A secure communication method and system for digital car keys

Abstract

The present invention relates to a secure communication method and system for a digital car key. A user downloads a digital car key and registers it. The user initiates a connection request with a target vehicle through the digital car key. The target vehicle broadcasts to a cloud server. The target vehicle continuously broadcasts signals. The digital car key turns on Bluetooth and scans. When the target vehicle signal is scanned, a connection is established between the digital car key and the target vehicle and identity authentication is performed. After receiving the broadcast, the cloud server initiates a pairing request. After the pairing is successful, the digital car key accepts the pairing request. The cloud server exchanges public keys with the target vehicle and generates an encryption key. The encryption key is used to encrypt communication data. The encrypted communication data is stored in the cloud server. The cloud server and the target vehicle perform encrypted communication based on the encrypted communication data. The intelligent cockpit domain control of the target vehicle performs positioning to complete the door opening. The security risk of users in the process of using digital car keys is effectively reduced.

Description

Technical Field

[0001] The present invention belongs to the technical field of digital car key communication security, and in particular relates to a digital car key security communication method and system. Background Art

[0002] Car entry systems are evolving rapidly - from traditional physical keys to advanced remote keyless entry (RKE) systems and smart key systems, namely digital car keys. Digital car keys are an innovative car key that uses smartphones, wearable devices, etc. to unlock the car and perform related operations, improving the convenience of using the car. ‌This technology uses communication technologies such as Bluetooth and NFC to turn wearable devices such as smartphones and smart watches into car keys, realizing functions such as keyless entry and starting, remote key authorization, and personalized vehicle settings. The popularization and application of digital car keys marks an important progress in the intelligent transformation of automobiles, making car use more convenient and intelligent. ‌

[0003] While digital car keys bring convenience to users, they also bring new security challenges. With the development of communications, the means of attack of criminals are constantly updated and developed, which brings great risks to the security of digital car keys, such as relay attacks. Criminals transmit signals from the key to the car, and may also extend the communication distance of the wireless signal through various software and hardware tools, or they may steal the communication data between the car key and the car. In a relay attack, the communication message is relayed from one location to another, making the entity sending the message appear to be closer to the target.

[0004] Currently, some cryptographic schemes rely on a single key and simply store the key value, or even directly store and transmit the key in plain text. These schemes have serious security risks and may lead to key leakage.

[0005] Therefore, how to provide a secure communication method for digital car keys to prevent attacks by criminals from bringing security risks to users when using digital car keys is a technical problem that urgently needs to be solved. Summary of the invention

[0006] The object of the present invention is to provide a secure communication method and system for a digital car key, so as to prevent attacks by lawless elements from bringing security risks to users in the process of using the digital car key.

[0007] In order to solve the above technical problems, the technical solution adopted by the present invention is as follows:

[0008] In a first aspect, a secure communication method for a digital vehicle key is provided, comprising the following steps:

[0009] S1: The user downloads the digital car key on his mobile phone terminal and registers his identity information, and initiates a connection request with the target vehicle through the digital car key, and the target vehicle broadcasts to the cloud server;

[0010] S2: The target vehicle continuously broadcasts NFC signals, UWB signals, or BLE signals. The digital car key turns on Bluetooth and scans. When the NFC signal, UWB signal, or BLE signal broadcast by the target vehicle is scanned, a connection is established between the digital car key and the target vehicle and identity authentication is performed.

[0011] S3: After the identity authentication is successful, the cloud server initiates a pairing request after receiving the broadcast. After the pairing is successful, the digital car key accepts the pairing request, the cloud server exchanges public keys with the target vehicle, and generates an encryption key. The encryption key is used to encrypt the communication data, and the encrypted communication data is stored in the cloud server;

[0012] S4: The cloud server and the target vehicle perform encrypted communication based on the encrypted communication data and add it to the parsing list;

[0013] S5: The intelligent cockpit domain control of the target vehicle is located based on the UWB signal and completes the door opening operation of the target vehicle.

[0014] Preferably, the specific process of step S3 is as follows:

[0015] S31: The cloud server and the target vehicle generate an initial random binary sequence of a specified length through negotiation, wherein the binary sequence is a seed key;

[0016] S32: Discretize the input of the cloud server using a discrete algorithm, and obtain a root key based on the seed key;

[0017] S33: Calculate the root key based on a specified cryptographic algorithm to obtain a key encryption key;

[0018] S34: calling the encryption card API interface in the cloud server to obtain the session key, and storing the session key in a ciphertext plus hash value manner;

[0019] S35: The cloud server and the target vehicle encrypt and decrypt the communication data through the session key to achieve encrypted communication between the two parties.

[0020] Preferably, the specific process of using a discrete algorithm to discretize the cloud server input in step S32 is as follows:

[0021] S321: sorting the input data of the cloud server and performing deduplication processing on the sorted data;

[0022] S322: Map the input data of the cloud server to the specified data based on the binary search or index mapping method.

[0023] Preferably, the specific process of obtaining the root key based on the seed key in step S32 is as follows:

[0024] Divide the specified data in step S322 into a plurality of data blocks;

[0025] The seed is used to generate a series of round keys using a specified key expansion algorithm;

[0026] Processing the plurality of data blocks and the seed key by bitwise XOR, and replacing each byte of the data blocks after the bitwise XOR processing by using a specified lookup table;

[0027] A row shift operation of circularly shifting each row of the data block after row replacement to the left according to a specified rule;

[0028] Perform linear transformation on the data block after the row shift operation within the column, and use matrix multiplication to mix the column data;

[0029] Take the first 16 bits of the data of the mixed column using matrix multiplication to generate a root key.

[0030] Preferably, the specified cryptographic algorithm in step S33 is a hash operation, and the specific process of obtaining the key encryption key through the hash operation is as follows:

[0031] S331: Preprocess the root key to process it into an integer multiple of 512 bytes. Let the length of the root key be X. The specific formula for processing the root key into an integer multiple of 512 bytes is:

[0032] X mod 512 = 448;

[0033] Wherein, mod is the modulus function. The length of the data to be filled is obtained according to the above formula. The filling process is to fill after the root key. The first digit filled is 1 and the rest are 0.

[0034] S332: Set 8 fixed 32-byte variables as initial values ​​for hash calculation and initialize round function constants;

[0035] S333: Split the preprocessed root key into data blocks with 512 bytes as units, and decompose the split data blocks into 16 32-bit character strings;

[0036] S334: Iteratively compress the 16 32-bit character strings after segmentation, and correct the compressed character strings. The corrected character strings are concatenated in a specified order to obtain a final hash value as a key encryption key.

[0037] Preferably, the specific process of calling the encryption card API interface in the cloud server to obtain the session key in step S34 is as follows:

[0038] S341: Call the cryptAcquireContext function based on the encryption card API interface to obtain the handle of the key container in the CSP module;

[0039] S342: The target vehicle uses the CryptImportKey function to import the recipient's certificate into the CSP module to obtain the public key of the cloud server;

[0040] S343: The cloud server uses the CryptGenKey function to randomly generate a session key and encrypts the session key using the public key of the target vehicle. The encrypted session key is then exported and sent to the target vehicle;

[0041] S344: After receiving the encrypted session key, the target vehicle uses its own private key to call the CryptImportKey function to decrypt the session key.

[0042] Preferably, step S35 is specifically that the target vehicle and the cloud server call CryptEncrypt function and CryptDecrypt function based on the session key to encrypt and decrypt data to achieve encrypted communication between the two parties.

[0043] In a second aspect, a secure communication system for a digital car key is provided, for implementing any one of the secure communication methods for a digital car key, comprising a target vehicle, a digital car key, a cloud server, a key generation module, a data encryption module, and a transmission module, wherein the target vehicle is connected to the user-end digital car key, the target vehicle is connected to the cloud server, the key generation module is integrated in the cloud server, the key generation module is connected to the data encryption module, the data encryption module is connected to the transmission module, and the digital car key is arranged on a user mobile phone terminal;

[0044] The digital car key is used to open the door and start the target vehicle;

[0045] The cloud server is used to manage the digital car key and control the function and security of the digital car key;

[0046] The key generation module is used to generate a seed key through negotiation between the cloud server and the target vehicle; discretize the input of the cloud server using a discrete algorithm, and obtain a root key based on the seed key; operate the root key based on a specified cryptographic algorithm to obtain a key encryption key; call the encryption card API interface in the cloud server to obtain a session key, and store the session key in a ciphertext plus a hash value manner;

[0047] The data encryption module is used to encrypt the data in the communication process based on the key generated by the key generation module;

[0048] The transmission module is used to transmit the specified key and encrypted data to achieve communication between the target vehicle and the cloud server.

[0049] The beneficial effects of the present invention include:

[0050] The secure communication method and system of the digital car key provided by the present invention, the user downloads the digital car key and registers, initiates a connection request with the target vehicle through the digital car key, and the target vehicle broadcasts to the cloud server; the target vehicle continuously broadcasts the signal, the digital car key turns on Bluetooth and scans, and when the target vehicle signal is scanned, the digital car key and the target vehicle are connected and identity authentication is performed; the cloud server initiates a pairing request after receiving the broadcast, and after the pairing is successful, the digital car key accepts the pairing request, the cloud server exchanges public keys with the target vehicle, and generates an encryption key, which is used to encrypt communication data, and the encrypted communication data is stored in the cloud server; the cloud server and the target vehicle perform encrypted communication based on the encrypted communication data, and the intelligent cockpit domain control of the target vehicle performs positioning to complete the door opening. The security risk of users in the process of using digital car keys is effectively reduced.

[0051] Firstly, in the process of communication between the target vehicle and the cloud server, the cloud server and the target vehicle generate an initial random seed key of a binary sequence of specified length through negotiation; the input of the cloud server is discretized by a discrete algorithm, and a root key is obtained based on the seed key; the root key is operated based on a specified cryptographic algorithm to obtain a key encryption key; the encryption card API interface in the cloud server is called to obtain a session key, and the session key is stored in the form of ciphertext plus hash value; the cloud server and the target vehicle encrypt and decrypt the communication data through the session key to achieve secure encrypted communication between the two parties.

[0052] Secondly, through the above-mentioned multi-level key structure system, the root key is obtained by using a discrete algorithm to discretely input the user. The root key is calculated using an irreversible cryptographic algorithm to obtain the key encryption key. The root key and the key encryption key are stored in the non-volatile storage area of ​​the cloud server encryption card. The data in this area is not allowed to be modified and can only be erased and rewritten, and is managed by the encryption card role authentication mechanism. The session key is generated by the random number chip of the cloud server's encryption card, and is exported after being protected by the key encryption key. It is stored in the device in the form of "ciphertext plus hash value", which effectively avoids the risk of the key being stolen and lost during use.

[0053] Again, when the communication data needs to be stored, the session key in ciphertext form is obtained, and the API interface of the encryption card is called, and the key encryption key and the corresponding cryptographic algorithm are used to decrypt the session key. Finally, the communication data is encrypted and stored using the session key, and when the data needs to be read, the communication data is decrypted using the same method.

[0054] Finally, the entire encrypted communication process does not involve the plaintext transmission and storage of session keys. Even if the ciphertext session key is leaked, it will not affect the security of the stored data. The hash value can easily detect whether there is tampering and malicious destruction of the key, thus alerting the user. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] Figure 1 It is a flowchart of the secure communication method of the digital car key of the present invention.

[0056] Figure 2 It is a schematic diagram of the multi-level key generation process of the present invention.

[0057] Figure 3 FIG. 1 is a schematic diagram of the architecture of the secure communication system of the digital car key of the present invention. DETAILED DESCRIPTION

[0058] The following is combined with Figure 1~Figure 3 The present invention is further described in detail:

[0059] Example 1

[0060] See attached Figure 1 , as shown, a secure communication method for a digital car key comprises the following steps:

[0061] S1: The user downloads the digital car key and registers the identity information on his mobile phone terminal. When the user needs to open a target vehicle, the digital car key initiates a connection request with the target vehicle, and the target vehicle sends a broadcast message to the cloud server.

[0062] S2: The target vehicle continuously broadcasts NFC signals, UWB signals, or BLE signals. The digital car key turns on Bluetooth and scans. When the digital car key scans the broadcast NFC signal, UWB signal, or BLE signal of the target vehicle, a connection is established between the digital car key and the target vehicle and identity authentication is performed. Through the identity authentication process between the digital car key and the target vehicle, the user identity of the digital car key can be verified to prevent unauthorized users from using the target vehicle, thereby protecting the target vehicle from unauthorized access and control.

[0063] S3: After the identity authentication is successful, the cloud server initiates a pairing request after receiving the broadcast. After the pairing is successful, the digital car key accepts the pairing request, and the cloud server exchanges public keys with the target vehicle and generates an encryption key. The encryption key is used to encrypt the communication data, and the encrypted communication data is stored in the cloud server. Through the above-mentioned multi-level key structure system, the discrete algorithm is used to discrete the user input to obtain the root key. The root key is calculated by an irreversible cryptographic algorithm to obtain the key encryption key. The root key and the key encryption key are stored in the non-volatile storage area of ​​the cloud server encryption card. The data in this area is not allowed to be modified and can only be erased and rewritten, and is managed by the encryption card role identification mechanism. The session key is generated by the random number chip of the encryption card of the cloud server, and is exported after being protected by the key encryption key. It is stored in the device in the form of "ciphertext plus hash value", which effectively avoids the risk of the key being stolen and lost during use.

[0064] S4: The cloud server and the target vehicle perform encrypted communication based on the encrypted communication data and add it to the parsing list; when the communication data needs to be stored, the ciphertext session key is obtained, and the API interface of the encryption card is called, and the key encryption key and the corresponding cryptographic algorithm are used to decrypt the session key. Finally, the communication data is encrypted and stored using the session key. When the data needs to be read, the communication data is decrypted using the same method. The entire encrypted communication process does not involve the plaintext transmission and storage of the session key. Even if the ciphertext session key is leaked, it does not affect the security of the stored data. The hash value can easily detect whether there is any tampering or malicious destruction of the key, thereby alerting the user.

[0065] S5: The intelligent cockpit domain control of the target vehicle is located based on the UWB signal and completes the door opening operation of the target vehicle.

[0066] Example 2

[0067] Based on Example 1, see Figure 2 , the specific process of step S3 is as follows:

[0068] S31: The cloud server and the target vehicle generate an initial random binary sequence of a specified length through negotiation, wherein the binary sequence is a seed key;

[0069] S32: Discretize the input of the cloud server using a discrete algorithm, and obtain a root key based on the seed key;

[0070] S33: Calculate the root key based on a specified cryptographic algorithm to obtain a key encryption key;

[0071] S34: calling the encryption card API interface in the cloud server to obtain the session key, and storing the session key in a ciphertext plus hash value manner;

[0072] S35: The cloud server and the target vehicle encrypt and decrypt the communication data through the session key to achieve encrypted communication between the two parties.

[0073] Through the above multi-level key structure system, the root key is obtained by using a discrete algorithm to discretely input the user. The root key is calculated using an irreversible cryptographic algorithm to obtain the key encryption key. The root key and the key encryption key are stored in the non-volatile storage area of ​​the cloud server encryption card. The data in this area is not allowed to be modified and can only be erased and rewritten, and is managed by the encryption card role authentication mechanism. The session key is generated by the random number chip of the cloud server encryption card, and is exported after being protected by the key encryption key. It is stored in the device in the form of ciphertext plus hash value, which effectively avoids the risk of the key being stolen and lost during use.

[0074] In this embodiment, the specific process of using the discrete algorithm to discretize the cloud server input in step S32 is as follows:

[0075] S321: sorting the input data of the cloud server and performing deduplication processing on the sorted data;

[0076] S322: Map the input data of the cloud server to the specified data based on the binary search or index mapping method.

[0077] The specific process of obtaining the root key based on the seed key in step S32 is as follows:

[0078] Divide the specified data in step S322 into a plurality of data blocks;

[0079] The seed is used to generate a series of round keys using a specified key expansion algorithm;

[0080] Processing the plurality of data blocks and the seed key by bitwise XOR, and replacing each byte of the data blocks after the bitwise XOR processing by using a specified lookup table;

[0081] A row shift operation of circularly shifting each row of the data block after row replacement to the left according to a specified rule;

[0082] Perform linear transformation on the data block after the row shift operation within the column, and use matrix multiplication to mix the column data;

[0083] Take the first 16 bits of the data of the mixed column using matrix multiplication to generate the root key.

[0084] Example 3

[0085] Based on Example 1 or Example 2, the specified cryptographic algorithm in step S33 is a hash operation, and the specific process of obtaining the key encryption key through the hash operation is as follows:

[0086] S331: Preprocess the root key to process it into an integer multiple of 512 bytes. Let the length of the root key be X. The specific formula for processing the root key into an integer multiple of 512 bytes is:

[0087] X mod 512 = 448;

[0088] Wherein, mod is the modulus function. The length of the data to be filled is obtained according to the above formula. The filling process is to fill after the root key. The first filled bit is 1 and the rest are 0.

[0089] First, fill the root key with a "1", and then add k zeros after it, where k is the smallest positive integer that satisfies "(n+1+k) mod 512", and mod is a modulus operation;

[0090] S332: Append 64-bit data length, set 8 fixed 32-byte variables as initial values ​​for hash calculation, and initialize round function constants;

[0091] S333: Split the preprocessed root key into data blocks with 512 bytes as units, and decompose the split data blocks into 16 32-bit character strings;

[0092] S334: Iteratively compress the 16 32-bit character strings after segmentation, and correct the compressed character strings, and concatenate the corrected character strings in the specified order to obtain the final hash value as the key encryption key. The iterative compression process does not use data grouping for calculation, but applies iterative compression to generate 132 message words, each of which has a length of 32, four bytes, and 8 hexadecimal digits. That is, a 512-bit data group is divided into 16 message words, and the first 16 of the 132 message words generated are used, and the remaining 116 message words are recursively generated using the 16 message words.

[0093] In this embodiment, the specific process of calling the encryption card API interface in the cloud server to obtain the session key in step S34 is as follows:

[0094] S341: Call the cryptAcquireContext function based on the encryption card API interface to obtain the handle of the key container in the CSP module;

[0095] S342: The target vehicle uses the CryptImportKey function to import the recipient's certificate into the CSP module to obtain the public key of the cloud server;

[0096] S343: The cloud server uses the CryptGenKey function to randomly generate a session key and encrypts the session key using the public key of the target vehicle. The encrypted session key is then exported and sent to the target vehicle;

[0097] S344: After receiving the encrypted session key, the target vehicle uses its own private key to call the CryptImportKey function to decrypt the session key.

[0098] Step S35 specifically involves the target vehicle and the cloud server calling the CryptEncrypt function and the CryptDecrypt function based on the session key to encrypt and decrypt the data, thereby achieving encrypted communication between the two parties.

[0099] See also Figure 3 As shown, a secure communication system for a digital car key is used to implement any one of the secure communication methods for a digital car key, including a target vehicle, a digital car key, a cloud server, a key generation module, a data encryption module, and a transmission module, wherein the target vehicle is connected to the user-end digital car key, the target vehicle is connected to the cloud server, the key generation module is integrated in the cloud server, the key generation module is connected to the data encryption module, the data encryption module is connected to the transmission module, and the digital car key is set in the user's mobile phone terminal;

[0100] The digital car key is used to open the door and start the target vehicle;

[0101] The cloud server is used to manage the digital car key and control the function and security of the digital car key;

[0102] The key generation module is used to generate a seed key through negotiation between the cloud server and the target vehicle; discretize the input of the cloud server using a discrete algorithm, and obtain a root key based on the seed key; operate the root key based on a specified cryptographic algorithm to obtain a key encryption key; call the encryption card API interface in the cloud server to obtain a session key, and store the session key in a ciphertext plus a hash value manner;

[0103] The data encryption module is used to encrypt the data in the communication process based on the key generated by the key generation module;

[0104] The transmission module is used to transmit the specified key and encrypted data to achieve communication between the target vehicle and the cloud server.

[0105] In summary, the secure communication method and system of the digital car key provided by the present invention is that the user downloads the digital car key and registers, initiates a connection request with the target vehicle through the digital car key, and the target vehicle broadcasts to the cloud server; the target vehicle continuously broadcasts signals, and the digital car key turns on Bluetooth and scans. When the target vehicle signal is scanned, a connection is established between the digital car key and the target vehicle and identity authentication is performed; the cloud server initiates a pairing request after receiving the broadcast, and after the pairing is successful, the digital car key accepts the pairing request, and the cloud server exchanges public keys with the target vehicle and generates an encryption key, which is used to encrypt communication data, and the encrypted communication data is stored in the cloud server; the cloud server and the target vehicle perform encrypted communication based on the encrypted communication data, and the intelligent cockpit domain control of the target vehicle performs positioning to complete the door opening. The security risks of users in the process of using digital car keys are effectively reduced.

[0106] During the communication between the target vehicle and the cloud server, the cloud server and the target vehicle generate an initial random seed key of a binary sequence of specified length through negotiation; the input of the cloud server is discretized using a discrete algorithm, and a root key is obtained based on the seed key; the root key is operated based on a specified cryptographic algorithm to obtain a key encryption key; the encryption card API interface in the cloud server is called to obtain a session key, and the session key is stored in the form of ciphertext plus hash value; the cloud server and the target vehicle encrypt and decrypt communication data through the session key to achieve secure encrypted communication between the two parties.

[0107] Through the above multi-level key structure system, the root key is obtained by using a discrete algorithm to discretely input the user. The root key is calculated using an irreversible cryptographic algorithm to obtain the key encryption key. The root key and the key encryption key are stored in the non-volatile storage area of ​​the cloud server encryption card. The data in this area is not allowed to be modified and can only be erased and rewritten, and is managed by the encryption card role authentication mechanism. The session key is generated by the random number chip of the cloud server encryption card, and is exported after being protected by the key encryption key. It is stored in the device in the form of "ciphertext plus hash value", which effectively avoids the risk of the key being stolen and lost during use.

[0108] When communication data needs to be stored, the session key in ciphertext is obtained, and the API interface of the encryption card is called. At the same time, the key encryption key and the corresponding cryptographic algorithm are used to decrypt the session key. Finally, the communication data is encrypted and stored using the session key. When the data needs to be read, the communication data is decrypted using the same method. The entire encrypted communication process does not involve the plaintext transmission and storage of the session key. Even if the ciphertext session key is leaked, it still does not affect the security of the stored data. The hash value can easily detect whether there is any tampering or malicious destruction of the key, thereby alerting the user.

Claims

1. A secure communication method for a digital car key, characterized in that: The following steps are involved: S1: The user downloads the digital car key on his mobile phone terminal and registers his identity information, and initiates a connection request with the target vehicle through the digital car key, and the target vehicle broadcasts to the cloud server; S2: The target vehicle continuously broadcasts NFC signals, UWB signals, or BLE signals. The digital car key turns on Bluetooth and scans. When the NFC signal, UWB signal, or BLE signal broadcast by the target vehicle is scanned, a connection is established between the digital car key and the target vehicle and identity authentication is performed. S3: After the identity authentication is successful, the cloud server initiates a pairing request after receiving the broadcast. After the pairing is successful, the digital car key accepts the pairing request, the cloud server exchanges public keys with the target vehicle, and generates an encryption key. The encryption key is used to encrypt the communication data, and the encrypted communication data is stored in the cloud server; S4: The cloud server and the target vehicle perform encrypted communication based on the encrypted communication data and add it to the parsing list; S5: The intelligent cockpit domain control of the target vehicle performs positioning based on the UWB signal and completes the door opening operation of the target vehicle; The specific process of step S3 is as follows: S31: The cloud server and the target vehicle generate an initial random binary sequence of a specified length through negotiation, wherein the binary sequence is a seed key; S32: Discretize the input of the cloud server using a discrete algorithm, and obtain a root key based on the seed key; S33: Calculate the root key based on a specified cryptographic algorithm to obtain a key encryption key; S34: calling the encryption card API interface in the cloud server to obtain the session key, and storing the session key in a ciphertext plus hash value manner; S35: The cloud server and the target vehicle encrypt and decrypt the communication data using the session key to achieve encrypted communication between the two parties; The specific process of using the discrete algorithm to discretize the cloud server input in step S32 is as follows: S321: sorting the input data of the cloud server and performing deduplication processing on the sorted data; S322: Map the input data of the cloud server to the specified data based on the binary search or index mapping method.

2. A secure communication method for a digital car key according to claim 1, characterized in that: The specific process of obtaining the root key based on the seed key in step S32 is as follows: Divide the specified data in step S322 into a plurality of data blocks; The seed is used to generate a series of round keys using a specified key expansion algorithm; Processing the plurality of data blocks and the seed key by bitwise XOR, and replacing each byte of the data blocks after the bitwise XOR processing by using a specified lookup table; A row shift operation of circularly shifting each row of the data block after row replacement to the left according to a specified rule; Perform linear transformation on the data block after the row shift operation within the column, and use matrix multiplication to mix the column data; Take the first 16 bits of the data of the mixed column using matrix multiplication to generate a root key.

3. A secure communication method for a digital car key according to claim 1, characterized in that: The specified cryptographic algorithm in step S33 is a hash operation. The specific process of obtaining the key encryption key through the hash operation is as follows: S331: Preprocess the root key to process it into an integer multiple of 512 bytes. Let the length of the root key be X. The specific formula for processing the root key into an integer multiple of 512 bytes is: X mod 512 = 448; Wherein, mod is the modulus function. The length of the data to be filled is obtained according to the above formula. The filling process is to fill after the root key. The first filled bit is 1 and the rest are 0. S332: Set 8 fixed 32-byte variables as initial values ​​for hash calculation and initialize round function constants; S333: Split the preprocessed root key into data blocks with 512 bytes as units, and decompose the split data blocks into 16 32-bit character strings; S334: Iteratively compress the 16 32-bit character strings after segmentation, and correct the compressed character strings. The corrected character strings are concatenated in a specified order to obtain a final hash value as a key encryption key.

4. A secure communication method for a digital car key according to claim 1, characterized in that: The specific process of calling the encryption card API interface in the cloud server to obtain the session key in step S34 is as follows: S341: Call the cryptAcquireContext function based on the encryption card API interface to obtain the handle of the key container in the CSP module; S342: The target vehicle uses the CryptImportKey function to import the recipient's certificate into the CSP module to obtain the public key of the cloud server; S343: The cloud server uses the CryptGenKey function to randomly generate a session key and encrypts the session key using the public key of the target vehicle. The encrypted session key is then exported and sent to the target vehicle; S344: After receiving the encrypted session key, the target vehicle uses its own private key to call the CryptImportKey function to decrypt the session key.

5. A secure communication method for a digital car key according to claim 1, characterized in that: Step S35 specifically involves the target vehicle and the cloud server calling the CryptEncrypt function and the CryptDecrypt function based on the session key to encrypt and decrypt the data, thereby achieving encrypted communication between the two parties.

6. A secure communication system for a digital car key, used to implement a secure communication method for a digital car key according to any one of claims 1 to 5, characterized in that: It includes a target vehicle, a digital car key, a cloud server, a key generation module, a data encryption module, and a transmission module. The target vehicle is connected to the user-end digital car key, the target vehicle is connected to the cloud server, the key generation module is integrated in the cloud server, the key generation module is connected to the data encryption module, the data encryption module is connected to the transmission module, and the digital car key is set in the user's mobile phone terminal; The digital car key is used to open the door and start the target vehicle; The cloud server is used to manage the digital car key and control the function and security of the digital car key; The key generation module is used to generate a seed key through negotiation between the cloud server and the target vehicle; Discretize the input of the cloud server using a discrete algorithm, and obtain a root key based on the seed key; operate the root key based on a specified cryptographic algorithm to obtain a key encryption key; call the encryption card API interface in the cloud server to obtain a session key, and store the session key in a ciphertext plus a hash value manner; The data encryption module is used to encrypt the data in the communication process based on the key generated by the key generation module; The transmission module is used to transmit the specified key and the encrypted data to achieve communication between the target vehicle and the cloud server; The execution process of the key generation module and the data encryption module is as follows: The cloud server and the target vehicle generate an initial random binary sequence of a specified length through negotiation, and the binary sequence is a seed key; Discretize the input of the cloud server using a discrete algorithm, and obtain a root key based on the seed key; The root key is operated based on a specified cryptographic algorithm to obtain a key encryption key; Call the encryption card API interface in the cloud server to obtain the session key, and store the session key in the form of ciphertext plus hash value; The cloud server and the target vehicle encrypt and decrypt the communication data through the session key to achieve encrypted communication between the two parties; The specific process of using the discrete algorithm to discretize the cloud server input is as follows: Sort the input data of the cloud server and perform deduplication processing on the sorted data; Based on binary search or index mapping method, the input data of the cloud server is mapped to the specified data.

Images