Device access verification method, vehicle, electronic device and computer storage medium

Abstract

The present application provides a device access verification method, a vehicle, an electronic device and a storage medium, which are applied to a vehicle; the method includes: receiving a device authentication request, the authentication request includes a protocol application time and a device certificate of the device, wherein the protocol application time is the time when the device sends an application request to an OCSP server based on the online certificate status protocol OCSP; obtaining an authentication verification time, the authentication verification time is a time determined based on the universal time coordinate; calculating the time difference between the authentication verification time and the protocol application time; detecting whether the time difference is within a preset time difference range; if it is detected that the time difference is within the preset time difference range, performing access verification on the device certificate; if the result of the access verification is that the verification is passed, opening the device's access rights to the vehicle. The present application can authenticate the device when the vehicle or both the vehicle and the device are disconnected from the network, avoiding the problem of after-sales market diagnosis caused by failure to authenticate the device.

Description

Technical Field

[0001] The present application relates to the field of vehicle technology, and in particular to a device access verification method, a vehicle, an electronic device, and a computer storage medium. Background Art

[0002] At present, in order to prevent the leakage of vehicle data, when a device sends an access request to a vehicle, it is necessary to authenticate the identity of the device first. After the authentication is passed, the device is granted the corresponding permission to access the vehicle. For example, the Online Certificate Status Protocol (OCSP) verification function is added to the public key infrastructure certificate authentication to authenticate the identity of the device.

[0003] However, when identity authentication is performed based on the OCSP verification function, there is a problem that when the vehicle is disconnected from the network or there is a network failure in the area where the vehicle is located, and both the vehicle and the device are disconnected from the network, the device cannot be authenticated, which may lead to after-sales market diagnosis. Summary of the invention

[0004] In view of the above, the embodiments of the present application provide a device access verification method, a vehicle, an electronic device and a computer storage medium, which can authenticate the device when the vehicle is disconnected from the network or both the vehicle and the device are disconnected from the network, and grant the device corresponding access rights after the device identity authentication is passed, thereby ensuring the security of vehicle data and avoiding the problem of after-sales market diagnosis caused by the inability to authenticate the device.

[0005] An embodiment of the present application provides an access verification method for a device, which is applied to a vehicle, and the method includes: receiving an authentication request from a device, the authentication request including a protocol application time and a device certificate of the device, wherein the protocol application time is the time when the device sends an application request to an Online Certificate Status Protocol (OCSP) server or the time when the device receives a response from the Online Certificate Status Protocol (OCSP) server; obtaining an authentication verification time when the device sends the authentication request, the authentication verification time being a time determined based on Universal Coordinated Time; calculating a time difference between the authentication verification time and the protocol application time; detecting whether the time difference is within a preset time difference range; if it is detected that the time difference is within the preset time difference range, performing access verification on the device certificate; if the result of the access verification is that the verification is passed, opening the device's access rights to the vehicle.

[0006] Compared with the related art, the embodiments of the present application have at least the following advantages: when the device sends an authentication request to the vehicle, in order to avoid the leakage of vehicle data, the device needs to be authenticated. Based on the online certificate status protocol OCSP, the time when the device sends an application request to the OCSP server or the time when the device receives the response from the OCSP server is used as the protocol application time. Since the protocol application time is a fixed time, it will not be affected by whether the vehicle is connected to the network, so that regardless of whether the vehicle is disconnected from the network, or whether the vehicle and the device are both disconnected from the network, the authentication verification time can be authenticated based on the protocol application time in the future. When the authentication verification time and the protocol application time and the access verification of the device certificate are passed, the device's access rights to the vehicle are opened. By double checking the relevant time in the device's identity authentication and the device certificate, the security of the vehicle data is further guaranteed, and the problem of after-sales market diagnosis caused by the inability to authenticate the device is avoided.

[0007] In some possible implementations, the authentication verification time includes the world standard time; the calculation of the time difference between the authentication verification time and the protocol application time includes: calculating the difference between the world standard time and the protocol application time, and taking the difference between the world standard time and the protocol application time as the first difference; the detection of whether the time difference is within a preset time difference range includes: detecting whether the first difference is within the preset time difference range; if it is detected that the time difference is within the preset time difference range, performing access verification on the device certificate includes: if it is detected that the first difference is within the preset time difference range, performing access verification on the device certificate.

[0008] In some possible implementations, the authentication verification time includes the local time in the vehicle, and the local time in the vehicle is the time determined based on the universal coordinated time and the location of the vehicle; the calculation of the time difference between the authentication verification time and the protocol application time includes: calculating the difference between the local time in the vehicle and the protocol application time, and taking the difference between the local time in the vehicle and the protocol application time as the second difference; detecting whether the time difference is within a preset time difference range includes: detecting whether the second difference is within the preset time difference range; if it is detected that the time difference is within the preset time difference range, performing access verification on the device certificate includes: if it is detected that the second difference is within the preset time difference range, performing access verification on the device certificate.

[0009] In some possible implementations, after detecting whether the second difference is within the preset time difference range, it also includes: if it is detected that the second difference is not within the preset time difference range, detecting whether the local time in the vehicle is earlier than the protocol application time; if it is detected that the local time in the vehicle is earlier than the protocol application time, performing access verification on the device certificate.

[0010] In some possible implementations, the authentication verification time includes the world standard time and the local time in the vehicle, the local time in the vehicle is the time determined based on the world coordinated time and the location of the vehicle, and the time difference includes a first difference and a second difference; the calculation of the time difference between the authentication verification time and the protocol application time includes: calculating the first difference between the world standard time and the protocol application time and calculating the second difference between the local time in the vehicle and the protocol application time; detecting whether the time difference is within a preset time difference range and performing access verification on the device certificate includes: detecting whether the first difference is within the preset time difference range; if it is detected that the first difference is not within the preset time difference range, detecting whether the second difference is within the preset time difference range; if it is detected that the second difference is within the preset time difference range, performing access verification on the device certificate.

[0011] In some possible implementations, if the time difference is detected to be within the preset time difference range, access verification is performed on the device certificate, which also includes: if the second difference is detected to be within the preset time difference range, detecting whether the local time in the vehicle is earlier than the protocol application time; if it is detected that the local time in the vehicle is earlier than the protocol application time, access verification is performed on the device certificate.

[0012] In some possible implementations, the application request includes requesting status information of the device certificate.

[0013] In some possible implementations, the access verification of the device certificate includes: obtaining an OCSP detection time and a certificate validity period of the device certificate, the OCSP detection time being the time for a detection pass between the protocol application time and the authentication verification time; detecting whether the OCSP detection time is within the validity period of the certificate; if it is detected that the OCSP detection time is within the validity period of the certificate, determining that the device certificate is valid; if it is detected that the OCSP detection time is not within the validity period of the certificate, determining that the device certificate is invalid.

[0014] In some possible implementations, the access verification of the device certificate includes: sending a challenge message to the device, the challenge message is used to request the device to prove ownership of the device certificate, the challenge message includes an authentication random number; receiving a signature response message from the device, the signature response message is calculated by the device using the device's private key to calculate the authentication random number; based on the public key of the device, verifying the signature response message; if the verification of the signature response message passes, determining that the device certificate is the digital certificate of the device.

[0015] In some possible implementations, the access verification of the device certificate includes: receiving the parsing result of the device to the OCSP response, wherein the OCSP response is the information signed by the OCSP server received by the device based on the OCSP protocol and the device certificate, and the device is used to parse the signed OCSP response to obtain the parsing result; if the parsing result is not revoked, determining that the status of the device certificate is not revoked.

[0016] The second aspect of the present application discloses a vehicle, which includes: a receiving module for receiving an authentication request of a device, the authentication request including a protocol application time and a device certificate of the device, wherein the protocol application time is the time when the device sends an application request to an online certificate status protocol OCSP server or the time when the device receives the online certificate status protocol OCSP server; an acquisition module for acquiring an authentication verification time when the device sends the authentication request, the authentication verification time is a time determined based on the universal coordinated time; a calculation module for calculating the time difference between the authentication verification time and the protocol application time; a detection module for detecting whether the time difference is within a preset time difference range; a verification module for performing access verification on the device certificate if it is detected that the time difference is within the preset time difference range; and a permission management module for opening the device's access rights to the vehicle if the result of the access verification is that the verification is passed.

[0017] The third aspect of the present application discloses an electronic device, which includes a processor and a memory, wherein the memory is used to store instructions, and the processor is used to call the instructions in the memory so that the electronic device executes the above-mentioned device access verification method.

[0018] The fourth aspect of the present application discloses a computer storage medium, including computer instructions. When the computer instructions are executed on an electronic device, the electronic device executes the above-mentioned device access verification method.

[0019] It can be understood that the vehicle of the second aspect, the electronic device of the third aspect and the computer storage medium of the fourth aspect provided above all correspond to the method of the first aspect. Therefore, the beneficial effects that can be achieved can refer to the beneficial effects in the corresponding methods provided above and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Figure 1 It is a flowchart of a method for verifying access to a device according to an embodiment of the present application.

[0021] Figure 2 This is another flowchart of a method for verifying access to a device according to an embodiment of the present application.

[0022] Figure 3 This is a schematic diagram of interaction when a vehicle performs identity authentication on a device according to an embodiment of the present application.

[0023] Figure 4 This is another interactive diagram when a vehicle performs identity authentication on a device according to an embodiment of the present application.

[0024] Figure 5 It is a schematic diagram of the structure of a vehicle according to an embodiment of the present application.

[0025] Figure 6 It is a schematic diagram of the hardware structure of an electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0026] In order to more clearly understand the above-mentioned purposes, features and advantages of the present application, the present application is described in detail below in conjunction with the accompanying drawings and specific implementation methods. It should be noted that the implementation methods of the present application and the features in the implementation methods can be combined with each other without conflict.

[0027] In the following description, many specific details are set forth to facilitate a full understanding of the present application. The described implementations are only part of the implementations of the present application, rather than all the implementations.

[0028] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art to which this application belongs. The terms used herein in the specification of this application are only for the purpose of describing specific embodiments and are not intended to limit this application.

[0029] It should be further noted that, in this article, the terms "comprises", "includes" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also includes other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the presence of other identical elements in the process, method, article or device including the element.

[0030] In this application, "at least one" means one or more, and "more" means two or more than two. "And / or" describes the association relationship of associated objects, indicating that there can be three relationships. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone, where A and B can be singular or plural.

[0031] In the embodiments of the present application, words such as "exemplary" or "for example" are used to indicate examples, illustrations or descriptions. Any embodiment or design described as "exemplary" or "for example" in the embodiments of the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplary" or "for example" is intended to present related concepts in a specific way.

[0032] Please refer to Figure 1 , is a flow chart of the access verification method of the device provided in the embodiment of the present application, and the present embodiment is applied to a vehicle. Among them, the vehicle can be a new energy vehicle, a fuel vehicle, etc., and the present application does not limit the specific type of the vehicle.

[0033] The access verification method of the device includes the following steps:

[0034] Step 101: Receive an authentication request from a device, where the authentication request includes a protocol application time and a device certificate of the device.

[0035] In this embodiment, the device certificate is a digital certificate that the device applies to a certificate authority (CA). The device may be a diagnostic instrument. For example, the diagnostic instrument may be used to detect the location and cause of a vehicle failure. In other embodiments, the device may be other devices besides a diagnostic instrument, such as a fuel consumption analyzer, an ignition analyzer, etc.

[0036] Specifically, before the device sends an authentication request to the vehicle, it will detect whether there is an available digital certificate locally. If it detects that there is no available digital certificate locally, the device generates a pair of public and private keys, uploads the public key and certificate application information to the CA, and based on the public key and certificate application information, the CA sends a digital certificate to the device.

[0037] After the device applies for a digital certificate from the CA, and when the device needs to access the vehicle, based on the Online Certificate Status Protocol OCSP, the device will send an application request to the CA's OCSP server to obtain the OCSP response of the digital certificate. The OCSP server sends an OCSP response (OCSP response includes OCSP Stapling information, which is also called OCSP stapling information) to the device, where the application request includes the status of the requested device certificate, and OCSP Stapling is used to query the status of the digital certificate. OCSP is an online query protocol used to verify the legitimacy of a certificate. The OCSP response contains certificate status information, such as whether it is revoked or valid, to verify whether the certificate is valid. Therefore, when the device sends an application request to the OCSP server, the OCSP Stapling information includes the status of the device certificate.

[0038] In this embodiment, the protocol application time is the time when the device sends an application request to the OCSP server or the time when the device receives a response from the OCSP server based on the OCSP protocol. For example, the time when the device sends an application request to the OCSP server is used as the protocol application time. In the subsequent process, when the protocol application time is used to verify the identity authentication of the device, since the protocol application time is fixed, the identity of the device can be verified regardless of whether the vehicle and the device are connected to the network or disconnected from the network, which expands the application scope of the verification.

[0039] Step 102: Obtain the authentication verification time when the device sends the authentication request, where the authentication verification time is a time determined based on the Universal Coordinated Time.

[0040] In one embodiment, the authentication verification time includes the world standard time and the local time in the vehicle. The world standard time is also called the world unified time, the world standard time or the international coordinated time. The local time in the vehicle is the time determined based on the world coordinated time and the location of the vehicle. In this embodiment, the local time in the vehicle is maintained by a crystal oscillator in the vehicle. The crystal oscillator mainly localizes the calculation time of the vehicle through a high-precision oscillation frequency.

[0041] Specifically, a vehicle gateway module, a telematics processing module and a vehicle local time module are provided in the vehicle. The vehicle gateway module is connected to the telematics processing module and the vehicle local time module. The telematics processing module is used to communicate with the cloud server and obtain the world standard time from the cloud server. The crystal oscillator is provided in the vehicle local time module.

[0042] In some embodiments, the telematics module is further used to send the world standard time to the in-vehicle local time module. After receiving the world standard time, the in-vehicle local time module completes the update of the in-vehicle local time based on the world standard time. The vehicle gateway module is used to receive the world standard time sent by the telematics module and the in-vehicle local time sent by the in-vehicle local time module, and authenticate the coordination application time based on the world standard time or the in-vehicle local time.

[0043] Step 103: Calculate the time difference between the authentication verification time and the protocol application time.

[0044] In one embodiment, when the authentication verification time includes the universal time or the local time in the vehicle, a first difference between the universal time and the protocol application time is calculated. Alternatively, a second difference between the local time in the vehicle and the protocol application time is calculated.

[0045] In another embodiment, when the authentication verification time includes the universal time and the local time in the vehicle, a first difference between the universal time and the protocol application time is calculated, and a second difference between the local time in the vehicle and the protocol application time is calculated.

[0046] Step 104: Detect whether the time difference is within a preset time difference range.

[0047] The preset time difference range includes a first preset difference range and a second preset difference range.

[0048] In one embodiment, when the authentication verification time includes the universal time or the local time in the vehicle, it is detected whether the first difference is within a first preset difference range. Alternatively, it is detected whether the second difference is within a second preset difference range.

[0049] In another embodiment, when the authentication verification time includes the universal time and the local time in the vehicle, it is detected whether the first difference is within a first preset difference range and it is detected whether the second difference is within a second preset difference range.

[0050] The first preset difference range and the second preset difference range may be the same or different.

[0051] For example, the first preset difference range may be set to [-8, 8], the second preset difference range may also be set to [-8, 8], or the second preset difference range may be set to [-10, 10].

[0052] Step 105: If it is detected that the time difference is within the preset time difference range, access verification is performed on the device certificate.

[0053] In one embodiment, when the authentication verification time includes the universal time or the local time in the vehicle, if the first difference is detected to be within a first preset difference range, the device certificate is access verified. Alternatively, if the second difference is detected to be within a second preset difference range, the device certificate is access verified.

[0054] In another embodiment, when the authentication verification time includes the universal time and the local time in the vehicle, if it is detected that the first difference is not within a first preset difference range, the second difference is detected whether it is within a second preset difference range. If it is detected that the second difference is within the second preset difference range, access verification is performed on the device certificate.

[0055] In another embodiment, when the authentication verification time includes the universal time and the local time in the vehicle, the second difference is first detected whether it is within a second preset difference range. If it is detected that the second difference is not within the second preset difference range, then the first difference is detected whether it is within the first preset difference range. If it is detected that the first difference is within the first preset difference range, access verification is performed on the device certificate.

[0056] If the time difference is within the preset time difference range, it proves that the interval between the time when the device sends the application request to the OCSP server and the authentication verification time is short, and the device certificate can be accessed and verified. On the contrary, if the interval between the time when the device sends the application request to the OCSP server and the authentication verification time is long, the OCSP Stapling information may be invalid. Therefore, the authentication of the protocol application time fails.

[0057] Further, when the authentication verification time includes the local time in the vehicle, if it is detected that the second difference is not within the second preset difference range, it is detected whether the local time in the vehicle is earlier than the protocol application time. If it is detected that the local time in the vehicle is earlier than the protocol application time, the device certificate is access verified.

[0058] If it is detected that the second difference is not within the second preset difference range, it is detected whether the local time in the car is earlier than the protocol application time to determine whether the local time in the car has a time rollback phenomenon. If it is detected that the local time in the car is earlier than the protocol application time, it indicates that there is a more obvious time rollback phenomenon in the local time in the car. Therefore, in order to avoid errors in the local time in the car due to damage to the local time module in the car, the verification cannot be passed, resulting in the impact of the device's access to the vehicle. At this time, skip the detection between the local time in the car and the protocol application time, and directly perform access verification on the device certificate. On the contrary, if it is detected that the local time in the car is not earlier than the protocol application time, it proves that the time when the device sends the application request to the OCSP server is long from the local time in the car, and the OCSP Stapling information may be invalid. Therefore, the authentication of the protocol application time fails.

[0059] In this embodiment, the access verification of the device certificate includes certificate validity period verification, certificate signature verification and certificate status verification. Specifically, the certificate validity period verification is used to verify whether the device certificate is within the validity period. The certificate signature verification is used to verify whether the device certificate is a digital certificate of the device. The certificate status verification is used to verify whether the device certificate is revoked based on the OCSP protocol.

[0060] The above content of access verification of the device certificate is only a partial verification. In other embodiments, access verification of the device certificate may also include verifying whether the format of the device certificate is correct, whether the format of the OCSP information is correct and legal, etc.

[0061] Step 106: If the result of the access verification is that the verification is passed, the device is allowed to access the vehicle.

[0062] In some embodiments, if any one or more of the certificate validity period verification, the certificate signature verification, and the certificate status verification are not satisfied, the device's access rights to the vehicle are not granted.

[0063] The following are the specific steps for certificate validity period verification, certificate signature verification, and certificate status verification:

[0064] (1) The steps of verifying the validity period of the certificate include: obtaining the OCSP detection time, which is the time between the protocol application time and the authentication verification time when the detection is passed. Check whether the OCSP detection time is within the validity period of the device certificate. If it is detected that the OCSP detection time is within the validity period of the certificate, the device certificate is determined to be valid. If it is detected that the OCSP detection time is not within the validity period of the certificate, the device certificate is determined to be invalid.

[0065] For example, the validity period of the device certificate is from 2024.10.06 00:00 to 2024.10.07 12:00. If the protocol application time is 2024.10.07 11:50, at this time, the OCSP information is valid, and the OCSP information also has a validity period. For example, if the validity period of the OCSP information is 12 hours, then the validity period of the OCSP information is from 2024.10.07 11:50 to 2024.10.07 23:50. However, since the device certificate is invalid after 2024.10.07 12:00, the identity authentication of the device certificate fails. Therefore, after the detection between the protocol application time and the authentication verification time passes, it is necessary to detect whether the OCSP detection time is within the certificate validity period of the device certificate.

[0066] In this embodiment, in order to ensure that the OCSP information is also valid when the device sends an authentication request to the vehicle, when the authentication verification time includes the local time in the vehicle, it is necessary to further detect whether the local time in the vehicle is within the validity period of the OCSP information. If it is detected that the local time in the vehicle is within the validity period of the OCSP information, the OCSP information is determined to be valid. Otherwise, the OCSP information is determined to be invalid.

[0067] (2) The steps of certificate signature verification include: sending a challenge message to the device, the challenge message is used to request the device to prove its ownership of the device certificate, and the challenge message includes an authentication random number. Receiving a signature response message from the device, the signature response message is the result of the device using the device's private key to calculate the authentication random number. Based on the device's public key, verify the signature response message. If the verification of the signature response message passes, it is determined that the device certificate is the device's digital certificate.

[0068] In this embodiment, the Challenge-Response process (Challenge Response Authentication) is used to verify whether the device certificate is the digital certificate of the device. Specifically, the vehicle generates a 32-byte authentication random number and sends the authentication random number to the device through the response of the 31 service. The device calculates the authentication random number based on its own private key and generates a signed response message. The device sends the signed response message to the vehicle. The vehicle uses the device certificate to parse the public key of the device, and then the vehicle verifies the signed response message based on the public key of the device. If the verification succeeds, it is determined that the device certificate is the digital certificate of the device. If the verification fails, it is determined that the device certificate is not the digital certificate of the device.

[0069] By jointly verifying whether the device certificate is the device's digital certificate through the Challenge-Response process and OCSP information, it is possible to avoid permanent leakage of the device's identity information due to leakage of the device's private key, resulting in failure to revoke the device certificate in time, or avoid third parties forging device certificates to access the vehicle, resulting in leakage of vehicle data.

[0070] (3) The step of verifying the certificate status includes: receiving the parsing result of the device for the OCSP response. The OCSP response is the information signed by the OCSP server received by the device based on the OCSP protocol and the device certificate. The device is used to parse the signed OCSP response to obtain the parsing result. If the parsing result is not revoked, the status of the device certificate is determined to be not revoked. On the contrary, if the parsing result is revoked, the status of the device certificate is revoked.

[0071] In this embodiment, if it is determined through the OCSP response that the device certificate is revoked, at this time, the certificate status verification is verification failure, and the access rights of the device are determined to not open the device access rights to the vehicle.

[0072] In some embodiments, the OCSP information contains access level information, and based on the access level information, the content of the access rights of the device to the vehicle is opened.

[0073] When the device is not allowed to access the vehicle, a detection failure message is generated. The detection failure message is sent to the device so that the device can determine the reason for the detection failure. In this embodiment, the 31 service (Routine Control) in the UDS diagnostic protocol is used to authenticate the device. Currently, most vehicles support the 31 service, so the use of the 31 service for identity authentication has good compatibility.

[0074] Compared with the related art, the embodiments of the present application have at least the following advantages:

[0075] When the device sends an authentication request to the vehicle, the device needs to be authenticated to avoid leakage of vehicle data. The time when the device sends an application request to the OCSP server or the time when the device receives a response from the OCSP server based on the Online Certificate Status Protocol OCSP is used as the protocol application time. Since the protocol application time is a fixed time, it will not be affected by whether the vehicle is connected to the Internet, so the device can be authenticated regardless of whether the vehicle is disconnected from the Internet or whether the vehicle and the device are both disconnected from the Internet. When the authentication verification time and the protocol application time and the access verification of the device certificate are passed, the device's access to the vehicle is opened. By double checking the relevant time in the device's identity authentication and the device certificate, the security of vehicle data is further guaranteed, and the problem of after-sales market diagnosis caused by the inability to authenticate the device is avoided.

[0076] Please refer to Figure 2 , Figure 2 This is another flow chart of the access verification method of the device provided by an embodiment of the present application. This embodiment is applied to a vehicle, and the specific process is as follows Figure 2 As shown, the following steps are included:

[0077] Step 201: Receive an authentication request from a device, where the authentication request includes a protocol application time and a device certificate of the device.

[0078] Step 202: Obtain the authentication verification time when the device sends the authentication request, where the authentication verification time includes the universal time and the local time in the vehicle.

[0079] In this embodiment, the authentication verification time is a time determined based on the UTC. Meanwhile, the in-vehicle local time is a time determined based on the UTC and the location of the vehicle. The in-vehicle local time is obtained in the same manner as in step 102 and step 201 is the same as step 101, and will not be described again here to avoid repetition.

[0080] Step 203: Calculate a first difference between the world standard time and the protocol application time and calculate a second difference between the in-vehicle local time and the protocol application time.

[0081] Step 204: Detect whether the first difference is within a preset time difference range.

[0082] The preset time difference range includes a first preset difference range and a second preset difference range. The specific setting requirements of the first preset difference range and the second preset difference range can refer to the relevant content of step 104. In this embodiment, it is detected whether the first difference is within the first preset difference range.

[0083] Step 205: When it is detected that the first difference is not within the preset time difference range, detect whether the second difference is within the preset time difference range.

[0084] In this embodiment, when it is detected that the first difference is not within the first preset difference range, it is detected whether the second difference is within the second preset difference range.

[0085] Step 206: When it is detected that the second difference is within the preset time difference range, perform access verification on the device certificate.

[0086] In this embodiment, when it is detected that the second difference is within a second preset difference range, access verification is performed on the device certificate.

[0087] In other embodiments, when it is detected that the second difference is not within the second preset difference range, it can also be detected whether the local time in the vehicle is earlier than the protocol application time.

[0088] By detecting whether the local time in the car is earlier than the protocol application time, it is determined whether the local time in the car has a significant regression. When it is detected that the local time in the car is earlier than the protocol application time, the local time in the car has a significant regression. The local time in the car can no longer be used to detect the protocol application time to avoid the occurrence of detection errors that cause the device's identity authentication to fail, making the device unable to access the vehicle. The specific detection process is described in detail above and will not be repeated here.

[0089] Step 207: If the result of the access verification is that the verification is passed, the device is allowed to access the vehicle.

[0090] The specific content of the access verification of the device certificate is the same as the specific content of the access verification of the device certificate in step 106, and will not be repeated here.

[0091] When the device is not allowed to access the vehicle, a test failure message is generated. The test failure message is sent to the device so that the device can determine the reason for the test failure.

[0092] Compared with the related art, the embodiments of the present application have at least the following advantages:

[0093] When the device sends an authentication request to the vehicle, in order to avoid the leakage of vehicle data, the device needs to be authenticated. On the one hand, the time when the device sends an application request to the OCSP server based on the online certificate status protocol OCSP or the time when the device receives the response of the OCSP server is used as the protocol application time. First, detect whether the first difference is within the first preset difference range, and then detect whether the second difference is within the second preset difference range. By jointly detecting the first difference and the second difference, the accuracy of the identity authentication of the device is improved. On the other hand, it is also possible to detect whether the protocol application time is earlier than the local time in the vehicle, so as to determine whether the protocol application time meets the authentication requirements according to the detection result, and determine whether the local time in the vehicle has a significant regression. When the local time in the vehicle has a significant regression, the detection between the local time in the vehicle and the protocol application time is directly skipped, thereby avoiding the failure of the identity authentication of the device due to an error in the local time in the vehicle, which affects the device's access to the vehicle. On the other hand, the time when the device sends the application request to the OCSP server or the time when the device receives the response of the OCSP server is used as the protocol application time, which solves the problem that the vehicle must be connected to the Internet to detect the relevant time in the identity authentication of the device. On the other hand, the security of vehicle data is further guaranteed by double checking the relevant time in the device identity authentication and the device certificate.

[0094] Please refer to Figure 3 , Figure 3 This is an interactive diagram of a vehicle performing identity authentication on a device provided in an embodiment of the present application.

[0095] Step S11: When the device detects that there is no device certificate locally, it sends a certificate request to the certificate server.

[0096] In some embodiments, before the device sends an authentication request to the vehicle, the device detects whether there is an available digital certificate locally. If it is detected that there is no available digital certificate locally, the device generates a pair of public and private keys, and uploads the public key and certificate application information to the certificate server to request the certificate server to issue a digital certificate. Specifically, the device requests the CA to issue a digital certificate.

[0097] Step S12: The certificate server sends the device certificate to the device.

[0098] In this embodiment, based on the public key and certificate application information, the CA sends the digital certificate to the device. After the device receives the digital certificate sent by the CA, it uses the digital certificate as the device certificate.

[0099] Step S13: The device sends an authentication request to the vehicle, wherein the authentication request includes the protocol application time and the device certificate of the device.

[0100] After the device applies for a digital certificate from the CA, and when the device needs to access the vehicle, based on the Online Certificate Status Protocol OCSP, the device will send an application request to the CA's OCSP server to obtain the OCSP response of the digital certificate. The OCSP server sends an OCSP response (OCSP response includes OCSP Stapling information, which is also called OCSP stapling information) to the device, where OCSP Stapling is used to query the status of the digital certificate. OCSP is an online query protocol used to verify the legitimacy of a certificate. The OCSP response contains information about the status of the certificate, such as whether it is revoked or valid, to verify whether the certificate is valid.

[0101] In this embodiment, the protocol application time is the time when the device sends an application request to the OCSP server or the time when the device receives a response from the OCSP server based on the OCSP protocol.

[0102] Step S14: The vehicle obtains the authentication verification time when the device sends the authentication request, and the authentication verification time is the time determined based on the Universal Coordinated Time.

[0103] In one embodiment, the authentication verification time includes the world standard time or the local time in the vehicle. The world standard time is also called the world unified time, the world standard time or the international coordinated time. The authentication verification time includes the local time in the vehicle. The local time in the vehicle is the time determined based on the world coordinated time and the location of the vehicle. In this embodiment, the local time in the vehicle is maintained by a crystal oscillator in the vehicle. The crystal oscillator mainly localizes the calculation time of the vehicle through a high-precision oscillation frequency.

[0104] In another embodiment, the authentication verification time includes the universal time and the local time in the vehicle.

[0105] It should be noted that the method for obtaining the world standard time and / or the local time in the vehicle can refer to step 102 and will not be described here.

[0106] Step S15: The vehicle calculates the time difference between the authentication verification time and the agreement application time.

[0107] In some embodiments, when the authentication verification time includes the universal time or the local time in the vehicle, the time difference between the universal time and the protocol application time is calculated, and the time difference between the universal time and the protocol application time is used as the first difference. Alternatively, the time difference between the local time in the vehicle and the protocol application time is calculated, and the time difference between the local time in the vehicle and the protocol application time is used as the second difference.

[0108] In another embodiment, when the authentication verification time includes the universal time and the local time in the vehicle, a first difference between the universal time and the protocol application time and a second difference between the local time in the vehicle and the protocol application time are calculated.

[0109] Step S16: If it is detected that the time difference is within the preset time difference range, access verification is performed on the device certificate.

[0110] The preset time difference range includes a first preset difference range and a second preset difference range. The specific ranges of the first preset difference range and the second preset difference range can refer to the relevant content in step 104.

[0111] In one embodiment, when the authentication verification time includes the universal time or the local time in the vehicle, it is detected whether the first difference is within a first preset difference range. If it is detected that the first difference is within the first preset difference range, the device certificate is access verified. Alternatively, it is detected whether the second difference is within a second preset difference range. If it is detected that the second difference is within the second preset difference range, the device certificate is access verified.

[0112] In another embodiment, when the authentication verification time includes the universal time and the local time in the vehicle, the first difference is detected whether it is within a first preset difference range and the second difference is detected whether it is within a second preset difference range. If the first difference is detected to be within the first preset difference range and the second difference is detected to be within the second preset difference range, access verification is performed on the device certificate.

[0113] The specific steps of performing access verification on the device certificate may refer to the relevant contents in step 105 and step 106, and will not be described again here to avoid repetition.

[0114] Step S17: Determine the access permission of the device to access the vehicle according to the access verification result.

[0115] If the access verification of the device certificate is passed, the vehicle will grant the device access rights to the vehicle. Otherwise, the device is not allowed to access the vehicle to avoid vehicle data leakage when the device accesses the vehicle for illegal reasons.

[0116] Compared with the related art, the embodiments of the present application have at least the following advantages:

[0117] When the device sends an authentication request to the vehicle, the device needs to be authenticated to avoid leakage of vehicle data. The time when the device sends an application request to the OCSP server or the time when the device receives the response from the OCSP server based on the Online Certificate Status Protocol OCSP is used as the protocol application time. The protocol application time is then compared with the world standard time, or the protocol application time is compared with the local time in the vehicle, thereby solving the problem that the vehicle must be connected to the Internet to detect the relevant time in the device's identity authentication. When the authentication verification time and the protocol application time, as well as the access verification of the device certificate, are passed, the device's access to the vehicle is opened. The security of vehicle data is further guaranteed by double verification of the relevant time in the device's identity authentication and the device certificate.

[0118] Please refer to Figure 4 , Figure 4 This is another interactive diagram when a vehicle performs identity authentication on a device provided in an embodiment of the present application.

[0119] Step S21: When the device detects that the local device does not have a device certificate, it sends a certificate request to the certificate server.

[0120] Step S22: The certificate server sends the device certificate to the device.

[0121] Step S23: The device sends an authentication request to the vehicle, wherein the authentication request includes the protocol application time and the device certificate of the device.

[0122] The specific contents of step S21 to step S23 are the same as the specific contents of step S11 to step S13, and will not be repeated here to avoid repetition.

[0123] Step S24: The vehicle obtains authentication verification time, which includes the universal time and the local time in the vehicle.

[0124] In this embodiment, the in-vehicle local time is a time determined based on the Universal Time Coordinated and the location of the vehicle. The method for obtaining the in-vehicle local time can refer to the relevant content in step 102.

[0125] Step S25: The vehicle calculates a first difference between the universal time and the protocol application time and calculates a second difference between the local time in the vehicle and the protocol application time.

[0126] Step S26: The vehicle detects whether the first difference is within a preset time difference range.

[0127] The preset time difference range includes a first preset difference range and a second preset difference range. The specific setting requirements of the first preset difference range and the second preset difference range can refer to the relevant content of step 104. In this embodiment, it is detected whether the first difference is within the first preset difference range.

[0128] Step S27: When the vehicle detects that the first difference is not within the preset time difference range, it detects whether the second difference is within the preset time difference range.

[0129] In this embodiment, when it is detected that the first difference is not within the first preset difference range, it is detected whether the second difference is within the second preset difference range.

[0130] Step S28: When the vehicle detects that the second difference is within the preset time difference range, the vehicle performs access verification on the device certificate.

[0131] In this embodiment, when it is detected that the second difference is within a second preset difference range, access verification is performed on the device certificate.

[0132] In other embodiments, when it is detected that the second difference is not within the second preset difference range, it can also be detected whether the local time in the vehicle is earlier than the protocol application time.

[0133] The specific content of this step can be referred to step 206, and will not be described again here to avoid repetition.

[0134] Step S29: Determine the access rights of the device to access the vehicle according to the access verification result.

[0135] If the access verification of the device certificate is passed, the vehicle will grant the device access rights to the vehicle. Otherwise, the device is not allowed to access the vehicle to avoid vehicle data leakage when the device accesses the vehicle for illegal reasons.

[0136] Compared with the related art, the embodiments of the present application have at least the following advantages:

[0137] When the device sends an authentication request to the vehicle, in order to avoid the leakage of vehicle data, the device needs to be authenticated. On the one hand, the time when the device sends an application request to the OCSP server or the time when the device receives the response from the OCSP server based on the online certificate status protocol OCSP is used as the protocol application time. It is detected whether the protocol application time is earlier than the local time in the vehicle, so as to determine whether the protocol application time meets the authentication requirements and whether the local time in the vehicle has a significant regression according to the detection result. When the local time in the vehicle has a significant regression, the detection between the local time in the vehicle and the protocol application time is directly skipped, thereby avoiding the failure of the device's identity authentication due to an error in the local time in the vehicle, which affects the device's access to the vehicle. On the other hand, the time when the device sends an application request to the OCSP server or the time when the device receives the response from the OCSP server is used as the protocol application time, which solves the problem that the vehicle must be connected to the Internet to detect the relevant time in the device's identity authentication. On the other hand, the security of vehicle data is further guaranteed by double verification of the relevant time in the device's identity authentication and the device certificate.

[0138] See also Figure 5 An embodiment of the present application further provides a vehicle, which includes a receiving module, an acquisition module, a calculation module, a detection module, a verification module and a permission management module.

[0139] The receiving module is used to receive an authentication request from a device, where the authentication request includes a protocol application time and a device certificate of the device, wherein the protocol application time is the time when the device sends an application request to an Online Certificate Status Protocol (OCSP) server or the time when the device receives a request from an Online Certificate Status Protocol (OCSP) server.

[0140] The acquisition module is used to obtain the authentication verification time when the device sends an authentication request. The authentication verification time is a time determined based on the universal coordinated time.

[0141] The calculation module is used to calculate the time difference between the authentication verification time and the protocol application time.

[0142] The detection module is used to detect whether the time difference is within a preset time difference range.

[0143] The verification module is used to perform access verification on the device certificate if it is detected that the time difference is within a preset time difference range.

[0144] The permission management module is used to open the device's access rights to the vehicle if the result of the access verification is that the verification is passed.

[0145] Please refer to Figure 6 , is a schematic diagram of the hardware structure of the electronic device 1000 provided in the embodiment of the present application. Figure 6As shown, the electronic device 1000 may include a processor 1001 and a memory 1002. The memory 1002 is used to store one or more computer programs 1003. The one or more computer programs 1003 are configured to be executed by the processor 1001. The one or more computer programs 1003 include instructions, and the above instructions can be used to implement the access verification method of the device executed in the electronic device 1000.

[0146] It is understandable that the structure shown in this embodiment does not constitute a specific limitation on the electronic device 1000. In other embodiments, the electronic device 1000 may include more or fewer components than shown, or combine or separate some components, or arrange the components differently.

[0147] The processor 1001 may include one or more processing units, for example, the processor 1001 may include an application processor (AP), a modem, a graphics processing unit (GPU), an image signal processor (ISP), a controller, a video codec, a digital signal processor (DSP), a baseband processor, and / or a neural-network processing unit (NPU), etc. Different processing units may be independent devices or integrated into one or more processors.

[0148] The processor 1001 may also be provided with a memory for storing instructions and data. In some embodiments, the memory in the processor 1001 is a cache memory. The memory may store instructions or data that the processor 1001 has just used or circulated. If the processor 1001 needs to use the instruction or data again, it may be directly called from the memory. This avoids repeated access, reduces the waiting time of the processor 1001, and thus improves the efficiency of the system.

[0149] In some embodiments, the processor 1001 may include one or more interfaces. The interface may include an inter-integrated circuit (I2C) interface, an inter-integrated circuit sound (I2S) interface, a pulse code modulation (PCM) interface, a universal asynchronous receiver / transmitter (UART) interface, a mobile industry processor interface (MIPI), a general-purpose input / output (GPIO) interface, a SIM interface, and / or a USB interface, etc.

[0150] In some embodiments, processor 1001 is used to execute acceleration schemes such as single instruction multiple data (SIMD) and very long instruction word (VLIW).

[0151] In some embodiments, memory 1002 may include high-speed random access memory and may also include non-volatile memory, such as a hard disk, a memory, a plug-in hard disk, a Smart Media Card (SMC), a Secure Digital (SD) card, a flash card (Flash Card), at least one disk storage device, a flash memory device, or other volatile solid-state storage devices.

[0152] This embodiment also provides a computer-readable storage medium, in which computer instructions are stored. When the instructions are executed on an electronic device, the electronic device executes the above-mentioned related method steps to implement the access verification method of the device in the above-mentioned embodiment.

[0153] Among them, the electronic device and storage medium provided in this embodiment are used to execute the corresponding methods provided above. Therefore, the beneficial effects that can be achieved can refer to the beneficial effects in the corresponding methods provided above, and will not be repeated here.

[0154] In practical applications, the above functions can be distributed to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above.

[0155] In several embodiments provided in the present application, the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are schematic. For example, the division of the modules or units is a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another device, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0156] The unit described as a separate component may or may not be physically separated, and the component shown as a unit may be one physical unit or multiple physical units, that is, it may be located in one place or distributed in multiple different places. Some or all of the units may be selected according to actual needs to achieve the purpose of the embodiment.

[0157] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0158] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a readable storage medium. Based on this understanding, the technical solution of the embodiment of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions to enable a device (which can be a single-chip microcomputer, chip, etc.) or a processor (processor) to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (Read-Only Memory, ROM), random access memory (Random Access Memory, RAM), disk or optical disk and other media that can store program code.

[0159] The above description is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any changes or substitutions within the technical scope disclosed in the present application should be included in the protection scope of the present application.

Claims

1. A method for verifying access to a device, characterized in that: Applied to a vehicle, the method comprises: Receive an authentication request from a device, the authentication request including a protocol application time and a device certificate of the device, wherein the protocol application time is a time when the device sends an application request to an Online Certificate Status Protocol (OCSP) server or a time when the device receives a response from the OCSP server; Acquire the authentication verification time when the device sends the authentication request, the authentication verification time includes the local time in the vehicle, and the local time in the vehicle is a time determined based on the Universal Coordinated Time and the location of the vehicle; Calculating a second difference between the in-vehicle local time and the protocol application time; Detecting whether the second difference is within a preset time difference range; If it is detected that the second difference is within the preset time difference range, performing access verification on the device certificate; If it is detected that the second difference is not within the preset time difference range, detecting whether the local time in the vehicle is earlier than the protocol application time; If it is detected that the local time in the vehicle is earlier than the protocol application time, access verification is performed on the device certificate; If the result of the access verification is that the verification is passed, the access right of the device to the vehicle is opened.

2. The device access verification method according to claim 1, characterized in that: The authentication verification time also includes the world standard time; Before calculating the second difference between the in-vehicle local time and the protocol application time, the method further includes: Calculating a first difference between the universal time and the protocol application time; The detecting whether the second difference is within a preset time difference range includes: Detecting whether the first difference is within the preset time difference range; If it is detected that the first difference is not within the preset time difference range, it is detected whether the second difference is within the preset time difference range.

3. The device access verification method according to claim 2, characterized in that: After detecting whether the first difference is within the preset time difference range, the method further includes: If it is detected that the first difference is within the preset time difference range, access verification is performed on the device certificate.

4. The device access verification method according to claim 1, characterized in that: The application request includes requesting status information of the device certificate.

5. The device access verification method according to claim 1, characterized in that: The access verification of the device certificate includes: Obtaining the OCSP detection time and the certificate validity period of the device certificate, the OCSP detection time being the time when the detection is passed between the protocol application time and the authentication verification time; Detecting whether the OCSP detection time is within the validity period of the certificate; If it is detected that the OCSP detection time is within the validity period of the certificate, it is determined that the device certificate is valid; If it is detected that the OCSP detection time is not within the validity period of the certificate, it is determined that the device certificate is invalid.

6. The device access verification method according to claim 1, characterized in that: The access verification of the device certificate includes: Sending a challenge message to the device, the challenge message being used to request the device to prove ownership of the device certificate, the challenge message including an authentication random number; Receiving a signature response message from the device, where the signature response message is obtained by the device calculating the authentication random number using the private key of the device; Verifying the signed response message based on a public key of the device; If the verification of the signature response message passes, it is determined that the device certificate is the digital certificate of the device.

7. The device access verification method according to claim 1, characterized in that: The access verification of the device certificate includes: Receiving a parsing result of an OCSP response by the device, wherein the OCSP response is information signed by an OCSP server and received by the device based on the OCSP protocol and the device certificate, and the device is used to parse the signed OCSP response to obtain the parsing result; If the parsing result is not revoked, it is determined that the status of the device certificate is not revoked.

8. A vehicle, characterized in that: The vehicle comprises: A receiving module, configured to receive an authentication request from a device, wherein the authentication request includes a protocol application time and a device certificate of the device, wherein the protocol application time is a time when the device sends an application request to an online certificate status protocol OCSP server or a time when the device receives the online certificate status protocol OCSP server; An acquisition module, used to acquire an authentication verification time when the device sends the authentication request, wherein the authentication verification time is a time determined based on the Universal Coordinated Time; A calculation module, used to calculate the time difference between the authentication verification time and the protocol application time; A detection module, used to detect whether the time difference is within a preset time difference range; A verification module, configured to perform access verification on the device certificate if it is detected that the time difference is within the preset time difference range; The permission management module is used to grant access rights of the device to the vehicle if the result of the access verification is that the verification is passed.

9. An electronic device, characterized in that: The electronic device comprises a processor and a memory, the memory is used to store instructions, and the processor is used to call the instructions in the memory, so that the electronic device executes the access verification method of the device according to any one of claims 1 to 7.

10. A computer storage medium, characterized in that: The method comprises computer instructions, which, when executed on an electronic device, enable the electronic device to execute the access verification method of the device according to any one of claims 1 to 7.

Images