Identity authentication method and system of vehicle electronic controller and vehicle

Abstract

The invention discloses an identity authentication method and system for a vehicle electronic controller and a vehicle, and the method comprises the steps: a central gateway sends a key updating request to a cloud key management system under the condition of power-on, so that the cloud key management system generates a new key; under the condition that a new key is received, encrypting the new key by using the original key to obtain an encrypted key, and sending the encrypted key to the target electronic controller, so that the target electronic controller updates the original key into the new key; sending an identity authentication request to the target electronic controller under the condition that the key update success message is received, so that the target electronic controller generates an identity authentication message; and under the condition that the identity authentication message is received, verifying the identity authentication message by using the new key. The identity authentication of the target electronic controller is carried out by using the new key dynamically generated by the cloud key management system, so that the security of the identity authentication of the electronic controller is improved.

Description

Technical Field

[0001] The present application belongs to the field of vehicle safety technology, and in particular, relates to an identity authentication method, system and vehicle for a vehicle electronic controller. Background Art

[0002] As the number of ECUs (Electronic Control Units) inside vehicles continues to increase, the complexity of the vehicle's internal network has increased significantly. Some key ECUs involve important business processing. Once attacked, the lives of drivers and passengers may be threatened and property losses may occur. It can be seen that ensuring the identity security of key ECUs is extremely important.

[0003] In the related art, the central gateway usually uses a fixed key to authenticate the identity of the ECU. Once the fixed key is cracked, the identity authentication result will be unreliable. Therefore, the current ECU identity authentication scheme has the problem of low security. Summary of the invention

[0004] The embodiments of the present application provide a method, system and vehicle for authenticating a vehicle electronic controller, which uses a new key dynamically generated by a cloud key management system to authenticate the ECU, which can improve the security of the authentication at least to a certain extent.

[0005] Other features and advantages of the present application will become apparent from the following detailed description, or may be learned in part by the practice of the present application.

[0006] According to a first aspect of an embodiment of the present application, a vehicle electronic controller identity authentication method is provided, which is applied to a vehicle, wherein the vehicle includes a central gateway and a target electronic controller, wherein both the central gateway and the target electronic controller store an original key for target electronic controller identity authentication, and the vehicle electronic controller identity authentication method includes:

[0007] When the central gateway is powered on, it sends a key update request to the cloud key management system, so that the cloud key management system generates a new key for identity authentication of the target electronic controller according to the key update request;

[0008] When receiving a new key returned by the cloud key management system, encrypt the new key with the original key to obtain an encrypted key, and send the encrypted key to the target electronic controller so that the target electronic controller updates the original key to the new key according to the encrypted key;

[0009] When receiving a key update success message returned by the target electronic controller, sending an identity authentication request to the target electronic controller, so that the target electronic controller generates an identity authentication message based on the identity authentication request and the new key;

[0010] When receiving the identity authentication message returned by the target electronic controller, the identity authentication message is verified using the new key.

[0011] In some embodiments, the target electronic controller generates an authentication message based on the authentication request and the new key, including:

[0012] The target electronic controller generates a target message upon receiving the identity authentication request;

[0013] Encrypting the target message and the preset freshness value using the new key to obtain a first message authentication code;

[0014] The target message, the freshness value and the first message authentication code are concatenated to obtain an identity authentication message.

[0015] In some embodiments, verifying the identity authentication message using the new key includes:

[0016] Determine whether the preset freshness value is consistent with the freshness value in the identity authentication message;

[0017] When the preset freshness value is consistent with the freshness value in the identity authentication message, encrypt the target message and the freshness value in the identity authentication message using the new key to obtain a second message authentication code;

[0018] Determining whether the first message authentication code and the second message authentication code are consistent;

[0019] When the first message authentication code and the second message authentication code are consistent, it is determined that the identity authentication of the target electronic controller is successful.

[0020] In some embodiments, the target electronic controller updates the original key to a new key according to the encrypted key, including:

[0021] The target electronic controller decrypts the encrypted key using the original key to obtain a new key;

[0022] Update the original key to the new key.

[0023] In some embodiments, there are multiple target electronic controllers, the key update request includes the identity of the target electronic controller, and sending the encrypted key to the target electronic controller includes:

[0024] Bind the encrypted key to the identity;

[0025] The encrypted key is sent to the target electronic controller corresponding to the identity.

[0026] In some embodiments, the vehicle further includes other electronic controllers in addition to the target electronic controller. After verifying the identity authentication message, the identity authentication method of the vehicle electronic controller further includes:

[0027] The central gateway broadcasts the identity authentication result of the target electronic controller to other electronic controllers, so that other electronic controllers can determine whether to communicate with the target electronic controller based on the identity authentication result.

[0028] According to a second aspect of an embodiment of the present application, a vehicle is provided, comprising a processor and a memory, wherein the memory stores computer program instructions that can be executed by the processor, and when the processor executes the computer program instructions, the steps of any method of the first aspect described above are implemented.

[0029] According to a third aspect of an embodiment of the present application, there is provided an identity authentication system for a vehicle electronic controller, comprising a vehicle as described in the second aspect above and a cloud key management system.

[0030] According to the fourth aspect of the embodiments of the present application, a computer-readable storage medium is provided, in which computer program instructions are stored. When the computer program instructions are executed by a processor, the processor is prompted to implement the steps of any method of the first aspect described above.

[0031] According to a fifth aspect of an embodiment of the present application, a computer program product is provided, including a computer program. When the computer program is executed by a processor, it prompts the processor to implement the steps of any method of the first aspect described above.

[0032] In the present application, when the central gateway is powered on, a key update request is sent to the cloud key management system, so that the cloud key management system generates a new key for the target electronic controller identity authentication according to the key update request; when the new key returned by the cloud key management system is received, the new key is encrypted with the original key to obtain the encrypted key, and the encrypted key is sent to the target electronic controller, so that the target electronic controller updates the original key to the new key according to the encrypted key; when the key update success message returned by the target electronic controller is received, an identity authentication request is sent to the target electronic controller, so that the target electronic controller generates an identity authentication message based on the identity authentication request and the new key; when the identity authentication message returned by the target electronic controller is received, the identity authentication message is verified using the new key. Among them, by using the new key dynamically generated by the cloud key management system to authenticate the target electronic controller instead of using a fixed key for identity authentication, the unreliable identity authentication result caused by the fixed key being cracked is avoided, and the security of the identity authentication of the electronic controller is improved.

[0033] It should be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] The drawings herein are incorporated into the specification and constitute a part of the specification, showing embodiments consistent with the present application, and together with the specification, are used to explain the principles of the present application. Obviously, the drawings described below are only some embodiments of the present application, and for ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work. In the drawings:

[0035] Figure 1 A schematic diagram showing a flow chart of an identity authentication method for a vehicle electronic controller in one embodiment is shown;

[0036] Figure 2 A schematic diagram of an interaction for obtaining an original key in one embodiment is shown;

[0037] Figure 3 A schematic diagram of interaction for updating an original key in one embodiment is shown;

[0038] Figure 4 A block diagram of an identity authentication device for a vehicle electronic controller in one embodiment is shown;

[0039] Figure 5 A schematic structural diagram of a vehicle in one embodiment is shown. DETAILED DESCRIPTION

[0040] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0041] In addition, described feature, structure or characteristic can be combined in one or more embodiments in any suitable manner. In the following description, many specific details are provided to provide a full understanding of the embodiments of the present application. However, those skilled in the art will appreciate that the technical scheme of the present application can be put into practice without one or more of the specific details, or other methods, components, devices, steps, etc. can be adopted. In other cases, known methods, devices, realizations or operations are not shown or described in detail to avoid blurring the various aspects of the application.

[0042] The block diagrams shown in the accompanying drawings are merely functional entities and do not necessarily correspond to physically independent entities. That is, these functional entities may be implemented in software form, or in one or more hardware modules or integrated circuits, or in different networks and / or processor devices and / or microcontroller devices.

[0043] The flowcharts shown in the accompanying drawings are only exemplary and do not necessarily include all the contents and operations / steps, nor must they be executed in the order described. For example, some operations / steps can be decomposed, and some operations / steps can be combined or partially combined, so the actual execution order may change according to actual conditions.

[0044] It should also be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the objects used in this way can be interchanged where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those shown or described.

[0045] Figure 1 The flowchart of the identity authentication method of the vehicle electronic controller in one embodiment is shown. The identity authentication method of the vehicle electronic controller is applied to a vehicle, the vehicle includes a central gateway and a target electronic controller, and the central gateway and the target electronic controller both store an original key for identity authentication of the target electronic controller, such as Figure 1 As shown, the identity authentication method of the vehicle electronic controller may include the following steps 101 to 104 .

[0046] In step 101, when the central gateway is powered on, it sends a key update request to the cloud key management system, so that the cloud key management system generates a new key for target electronic controller identity authentication according to the key update request.

[0047] In some embodiments, the target electronic controller may be a key ECU involved in important business processing in the vehicle, such as a TBOX (Telematics BOX, a remote communication terminal), an engine ECU, a steering gear ECU, etc. By authenticating only the identity of the target electronic controller, rather than authenticating all electronic controllers of the vehicle, the communication load during the authentication can be reduced while ensuring the safety of the vehicle.

[0048] It should be noted that the embodiment of the present application adopts KMS (Key Management Service, cloud key management system) to manage keys, which not only enhances the security of the keys but also reduces the load of the central gateway compared to using the central gateway to manage keys.

[0049] It is understandable that both the central gateway and the target electronic controller store the original key used for identity authentication of the target electronic controller, and the original key may also be issued by the KMS. Figure 2 FIG. 2 shows an interactive schematic diagram of obtaining the original key in an embodiment. Figure 2 As shown, the original key can be applied to the cloud KMS through the car EOL (End-of-Line, production line tester). The n target ECUs on the same car correspond to n original keys. The cloud KMS sends the original key related information to the EOL, and the EOL sends the original key related information to the central gateway. The central gateway records the ID of each target ECU and its corresponding original key in the form of an array, stores the array securely, and then distributes each original key to the corresponding target ECU. The specific process is as follows:

[0050] 1. EOL sends an original key application request to the cloud KMS, including the key application instruction, vehicle VIN code, ID of each target ECU, etc., to apply for the original key for target ECU identity authentication;

[0051] 2. The cloud KMS generates the original key and records its binding relationship with the ID of each target ECU and the vehicle VIN to obtain the original key related information;

[0052] 3. Cloud KMS sends the original key related information to EOL;

[0053] 4. EOL transmits the original key related information to the central gateway;

[0054] 5. The central gateway records and stores the ID of each ECU and its corresponding original key;

[0055] 6. The central gateway sends the corresponding original key to the target ECU;

[0056] 7. The target ECU securely stores the original key.

[0057] In order to further enhance the key security of vehicle ECU identity authentication, the embodiment of the present application adopts a dynamic application method to update the key and uses the new key for identity authentication.

[0058] Figure 3 FIG. 2 shows an interactive schematic diagram of updating the original key in an embodiment. Figure 3As shown, after the central gateway and the target ECU are powered on and awakened, the central gateway can send a key update request to the cloud KMS, which can include the original key of the target ECU, the ID of the target ECU, and the vehicle VIN and other information. After receiving the key update request, the cloud KMS determines whether the original key, ID, vehicle VIN and other information are correct. If correct, a new key is generated, and the binding relationship between the new key and each ID, vehicle VIN, the time when the new key was generated and other information are recorded to obtain the new key related information, and then send the new key related information to the central gateway.

[0059] In step 102, upon receiving the new key returned by the cloud key management system, the central gateway encrypts the new key using the original key to obtain the encrypted key, and sends the encrypted key to the target electronic controller so that the target electronic controller updates the original key to the new key based on the encrypted key.

[0060] It is understandable that the number of key ECUs in a vehicle is usually multiple, that is, the number of target electronic controllers is multiple. In this case, the central gateway needs to send the encrypted key to the corresponding target electronic controller.

[0061] In some embodiments, the central gateway may bind the encrypted key to an identity identifier; and send the encrypted key to a target electronic controller corresponding to the identity identifier.

[0062] Continue to refer to Figure 3 After receiving the information related to the new key, the central gateway binds the new key to the ID and encrypts the new key with the original key. After obtaining the encrypted key, the encrypted key is sent to the target ECU corresponding to the ID, realizing the accurate transmission of the key.

[0063] In some embodiments, the target ECU decrypts the encrypted key using the original key to obtain a new key; and updates the original key to the new key.

[0064] It is understandable that the legitimate target ECU has the original key. By encrypting the new key with the original key on the central gateway side and decrypting it with the original key on the target ECU side, the security of the key can be further improved.

[0065] In step 103, upon receiving the key update success message returned by the target electronic controller, the central gateway sends an identity authentication request to the target electronic controller, so that the target electronic controller generates an identity authentication message based on the identity authentication request and the new key.

[0066] It is understandable that after the target ECU has updated the key, it will send a key update success message to the central gateway. After receiving the key update success message, the central gateway can issue an identity authentication request (such as a Notify message) to notify the target ECU that identity authentication is required. After receiving the identity authentication request, the target ECU generates a target message, which includes the ID of the target ECU, and then encrypts the target message with the new key to obtain an identity authentication message.

[0067] In some embodiments, the target electronic controller can generate a target message upon receiving an identity authentication request; encrypt the target message and a preset freshness value using a new key to obtain a first message authentication code; and concatenate the target message, the freshness value and the first message authentication code to obtain an identity authentication message.

[0068] During the implementation process, the target message and FV (Freshness Value) can be encrypted by AES using a new key to obtain a first message authentication code. Of course, other encryption algorithms can also be used for encryption, and the embodiments of the present application are not limited to this.

[0069] In step 104, upon receiving the identity authentication message returned by the target electronic controller, the central gateway verifies the identity authentication message using the new key.

[0070] It is understandable that the central gateway can verify the identity authentication message based on the idea of ​​generating the identity authentication message by the target ECU to determine whether the identity authentication of the target ECU is passed.

[0071] In some embodiments, the central gateway can determine whether a preset freshness value is consistent with the freshness value in the identity authentication message; when the preset freshness value is consistent with the freshness value in the identity authentication message, use the new key to encrypt the target message and the freshness value in the identity authentication message to obtain a second message authentication code; determine whether the first message authentication code and the second message authentication code are consistent; when the first message authentication code and the second message authentication code are consistent, determine that the identity authentication of the target electronic controller is passed.

[0072] It can be understood that if the freshness value and the message authentication code are consistent, the authenticity and integrity of the identity authentication message can be confirmed, and then the target ECU can be determined to be a legal ECU, otherwise, the target ECU is an illegal ECU. Regardless of whether the target ECU is a legal ECU, the central gateway will return the identity authentication result to the target ECU.

[0073] If the target ECU does not receive the authentication result within the time limit, it will resend the authentication message to the central gateway. If the target ECU receives the authentication result within the preset time, it will stop sending the authentication message and save the authentication result.

[0074] By calculating the message authentication code and checking the freshness value of the transmitted data, the authenticity and integrity of the data can be ensured, thereby ensuring the legitimacy of the target ECU.

[0075] In some embodiments, after verifying the identity authentication message, the central gateway may also broadcast the identity authentication result of the target electronic controller to other electronic controllers, so that other electronic controllers can determine whether to communicate with the target electronic controller based on the identity authentication result.

[0076] It is understandable that after broadcasting the identity authentication result to other electronic controllers, other electronic controllers can determine whether the target ECU is legitimate and choose to communicate only with the legitimate target ECU, thereby improving the security of communication between ECUs.

[0077] In the embodiment of the present application, when the central gateway is powered on, a key update request is sent to the cloud key management system, so that the cloud key management system generates a new key for the target electronic controller identity authentication according to the key update request; when the new key returned by the cloud key management system is received, the new key is encrypted with the original key to obtain the encrypted key, and the encrypted key is sent to the target electronic controller, so that the target electronic controller updates the original key to the new key according to the encrypted key; when the key update success message returned by the target electronic controller is received, an identity authentication request is sent to the target electronic controller, so that the target electronic controller generates an identity authentication message based on the identity authentication request and the new key; when the identity authentication message returned by the target electronic controller is received, the identity authentication message is verified with the new key. Among them, by using the new key dynamically generated by the cloud key management system to authenticate the target electronic controller instead of using a fixed key for identity authentication, the unreliable identity authentication result caused by the fixed key being cracked is avoided, and the security of the identity authentication of the electronic controller is improved.

[0078] The following describes an apparatus embodiment of the present application, which can be used to execute the vehicle electronic controller identity authentication method in the above-mentioned embodiment of the present application. For details not disclosed in the apparatus embodiment of the present application, please refer to the embodiment of the vehicle electronic controller identity authentication method in the above-mentioned embodiment of the present application.

[0079] Figure 4 FIG. 1 is a block diagram of an identity authentication device for a vehicle electronic controller in one embodiment. Figure 4As shown, the identity authentication device of the vehicle electronic controller of the embodiment of the present application is applied to a vehicle, the vehicle includes a central gateway and a target electronic controller, the central gateway and the target electronic controller both store the original key for the identity authentication of the target electronic controller, the identity authentication device of the vehicle electronic controller may include: a key request module 401, a key encryption module 402, an authentication request module 403 and a message verification module 404, wherein the key request module 401 is used for the central gateway to send a key update request to the cloud key management system when it is powered on, so that the cloud key management system generates a new key for the identity authentication of the target electronic controller according to the key update request; the key encryption module 402 is used for When a new key is received from the cloud key management system, the new key is encrypted using the original key to obtain the encrypted key, and the encrypted key is sent to the target electronic controller, so that the target electronic controller updates the original key to the new key according to the encrypted key; the authentication request module 403 is used to send an identity authentication request to the target electronic controller when a key update success message is received from the target electronic controller, so that the target electronic controller generates an identity authentication message based on the identity authentication request and the new key; the message verification module 404 is used to verify the identity authentication message using the new key when the identity authentication message is received from the target electronic controller.

[0080] In some embodiments, the identity authentication device of the vehicle electronic controller may also include a message generation module (not shown), which is used for the target electronic controller to generate a target message when receiving an identity authentication request; encrypt the target message and a preset freshness value using a new key to obtain a first message authentication code; and concatenate the target message, the freshness value and the first message authentication code to obtain an identity authentication message.

[0081] In some embodiments, the message verification module 404 can also be used to determine whether a preset freshness value is consistent with the freshness value in the identity authentication message; when the preset freshness value is consistent with the freshness value in the identity authentication message, the target message and the freshness value in the identity authentication message are encrypting with a new key to obtain a second message authentication code; determine whether the first message authentication code and the second message authentication code are consistent; when the first message authentication code and the second message authentication code are consistent, determine that the identity authentication of the target electronic controller is passed.

[0082] In some embodiments, the identity authentication device of the vehicle electronic controller may further include a key update module (not shown) for the target electronic controller to decrypt the encrypted key using the original key to obtain a new key; and update the original key to the new key.

[0083] In some embodiments, there are multiple target electronic controllers, and the key encryption module 402 can also be used to bind the encrypted key to the identity identifier; and send the encrypted key to the target electronic controller corresponding to the identity identifier.

[0084] In some embodiments, the message verification module 404 can also be used by the central gateway to broadcast the identity authentication result of the target electronic controller to other electronic controllers, so that other electronic controllers can determine whether to communicate with the target electronic controller based on the identity authentication result.

[0085] Based on the same inventive concept, the embodiment of the present application further provides a vehicle, referring to Figure 5 , shows a schematic diagram of the structure of a vehicle in an embodiment of the present application, wherein the vehicle includes one or more memories 504, one or more processors 502, and at least one computer program (computer program instruction) stored in the memory 504 and executable on the processor 502, and the processor 502 implements the method described above when executing the computer program.

[0086] Among them, Figure 5 In the embodiment of the present invention, a bus architecture (represented by bus 500) is shown, which may include any number of interconnected buses and bridges, and bus 500 links various circuits including one or more processors represented by processor 502 and memory represented by memory 504. Bus 500 may also link various other circuits such as peripherals, voltage regulators, and power management circuits, which are well known in the art and are therefore not further described herein. Bus interface 505 provides an interface between bus 500 and receiver 501 and transmitter 503. Receiver 501 and transmitter 503 may be the same element, namely a transceiver, providing a unit for communicating with various other devices over a transmission medium. Processor 502 is responsible for managing bus 500 and general processing, while memory 504 may be used to store data used by processor 502 when performing operations.

[0087] Based on the same inventive concept, an embodiment of the present application provides an identity authentication system for a vehicle electronic controller, including the above-mentioned vehicle and a cloud key management system.

[0088] Based on the same inventive concept, an embodiment of the present application provides a computer-readable storage medium, in which computer program instructions are stored. When the computer program instructions are executed by a processor, the processor is prompted to implement the steps of the method as described above.

[0089] Based on the same inventive concept, an embodiment of the present application provides a computer program product, including a computer program. When the computer program product is executed by a processor, it prompts the processor to implement the steps of the method as described above.

[0090] The functions described herein may be implemented in hardware, software executed by a processor, firmware, or any combination thereof. If implemented in software executed by a processor, the functions may be stored as one or more instructions or codes on a computer-readable medium or transmitted via a computer-readable medium. Other examples and implementations are within the scope and spirit of the present application and the appended claims. For example, due to the nature of software, the functions described above may be implemented using software executed by a processor, hardware, firmware, hard wiring, or a combination of any of these. In addition, each functional unit may be integrated into a processing unit, each unit may exist physically separately, or two or more units may be integrated into one unit.

[0091] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of the units can be a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0092] The units described as separate components may or may not be physically separated, and the components of the control device may or may not be physical units, that is, they may be located in one place or distributed in multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0093] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can be essentially or partly or all or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, disk or optical disk, etc., which can store computer program instructions.

[0094] The above description is only an embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application may have various modifications and variations. Any modification, equivalent substitution, improvement, etc. made within the spirit and principle of the present application shall be included in the scope of the claims of the present application.

Claims

1. A vehicle electronic controller identity authentication method, applied to a vehicle, characterized in that: The vehicle includes a central gateway and a target electronic controller, both of which store an original key for identity authentication of the target electronic controller. The method includes: When the central gateway is powered on, it sends a key update request to the cloud key management system, so that the cloud key management system generates a new key for the identity authentication of the target electronic controller according to the key update request; Upon receiving the new key returned by the cloud key management system, encrypting the new key with the original key to obtain an encrypted key, and sending the encrypted key to the target electronic controller, so that the target electronic controller updates the original key to the new key according to the encrypted key; When receiving a key update success message returned by the target electronic controller, sending an identity authentication request to the target electronic controller, so that the target electronic controller generates an identity authentication message based on the identity authentication request and the new key; When the identity authentication message returned by the target electronic controller is received, the identity authentication message is verified using the new key.

2. The identity authentication method of a vehicle electronic controller according to claim 1, characterized in that: The target electronic controller generates an identity authentication message based on the identity authentication request and the new key, including: The target electronic controller generates a target message when receiving the identity authentication request; Encrypting the target message and a preset freshness value using the new key to obtain a first message authentication code; The target message, the freshness value and the first message authentication code are concatenated to obtain the identity authentication message.

3. The identity authentication method of a vehicle electronic controller according to claim 2, characterized in that: The verifying the identity authentication message by using the new key includes: Determine whether the preset freshness value is consistent with the freshness value in the identity authentication message; When the preset freshness value is consistent with the freshness value in the identity authentication message, encrypt the target message and the freshness value in the identity authentication message using the new key to obtain a second message authentication code; Determining whether the first message authentication code and the second message authentication code are consistent; When the first message authentication code and the second message authentication code are consistent, it is determined that the identity authentication of the target electronic controller is passed.

4. The identity authentication method of a vehicle electronic controller according to claim 1, characterized in that: The target electronic controller updates the original key to the new key according to the encrypted key, including: The target electronic controller decrypts the encrypted key using the original key to obtain the new key; The original key is updated to the new key.

5. The identity authentication method of a vehicle electronic controller according to claim 1, characterized in that: There are multiple target electronic controllers, the key update request includes the identity of the target electronic controller, and sending the encrypted key to the target electronic controller includes: Binding the encrypted key to the identity identifier; The encrypted key is sent to a target electronic controller corresponding to the identity identifier.

6. The identity authentication method of a vehicle electronic controller according to claim 1, characterized in that: The vehicle further includes other electronic controllers in addition to the target electronic controller. After verifying the identity authentication message, the method further includes: The central gateway broadcasts the identity authentication result of the target electronic controller to the other electronic controllers, so that the other electronic controllers determine whether to communicate with the target electronic controller based on the identity authentication result.

7. A vehicle comprising a processor and a memory, characterized in that: The memory stores computer program instructions that can be executed by the processor, and when the processor executes the computer program instructions, the steps of the method according to any one of claims 1 to 6 are implemented.

8. An identity authentication system for a vehicle electronic controller, characterized in that: Comprising a vehicle according to claim 7 and a cloud key management system.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer program instructions, which, when executed by a processor, prompt the processor to implement the steps of the method according to any one of claims 1 to 6.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the processor is prompted to implement the steps of the method according to any one of claims 1 to 6.

Images