Vehicle data transmission method and system and vehicle

Abstract

The invention relates to a vehicle data transmission method and system and a vehicle, the method is used in the vehicle data transmission system comprising a data sending end, a data receiving end and a vehicle-mounted network terminal, and the method comprises the following steps: the data receiving end completes identity verification processing on the data sending end based on the vehicle-mounted network terminal to obtain an identity verification result; when the identity verification result is that verification is passed, the data sending end encrypts the to-be-sent data based on a preset shared key to obtain target sending data, and transmits the target sending data to a data receiving end; and the data receiving end decrypts the target sending data based on the shared key to obtain decrypted data. By adopting the method, the security of data transmission can be improved.

Description

Technical Field

[0001] The present application relates to the technical field of in-vehicle Ethernet communication, and in particular to a vehicle data transmission method, system and vehicle. Background Art

[0002] At present, commercial vehicles with assisted driving or autonomous driving functions generally adopt domain control, that is, through the centralized domain controller, external sensors, in-vehicle actuators, and in-vehicle network terminals are connected to complete the control functions of the assisted driving system or the autonomous driving system. The control process of autonomous driving or assisted driving involves the coordination of multiple internal and external equipment systems of the whole vehicle, and with the maturity and rapid application of in-vehicle Ethernet technology, higher requirements are put forward for the information security of in-vehicle equipment, especially for the attack methods such as data theft, tampering, identity forgery or hardware changes of the whole vehicle network. The whole vehicle needs to have information security authentication for each device under the existing network.

[0003] Therefore, there is an urgent need for a vehicle data transmission method that can authenticate both parties of the data transmission during vehicle data transmission. Summary of the invention

[0004] Based on this, it is necessary to provide a vehicle data transmission method, system and vehicle that can authenticate both parties of data transmission during vehicle data transmission in order to address the above technical problems.

[0005] In a first aspect, the present application provides a vehicle data transmission method, which is used in a vehicle data transmission system including a data sending end, a data receiving end and a vehicle network terminal, and the method includes:

[0006] The data receiving end completes the identity authentication processing of the data sending end based on the vehicle network terminal and obtains the identity authentication result;

[0007] If the identity authentication result is that the authentication is passed, the data sending end encrypts the data to be sent based on the preset shared key to obtain the target sending data, and transmits the target sending data to the data receiving end;

[0008] The data receiving end decrypts the target sent data based on the shared key to obtain the decrypted data.

[0009] In one embodiment, the data receiving end completes the identity authentication processing of the data sending end based on the vehicle network terminal, and the process of obtaining the identity authentication result includes:

[0010] The data receiving end sends an identity authentication request to the data sending end;

[0011] The data sending end sends a certificate acquisition request to the vehicle network terminal in response to the identity authentication request, and obtains the identity certificate fed back by the vehicle network terminal;

[0012] The data sending end sends the identity certificate to the data receiving end;

[0013] The data receiving end generates an identity verification request based on the identity certificate, sends the identity verification request to the vehicle network terminal, and obtains the identity verification result fed back by the vehicle network terminal.

[0014] In one embodiment, the process of sending a certificate acquisition request to the vehicle network terminal in response to the identity authentication request includes:

[0015] The data receiving end generates an identity acquisition request based on the hardware information and public key of the data receiving end in response to the identity authentication request;

[0016] The data receiving end sends a certificate acquisition request to the vehicle network terminal.

[0017] In one embodiment, the identity certificate includes communication object data, certificate validity period and verification identifier, and the process of the data receiving end generating an identity verification request based on the identity certificate includes:

[0018] The data sender verifies the communication object data and the validity period of the certificate to obtain a local verification result;

[0019] When the local verification result is that the verification is passed, the data sender generates an identity verification request based on the verification identifier.

[0020] In one embodiment, the data sending end encrypts the data to be sent based on a preset shared key, and the process of obtaining the target sent data includes:

[0021] The data sending end generates a key verification message, and encrypts the key verification message based on the shared key stored in the data sending end to obtain an encrypted verification request, and sends the encrypted verification request to the data receiving end;

[0022] The data receiving end decrypts the encrypted verification request based on the shared key stored in the data receiving end to obtain a decryption verification result;

[0023] When the decryption verification result corresponds to the verification passed, the data sending end encrypts the data to be sent based on the shared key to obtain the target sending data.

[0024] In one of the embodiments, when the identity authentication result is that the authentication is passed, before executing the step of encrypting the data to be sent based on the preset shared key at the data sending end to obtain the target sent data, the method further includes:

[0025] The data sending end and the data receiving end perform key negotiation to obtain a shared key.

[0026] In one embodiment, the process of performing key negotiation between a data sending end and a data receiving end to obtain a shared key includes:

[0027] The data sending end sends initial negotiation parameters to the data receiving end;

[0028] The data receiving end generates target negotiation parameters based on the initial negotiation parameters, and sends the target negotiation parameters to the data sending end;

[0029] The data sending end and the data receiving end generate a shared key based on the target negotiation parameters respectively.

[0030] In one embodiment, the process of performing key negotiation between a data sending end and a data receiving end to obtain a shared key includes:

[0031] The data sending end sends initial negotiation parameters to the data receiving end;

[0032] The data receiving end generates target negotiation parameters based on the initial negotiation parameters, and sends the target negotiation parameters to the data sending end;

[0033] The data sending end and the data receiving end generate a shared key based on the target negotiation parameters respectively.

[0034] In a second aspect, the present application also provides a vehicle data transmission system, comprising:

[0035] The data receiving end is used to complete the identity authentication processing of the data sending end based on the vehicle network terminal to obtain the identity authentication result;

[0036] If the identity authentication result is that the authentication is passed, the data sending end is used to encrypt the data to be sent based on the preset shared key to obtain the target sending data, and transmit the target sending data to the data receiving end;

[0037] The data receiving end is used to decrypt the target sent data based on the shared key to obtain the decrypted data.

[0038] In a third aspect, the present application further provides a vehicle, which includes the vehicle data transmission system provided in the second aspect.

[0039] The above-mentioned vehicle data transmission method, system and vehicle, the method is used in a vehicle data transmission system including a data sending end, a data receiving end and an on-board network terminal, the method comprising: the data receiving end completes identity authentication processing of the data sending end based on the on-board network terminal to obtain an identity authentication result; when the identity authentication result is verification passed, the data sending end encrypts the data to be sent based on a preset shared key to obtain target sending data, and transmits the target sending data to the data receiving end; the data receiving end decrypts the target sending data based on the shared key to obtain decrypted data; in this way, before transmitting data, the data sending end and the data receiving end first complete identity authentication at both ends through the on-board network terminal, that is, complete the authentication of the data sending end and the data receiving end, which can effectively improve the network security of the on-board Ethernet of commercial vehicles; at the same time, the identity authentication between the data sending end and the data receiving end is completed through the on-board network terminal, avoiding the problem of low authentication security caused by a malicious third party impersonating the data sending end or one of the data receiving ends during the identity authentication stage; the above-mentioned vehicle data transmission method has high security. Furthermore, after the identity authentication is passed, the data sender and the data receiver use the shared key to perform encryption and decryption when transmitting data, thereby further improving the security of data transmission. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the related technologies, the drawings required for use in the embodiments or the related technical descriptions are briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0041] FIG1 is a diagram showing an application environment of a vehicle data transmission method according to an embodiment;

[0042] Figure 2 A schematic diagram of a process flow of a vehicle data transmission method in one embodiment;

[0043] Figure 3 A flowchart of a process for obtaining an identity authentication result in one embodiment;

[0044] Figure 4 A schematic diagram of a process of obtaining target sending data in one embodiment;

[0045] Figure 5 A schematic diagram of a process for obtaining a shared key in one embodiment;

[0046] Figure 6 The figure is a flowchart of a data encryption and decryption process in one embodiment. DETAILED DESCRIPTION

[0047] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0048] The vehicle data transmission method provided in the embodiment of the present application can be applied to the whole vehicle network part in the application environment as shown in Figure 1. As shown in Figure 1, the whole vehicle network includes an intelligent driving domain controller, an on-board network terminal, an instrument vehicle domain controller, other domain controllers, sensors, and actuators. The whole vehicle network is connected to the outside mainly through the on-board network terminal; the on-board network terminal is connected to the intelligent driving domain controller through Ethernet to complete the interactive forwarding of external information and in-vehicle information. The on-board network terminal is connected to the external network through 4G / 5G, and mainly receives information transmitted by servers such as cloud services and OTA (Over-The-Air). At the same time, the on-board network is connected to the vehicle-road cooperative network through C-V2X (Cellular Vehicle-to-Everything), and mainly receives information transmitted by roadside and vehicle-side related RSU (Roadside Unit) and OBU (On-Board Unit). The instrument vehicle domain controller is connected to the intelligent driving domain controller and other domain controllers through Ethernet, and transmits relevant messages according to the function definition. The sensor is connected to the intelligent driving domain controller, which mainly transmits sensor perception-related content, including point cloud data, perception target data, etc. The actuator is connected to the intelligent driving domain controller, which mainly transmits control instructions output by the autonomous driving algorithm, including chassis control messages, body control messages, etc. The connection between the intelligent driving domain controller and sensors and actuators includes Ethernet and CAN (Controller Area Network); among them, in the case of CAN connection, the process of authenticating both parties of data transmission during data transmission is not limited in this application.

[0049] Exemplarily, the in-vehicle network terminal may be a T-BOX (Telematics BOX, telematics processor).

[0050] The two sides of vehicle data transmission provided in the embodiment of the present application involve the two ends of data transmission through Ethernet in the vehicle network. For example, please refer to Figure 1, the intelligent driving domain controller and the vehicle network terminal, the instrument vehicle domain controller, and other domain controllers are in two-way communication, and the intelligent driving domain controller and other controllers are both data sending ends and data receiving ends; the intelligent driving domain controller receives relevant data from the sensor, does not send relevant data, the sensor acts as a data sending end, and the intelligent driving domain controller acts as a data receiving end; the intelligent driving domain controller sends relevant data to the actuator, does not receive relevant data, the intelligent driving domain controller acts as a data sending end, and the actuator acts as a data receiving end. It should be noted that the data sending end and the data receiving end involved in the embodiment of the present application are limited to the sending and receiving of data flows such as operation data or monitoring data. The data sending end can also receive verification requests, key negotiation requests, etc. sent by the data receiving end, and the data receiving end can also send data acquisition requests to the data sending end; the arrows in Figure 1 only indicate the data flow direction, and other request messages such as identity authentication requests in the subsequent embodiment of the present application may not follow the flow direction indicated by the arrow.

[0051] In an exemplary embodiment, please refer to Figure 2 A vehicle data transmission method is provided for use in a vehicle data transmission system including a data transmitter, a data receiver and a vehicle network terminal. Figure 2 As shown, the method includes:

[0052] Step 202: The data receiving end completes the identity authentication processing for the data sending end based on the vehicle network terminal and obtains the identity authentication result.

[0053] After the vehicle is powered on and initialized, each device in the vehicle network performs a self-test. If all self-tests pass, the data receiver initiates verification of the identity information of the data sender to establish a communication connection between the two parties.

[0054] Exemplarily, taking the data transmission process between the intelligent driving domain controller and sensor B in Figure 1 as an example, the intelligent driving domain controller completes the identity authentication processing of sensor B based on the vehicle network terminal, obtains the identity authentication result, and establishes a communication connection channel between the intelligent driving domain controller and sensor B.

[0055] Exemplarily, taking the data transmission process between the intelligent driving domain controller and actuator A in Figure 1 as an example, actuator A completes the identity authentication processing of the intelligent driving domain controller based on the vehicle network terminal, obtains the identity authentication result, and establishes a communication connection channel between the intelligent driving domain controller and actuator A.

[0056] Exemplarily, taking the data transmission process between other domain controllers and the intelligent driving domain controller in FIG1 as an example, other domain controllers complete the identity authentication processing of the intelligent driving domain controller based on the vehicle network terminal, obtain the identity authentication result, and establish the communication connection channel between the intelligent driving domain controller and other domain controllers; or the intelligent driving domain controller can complete the identity authentication processing of other domain controllers based on the vehicle network terminal, obtain the identity authentication result, and establish the communication connection channel between the intelligent driving domain controller and other domain controllers. Among them, the two ends of the two-way data communication can complete the identity authentication processing only once.

[0057] Exemplarily, the data receiving end initiates an identity authentication request including its own identity information to the data sending end, and the data sending end sends the identity authentication request to the vehicle network terminal. The vehicle network terminal verifies the identity of the data receiving end based on the identity information of each device stored in advance. If the verification is successful, the vehicle network terminal feeds back a message of verification success to the data sending end; if the verification is unsuccessful, the vehicle network terminal feeds back a message of verification failure to the data sending end; at the same time, the vehicle network terminal also verifies the identity of the data sending end. If the verification is successful, the vehicle network terminal feeds back a message of verification success to the data receiving end; if the verification is unsuccessful, the vehicle network terminal feeds back a message of verification failure to the data receiving end. In this example, the identity authentication result in step 202 is verification success, including that the vehicle network terminal sends both the verification success result to the data sending end and the data receiving end.

[0058] Step 204, when the identity authentication result is verification passed, the data sending end encrypts the data to be sent based on the preset shared key to obtain the target sending data, and transmits the target sending data to the data receiving end.

[0059] Among them, when the identity authentication result is that the authentication is passed, the data sending end, when it needs to send data, encrypts the data to be sent based on the preset shared key, and then transmits it to the data receiving end.

[0060] Wherein, both the data sending end and the data receiving end are provided with a shared key, the data sending end uses the shared key to encrypt the transmitted data, and the data receiving end uses the shared key to decrypt the transmitted data.

[0061] Exemplarily, a shared key is obtained between the data sender and the data receiver through a preset rule after completing the identity authentication; exemplarily, in the process of completing the identity authentication, if the verification is passed, the vehicle network terminal sends the shared key to the data sender and the data receiver for use in subsequent data transmission.

[0062] In a possible implementation, when the identity authentication result is a failed authentication, the data sender and the data receiver do not start the subsequent data transmission process, prompt an error message, and the vehicle network terminal prompts the error message to the cockpit display. Exemplarily, the error message prompted by the cockpit display includes the names of the data sender and the data receiver whose identity authentication failed.

[0063] Step 206: The data receiving end decrypts the target transmitted data based on the shared key to obtain decrypted data.

[0064] The vehicle data transmission method provided in the above embodiment is used in a vehicle data transmission system including a data sending end, a data receiving end and an on-board network terminal. The method includes: the data receiving end completes the identity authentication processing of the data sending end based on the on-board network terminal to obtain the identity authentication result; when the identity authentication result is verification passed, the data sending end encrypts the data to be sent based on the preset shared key to obtain the target sending data, and transmits the target sending data to the data receiving end; the data receiving end decrypts the target sending data based on the shared key to obtain the decrypted data; in this way, before transmitting data, the data sending end and the data receiving end first complete the identity authentication of both ends through the on-board network terminal, that is, complete the authentication of the data sending end and the data receiving end, which can effectively improve the network security of the on-board Ethernet of commercial vehicles; at the same time, the identity authentication between the data sending end and the data receiving end is completed through the on-board network terminal, avoiding the problem of low authentication security caused by a malicious third party impersonating the data sending end or one of the data receiving ends during the identity authentication stage; the above-mentioned vehicle data transmission method has high security. Furthermore, after identity authentication is passed, the data transmitting end and the data receiving end use a shared key for encryption and decryption when transmitting data, thereby further improving the security of data transmission. Furthermore, the vehicle data transmission method provided in the above embodiment is universal, and its data transmitting end and data receiving end can be adapted to various situations based on vehicle Ethernet authentication, and has implementation flexibility.

[0065] In an exemplary embodiment, based on Figure 2 For the examples shown, please refer to Figure 3 The embodiment provided is related to the process in which the data receiving end completes the identity authentication processing of the data sending end based on the vehicle network terminal and obtains the identity authentication result. Figure 3 As shown, the process includes steps 302 to 306, wherein:

[0066] Step 302: The data receiving end sends an identity authentication request to the data sending end.

[0067] The identity authentication request is initiated by the data receiving end.

[0068] Step 304 : the data transmitting end sends a certificate obtaining request to the vehicle network terminal in response to the identity verification request, and obtains the identity certificate fed back by the vehicle network terminal.

[0069] After receiving the identity authentication request sent by the data receiving end, the data transmitting end sends a certificate acquisition request to the vehicle network terminal to apply for identity verification from the vehicle network terminal. The certificate acquisition request includes data that can be used by the vehicle network terminal to determine the identity of the data transmitting end.

[0070] In one possible implementation, the identity authentication request includes the hardware information and public key of the data sending end. Correspondingly, in this implementation, the process of the data sending end sending a certificate acquisition request to the vehicle network terminal in response to the identity authentication request includes: the data receiving end generates an identity acquisition request based on the hardware information and public key of the data receiving end in response to the identity authentication request; the data receiving end sends the certificate acquisition request to the vehicle network terminal. Among them, when the data sending end is an intelligent driving domain controller, the hardware information includes controller information.

[0071] Correspondingly, after the vehicle network terminal completes the hardware information review and public key confirmation, it generates an identity certificate and sends it to the data sender.

[0072] In a possible implementation, the identity certificate includes communication object data, certificate validity period, and verification identifier. The communication object data includes the identity identifier of the data sender and / or the identity identifier of the data receiver, the certificate validity period includes the validity period of the certificate, and if the data receiver receives the identity certificate after the certificate validity period has expired, the identity certificate is considered invalid; the verification identifier is a unique identifier that the vehicle network terminal encrypts and calculates based on the certificate acquisition request, and the vehicle network terminal stores the certificate identifier.

[0073] Among them, in some embodiments, the data receiving end acts as a gateway of the data sending end, connecting the data receiving end and the vehicle network terminal. Exemplarily, the data receiving end is an intelligent driving domain controller and the data sending end is a sensor. The intelligent driving domain controller acts as a gateway device of the sensor to forward relevant requests to the vehicle network terminal.

[0074] Step 306: The data sending end sends the identity certificate to the data receiving end.

[0075] Exemplarily, after receiving the identity certificate, the data sending end stores it locally and sends it to the data receiving end.

[0076] Step 308 : The data receiving end generates an identity verification request based on the identity certificate, sends the identity verification request to the vehicle network terminal, and obtains the identity verification result fed back by the vehicle network terminal.

[0077] After receiving the identity certificate, the data receiving end generates an identity verification request based on the identity certificate and sends it to the vehicle network terminal, and verifies whether the identity certificate is correct through the vehicle network terminal.

[0078] In one possible implementation, the identity certificate includes communication object data, certificate validity period and verification identifier; the process of the data receiving end generating an identity verification request based on the identity certificate includes: the data sending end verifies the communication object data and the certificate validity period to obtain a local verification result; when the local verification result is that the verification is passed, the data sending end generates an identity verification request based on the verification identifier.

[0079] When the vehicle network terminal receives the identity verification request, it verifies the verification identifier. If there is a record and the data sender is correct, it feeds back the identity verification result of passing the verification.

[0080] If the verification identifier has been recorded but the data sender is incorrect, the authentication result of failed verification will be fed back; if the verification identifier has not been recorded, the authentication result of failed verification will be fed back.

[0081] In the above embodiment, the data receiving end sends an identity authentication request to the data sending end; the data sending end sends a certificate acquisition request to the vehicle network terminal in response to the identity authentication request, and obtains the identity certificate fed back by the vehicle network terminal; the data sending end sends the identity certificate to the data receiving end; the data receiving end generates an identity verification request based on the identity certificate, sends the identity verification request to the vehicle network terminal, and obtains the identity authentication result fed back by the vehicle network terminal; in this embodiment, the vehicle network terminal generates an identity certificate during the identity authentication process between the data sending end and the data receiving end, thereby improving the security of authentication verification.

[0082] In an exemplary embodiment, based on Figure 2 For the examples shown, please refer to Figure 4 This embodiment involves a process in which a data transmitting end encrypts the data to be transmitted based on a preset shared key, and obtains the target transmitted data, including:

[0083] Step 402: The data sending end generates a key verification message, and encrypts the key verification message based on the shared key stored in the data sending end to obtain an encrypted verification request, and sends the encrypted verification request to the data receiving end.

[0084] Step 404: The data receiving end decrypts the encrypted verification request based on the shared key stored in the data receiving end to obtain a decryption verification result.

[0085] Step 406: When the decryption verification result corresponds to the verification passing, the data sending end encrypts the data to be sent based on the shared key to obtain the target sending data.

[0086] If the decryption verification result corresponds to a verification failure, the data sending end and the data receiving end will display an error prompt state.

[0087] In this embodiment, after the identity authentication is passed, the data sending end requests the data receiving end to verify the shared key, so as to avoid data transmission problems caused by inconsistent shared keys.

[0088] In an exemplary embodiment, based on Figure 2 The embodiment shown in this embodiment involves that when the identity authentication result is verification passed, before executing the step that the data sending end encrypts the data to be sent based on a preset shared key to obtain the target sent data, the method also includes: key negotiation processing is performed between the data sending end and the data receiving end to obtain a shared key.

[0089] In one possible implementation, please refer to Figure 5 The process of key negotiation between the data sending end and the data receiving end to obtain a shared key includes:

[0090] Step 502: The data sending end sends initial negotiation parameters to the data receiving end.

[0091] Exemplarily, the initial negotiation parameters include random numbers and other information used to generate a shared key. Exemplarily, the other information includes, but is not limited to, the protocol version, algorithm selection, and encryption parameters corresponding to the generation of the shared key, which are used to help the data sender and the data receiver determine the specific details of the negotiation and the encryption algorithm used, thereby ensuring the correctness and consistency of secure communication.

[0092] Step 504: The data receiving end generates target negotiation parameters based on the initial negotiation parameters, and sends the target negotiation parameters to the data sending end.

[0093] Exemplarily, the data receiving end generates the target negotiation parameters by performing calculations based on the initial negotiation parameters and locally stored private information (such as a private key or another random number).

[0094] Step 506: The data sending end and the data receiving end generate a shared key based on the target negotiation parameters respectively.

[0095] The data sending end and the data receiving end generate a shared key based on the target negotiation parameters according to the same encryption algorithm.

[0096] In a possible implementation, the encryption algorithms used by the data sending end and the data receiving end are preset, and the data sending end and the data receiving end perform calculations based on the target negotiation parameters and the preset encryption algorithms to obtain a shared key.

[0097] In another possible implementation, the data sending end and the data receiving end pre-set multiple encryption algorithms. When generating initial negotiation parameters, the data sending end randomly selects an encryption algorithm from the multiple encryption algorithms and puts the corresponding identifier in the initial negotiation parameters for transmission to the data receiving end; the data receiving end determines the encryption algorithm for calculating the shared key in the current key negotiation process based on the initial negotiation parameters.

[0098] In this embodiment, the shared key used in the data transmission process is generated by negotiation between the data sending end and the data receiving end after identity authentication, thereby improving the randomness of the shared key and improving the security of data transmission.

[0099] In an exemplary embodiment, based on Figure 2 For the examples shown, please refer to Figure 6 This embodiment involves a process in which a data transmitting end encrypts the data to be transmitted based on a shared key, and obtains the target transmitted data, including:

[0100] Step 602: The data sending end performs hashing and private key signature processing on the data to be sent to obtain intermediate sending data.

[0101] In one possible implementation, the data receiving end sends a data acquisition request to the data sending end, wherein the data acquisition request includes the type and period of the required monitoring data, such as temperature, posture, etc.; after the data sending end determines the monitoring data, it completes the collection according to the required period and data type to obtain the data to be sent.

[0102] In a possible implementation, the process by which the data sending end performs hashing and private key signing on the data to be sent to obtain the target sending data includes: the data sending end serializes the data to be sent, calculates the hash value, packages the data, and then uses the private key of the data sending end to sign to obtain the intermediate sending data.

[0103] Step 604: The data sending end encrypts the intermediate sending data based on the shared key to obtain the target sending data.

[0104] Correspondingly, please continue to refer to Figure 6 In this embodiment, the data receiving end decrypts the target sent data based on the shared key, and the process of obtaining the decrypted data includes:

[0105] Step 606: The data receiving end decrypts the target transmission data based on the shared key to obtain intermediate decrypted data.

[0106] Step 608: The data receiving end obtains the public key corresponding to the data sending end through the vehicle network terminal, and performs signature verification processing on the intermediate decrypted data based on the public key to obtain a signature verification result.

[0107] In a possible implementation, when the data receiving end receives the target data for the first time after the device is powered on, the data receiving end obtains the public key corresponding to the data sending end through the vehicle network terminal, and then stores the public key for subsequent signature verification of the target data sent by the data sending end. After the device is powered off, the public key is deleted; or the public key is stored in a random access memory, and the public key is lost after the device is powered off.

[0108] Step 610: When the signature verification result is verified to be passed, perform hash inverse processing on the intermediate decrypted data to obtain the decrypted data.

[0109] In one possible implementation, performing hash inverse processing on the intermediate decrypted data to obtain the decrypted data includes: unpacking the intermediate decrypted data, calculating a hash value for the data segment, and verifying it with the original hash value, and performing deserialization processing after the verification passes to obtain the decrypted data, that is, the original data to be sent.

[0110] In the above embodiment, the data sending end performs hash processing and private key signature processing on the data to be sent, and then uses the shared key to encrypt the transmission after obtaining the intermediate transmission data; after using the shared key for transmission decryption, the data receiving end applies to the public key from the vehicle network terminal for signature verification, and then performs hash inverse processing to obtain the decrypted data, thereby further improving the security of data transmission.

[0111] In a possible embodiment, the data receiving end proofreads the decrypted data according to preset regulations; the proofreading content includes the data type, range, period and rationality.

[0112] In an exemplary embodiment, a data transmission method is provided, which is used in a vehicle data transmission system including a data transmitting end, a data receiving end and a vehicle network terminal. The method includes:

[0113] Step S1, the data receiving end sends an identity authentication request to the data sending end;

[0114] Step S2: the data sending end sends a certificate acquisition request to the vehicle network terminal in response to the identity authentication request; and acquires the identity certificate fed back by the vehicle network terminal.

[0115] Optionally, step S2 includes: the data receiving end generates an identity acquisition request based on the hardware information and public key of the data receiving end in response to the identity authentication request; and the data receiving end sends the certificate acquisition request to the vehicle network terminal.

[0116] Step S3, the data sending end sends the identity certificate to the data receiving end;

[0117] Step S4, the data receiving end generates an identity verification request based on the identity certificate, sends the identity verification request to the vehicle network terminal, and obtains the identity verification result fed back by the vehicle network terminal.

[0118] Optionally, the identity certificate includes communication object data, certificate validity period and verification identifier, and step S4 includes: the data sending end verifies the communication object data and the certificate validity period to obtain a local verification result; when the local verification result is that the verification is passed, the data sending end generates an identity verification request based on the verification identifier.

[0119] Step S5, when the identity authentication result is that the authentication is passed, the data sending end sends the initial negotiation parameters to the data receiving end;

[0120] Step S6, the data receiving end generates target negotiation parameters based on the initial negotiation parameters, and sends the target negotiation parameters to the data sending end;

[0121] Step S7: the data sending end and the data receiving end generate a shared key based on the target negotiation parameters respectively.

[0122] Step S8, the data sending end generates a key verification message, and encrypts the key verification message based on the shared key stored in the data sending end to obtain an encrypted verification request, and sends the encrypted verification request to the data receiving end;

[0123] Step S9, the data receiving end decrypts the encrypted verification request based on the shared key stored in the data receiving end to obtain a decryption verification result;

[0124] Step S10, when the decryption verification result corresponds to the verification passed, the data sending end encrypts the data to be sent based on the shared key to obtain the target sending data, and transmits the target sending data to the data receiving end.

[0125] Optionally, step S10 includes: the data sending end performs hashing and private key signature processing on the data to be sent to obtain intermediate sending data; the data sending end encrypts the intermediate sending data based on the shared key to obtain target sending data.

[0126] Step S11, the data receiving end decrypts the target sent data based on the shared key to obtain decrypted data.

[0127] Optionally, step S11 includes: the data receiving end decrypts the target sent data based on the shared key to obtain intermediate decrypted data; the data receiving end obtains the public key corresponding to the data sending end through the vehicle network terminal, and performs signature verification on the intermediate decrypted data based on the public key to obtain a signature verification result; when the signature verification result is that the verification is passed, the intermediate decrypted data is hashed inversely to obtain the decrypted data.

[0128] It should be understood that, although the steps in the flowcharts involved in the above embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps is not strictly limited in order, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above embodiments may include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0129] It is understood that the term "based on" used in this application is used to describe one or more factors that affect the determination, and does not exclude other factors that may affect the determination. For example, the phrase "determine A based on B" means that the determination of A can be based entirely or at least partially on factor B, that is, B is a factor that affects the determination of A, but does not exclude that the determination of A is also based on C.

[0130] Based on the same inventive concept, the embodiment of the present application also provides a vehicle data transmission device for implementing the vehicle data transmission method involved above. The implementation solution provided by the system to solve the problem is similar to the implementation solution recorded in the above method, so the specific limitations in one or more vehicle data transmission system embodiments provided below can refer to the limitations of the vehicle data transmission method above, and will not be repeated here.

[0131] In an exemplary embodiment, a vehicle data transmission system is provided, comprising: a data receiving end, a data transmitting end and a vehicle network terminal, wherein:

[0132] The data receiving end is used to complete the identity authentication processing of the data sending end based on the vehicle network terminal to obtain the identity authentication result;

[0133] If the identity authentication result is that the authentication is passed, the data sending end is used to encrypt the data to be sent based on the preset shared key to obtain the target sending data, and transmit the target sending data to the data receiving end;

[0134] The data receiving end is used to decrypt the target sent data based on the shared key to obtain the decrypted data.

[0135] In an exemplary embodiment, the data receiving end is used to send an identity authentication request to the data sending end; the data sending end is used to send a certificate acquisition request to the vehicle network terminal in response to the identity authentication request, and obtain the identity certificate fed back by the vehicle network terminal; the data sending end is used to send the identity certificate to the data receiving end; the data receiving end is used to generate an identity verification request based on the identity certificate, send the identity verification request to the vehicle network terminal, and obtain the identity authentication result fed back by the vehicle network terminal.

[0136] In an exemplary embodiment, the data receiving end is used to generate an identity acquisition request based on the hardware information and public key of the data receiving end in response to the identity authentication request; the data receiving end is used to send the certificate acquisition request to the vehicle network terminal.

[0137] In an exemplary embodiment, the identity certificate includes communication object data, certificate validity period and verification identifier. The data sending end is used to verify the communication object data and the certificate validity period to obtain a local verification result; the data sending end is used to generate an identity verification request based on the verification identifier when the local verification result is that the verification is passed.

[0138] In an exemplary embodiment, the data sending end is used to generate a key verification message, and encrypt the key verification message based on the shared key stored in the data sending end to obtain an encrypted verification request, and send the encrypted verification request to the data receiving end; the data receiving end is used to decrypt the encrypted verification request based on the shared key stored in the data receiving end to obtain a decrypted verification result; when the decryption verification result corresponds to the verification passed, the data sending end is used to encrypt the data to be sent based on the shared key to obtain the target sending data.

[0139] In an exemplary embodiment, the data sending end and the data receiving end are also used to perform a key negotiation process to obtain a shared key.

[0140] In an exemplary embodiment, the data sending end is used to send initial negotiation parameters to the data receiving end; the data receiving end is used to generate target negotiation parameters based on the initial negotiation parameters, and send the target negotiation parameters to the data sending end; the data sending end and the data receiving end are respectively used to generate a shared key based on the target negotiation parameters.

[0141] In an exemplary embodiment, the data transmitting end is used to perform hash and private key signature processing on the data to be transmitted to obtain intermediate transmission data, and to encrypt the intermediate transmission data based on the shared key to obtain target transmission data; the data receiving end decrypts the target transmission data based on the shared key to obtain intermediate decrypted data;

[0142] The data receiving end is used to obtain the public key corresponding to the data sending end through the vehicle network terminal, and perform signature verification processing on the intermediate decrypted data based on the public key to obtain the signature verification result. When the signature verification result is verification passed, the intermediate decrypted data is hashed inversely to obtain the decrypted data.

[0143] In one embodiment, a vehicle is further provided, and the vehicle includes the vehicle data transmission system provided in the above embodiment.

[0144] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0145] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but are not limited to this.

[0146] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0147] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A vehicle data transmission method, characterized in that: The method is used in a vehicle data transmission system including a data transmitting end, a data receiving end and a vehicle network terminal, and the method includes: The data receiving end completes the identity authentication processing of the data sending end based on the vehicle network terminal to obtain an identity authentication result; If the identity authentication result is that the authentication is passed, the data sending end encrypts the data to be sent based on a preset shared key to obtain target sending data, and transmits the target sending data to the data receiving end; The data receiving end decrypts the target sent data based on the shared key to obtain decrypted data.

2. The method according to claim 1, characterized in that The data receiving end completes the identity authentication processing of the data sending end based on the vehicle network terminal, and the process of obtaining the identity authentication result includes: The data receiving end sends an identity authentication request to the data sending end; The data sending end sends a certificate acquisition request to the vehicle network terminal in response to the identity authentication request, and acquires the identity certificate fed back by the vehicle network terminal; The data sending end sends the identity certificate to the data receiving end; The data receiving end generates an identity verification request based on the identity certificate, sends the identity verification request to the in-vehicle network terminal, and obtains the identity verification result fed back by the in-vehicle network terminal.

3. The method according to claim 2, characterized in that The process of the data receiving end sending a certificate acquisition request to the vehicle network terminal in response to the identity authentication request includes: The data receiving end generates the identity acquisition request based on the hardware information and public key of the data receiving end in response to the identity authentication request; The data receiving end sends the certificate acquisition request to the in-vehicle network terminal.

4. The method according to claim 2, characterized in that: The identity certificate includes communication object data, certificate validity period and verification identifier, and the process of the data receiving end generating an identity verification request based on the identity certificate includes: The data sending end verifies the communication object data and the validity period of the certificate to obtain a local verification result; When the local verification result is verification passed, the data sending end generates the identity verification request based on the verification identifier.

5. The method according to claim 1, characterized in that The data transmitting end encrypts the data to be transmitted based on the preset shared key to obtain the target transmitted data, which includes: The data sending end generates a key verification message, and encrypts the key verification message based on the shared key stored in the data sending end to obtain an encrypted verification request, and sends the encrypted verification request to the data receiving end; The data receiving end decrypts the encrypted verification request based on the shared key stored in the data receiving end to obtain a decryption verification result; When the decryption verification result corresponds to the verification passing, the data sending end encrypts the data to be sent based on the shared key to obtain the target sending data.

6. The method according to claim 1, characterized in that When the identity authentication result is that the authentication is passed, before executing the step where the data sending end encrypts the data to be sent based on the preset shared key to obtain the target sent data, the method further includes: The data sending end and the data receiving end perform key negotiation processing to obtain a shared key.

7. The method according to claim 6, characterized in that The process of performing key negotiation between the data sending end and the data receiving end to obtain a shared key includes: The data sending end sends initial negotiation parameters to the data receiving end; The data receiving end generates a target negotiation parameter based on the initial negotiation parameter, and sends the target negotiation parameter to the data sending end; The data sending end and the data receiving end generate the shared key based on the target negotiation parameter respectively.

8. The method according to claim 1, characterized in that: The data transmitting end encrypts the data to be transmitted based on the shared key to obtain the target transmitted data, including: The data sending end performs hashing and private key signature processing on the data to be sent to obtain intermediate sending data; The data sending end encrypts the intermediate sending data based on the shared key to obtain the target sending data; The data receiving end decrypts the target sent data based on the shared key to obtain the decrypted data, including: The data receiving end decrypts the target sent data based on the shared key to obtain intermediate decrypted data; The data receiving end obtains the public key corresponding to the data sending end through the vehicle network terminal, and performs signature verification processing on the intermediate decrypted data based on the public key to obtain a signature verification result; When the signature verification result is that the verification is passed, the intermediate decrypted data is subjected to a hash inverse process to obtain the decrypted data.

9. A vehicle data transmission system, characterized in that: The vehicle data transmission system comprises: The data receiving end is used to complete the identity authentication processing of the data sending end based on the vehicle network terminal to obtain the identity authentication result; When the identity authentication result is that the authentication is passed, the data sending end is used to encrypt the data to be sent based on the preset shared key to obtain the target sending data, and transmit the target sending data to the data receiving end; The data receiving end is used to decrypt the target sending data based on the shared key to obtain decrypted data.

10. A vehicle, characterized in that: The vehicle comprises the vehicle data transmission system as claimed in claim 9.

Images