Key processing method, system and equipment for vehicle controller and medium

Abstract

The embodiment of the invention discloses a secret key processing method, system and device for a vehicle controller and a medium. In response to an interaction operation of the user interface, determining target identification information of the target service module; according to the target identification information, determining a target service key of a target service module from a pre-constructed key derivation tree of a vehicle; wherein the key derivation tree comprises a root key, an electronic and electrical architecture key layer, a controller key layer and a service module key layer, and key nodes in the key layers are generated according to key derivation parameters corresponding to the key layers and attribute information of the key nodes; and issuing the target service key to a controller of the vehicle for storage. According to the embodiment of the invention, an automobile networking service key management system is combined with an automobile application scene, so that the method is suitable for key acquisition in multiple scenes, and the confidentiality, integrity and availability of the key are protected.

Description

Technical Field

[0001] Embodiments of the present invention relate to the field of vehicle information security technology, and in particular, to a key processing method, system, device and medium for a vehicle controller. Background Art

[0002] At present, the car controller key may face a variety of security threats during the generation, distribution and storage process. These threats may come from different aspects, including technical vulnerabilities, human errors or intentional attacks. In the key generation process, there is a threat of insufficient random number generation. If the random number generator used in key generation is of low quality, the generated key may be easily predicted; in the key distribution process, there are threats of man-in-the-middle attacks and insecure key transmission channels; man-in-the-middle attacks refer to the possibility that attackers may intercept and replace keys during key transmission, thereby controlling encrypted communications; insecure key transmission channels refer to the possibility that keys may be stolen if they are transmitted through insecure channels, such as unencrypted emails or HTTP connections; in the key storage process, there is a threat of unauthorized access. If the keys are stored in an inadequately protected car controller, unauthorized users may access and steal the keys.

[0003] Currently, there are two problems with the generation and distribution of automotive controller keys: 1. Lack of management of automotive controller key application scenarios; 2. Lack of effective key confidentiality and integrity protection during key distribution to automotive controllers. Summary of the invention

[0004] The present invention provides a key processing method, system, device and medium for a vehicle controller, which combines a vehicle networking service key management system with a vehicle application scenario, is suitable for key acquisition in multiple scenarios, and protects key confidentiality, integrity and availability.

[0005] In a first aspect, an embodiment of the present invention provides a key processing method for a vehicle controller, comprising:

[0006] In response to an interactive operation of the user interface, determining target identification information of a target business module;

[0007] According to the target identification information, determine the target business key of the target business module from a pre-built key derivation tree of the vehicle; wherein the key derivation tree includes a root key, an electronic and electrical architecture key layer, a controller key layer, and a business module key layer, and a key node in each key layer is generated according to a key derivation parameter corresponding to the key layer and attribute information of the key node;

[0008] The target business key is published to a controller of the vehicle for storage.

[0009] In a second aspect, an embodiment of the present invention further provides a key processing system for a vehicle controller, comprising:

[0010] An identification acquisition module, used to determine target identification information of a target business module in response to an interactive operation of a user interface;

[0011] A business key determination module, used to determine the target business key of the target business module from a pre-built key derivation tree of the vehicle according to the target identification information; wherein the key derivation tree includes a root key, an electronic and electrical architecture key layer, a controller key layer, and a business module key layer, and a key node in each key layer is generated according to a key derivation parameter corresponding to the key layer and attribute information of the key node;

[0012] The business key issuing module is used to issue the target business key to the controller of the vehicle for storage.

[0013] In a third aspect, an embodiment of the present invention further provides an electronic device, comprising: a processor, a memory, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, a key processing method for a vehicle controller as described in any one of the embodiments of the present invention is implemented.

[0014] In a fourth aspect, an embodiment of the present invention further provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements a key processing method for a vehicle controller as described in any one of the embodiments of the present invention.

[0015] The embodiment of the present invention determines the business key of the vehicle controller through a pre-built key derivation tree of the vehicle, combines the business key of the vehicle controller with its specific business scenario, realizes the precise management of the business key corresponding to the specific business scenario in the vehicle controller, obtains the business key according to the key derivation tree to ensure the accurate acquisition of the business key, and further improves the efficiency of business key injection in the vehicle controller. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 is a flow chart of a key processing method for a vehicle controller provided according to an embodiment of the present invention;

[0017] Figure 2 is a schematic diagram of the design of a car networking service key management system used in an embodiment of the present invention;

[0018] Figure 3 is a schematic diagram of a design of a key derivation tree used in an embodiment of the present invention;

[0019] Figure 4is a flow chart of a key processing method for a vehicle controller provided according to an embodiment of the present invention;

[0020] Figure 5 A schematic diagram of a design of a key processing method for a vehicle controller according to an embodiment of the present invention;

[0021] Figure 6 is a structural block diagram of a key processing system for a vehicle controller provided according to an embodiment of the present invention;

[0022] Figure 7 It is a structural block diagram of an electronic device provided for an embodiment of the present invention. DETAILED DESCRIPTION

[0023] The present invention will be further described in detail below in conjunction with the accompanying drawings and embodiments. It is to be understood that the specific embodiments described herein are only used to explain the present invention, rather than to limit the present invention. It should also be noted that, for ease of description, only parts related to the present invention, rather than all structures, are shown in the accompanying drawings.

[0024] Figure 1 A flowchart of a key processing method for a vehicle controller provided in an embodiment of the present invention, which can be applied to the data communication process in the vehicle controller, and can ensure the security and reliability of vehicle information through the method of the embodiment of the present invention. The method can be executed by the key processing system for the vehicle controller provided in an embodiment of the present invention, which can be implemented in software and / or hardware, and can be completed by an electronic device with data processing function. The method can be applied to the key management system of the automobile network service, and specifically includes the following steps:

[0025] Step 110: In response to the interactive operation of the user interface, determine the target identification information of the target business module.

[0026] The target business module is a business function module for data transmission between the vehicle controller and the outside world; its business functions include software upgrades, remote diagnosis, driving data collection, and remote query or control. The vehicle controller transmits vehicle data to external devices such as mobile terminals, cloud servers, other vehicles or infrastructure through the business module, enabling the vehicle to achieve intelligent and networked development.

[0027] The target identification information is a character string or code that identifies the location and affiliation of the target business module in the vehicle controller; the identification information reflects the path information of the business module from the top level to the bottom level of the controller to the specific business module according to the hierarchical structure of the vehicle controller.

[0028] The user interface is the interface for the car networking service key management system to exchange information with users; the car networking service key management system is used to manage the keys used in the car networking service, involving multiple links such as key generation, distribution, storage, use and update. Figure 2 As shown, the car networking service key management system interacts with users through the user interface and application program interface; the key management module is used to build key derivation tree information, the user management module is used to manage the user account password information that can log in to the system, and the authority management module is for the administrator to enter the system to input the relevant information of the key requirement, so as to build the corresponding key derivation tree according to the key requirement; the password engine module is used to store the relevant information of the key derivation tree. The vehicle business key generated by the car networking service key management system is the verification key used by the vehicle controller to communicate data with the outside world. It is often injected into the vehicle controller during the research and development and production stage of the vehicle controller, so that when the vehicle controller needs to interact with data communication, it can directly use the business key to encrypt or decrypt the vehicle data to ensure the confidentiality and integrity of the vehicle data.

[0029] For example, according to different usage scenarios in the vehicle controller production process, each business key in the vehicle controller can be obtained by manual application or automatic application by the device, specifically including:

[0030] In one way, during the controller development stage, the software developer enters the account password in the user interface of the vehicle network business key management system, logs into the vehicle network business key management system, and enters the corresponding identification information of the business module that needs to be injected with the key into the system interface. It should be noted that the specific identification information input method can be through text input or voice input, and the present invention does not specifically limit this.

[0031] Another way is that at the end of the production cycle of the controller, the controller device automatically sends a key request to the vehicle network service key management system. The key application includes the target identification information corresponding to the business module that needs to be key injected.

[0032] Step 120: Determine the target business key of the target business module from a pre-built key derivation tree of the vehicle according to the target identification information.

[0033] The key derivation tree includes the root key, the electronic and electrical architecture key layer, the controller key layer and the business module key layer. The key nodes in each key layer are generated according to the key derivation parameters corresponding to the key layer and the attribute information of the key node. The key derivation tree is a tree structure used to manage and generate keys. Figure 3As shown, starting from the root key, the nodes of each layer are keys, key derivation keys and business keys in turn, and each layer of nodes is generated according to the corresponding upper layer nodes, key derivation parameters P and key derivation algorithms. Specifically, the tree structure hierarchy of the key derivation tree can be divided according to the structural hierarchy of the vehicle controller; each node in the tree structure represents a key; the root node can be the root key; for example: in a key derivation tree of a vehicle networking system, the root key is the master key of the entire system, which is used to generate other node keys in the structural hierarchy of the vehicle controller; the key of the middle level is the key of a certain function; the key of the leaf node is the specific business key of a specific business function; the key derivation parameters corresponding to each layer in the key derivation tree are used to generate the keys of each node, which are randomly generated and selected according to the key derivation function, and each key derivation parameter is different from each other; it should be noted that the key derivation parameters can be selected according to specific security requirements and the structural hierarchy of the vehicle controller, and the embodiment of the present invention does not specifically limit this.

[0034] The key of each layer of nodes is generated based on the nodes of the previous layer corresponding to the layer, the key derivation parameters and key derivation algorithm corresponding to the layer. For example: each key node in the electronic and electrical architecture key layer is generated based on the root key, the key derivation parameters and key derivation algorithm corresponding to the electronic and electrical architecture key layer; each key node in the controller key layer is generated based on the key nodes in the electronic and electrical architecture key layer corresponding to the controller key layer, the key derivation parameters and key derivation algorithm corresponding to the controller key layer; each key node in the business module key layer is generated based on the key nodes in the controller key layer corresponding to the business module key layer, the key derivation parameters and key derivation algorithm corresponding to the business module key layer.

[0035] Optionally, the attribute information of the key nodes in the electronic and electrical architecture key layer is the version information of the electronic and electrical architecture; the attribute information of the key nodes in the controller key layer is the controller identification; the controller identification includes at least one of the following: front body control, rear body control or vehicle body control; the attribute information of the key nodes in the business module key layer is the business identification; the business identification includes at least one of the following: diagnosis, secure access or secure communication.

[0036] It can be understood that the key derivation tree structure is a multi-level architecture of the vehicle controller, for example: the controller architecture is built according to the business level, starting from the root key node, the first layer of attribute information is the electronic and electrical architecture type, such as the first generation architecture, the second generation architecture or the third generation architecture; the second layer is the controller function type architecture, and its attribute information is a specific controller identification, such as at least one of the controller front control, rear control or body control under the first generation architecture type in the first layer; the third layer is the specific business type of the controller, and its attribute information is a business identification, such as at least one of the diagnosis, secure access or secure communication under the second layer body control type.

[0037] The pre-built key derivation tree can be used to directly obtain business keys without the need for secondary generation, and further ensures accurate acquisition of business keys during subsequent business key injection, thereby improving the efficiency of subsequent business key acquisition.

[0038] Optionally, the target identification information includes an electronic and electrical architecture version to which the target controller belongs, a target controller ID to which the target business module belongs, and a target ID of the target business module.

[0039] It can be understood that the vehicle networking business key management system obtains the path information corresponding to the target business module that needs to be injected with keys through interactive operations of the user interface, including the ID of the target business module, the target controller ID and the electronic and electrical architecture version information of the target controller. The vehicle networking business key management system determines the corresponding node from the pre-built key derivation tree based on the electronic and electrical architecture version information, the target controller and the target business module under the target controller according to the obtained target identification information, and then uses the node key as the target business key.

[0040] In an embodiment of the present invention, through the tree structure of the key derivation tree, combined with the multi-level architecture of the vehicle, the business key corresponding to the specific business module can be accurately determined, and the vehicle controller key can be combined with the specific business scenario to ensure the accuracy of business key acquisition, and further improve the efficiency of business key acquisition through the tree structure.

[0041] Step 130: Publish the target business key to a controller of the vehicle for storage.

[0042] For example, during the controller development stage, the software developer enters the account and password in the user interface of the vehicle networking business key management system for verification. After successful verification, the developer logs in to the vehicle networking business key management system and enters the key request into the system interface. The vehicle networking business key management system obtains the corresponding target business key through the key derivation tree structure and then feeds back to the software developer through a secure channel. The software developer injects the target business key into the controller.

[0043] There is another way. At the end of the production cycle of the controller, the controller device automatically sends a key request to the vehicle network business key management system through a secure channel. The vehicle network business key management system obtains the corresponding target business key through the key derivation tree structure based on the key request, and feeds back the target business key to the controller device through the secure channel to complete the automatic injection of the business key in the controller.

[0044] After determining the target business key, the target business key is published to the vehicle's controller for storage, so that subsequent business modules can encrypt vehicle data with the injected business key when communicating data with the outside world. By injecting the business key into the vehicle controller, it is ensured that when the vehicle is updated, diagnosed or remotely controlled, important data in the vehicle data transmission process can be effectively protected to prevent malicious attacks and data tampering. Optionally, the vehicle controller can store the business key in an HSM (Hardware Security Module) and use the HSM for controller-side key storage to protect the confidentiality of the key and prevent unauthorized users from privately accessing and stealing the key.

[0045] The technical solution of the embodiment of the present invention determines the target identification information of the target business module in response to the interactive operation of the user interface; determines the target business key of the target business module from the pre-built key derivation tree of the vehicle according to the target identification information; wherein the key derivation tree includes a root key, an electronic and electrical architecture key layer, a controller key layer and a business module key layer, and the key nodes in each key layer are generated according to the key derivation parameters corresponding to the key layer and the attribute information of the key node; the target business key is published to the controller of the vehicle for storage; the technical problem of inadequate management of the application scenario of the vehicle controller is solved, the business key of the vehicle controller is determined through the pre-built key derivation tree of the vehicle, the business key of the vehicle controller is combined with its application scenario, and the precise management of the business key corresponding to the application scenario of the vehicle controller is realized, the confidentiality, integrity and availability of the key are protected, and the technical effect of further improving the injection efficiency of the business key in the vehicle controller is achieved.

[0046] On the basis of the above technical solution, further, after a certain business module in the controller is replaced, the corresponding business key needs to be injected so that the replaced controller can be used normally, and the key injection process is optimized. It should be noted that for the parts not described in detail in the embodiments of the present invention, reference can be made to the relevant description of the aforementioned embodiments.

[0047] In an optional implementation, when any service module in the vehicle is replaced, the replaced service module is used as a new target service module, and the identification information of the original service module is used as the identification information of the new target service module;

[0048] According to the identification information of the new target service module, determining the corresponding original service key from the key derivation tree as the target service key of the new target service module;

[0049] The target service key of the new target service module is published to the new target service module in the controller for storage.

[0050] Exemplarily, during the maintenance process, the maintenance personnel send a key application to the automobile network business key management system through the diagnostic instrument, use the currently replaced business module as the target business module, and use the identification information of the original business module as the identification information of the target business module. The identification information can determine the position and affiliation of the business module in the controller, and reflect the path information of the business module from the top layer to the bottom layer in the controller hierarchy to the specific business module. The automobile network business key management system determines the node corresponding to the target business module in the key derivation tree according to the path information, and obtains the corresponding node key as the target business key of the target business module. The automobile network business key management system publishes the target business key to the new target business module in the controller, and stores the corresponding relationship between the new target business module and the target business key corresponding to the new target business module, so that when the new target business module performs data transmission later, the target business key corresponding to the new target business module can be directly called to encrypt the vehicle data.

[0051] It is understandable that if one or more business modules in the controller fails and the controller needs to be replaced, the business modules in the replaced controller do not have the corresponding business keys injected into them under the current vehicle architecture. To ensure that the controller can be used normally after repair, the corresponding business keys need to be injected into the replaced new business modules. For the replaced business module, the original business key can be directly obtained as the business key of the business module based on the constructed key derivation tree, avoiding repeated generation of business keys and waste of resources.

[0052] Figure 4 This is a flowchart of another key processing method for a vehicle controller provided by an embodiment of the present invention. Based on the above embodiment, the embodiment of the present invention supplements the construction method of the key derivation tree. It should be noted that for the part not described in detail in the embodiment of the present invention, reference can be made to the relevant descriptions of other embodiments.

[0053] Step 210: Obtain key requirements from the user interface; wherein the key requirements include electronic and electrical architecture type, controller function type, and controller business type.

[0054] The administrator enters the key requirements through the user interface of the vehicle network business key management system, which is a multi-level structure corresponding to the vehicle controller, including: the electronic and electrical architecture type of the controller, the function type within each architecture, and the business type corresponding to each function type. For example, the controller architecture type is the first-generation architecture or second-generation architecture corresponding to the controller. Different architecture types correspond to different hierarchical structures. Different vehicles can use the same controller electronic and electrical architecture type; the function type within each architecture is the function corresponding to the control architecture; different functions have one or more businesses.

[0055] It is understandable that the administrator inputs the key requirements through the user interface of the vehicle networking business key management system, including the electronic and electrical architecture type is the first-generation architecture of vehicle control, the next level is the front control function, rear control function and body control function included in this generation of architecture; the last level is the multiple business modules such as diagnostic business, security access business, remote control business, etc. included under the body control function.

[0056] Furthermore, the automobile network service key management system can build a corresponding vehicle key derivation tree based on the administrator authority module according to the input key requirements. The vehicle key derivation tree is constructed according to the multi-level structure of the vehicle controller, and the levels of the vehicle key derivation tree are divided according to the vehicle hierarchy structure; the key derivation parameters corresponding to each level can be automatically generated according to a random function, and the vehicle structure level in the key derivation tree and the corresponding key derivation parameters at each level are encrypted and stored.

[0057] Step 220: Call the key generation tool to generate the key in the corresponding key node according to the key derivation parameters of the electronic and electrical architecture key layer, the controller key layer and the business module key layer and the attribute information of the key node in each key layer.

[0058] The key generation tool can be a PKI (Public Key Infrastructure), and the automotive network service key management system calls PKI to generate key nodes in the key derivation tree. Specifically, each layer of nodes is determined according to the key derivation parameters corresponding to the key layer and the attribute information of the node, and the key of each layer of nodes is generated according to the child nodes of the previous layer corresponding to the layer, the key derivation parameters corresponding to the layer, and the key derivation algorithm; for example: each key node in the electronic and electrical architecture key layer is generated according to the root key, the key derivation parameters and key derivation algorithm corresponding to the electronic and electrical architecture key layer; each key node in the controller key layer is generated according to the key nodes in the electronic and electrical architecture key layer corresponding to the controller key layer, the key derivation parameters and key derivation algorithm corresponding to the controller key layer; each key node in the business module key layer is generated according to the key nodes in the controller key layer corresponding to the business module key layer, the key derivation parameters and key derivation algorithm corresponding to the business module key layer.

[0059] The key of each key node is stored in PKI, so that the corresponding business key can be determined from PKI according to the position of the business module in the key derivation tree and the key can be released later.

[0060] The vehicle key derivation tree is built through the multi-level architecture of the vehicle controller, and PKI is called to generate the keys corresponding to each node in the vehicle key derivation tree to construct the key derivation tree used for subsequent key release; each business key in the vehicle controller is associated with a specific business scenario to ensure the accuracy and confidentiality of subsequent key release.

[0061] Step 230: In response to the interactive operation of the user interface, determine the target identification information of the target business module.

[0062] Step 240: Determine the target business key of the target business module from a pre-built key derivation tree of the vehicle based on the target identification information; wherein the key derivation tree includes a root key, an electronic and electrical architecture key layer, a controller key layer, and a business module key layer, and the key nodes in each key layer are generated based on the key derivation parameters corresponding to the key layer and the attribute information of the key node.

[0063] Step 250: Publish the target business key to a controller of the vehicle for storage.

[0064] The technical solution of the embodiment of the present invention determines the target identification information of the target business module in response to the interactive operation of the user interface; determines the target business key of the target business module from the pre-built key derivation tree of the vehicle according to the target identification information; wherein the key derivation tree includes a root key, an electronic and electrical architecture key layer, a controller key layer and a business module key layer, and the key nodes in each key layer are generated according to the key derivation parameters corresponding to the key layer and the attribute information of the key node; the target business key is published to the controller of the vehicle for storage; the technical problem of inadequate management of the application scenario of the vehicle controller is solved, the business key of the vehicle controller is determined through the pre-built key derivation tree of the vehicle, the business key of the vehicle controller is combined with its specific business scenario, and the confidentiality, integrity and availability of the key are protected; the precise management of the business keys corresponding to the application scenarios of the vehicle controller is realized, the accurate acquisition of the business keys is ensured, and the technical effect of further improving the injection efficiency of the business keys in the vehicle controller is achieved.

[0065] Figure 5This is a specific key processing method framework design diagram combined with the automobile network business key management system. The automobile network business key management system manages the generation and release of business keys corresponding to each ECU (Electronic Control Unit) in the vehicle controller; obtains key application information and builds a key derivation tree through information exchange with the administrator through the web client, and calls PKI to generate keys for each node in the key derivation tree; and data is transmitted through a secure communication channel during the key release stage, and business keys are manually released with users through the web client; business keys are automatically obtained and injected through MES (Manufacturing Execution System) and EOL (End-of-life, final node equipment); business keys are repaired and replaced with diagnostic instruments and maintenance personnel; it should be noted that the means of protecting data in the secure communication channel during data transmission can use encryption algorithms to convert plaintext data into ciphertext, transmit data through VPN, etc. In practical applications, appropriate secure channel transmission technology can be selected according to specific business needs and technical characteristics, and the present invention does not specifically limit this.

[0066] The embodiment of the present invention utilizes PKI for key generation and background storage, manages specific business scenarios of vehicle controllers and distributes corresponding business keys through the automobile network business key management system, and promotes the development of automobile controller key management; the controller obtains the business key corresponding to the business module through a secure channel, and further protects the availability, integrity and confidentiality of the key during the key release process.

[0067] Figure 6 It is a schematic diagram of the structure of a key processing system for a vehicle controller provided by an embodiment of the present invention. The key processing system 300 includes an identification acquisition module 310 , a business key determination module 320 , and a business key issuance module 330 .

[0068] Exemplarily, an identification acquisition module is used to determine target identification information of a target business module in response to an interactive operation of a user interface;

[0069] A business key determination module, used to determine the target business key of the target business module from a pre-built key derivation tree of the vehicle according to the target identification information; wherein the key derivation tree includes a root key, an electronic and electrical architecture key layer, a controller key layer, and a business module key layer, and a key node in each key layer is generated according to a key derivation parameter corresponding to the key layer and attribute information of the key node;

[0070] The business key issuing module is used to issue the target business key to the controller of the vehicle for storage.

[0071] Wherein, the attribute information of the key node in the electronic and electrical architecture key layer is the version information of the electronic and electrical architecture;

[0072] The attribute information of the key node in the controller key layer is a controller identifier; the controller identifier includes at least one of the following: front body control, rear body control or vehicle body control;

[0073] The attribute information of the key node in the business module key layer is a business identifier; the business identifier includes at least one of the following: diagnosis, secure access or secure communication.

[0074] The target identification information includes the electronic and electrical architecture version to which the target controller belongs, the target controller ID to which the target business module belongs, and the target ID of the target business module.

[0075] On the basis of the above technical solutions, the device further comprises a key derivation tree construction module, specifically comprising: a demand acquisition unit and a key generation unit;

[0076] The requirement acquisition unit is used to acquire a key requirement from a user interface; wherein the key requirement includes an electronic and electrical architecture type, a controller function type, and a controller service type;

[0077] The key generation unit is used to call the key generation tool to generate the key in the corresponding key node according to the key derivation parameters of the electronic and electrical architecture key layer, the controller key layer and the business module key layer and the attribute information of the key node in each key layer.

[0078] On the basis of the above technical solutions, the device further includes a key replacement module, which is specifically used to use the replaced business module as a new target business module and the identification information of the original business module as the identification information of the new target business module when any business module in the vehicle is replaced;

[0079] According to the identification information of the new target service module, determining the corresponding original service key from the key derivation tree as the target service key of the new target service module;

[0080] The target service key of the new target service module is published to the new target service module in the controller for storage.

[0081] The technical solution of the embodiment of the present invention determines the target identification information of the target business module in response to the interactive operation of the user interface; determines the target business key of the target business module from the pre-built key derivation tree of the vehicle according to the target identification information; wherein the key derivation tree includes a root key, an electronic and electrical architecture key layer, a controller key layer and a business module key layer, and the key nodes in each key layer are generated according to the key derivation parameters corresponding to the key layer and the attribute information of the key node; the target business key is published to the controller of the vehicle for storage; the technical problem of inadequate management of the application scenario of the vehicle controller is solved, the business key of the vehicle controller is determined through the pre-built key derivation tree of the vehicle, the business key of the vehicle controller is combined with its application scenario, and the precise management of the business key corresponding to the application scenario of the vehicle controller is realized, the confidentiality, integrity and availability of the key are protected, and the technical effect of further improving the injection efficiency of the business key in the vehicle controller is achieved.

[0082] Figure 7 It is a structural diagram of an electronic device provided by an embodiment of the present invention. Figure 7 A block diagram of an exemplary electronic device 12 suitable for use in implementing embodiments of the present invention is shown. Figure 7 The electronic device 12 shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present invention.

[0083] like Figure 7 As shown, the electronic device 12 is in the form of a general purpose computing device. The components of the electronic device 12 may include, but are not limited to: one or more processors or processing units 16, a system memory 28, and a bus 18 that connects various system components (including the system memory 28 and the processing unit 16).

[0084] Bus 18 represents one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, an accelerated graphics port, a processor or a local bus using any of a variety of bus architectures. By way of example, these architectures include, but are not limited to, an Industry Standard Architecture (ISA) bus, a Micro Channel Architecture (MAC) bus, an Enhanced ISA bus, a Video Electronics Standards Association (VESA) local bus, and a Peripheral Component Interconnect (PCI) bus.

[0085] The electronic device 12 typically includes a variety of computer system readable media. These media can be any available media that can be accessed by the electronic device 12, including volatile and non-volatile media, removable and non-removable media.

[0086] The system memory 28 may include computer system readable media in the form of volatile memory, such as random access memory (RAM) 30 and / or cache memory 32. The electronic device 12 may further include other removable / non-removable, volatile / non-volatile computer system storage media. By way of example only, the storage system 34 may be used to read and write non-removable, non-volatile magnetic media ( Figure 7 not shown, usually called a "hard drive"). Although Figure 7 Not shown in the figure, a disk drive for reading and writing to a removable non-volatile disk (e.g., a "floppy disk"), and an optical disk drive for reading and writing to a removable non-volatile optical disk (e.g., a CD-ROM, a DVD-ROM, or other optical media) may be provided. In these cases, each drive may be connected to the bus 18 via one or more data medium interfaces. The memory 28 may include at least one program product having a set (e.g., at least one) of program modules that are configured to perform the functions of the various embodiments of the present invention.

[0087] A program / utility 40 having a set (at least one) of program modules 42 may be stored, for example, in the memory 28, such program modules 42 including, but not limited to, an operating system, one or more application programs, other program modules, and program data, each or some combination of which may include an implementation of a network environment. The program modules 42 generally perform the functions and / or methods of the embodiments described herein.

[0088] The electronic device 12 may also communicate with one or more external devices 14 (e.g., keyboards, pointing devices, displays 24, etc.), one or more devices that enable a user to interact with the electronic device 12, and / or any device that enables the electronic device 12 to communicate with one or more other computing devices (e.g., network cards, modems, etc.). Such communication may be performed through an input / output (I / O) interface 22. Furthermore, the electronic device 12 may also communicate with one or more networks (e.g., local area networks (LANs), wide area networks (WANs), and / or public networks, such as the Internet) through a network adapter 20. Figure 7 As shown, the network adapter 20 communicates with other modules of the electronic device 12 via the bus 18. It should be understood that although Figure 7 Not shown, other hardware and / or software modules may be used in conjunction with the electronic device 12, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0089] The processing unit 16 executes various functional applications and data processing by running at least one of the other programs among the multiple programs stored in the system memory 28, such as implementing a key management method for an automobile controller provided in an embodiment of the present invention.

[0090] The embodiment of the present invention provides a computer-readable storage medium, on which a computer program is stored. When the program is executed by a processor, a key management method for a vehicle controller provided by the embodiment of the present invention is implemented.

[0091] Note that the above are only preferred embodiments of the present invention and the technical principles used. Those skilled in the art will understand that the present invention is not limited to the specific embodiments described herein, and that various obvious changes, readjustments and substitutions can be made by those skilled in the art without departing from the scope of protection of the present invention. Therefore, although the present invention has been described in more detail through the above embodiments, the present invention is not limited to the above embodiments, and may include more other equivalent embodiments without departing from the concept of the present invention, and the scope of the present invention is determined by the scope of the appended claims.

Claims

1. A key processing method for a vehicle controller, comprising: In response to an interactive operation of the user interface, determining target identification information of a target business module; According to the target identification information, determine the target business key of the target business module from a pre-built key derivation tree of the vehicle; wherein the key derivation tree includes a root key, an electronic and electrical architecture key layer, a controller key layer, and a business module key layer, and a key node in each key layer is generated according to a key derivation parameter corresponding to the key layer and attribute information of the key node; The target business key is published to a controller of the vehicle for storage.

2. The method according to claim 1, characterized in that The attribute information of the key node in the electronic and electrical architecture key layer is the version information of the electronic and electrical architecture; The attribute information of the key node in the controller key layer is a controller identifier; the controller identifier includes at least one of the following: front body control, rear body control or vehicle body control; The attribute information of the key node in the business module key layer is a business identifier; the business identifier includes at least one of the following: diagnosis, secure access or secure communication.

3. The method according to claim 1, characterized in that The key derivation tree is constructed by: Acquire a key requirement from a user interface; wherein the key requirement includes an electronic and electrical architecture type, a controller function type, and a controller service type; The key generation tool is called to generate the key in the corresponding key node according to the key derivation parameters of the electronic and electrical architecture key layer, the controller key layer and the business module key layer and the attribute information of the key node in each key layer.

4. The method according to claim 1, characterized in that Also includes: When any service module in the vehicle is replaced, the replaced service module is used as a new target service module, and the identification information of the original service module is used as the identification information of the new target service module; According to the identification information of the new target service module, determining the corresponding original service key from the key derivation tree as the target service key of the new target service module; The target service key of the new target service module is published to the new target service module in the controller for storage.

5. The method according to claim 1, characterized in that The target identification information includes the electronic and electrical architecture version to which the target controller belongs, the target controller ID to which the target business module belongs, and the target ID of the target business module.

6. A key processing system for a vehicle controller, characterized in that: include: An identification acquisition module, used to determine target identification information of a target business module in response to an interactive operation of a user interface; A business key determination module, used to determine the target business key of the target business module from a pre-built key derivation tree of the vehicle according to the target identification information; wherein the key derivation tree includes a root key, an electronic and electrical architecture key layer, a controller key layer, and a business module key layer, and a key node in each key layer is generated according to a key derivation parameter corresponding to the key layer and attribute information of the key node; The business key issuing module is used to issue the target business key to the controller of the vehicle for storage.

7. The system according to claim 6, characterized in that The attribute information of the key node in the electronic and electrical architecture key layer is the version information of the electronic and electrical architecture; The attribute information of the key node in the controller key layer is a controller identifier; the controller identifier includes at least one of the following: front body control, rear body control or vehicle body control; The attribute information of the key node in the key layer of the business module is a business identifier; the business identifier includes at least one of the following: diagnosis, secure access or secure communication.

8. The system according to claim 6, characterized in that The target identification information includes the electronic and electrical architecture version to which the target controller belongs, the target controller ID to which the target business module belongs, and the target ID of the target business module.

9. An electronic device, characterized in that: include: one or more processors; A memory for storing one or more programs; When the one or more programs are executed by the one or more processors, the one or more processors implement the key processing method for a vehicle controller as described in any one of claims 1-5.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the key processing method for a vehicle controller as described in any one of claims 1-5 is implemented.

Images