Identity authentication method and device, Internet of Vehicles communication terminal and automobile

Abstract

The invention discloses an identity authentication method and device, an Internet of Vehicles communication terminal and an automobile, and relates to the technical field of automobiles, the method is applied to the Internet of Vehicles communication terminal, and the method comprises the following steps: detecting whether an effective pre-shared key is stored at present, the pre-shared key is a master key negotiated by the Internet of Vehicles communication terminal and the vehicle-mounted gateway in a historical identity authentication process; and if the valid pre-shared key is stored, performing identity authentication with the vehicle-mounted gateway by adopting a security transport protocol TLS based on the pre-shared key. Therefore, the stored effective pre-shared key and the vehicle-mounted gateway are used for identity authentication, the time consumed in the identity authentication process is shortened, the time delay of communication is reduced, and the influence on the network connection service of the intelligent network connection automobile is avoided.

Description

Technical Field

[0001] The present application relates to the field of automobile technology, and in particular to an identity authentication method, device, Internet of Vehicles communication terminal and automobile. Background Art

[0002] With the continuous advancement of the "new four modernizations" of intelligent connected vehicles, more and more vehicles are using central gateway (GW) type electronic and electrical architecture. As the "gateway" for communication connections inside and outside the vehicle, GW plays a vital role in the security of in-vehicle communications, and the Internet of Vehicles communication terminal (Telematics BOX, TBOX) is the remote communication module of intelligent connected vehicles. When TBOX and GW communicate, the existing technology does not perform identity authentication between TBOX and GW. If identity authentication is not required when TBOX and GW communicate, there will be a risk of illegal TBOX maliciously reading and writing data to the vehicle.

[0003] However, if the two-way authentication scheme based on digital certificate-based secure transmission protocol (Transport Layer Security, TLS) is directly used on the Ethernet link, although the requirements for GW access authentication are met, the digital certificates of both parties need to be verified during each TLS handshake. If the system performance of TBOX or GW is poor, it is likely to greatly increase the communication latency and affect the connected services of intelligent connected vehicles. Summary of the invention

[0004] The purpose of this application is to provide an identity authentication method, device, Internet of Vehicles communication terminal and automobile, so as to solve the problem that the direct use of a two-way authentication scheme on an Ethernet link by an intelligent connected car will increase the communication delay.

[0005] In a first aspect, in order to achieve the above-mentioned purpose, an embodiment of the present application provides an identity authentication method, which is applied to a vehicle networking communication terminal, comprising:

[0006] Detecting whether a valid pre-shared key is currently stored, wherein the pre-shared key is a master key negotiated between the Internet of Vehicles communication terminal and the vehicle gateway during a historical identity authentication process;

[0007] If the valid pre-shared key has been stored, the identity authentication is performed with the vehicle gateway using a secure transmission protocol TLS based on the pre-shared key.

[0008] Optionally, the detecting whether a valid pre-shared key is currently stored includes:

[0009] Check whether a pre-shared key is currently stored;

[0010] If a pre-shared key is currently stored and the storage duration of the pre-shared key does not reach a preset duration, determining that the pre-shared key currently stored is a valid pre-shared key;

[0011] If a pre-shared key is currently stored and the storage time of the pre-shared key has reached a preset time, it is determined that the pre-shared key currently stored is an invalid pre-shared key.

[0012] Optionally, the method further comprises:

[0013] If a valid pre-shared key is not stored, TLS based on a digital certificate is used to perform identity authentication with the vehicle gateway.

[0014] Optionally, the method further comprises:

[0015] Obtaining a master key generated during identity authentication between the TLS based on a digital certificate and the vehicle gateway;

[0016] If no pre-shared key is currently stored, storing the master key as the pre-shared key;

[0017] In the case that the currently stored pre-shared key is an invalid pre-shared key, the invalid pre-shared key is updated to the master key.

[0018] Optionally, the method further comprises:

[0019] After the identity authentication is successful, a heartbeat message is periodically sent to the vehicle gateway.

[0020] In a second aspect, in order to achieve the above-mentioned purpose, an embodiment of the present application further provides an identity authentication device, which is applied to a vehicle networking communication terminal, comprising:

[0021] A detection module, used to detect whether a valid pre-shared key is currently stored, wherein the pre-shared key is a master key negotiated between the Internet of Vehicles communication terminal and the vehicle gateway in a historical identity authentication process;

[0022] The first authentication module is used to perform identity authentication with the vehicle-mounted gateway using a secure transmission protocol TLS based on the pre-shared key if the valid pre-shared key has been stored.

[0023] In the third aspect, in order to achieve the above-mentioned purpose, an embodiment of the present application also provides a vehicle network communication terminal, including: a processor, a memory, and a program stored in the memory and executable on the processor, and when the program is executed by the processor, the steps of the identity authentication method described in the first aspect are implemented.

[0024] In a fourth aspect, in order to achieve the above-mentioned purpose, an embodiment of the present application further provides a car, comprising an on-board gateway and the Internet of Vehicles communication terminal as described in the third aspect.

[0025] In a fifth aspect, in order to achieve the above-mentioned purpose, an embodiment of the present application further provides a readable storage medium, on which a program is stored, and when the program is executed by a processor, the identity authentication method as described in the first aspect is implemented.

[0026] In a sixth aspect, in order to achieve the above-mentioned purpose, an embodiment of the present application further provides a computer program product, comprising computer instructions, which, when executed by a processor, implement the identity authentication method as described in the first aspect.

[0027] The above technical solution of the present application has at least the following beneficial effects:

[0028] In the identity authentication method of the embodiment of the present application, first, the Internet of Vehicles communication terminal detects whether a valid pre-shared key is currently stored, wherein the pre-shared key is the master key negotiated between the Internet of Vehicles communication terminal and the vehicle gateway in the historical identity authentication process; secondly, if the valid pre-shared key is stored, the secure transmission protocol TLS based on the pre-shared key is used to authenticate the vehicle gateway. In this way, the stored valid pre-shared key is used to authenticate the vehicle gateway, which shortens the time spent on the identity authentication process, reduces the latency of communication, and avoids the impact on the network services of the intelligent networked car. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] Figure 1 This is one of the flowcharts of the identity authentication method of an embodiment of the present application;

[0030] Figure 2 This is a second flow chart of the identity authentication method according to an embodiment of the present application;

[0031] Figure 3 This is a flowchart of the identity authentication method according to an embodiment of the present application;

[0032] Figure 4 A schematic diagram of the vehicle networking communication terminal sending a heartbeat message to the vehicle gateway in an embodiment of the present application;

[0033] Figure 5 This is a schematic diagram of the structure of an identity authentication device according to an embodiment of the present application;

[0034] Figure 6 This is a schematic diagram of the structure of the Internet of Vehicles communication terminal according to an embodiment of the present application. DETAILED DESCRIPTION

[0035] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0036] The terms "first", "second", etc. in the specification and claims of the present application are used to distinguish similar objects, and are not used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable under appropriate circumstances, so that the embodiments of the present application can be implemented in an order other than those illustrated or described here. In addition, the "and / or" in the specification and claims represents at least one of the connected objects, and the character " / " generally represents that the objects associated with each other are in an "or" relationship.

[0037] The following, in conjunction with the accompanying drawings, describes in detail the identity authentication method, device, Internet of Vehicles communication terminal and automobile provided in the embodiments of the present application through specific embodiments and their application scenarios.

[0038] The embodiment of the present application provides an identity authentication method, which is applied to a vehicle networking communication terminal, such as Figure 1 As shown, the method includes:

[0039] Step 101, detecting whether a valid pre-shared key is currently stored, wherein the pre-shared key is a master key negotiated between the Internet of Vehicles communication terminal and the vehicle gateway in a historical identity authentication process; here, the pre-shared key may be referred to as PSK (Pre-Shared Key);

[0040] Step 102: If the valid pre-shared key has been stored, a secure transmission protocol TLS based on the pre-shared key is used to perform identity authentication with the vehicle gateway.

[0041] In the identity authentication method of the embodiment of the present application, first, the Internet of Vehicles communication terminal detects whether a valid pre-shared key is currently stored, wherein the pre-shared key is the master key negotiated between the Internet of Vehicles communication terminal and the vehicle gateway in the historical identity authentication process; secondly, if the valid pre-shared key has been stored, the secure transmission protocol TLS based on the pre-shared key is used to authenticate the vehicle gateway. In this way, during the identity authentication process, it is not necessary to verify the digital certificate above, but only to use the stored valid pre-shared key to authenticate the vehicle gateway, which shortens the time spent on the identity authentication process, reduces the latency of communication, and avoids the impact on the network services of smart connected vehicles.

[0042] As an optional implementation, step 101 includes:

[0043] Check whether a pre-shared key is currently stored;

[0044] If a pre-shared key is currently stored and the storage duration of the pre-shared key does not reach a preset duration, determining that the pre-shared key currently stored is a valid pre-shared key;

[0045] If a pre-shared key is currently stored and the storage time of the pre-shared key has reached a preset time, it is determined that the pre-shared key currently stored is an invalid pre-shared key.

[0046] That is to say, if it is detected that a pre-shared key is currently stored, it is further determined whether the storage duration of the pre-shared key reaches the preset duration (such as 90 days); if it does not reach the preset duration, it indicates that the currently stored pre-shared key is within the validity period, the pre-shared key is a valid pre-shared key, and identity authentication can be performed based on the pre-shared key; if it does not reach the preset duration, it indicates that the currently stored pre-shared key exceeds the validity period, the pre-shared key is an invalid pre-shared key, and identity authentication cannot be performed based on the pre-shared key.

[0047] In this optional implementation, based on the detection of the existence of a pre-shared key, the storage duration of the pre-shared key is further judged, thereby achieving regular updating of the stored pre-shared key and ensuring the validity of the identity of the Internet of Vehicles communication terminal and the vehicle gateway.

[0048] Furthermore, as an optional implementation, the method further includes:

[0049] If a valid pre-shared key is not stored, TLS based on a digital certificate is used to perform identity authentication with the vehicle gateway.

[0050] That is to say, in the case where no valid pre-shared key is stored in the Internet of Vehicles communication terminal (the pre-shared key is not stored or the stored pre-shared key has expired, etc.), in order to ensure communication security, it is necessary to use TLS based on digital certificates with a relatively long authentication time to communicate with the vehicle gateway.

[0051] Furthermore, as an optional implementation, the method further includes:

[0052] Obtaining a master key generated during identity authentication between the TLS based on a digital certificate and the vehicle gateway;

[0053] If no pre-shared key is currently stored, storing the master key as the pre-shared key;

[0054] In the case that the currently stored pre-shared key is an invalid pre-shared key, the invalid pre-shared key is updated to the master key.

[0055] Here, it should be noted that on the basis of using TLS based on digital certificates to authenticate with the on-board gateway, the above optional implementation method will store the master key generated during the authentication process as a pre-shared key, so that TLS based on pre-shared keys can be used for identity authentication in the future, thereby reducing the delay caused by authentication and improving the vehicle's networking function.

[0056] Here, it should be noted that after storing the master key generated in the TLS authentication process based on the digital certificate, in order to ensure the correctness of the stored master key, the TLS authentication process based on the pre-shared key can be performed based on the master key. After the TLS authentication based on the pre-shared key is passed, the authentication between the Internet of Vehicles communication terminal and the vehicle gateway is confirmed to be successful; of course, when the result of the TLS authentication based on the digital certificate is a successful authentication, it can be confirmed that the authentication of both parties has passed, without the need to perform the TLS authentication process based on the pre-shared key, so as to reduce the communication delay increased by the authentication process.

[0057] Further, as an optional implementation, after the identity authentication is successful, the method further includes:

[0058] After the identity authentication is successful, a heartbeat message is periodically sent to the vehicle gateway.

[0059] like Figure 4 As shown, the IoV communication terminal can send the heartbeat message to the vehicle terminal once per second to maintain the validity of the identities of both parties. When the vehicle gateway fails to receive the heartbeat message sent by the IoV communication terminal for more than 3 seconds, the vehicle gateway determines that the identity of the IoV communication terminal is invalid and closes the routing state.

[0060] In simple terms, the implementation process of the identity authentication method of the embodiment of the present application is as follows: when TBOX and GW establish a communication link, TBOX must first determine whether there is a negotiated PSK with GW. If not, TLS two-way authentication based on digital certificates is used, and both TBOX and GW will store the Master Key negotiated during the handshake as PSK securely; then, TBOX needs to determine whether the current valid PSK storage time exceeds 90 days. If the PSK storage time exceeds 90 days, the PSK needs to be updated, that is, a TLS handshake based on digital certificates is used, and both parties will store the Master Key negotiated during the handshake as the updated PSK securely. Finally, when TBOX confirms that there is a PSK negotiated with GW and the PSK does not need to be updated, the two parties will perform a TLS handshake based on PSK. After the identity authentication is passed, GW activates the routing state and routes the signal sent by TBOX to the relevant network segment in the vehicle.

[0061] In the following, TBOX represents the vehicle communication terminal, GW represents the vehicle gateway, and Figure 2 and Figure 3 The implementation process of the identity authentication method of the embodiment of the present application is described respectively:

[0062] Example 1:

[0063] Step 201, TBOX initiates GW identity authentication;

[0064] Step 202, TBOX determines whether there is a PSK negotiated with GW, if yes, execute step 204, if not, execute step 203;

[0065] Step 203, execute TLS handshake based on digital certificates, and TBOX and GW securely store PSK; then, execute step 206; that is, TBOX uses TLS based on digital certificates to perform two-way identity authentication with GW, and stores the PSK generated during the identity authentication process as a pre-shared key;

[0066] Step 204, TBOX determines whether the PSK needs to be updated, if yes, executes step 203, if no, executes step 205;

[0067] Step 205, perform a PSK-based TLS two-way authentication process, and then perform step 206;

[0068] Step 206: GW turns on the routing state.

[0069] Example 2:

[0070] Step 301, TBOX initiates GW identity authentication;

[0071] Step 302, TBOX determines whether there is a PSK negotiated with GW, if yes, execute step 204, if not, execute step 303;

[0072] Step 303, perform a TLS handshake based on a digital certificate, and TBOX and GW securely store the PSK; then, return to step 302; that is, TBOX uses TLS based on a digital certificate to perform two-way authentication with GW, and stores the PSK generated during the authentication process as a pre-shared key;

[0073] Step 304, TBOX determines whether the PSK needs to be updated, if yes, executes step 303, if no, executes step 305;

[0074] Step 305, perform a PSK-based TLS two-way authentication process, and then perform step 306;

[0075] Step 306: GW turns on the routing state.

[0076] The identity authentication method of the embodiment of the present application adopts TLS based on a combination of digital certificates and PSK to perform identity authentication between the Internet of Vehicles communication terminal and the vehicle gateway. The TLS handshake based on digital certificates is used for the first time, and the master key (Master key) in this handshake process is used as the pre-stored key (PSK). After the first time, TLS two-way authentication based on PSK is adopted. Different from the method that does not require identity authentication, the embodiment of the present application ensures the security of the identities of both parties during the identity authentication process between the Internet of Vehicles communication terminal and the vehicle gateway. Different from the identity authentication of the TLS protocol based on digital certificates, the embodiment of the present application solves the problem of communication delay and resource occupation caused by the need to verify the digital certificate for each communication service between the Internet of Vehicles communication terminal and the vehicle gateway.

[0077] The embodiment of the present application also provides an identity authentication device, which is applied to a vehicle network communication terminal, such as Figure 5 As shown, including:

[0078] A detection module 501 is used to detect whether a valid pre-shared key is currently stored, wherein the pre-shared key is a master key negotiated between the Internet of Vehicles communication terminal and the vehicle gateway in a historical identity authentication process;

[0079] The first authentication module 502 is configured to perform identity authentication with the vehicle-mounted gateway using a secure transmission protocol TLS based on a pre-shared key if the valid pre-shared key has been stored.

[0080] Optionally, the detection module 501 includes:

[0081] A detection submodule, used to detect whether a pre-shared key is currently stored;

[0082] A first determination submodule, configured to determine that the currently stored pre-shared key is a valid pre-shared key if a pre-shared key is currently stored and the storage duration of the pre-shared key does not reach a preset duration;

[0083] The second determining submodule is configured to determine that the currently stored pre-shared key is an invalid pre-shared key if a pre-shared key is currently stored and the storage time of the pre-shared key has reached a preset time.

[0084] Optionally, the device further comprises:

[0085] The second authentication module is used to use TLS based on digital certificates to perform identity authentication with the vehicle-mounted gateway if a valid pre-shared key is not stored.

[0086] Optionally, the device further comprises:

[0087] An acquisition module, used to acquire a master key generated during the identity authentication process between the TLS based on the digital certificate and the vehicle gateway;

[0088] A storage module, configured to store the master key as a pre-shared key when no pre-shared key is currently stored;

[0089] The updating module is configured to update the invalid pre-shared key to the master key when the currently stored pre-shared key is an invalid pre-shared key.

[0090] Optionally, the device further comprises:

[0091] The sending module is used to periodically send heartbeat messages to the vehicle gateway after the identity authentication is successful.

[0092] It should be noted here that the above-mentioned identity authentication device provided in the embodiment of the present application can implement all the method steps implemented in the above-mentioned identity authentication method embodiment, and can achieve the same technical effect. The parts and beneficial effects of this embodiment that are the same as those in the method embodiment will not be described in detail here.

[0093] The embodiment of the present application also provides a vehicle networking communication terminal, such as Figure 6 As shown, it includes a transceiver 610, a processor 600, a memory 620, and a program or instruction stored in the memory 620 and executable on the processor 600; when the processor 600 executes the program or instruction, the above-mentioned identity authentication method is implemented.

[0094] The transceiver 610 is used to receive and send data under the control of the processor 600 .

[0095] Among them, Figure 6In the embodiment, the bus architecture may include any number of interconnected buses and bridges, specifically linking various circuits of one or more processors represented by processor 600 and memory represented by memory 620. The bus architecture may also link various other circuits such as peripherals, voltage regulators, and power management circuits, which are well known in the art and are therefore not further described herein. The bus interface provides an interface. The transceiver 610 may be a plurality of components, i.e., including a transmitter and a receiver, providing a unit for communicating with various other devices on a transmission medium. The processor 600 is responsible for managing the bus architecture and general processing, and the memory 620 may store data used by the processor 600 when performing operations.

[0096] It should be noted here that the above-mentioned Internet of Vehicles communication terminal provided in the embodiment of the present application can implement all the method steps implemented in the above-mentioned identity authentication method embodiment, and can achieve the same technical effect. The parts and beneficial effects that are the same as the method embodiment in this embodiment will not be described in detail here.

[0097] An embodiment of the present application also provides a car, comprising an on-board gateway and the Internet of Vehicles communication terminal as described above.

[0098] The embodiment of the present application also provides a readable storage medium, on which a program is stored, and when the program is executed by a processor, each process of the above-mentioned identity authentication method embodiment is implemented, and the same technical effect can be achieved. To avoid repetition, it is not repeated here. Among them, the readable storage medium, such as a read-only memory (ROM), a random access memory (RAM), a disk or an optical disk, etc.

[0099] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, disk, CD), and includes a number of instructions for enabling the device to execute the methods described in each embodiment of the present application.

[0100] Therefore, an embodiment of the present application also provides a computer program product, including computer instructions, which, when executed by a processor, implement the steps in the identity authentication method as described above and can achieve the same technical effect. To avoid repetition, they will not be repeated here.

[0101] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or terminal device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0102] The above is a preferred embodiment of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles described in the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. An identity authentication method, characterized in that: Applied to Internet of Vehicles communication terminals, including: Detecting whether a valid pre-shared key is currently stored, wherein the pre-shared key is a master key negotiated between the Internet of Vehicles communication terminal and the vehicle gateway during a historical identity authentication process; If the valid pre-shared key has been stored, the identity authentication is performed with the vehicle gateway using a secure transmission protocol TLS based on the pre-shared key.

2. The method according to claim 1, characterized in that The detecting whether a valid pre-shared key is currently stored comprises: Check whether a pre-shared key is currently stored; If a pre-shared key is currently stored and the storage duration of the pre-shared key does not reach a preset duration, determining that the pre-shared key currently stored is a valid pre-shared key; If a pre-shared key is currently stored and the storage time of the pre-shared key has reached a preset time, it is determined that the pre-shared key currently stored is an invalid pre-shared key.

3. The method according to claim 1, characterized in that The method further comprises: If a valid pre-shared key is not stored, TLS based on a digital certificate is used to perform identity authentication with the vehicle gateway.

4. The method according to claim 3, characterized in that The method further comprises: Obtaining a master key generated during identity authentication between the TLS based on a digital certificate and the vehicle gateway; If no pre-shared key is currently stored, storing the master key as the pre-shared key; In the case that the currently stored pre-shared key is an invalid pre-shared key, the invalid pre-shared key is updated to the master key.

5. The method according to claim 1 or 3, characterized in that: The method further comprises: After the identity authentication is successful, a heartbeat message is periodically sent to the vehicle gateway.

6. An identity authentication device, characterized in that: Applied to Internet of Vehicles communication terminals, including: A detection module, used to detect whether a valid pre-shared key is currently stored, wherein the pre-shared key is a master key negotiated between the Internet of Vehicles communication terminal and the vehicle gateway in a historical identity authentication process; The first authentication module is used to perform identity authentication with the vehicle-mounted gateway using a secure transmission protocol TLS based on the pre-shared key if the valid pre-shared key has been stored.

7. A vehicle networking communication terminal, characterized in that: include: A processor, a memory, and a program stored in the memory and executable on the processor, wherein when the program is executed by the processor, the steps of the identity authentication method as described in any one of claims 1 to 5 are implemented.

8. A car, characterized in that: It comprises a vehicle-mounted gateway and the Internet of Vehicles communication terminal as claimed in claim 7.

9. A readable storage medium, characterized in that: The readable storage medium stores a program, and when the program is executed by the processor, the identity authentication method according to any one of claims 1 to 5 is implemented.

10. A computer program product, characterized in that The method comprises computer instructions, which, when executed by a processor, implement the identity authentication method as claimed in any one of claims 1 to 5.

Images