 700 includes:

[0148] The first generating module 701 is used to generate a component safety identification number that uniquely identifies the target device based on the component identification number, supplier code, and supplier production plant code of the target device in the vehicle;

[0149] The second generating module 702 is used to generate a public-private key pair of a target device in a trusted execution environment; wherein the public-private key pair includes a public key and a private key;

[0150] A download module 703, for downloading a certificate of a target device based on a vehicle identification number, a component identification number, a component security identification number and a public key of the vehicle;

[0151] The deployment module 704 is used to deploy the certificate and the private key in the replay protection memory partition of the target device, so that the target device can perform two-way authentication communication with a third party based on the certificate and the private key.

[0152] In one possible implementation, the download module 703 is specifically used to generate a certificate signing request based on the vehicle identification number, component identification number, component safety identification number and public key; wherein the certificate signing request includes information required to generate a certificate for the target device; and based on the certificate signing request and the public key, download the certificate of the target device.

[0153] In one possible implementation, the download module 703 is specifically used to verify whether the vehicle has downloaded a certificate for the target device based on the vehicle identification number, the component identification number, and the component safety identification number; if it is determined that the vehicle has not downloaded a certificate for the target device, instruct the certificate authority to generate a certificate for the target device based on the certificate signing request and the public key; and download the certificate of the target device from the certificate authority.

[0154] In one possible implementation, the download module 703 is specifically used to send the vehicle identification number, the component identification number and the component safety identification number to the remote service provider so that the remote service provider can check the binding relationship between the vehicle identification number, the component identification number and the component safety identification number; when the remote service provider determines that there is no binding relationship between the vehicle identification number, the component identification number and the component safety identification number, it is determined that the target device has not downloaded the certificate.

[0155] In one possible implementation, the second generation module 702 is specifically used to detect whether a valid certificate already exists in the target device based on the automatic certificate issuance service application; when it is determined that there is no valid certificate in the target device, control the automatic certificate issuance service application to send a target instruction to the program in the trusted execution environment through the hardware abstraction layer, so that the program in the trusted execution environment generates a public and private key pair for the target device when receiving the target instruction; wherein the hardware abstraction layer includes a trusted execution environment service, and the trusted execution environment service is used to provide the automatic certificate issuance service application with an interface for interacting with the program in the trusted execution environment.

[0156] In one possible implementation, the first generation module 701 is specifically used to select characters of a first preset byte from the supplier code; select characters of a second preset byte from the supplier production plant code; select characters of a third preset byte from the component identification number; generate a check code based on the characters of the first preset byte, the characters of the second preset byte, and the characters of the third preset byte; and combine the characters of the first preset byte, the characters of the second preset byte, the characters of the third preset byte and the check code to obtain the component safety identification number.

[0157] In one possible implementation, the device also includes a writing module for writing the component security identification number into a non-volatile storage area of ​​the target device for storage based on a trusted execution environment, and when the component security identification number is used, reading the component security identification number from the non-volatile storage area through the trusted execution environment; wherein the non-volatile storage area can only be written once.

[0158] Figure 8 It is a structural schematic diagram of a vehicle provided in an embodiment of the present application.

[0159] For example, Figure 8 As shown, the vehicle 800 includes: a memory 801 and a processor 802, wherein the memory 801 stores an executable program code 8011, and the processor 802 is used to call and execute the executable program code 8011 to perform a method for downloading a certificate.

[0160] In addition, an embodiment of the present application also protects a device, which may include a memory and a processor, wherein the memory stores an executable program code, and the processor is used to call and execute the executable program code to perform a method for downloading a certificate provided in an embodiment of the present application.

[0161] In this embodiment, the functional modules of the device can be divided according to the above method example. For example, each functional module can be corresponded, or two or more functions can be integrated into one processing module. The above integrated module can be implemented in the form of hardware. It should be noted that the division of modules in this embodiment is schematic and is only a logical function division. There may be other division methods in actual implementation.

[0162] In the case of dividing each functional module according to each function, the device may also include a first generation module, a second generation module, a download module, and a deployment module. It should be noted that all relevant contents of each step involved in the above method embodiment can be referred to the functional description of the corresponding functional module, which will not be repeated here.

[0163] It should be understood that the device provided in this embodiment is used to execute the above-mentioned method for downloading a certificate, and thus can achieve the same effect as the above-mentioned implementation method.

[0164] In the case of an integrated unit, the device may include a processing module and a storage module. When the device is applied to a vehicle, the processing module may be used to control and manage the actions of the vehicle. The storage module may be used to support the vehicle in executing relevant program codes, etc.

[0165] The processing module may be a processor or a controller, which may implement or execute various exemplary logic blocks, modules and circuits shown in conjunction with the disclosure of the present application. The processor may also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of digital signal processing (DSP) and a microprocessor, etc. The storage module may be a memory.

[0166] In addition, the device provided in the embodiments of the present application may specifically be a chip, a component or a module, and the chip may include a connected processor and a memory; wherein the memory is used to store instructions, and when the processor calls and executes the instructions, the chip can execute a method for downloading a certificate provided in the above embodiment.

[0167] This embodiment also provides a computer-readable storage medium, in which a computer program code is stored. When the computer program code is executed on a computer, the computer executes the above-mentioned related method steps to implement a method for downloading a certificate provided in the above embodiment.

[0168] This embodiment further provides a computer program product. When the computer program product is run on a computer, the computer is caused to execute the above-mentioned related steps to implement a method for downloading a certificate provided in the above embodiment.

[0169] Among them, the device, computer-readable storage medium, computer program product or chip provided in this embodiment is used to execute the corresponding method provided above. Therefore, the beneficial effects that can be achieved can refer to the beneficial effects in the corresponding method provided above, and will not be repeated here.

[0170] Through the description of the above implementation methods, technical personnel in the relevant field can understand that for the convenience and simplicity of description, only the division of the above-mentioned functional modules is used as an example. In actual applications, the above-mentioned functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above.

[0171] In the embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic, for example, the division of modules or units is only a logical function division, and there may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another device, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0172] The above contents are only specific implementation methods of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A method for downloading a certificate, characterized in that: The method comprises: Based on the component identification number, supplier code, and supplier production plant code of the target device in the vehicle, generate a component safety identification number that uniquely identifies the target device; In a trusted execution environment, generating a public-private key pair of the target device; wherein the public-private key pair includes a public key and a private key; downloading a certificate of the target device based on the vehicle identification number of the vehicle, the component identification number, the component security identification number, and the public key; The certificate and the private key are deployed in the replay protection memory partition of the target device, so that the target device can perform two-way authentication communication with a third party based on the certificate and the private key.

2. The method according to claim 1, characterized in that The downloading of the certificate of the target device based on the vehicle identification number of the vehicle, the component identification number, the component security identification number and the public key includes: Generate a certificate signing request based on the vehicle identification number, the component identification number, the component security identification number and the public key; wherein the certificate signing request contains information required for generating a certificate for the target device; Based on the certificate signing request and the public key, a certificate of the target device is downloaded.

3. The method according to claim 2, characterized in that The downloading of the certificate of the target device based on the certificate signing request and the public key includes: Based on the vehicle identification number, the component identification number and the component safety identification number, verifying whether the vehicle has downloaded a certificate for the target device; In the case where it is determined that the vehicle has not downloaded a certificate for the target device, instructing a certificate issuing authority to generate a certificate for the target device according to the certificate signing request and the public key; A certificate for the target device is downloaded from the certificate authority.

4. The method according to claim 3, characterized in that The verifying whether the vehicle has downloaded a certificate for the target device based on the vehicle identification number, the component identification number and the component safety identification number includes: sending the vehicle identification number, the component identification number and the component safety identification number to a remote service provider so that the remote service provider can check the binding relationship between the vehicle identification number, the component identification number and the component safety identification number; When the remote service provider determines that there is no binding relationship between the vehicle identification number, the component identification number and the component safety identification number, it is determined that the target device has not downloaded a certificate.

5. The method according to any one of claims 1 to 4, characterized in that: Generating a public-private key pair of the target device in a trusted execution environment includes: Detecting whether a valid certificate already exists in the target device based on the automatic certificate issuance service application; When it is determined that no valid certificate exists in the target device, the automatic certificate issuance service application is controlled to send a target instruction to the program in the trusted execution environment through the hardware abstraction layer, so that the program in the trusted execution environment generates a public-private key pair for the target device when receiving the target instruction; wherein the hardware abstraction layer includes a trusted execution environment service, and the trusted execution environment service is used to provide the automatic certificate issuance service application with an interface for interacting with the program in the trusted execution environment.

6. The method according to any one of claims 1 to 4, characterized in that The generating of a component safety identification number that uniquely identifies the target device based on the component identification number, supplier code, and supplier production plant code of the target device in the vehicle includes: Selecting a character of a first predetermined byte from the vendor code; Selecting characters of a second preset byte from the supplier production plant code; selecting a third predetermined number of characters from the component identification number; Generate a check code based on the characters of the first preset byte, the characters of the second preset byte, and the characters of the third preset byte; The character of the first preset byte, the character of the second preset byte, the character of the third preset byte and the check code are combined to obtain the component safety identification number.

7. The method according to any one of claims 1 to 4, characterized in that After generating a component safety identification number that uniquely identifies the target device, the method further includes: Based on a trusted execution environment, the component security identification number is written into a non-volatile storage area of ​​the target device for storage, and when the component security identification number is used, the component security identification number is read from the non-volatile storage area through the trusted execution environment; wherein the non-volatile storage area can only be written once.

8. A device for downloading a certificate, characterized in that: The device comprises: A first generating module, for generating a component safety identification number that uniquely identifies the target device based on the component identification number, supplier code, and supplier production plant code of the target device in the vehicle; A second generating module is used to generate a public-private key pair of the target device in a trusted execution environment; wherein the public-private key pair includes a public key and a private key; A download module, configured to download a certificate of the target device based on the vehicle identification number of the vehicle, the component identification number, the component security identification number and the public key; A deployment module is used to deploy the certificate and the private key in the replay protection memory partition of the target device, so that the target device can perform two-way authentication communication with a third party based on the certificate and the private key.

9. A vehicle, characterized in that: The vehicle comprises: A memory for storing executable program codes; A processor, configured to call and run the executable program code from the memory, so that the vehicle executes the method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed, the method according to any one of claims 1 to 7 is implemented.

Images