Data transmission encryption method and device, equipment and storage medium

Abstract

The invention discloses a data transmission encryption method and device, equipment and a storage medium. The data transmission encryption method comprises the steps of obtaining a first diagnosis moment for performing automobile diagnosis on a target automobile and a VIN code of the target automobile; generating a first JWE key according to the first diagnosis moment, the VIN code and the first character string, and storing the first JWE key to a first hardware security module; sending the first diagnosis moment and the VIN code to the remote server, generating a second JWE secret key according to the first diagnosis moment, the VIN code and the first character string, and storing the second JWE secret key to a second hardware security module; obtaining target diagnosis data corresponding to the first diagnosis moment; encrypting the target diagnosis data according to the first JWE secret key to obtain target encrypted data; and sending the target encrypted data to the remote server, so that the remote server decrypts the target encrypted data according to the second JWE secret key to obtain the target diagnosis data, and the security of data transmission is improved.

Description

Technical Field

[0001] The present application relates to the field of data encryption technology, and in particular to a data transmission encryption method, device, equipment and storage medium. Background Art

[0002] With the increasing application of digital diagnosis in the field of automotive diagnosis, convenient diagnostic services can be achieved by developing the H5 (fifth generation Hypertext Markup Language (HTML)) interface. As the complexity and sensitivity of vehicle diagnostic data continue to increase, data security faces severe challenges. JWE (JSON Web Encryption) keys are usually used between H5 pages and servers to encrypt vehicle diagnostic data, which relies on the security of the keys. However, since the keys are vulnerable to attacks and theft, the risk of data leakage increases. Therefore, how to strengthen encryption methods to ensure the security of vehicle diagnostic data has become an urgent problem to be solved. Summary of the invention

[0003] The embodiments of the present application provide a data transmission encryption method, apparatus, device and storage medium, which effectively improves the security of vehicle diagnostic data during transmission and storage through the close combination of JWE keys and hardware security modules (HSM).

[0004] In a first aspect, an embodiment of the present application provides a data transmission encryption method, which is applied to an automobile diagnostic device, wherein the automobile diagnostic device includes a first hardware security module, the automobile diagnostic device is communicatively connected to a remote server, and the remote server includes a second hardware security module; the method includes:

[0005] Obtaining a first diagnosis time of performing vehicle diagnosis on a target vehicle and a VIN code of the target vehicle;

[0006] Generate a first JWE key according to the first diagnosis time, the VIN code and the first character string, and store the first JWE key in the first hardware security module; the first character string is an initial character string agreed upon by the vehicle diagnostic device and the remote server;

[0007] Sending the first diagnosis time and the VIN code to the remote server, generating a second JWE key by the remote server according to the first diagnosis time, the VIN code and the first character string, and storing the second JWE key in the second hardware security module;

[0008] Acquiring target diagnostic data corresponding to the first diagnostic moment;

[0009] Encrypting the target diagnostic data according to the first JWE key to obtain target encrypted data;

[0010] The target encrypted data is sent to the remote server, so that the remote server decrypts the target encrypted data according to the second JWE key to obtain the target diagnostic data.

[0011] In a second aspect, an embodiment of the present application provides a data transmission encryption device, which is applied to an automobile diagnostic device, wherein the automobile diagnostic device includes a first hardware security module, the automobile diagnostic device is connected to a remote server for communication, and the remote server includes a second hardware security module; the data transmission encryption device includes: a data acquisition unit, a secret key generation unit, a first data transmission unit, a data encryption unit, and a second data transmission unit, wherein:

[0012] The data acquisition unit is used to acquire a first diagnosis time of performing vehicle diagnosis on a target vehicle and a VIN code of the target vehicle;

[0013] The key generation unit is used to generate a first JWE key according to the first diagnosis time, the VIN code and the first character string, and store the first JWE key in the first hardware security module; the first character string is an initial character string agreed upon by the vehicle diagnostic device and the remote server;

[0014] The first data transmission unit is used to send the first diagnosis time and the VIN code to the remote server, generate a second JWE key according to the first diagnosis time, the VIN code and the first character string by the remote server, and store the second JWE key in the second hardware security module;

[0015] The data acquisition unit is further used to acquire target diagnostic data corresponding to the first diagnostic time;

[0016] The data encryption unit is used to encrypt the target diagnostic data according to the first JWE key to obtain target encrypted data;

[0017] The second data transmission unit is used to send the target encrypted data to the remote server, so that the remote server decrypts the target encrypted data according to the second JWE key to obtain the target diagnostic data.

[0018] In a third aspect, an embodiment of the present application provides an electronic device, comprising: a processor, a memory, a communication interface, and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the processor, and the program includes instructions for executing the steps in the first aspect of the embodiment of the present application.

[0019] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program for electronic data exchange, wherein the computer program enables a computer to execute part or all of the steps described in the first aspect of the embodiment of the present application.

[0020] In a fifth aspect, an embodiment of the present application provides a computer program product, wherein the computer program product includes a non-transitory computer-readable storage medium storing a computer program, and the computer program is operable to cause a computer to execute some or all of the steps described in the first aspect of the embodiment of the present application. The computer program product may be a software installation package.

[0021] It can be seen that the following beneficial effects are achieved by using the embodiments of the present application:

[0022] By implementing the embodiment of the present application, the first diagnostic time for automobile diagnosis of the target automobile and the VIN code of the target automobile are obtained; the first JWE key is generated according to the first diagnostic time, the VIN code and the first character string, and the first JWE key is stored in the first hardware security module; the first character string is the initial character string agreed upon by the automobile diagnostic device and the remote server; the first diagnostic time and the VIN code are sent to the remote server, and the remote server generates a second JWE key according to the first diagnostic time, the VIN code and the first character string, and the second JWE key is stored in the second hardware security module; the target diagnostic data corresponding to the first diagnostic time is obtained; the target diagnostic data is encrypted according to the first JWE key to obtain the target encrypted data; the target encrypted data is sent to the remote server, so that the remote server decrypts the target encrypted data according to the second JWE key to obtain the target diagnostic data. It can be seen that the close combination of the JWE key and the hardware security module HSM effectively improves the security of vehicle diagnostic data during transmission and storage. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the background technology, the drawings required for use in the embodiments of the present application or the background technology will be described below.

[0024] Figure 1This is a system architecture diagram of a data transmission encryption method provided in an embodiment of the present application;

[0025] Figure 2 It is a flowchart of a data transmission encryption method provided by an embodiment of the present application;

[0026] Figure 3 It is a structural diagram of a data transmission encryption device provided in an embodiment of the present application;

[0027] Figure 4 It is a structural schematic diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0028] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0029] The terms "first", "second", etc. in the specification and claims of this application and the above-mentioned drawings are used to distinguish different objects, rather than to describe a specific order. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not limited to the listed steps or units, but optionally includes steps or units that are not listed, or optionally includes other steps or units inherent to these processes, methods, products or devices.

[0030] Reference to "embodiments" herein means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present application. The appearance of the phrase in various locations in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0031] The following is an explanation of the relevant contents, concepts, meanings, technical issues, technical solutions, beneficial effects, etc. involved in the embodiments of the present application.

[0032] First, some terms involved in this application are explained:

[0033] JWE (JSON Web Encryption) key: JWE key is an encryption key to ensure secure data transmission and storage. It is used to encrypt or decrypt data to prevent unauthorized access and theft, thereby maintaining the confidentiality, integrity and authenticity of the data.

[0034] Hardware Security Module (HSM): A hardware security module is a physical device that protects sensitive information. It can generate, store and manage various encryption keys. HSM provides a highly reliable environment for security operations such as digital signatures, identity authentication and data encryption, effectively preventing keys from being illegally obtained or tampered with.

[0035] See also Figure 1 , Figure 1 is a system architecture diagram of a data transmission encryption method provided in an embodiment of the present application, such as Figure 1 As shown, the target vehicle 100 includes an automobile diagnostic device 101 and a first communication module 102, the automobile diagnostic device 101 includes a first hardware security module 1011, and the remote server 200 includes a second hardware security module 201 and a second communication module 202. Based on the first communication module 102 and the second communication module 202, the automobile diagnostic device 101 can communicate with the remote server 200.

[0036] The target vehicle 100 is a vehicle that needs to be diagnosed with vehicle faults, monitored for performance, and collects and transmits relevant data, including traditional fuel vehicles, hybrid vehicles, and pure electric vehicles. Many electronic control units in the vehicle store key data reflecting the operating status of various vehicle systems, which are essential for subsequent diagnostic analysis. The target vehicle 100 includes a vehicle diagnostic device 101 and a first communication module 102.

[0037] The automobile diagnostic device 101 is a professional vehicle-mounted or external device that is specially used to interact with the electronic control unit of the target vehicle 100, obtain vehicle-related operating parameters, and has data processing, encryption, and transmission functions. It can read various diagnostic data such as engine speed, oil temperature, fault code, etc. by connecting to a specific vehicle interface (such as an on-board automatic diagnostic system interface, etc.), and then integrate and analyze these diagnostic data. It can also transmit the diagnostic data to a remote server for further analysis. The automobile diagnostic device 101 includes a first hardware security module 1011, wherein the first hardware security module 1011 is a core security component inside the automobile diagnostic device 101, which has highly reliable hardware encryption technology and a physical protection design with anti-tampering and anti-physical attack characteristics. Its main function is to store various sensitive information, especially encryption keys such as the first JWE secret key that play a key role in the data encryption and decryption process, to ensure the confidentiality and integrity of these important data when stored inside the device, and to prevent key data leakage due to illegal intrusion, malware attacks, etc.

[0038] The first communication module 102 may be connected to other devices or equipment or modules by means of Bluetooth, wireless network, custom communication protocol, etc., so as to realize stable and efficient data interaction between the automobile diagnostic device 101 and the remote server 200.

[0039] Among them, the remote server 200 is the back-end core hub of the entire automobile diagnostic system, with powerful data storage, analysis and management capabilities. It can receive a large amount of diagnostic data from different regions and different vehicles, and perform operations such as classified storage, deep mining and correlation analysis on these data, so as to provide automobile manufacturers, maintenance service providers and other related parties with diversified services such as vehicle fault warning, performance evaluation report, recall decision basis, etc. At the same time, it can also coordinate and manage the encryption and decryption during data transmission to ensure the security and accuracy of data during the interactive process such as transmission from the vehicle end and subsequent issuance of instructions. The remote server 200 includes a second hardware security module 201 and a second communication module 202.

[0040] Among them, the second hardware security module 201 is the core security component for ensuring data security in the remote server 200. Its function is similar to that of the first hardware security module 1011 in the automobile diagnostic equipment. It also has advanced encryption chips, physical isolation, access control and other technical means. It is specially used to store important encryption keys such as the second JWE key and other sensitive data to prevent external illegal access and data tampering. When interacting with the automobile diagnostic equipment, it can perform accurate decryption and encryption operations based on the stored keys to ensure the secure transmission of data on the server side.

[0041] The second communication module 202 can be connected to other devices or equipment or modules through Bluetooth, wireless network, custom communication protocol, etc., to ensure that a two-way data transmission channel is established between the remote server 200 and the vehicle diagnostic equipment 101 on the target vehicles 100.

[0042] See also Figure 2 , Figure 2 : is a flow chart of a data transmission encryption method provided by an embodiment of the present application. The method is applied to an automobile diagnostic device, the automobile diagnostic device includes a first hardware security module, the automobile diagnostic device is connected to a remote server for communication, and the remote server includes a second hardware security module. The method includes but is not limited to the following steps:

[0043] S201: Acquire a first diagnosis time of performing vehicle diagnosis on a target vehicle and a VIN code of the target vehicle.

[0044] In the embodiment of the present application, the automobile diagnostic device is a device for detecting the technical condition of the automobile or diagnosing a fault. It has a data processing module and a variety of communication interfaces, and can establish a communication connection with the target automobile, and obtain data related to the target automobile for diagnosis through two-way data interaction. For example, the automobile diagnostic device can establish a physical connection link with the electronic control unit of the target automobile through a standard automobile diagnostic interface (such as an OBD-II interface), and obtain data related to the target automobile for diagnosis through the connection.

[0045] In the embodiment of the present application, the automobile diagnostic device is equipped with a user interaction interface, which can be an H5 interface, application software, etc., which is not limited here. Through the user interaction interface, the automobile diagnostic device can transmit data with the remote server. During the data transmission process, it is usually necessary to encrypt the transmitted data to ensure data security and avoid data leakage. When data transmission is encrypted, one end (which can be the automobile diagnostic device end or the remote server end) can encrypt the key data through the JWE key, generate the encrypted ciphertext and transmit it to the other end. Correspondingly, after receiving the ciphertext, the other end can decrypt the ciphertext through the corresponding JWE key to obtain the decrypted key data.

[0046] In a specific embodiment, a JWE key for encryption can be generated by the first diagnostic moment of the target car for car diagnosis and the VIN code (Vehicle Identification Number) of the target car. Therefore, it is necessary to obtain the first diagnostic moment of the target car for car diagnosis and the VIN code of the target car. Specifically, the car diagnostic device has a built-in clock module. When the user starts the diagnostic program for the target car on the user interaction interface of the car diagnostic device, the car diagnostic device will trigger the clock module to perform a time reading operation and use the time read this time as the first diagnostic moment. After the car diagnostic device establishes a communication connection with the target car, the VIN code of the target car can be directly read. The VIN code is the unique identification code of the vehicle, which may include information such as the manufacturer, model, and year of production of the vehicle. The VIN code can be used to generate a JWE key with vehicle specificity, so that the data of each car can be securely transmitted using a dedicated encryption key. After obtaining the first diagnostic time and VIN code, a JWE key for data encryption and decryption can be generated based on the first diagnostic time and VIN code. In the current vehicle diagnostic cycle, if the vehicle diagnostic equipment communicates data with the remote server, the transmitted data can be encrypted based on the JWE key to ensure the security and reliability of data transmission during this vehicle diagnostic cycle.

[0047] S202: Generate a first JWE key according to the first diagnosis time, the VIN code and the first character string, and store the first JWE key in the first hardware security module.

[0048] Among them, the first character string is the initial character string agreed upon by the automobile diagnostic device and the remote server, which can be a random character combination of a fixed length after encryption. The first character string is a key factor in the generation of the JWE key and has a confidential nature. In the subsequent process of updating the key, the initial character string can be encrypted and calculated to obtain a new character string, and the new character string is used as the character string for key generation. For each automobile diagnostic device, its corresponding first character string usually remains fixed, and the first character strings associated with different automobile diagnostic devices are also different. When the automobile diagnostic device performs a system update or security upgrade operation, the first character string can be updated and changed to reduce the risk of leakage caused by the long-term use of a fixed character string, thereby ensuring the security and reliability of data encryption.

[0049] In a specific embodiment, the first JWE key can be generated based on the key generation algorithm according to the first diagnostic moment, the VIN code and the first character string. Among them, the first diagnostic moment is unique in time, and the VIN code is the globally unique identification code of the vehicle. Combining the first diagnostic moment, the VIN code and the first character string can increase the uniqueness and randomness of the key. At the same time, the first diagnostic moment can also establish a direct association between the generated key and the diagnostic activity of a specific vehicle at a specific time, which ensures the accuracy and legitimacy of the source and usage scenario of the data during data encryption and decryption, and prevents the data from being mistakenly decrypted or maliciously used during transmission and storage.

[0050] After obtaining the first JWE key, the first JWE key can be stored in the first hardware security module. When the key needs to be obtained, verification is required first, and the key can be obtained only after the verification is passed. This makes the key difficult to steal or crack. At the same time, the first hardware security module can log the storage operation of the key, including storage time, storage source and other information, so as to facilitate subsequent problem tracking and key updates.

[0051] Optionally, the step of generating the first JWE key according to the first diagnosis time, the VIN code and the first character string specifically includes the following steps:

[0052] The first diagnostic time and the VIN code are hashed to obtain a target key factor; the target key factor is concatenated with the first character string to obtain a target concatenated character string; and the first JWE key is generated according to the target concatenated character string based on a preset encryption algorithm.

[0053] The preset encryption algorithm is an encryption algorithm for encrypting key information to obtain encrypted ciphertext, which may be an AES encryption algorithm. In the embodiment of the present application, the target concatenated string may be encrypted by the AES encryption algorithm to obtain an encrypted ciphertext, which is used as a JWE key.

[0054] In a specific implementation, the first diagnostic time and the VIN code can be hashed, and the input first diagnostic time and the VIN code can be converted into a hash value of fixed length using a hash function to obtain two hash values, which together constitute the target secret key factor for secret key generation. The target secret key factor is concatenated with the first string to obtain a target concatenated string, and then, based on a preset encryption algorithm, the first JWE secret key can be generated according to the target concatenated string, and the secret key has sufficient length and complexity to meet the security requirements of automobile diagnostic data encryption.

[0055] S203: Send the first diagnosis time and the VIN code to the remote server, generate a second JWE key according to the first diagnosis time, the VIN code and the first character string by the remote server, and store the second JWE key in the second hardware security module.

[0056] In a specific embodiment, the first diagnostic time and the VIN code are sent to a remote server, and the remote server can generate a second JWE key according to the first diagnostic time, the VIN code and the first character string, and store the second JWE key in a second hardware security module. Wherein, the first JWE key and the second JWE key are both generated according to the first diagnostic time, the VIN code and the first character string using a specific encryption algorithm, and the first JWE key is the same as the second JWE key. Therefore, after the first JWE key encrypts the data, the second JWE key can accurately decrypt the encrypted data. Similarly, after the second JWE key encrypts the data, the first JWE key can accurately decrypt the encrypted data.

[0057] Among them, due to the existence of the commonly agreed first character string, even if the first diagnostic time and the VIN code are leaked during the process of sending to the server when the JWE key is generated for the first time, it is impossible to generate a key that is identical to the first JWE key in the first hardware security module of the automobile diagnostic device, thereby ensuring the security of the key. In the subsequent JWE key update process, a new JWE key will be generated through the time of the second automobile diagnosis and the first JWE key. After the JWE key is generated for the first time, all data will be encrypted and transmitted in subsequent data transmission processes.

[0058] It should be noted that since the secret key is vulnerable to attack and leakage when it is stored at the software level, the secret key can be stored in the hardware security module, and the secret key is only retrieved from the hardware security module when it is needed to encrypt data. Of course, since there can be multiple different automotive diagnostic devices, or multiple different diagnostic vehicles, or diagnostic times at different times, the JWE secret keys generated for different vehicles must be different, ensuring that the JWE secret keys for different vehicles are unique.

[0059] S204: Obtain target diagnostic data corresponding to the first diagnostic time.

[0060] In a specific embodiment, the target diagnostic data corresponding to the target vehicle at the first diagnostic moment can be obtained through the vehicle diagnostic equipment, including the vehicle's operating status and data related to potential fault diagnosis, such as the vehicle's driving trajectory, vehicle usage, operating parameters of various vehicle systems, various fault codes, etc.

[0061] Among them, the target diagnostic data usually contains various privacy content and vehicle control parameters. If this data is leaked and tampered with or stolen, the vehicle's control system will be cracked, which will seriously endanger the life safety of the driver and passengers and the property safety of the vehicle. By encrypting the target diagnostic data, it is more difficult to obtain and tamper with the key content of the target diagnostic data, thereby maintaining the safe and stable operation of the vehicle.

[0062] Optionally, after obtaining the first diagnosis time of performing vehicle diagnosis on the target vehicle and the VIN code of the target vehicle, the following steps may also be included:

[0063] S2041. Determine whether there is a JWE key in the first hardware security module;

[0064] S2042: If the JWE key does not exist in the first hardware security module, executing the step of generating a first JWE key according to the first diagnosis time, the VIN code and the first character string;

[0065] S2043: If the JWE key exists in the first hardware security module, obtain a second diagnosis time for performing vehicle diagnosis on the target vehicle; the second diagnosis time is before the first diagnosis time;

[0066] S2044, obtaining the JWE key corresponding to the second diagnosis moment, and obtaining a third JWE key;

[0067] S2045, determining a target diagnosis time interval according to the first diagnosis time and the second diagnosis time;

[0068] S2046, acquiring the frequency of data communication within the target diagnosis time interval to obtain a target communication frequency;

[0069] S2047, when the target diagnostic time interval is greater than or equal to a preset diagnostic time interval threshold, or when the target communication frequency is greater than or equal to a preset communication frequency threshold, determining the first JWE key according to the third JWE key, the first diagnostic time, the VIN code, and the first character string;

[0070] S2048, executing the step of obtaining the target diagnostic data corresponding to the first diagnostic moment;

[0071] S2049. Otherwise, use the third JWE key as the first JWE key and execute the step of obtaining the target diagnostic data corresponding to the first diagnostic moment.

[0072] Among them, the preset diagnostic time interval threshold is a pre-set time length standard, usually measured in hours, days, weeks and other time units. It represents the time interval between two diagnostic operations on the target vehicle. If this limit is exceeded, it can be considered that the vehicle's operating status and diagnostic conditions may have changed significantly, and the encryption key can be considered to be updated to adapt to the new situation and ensure the security and effectiveness of data encryption. The preset communication frequency threshold is a pre-set communication frequency threshold, which represents the number of data communications between the vehicle diagnostic equipment and the remote server within a certain period of time, reflecting the frequency limit of vehicle data interaction. When the actual data communication frequency exceeds this set threshold, it means that the data interaction between the vehicle and the outside world becomes very active. Correspondingly, the security risks faced by the data may also increase. Therefore, it is possible to consider updating the encryption key to enhance the confidentiality and integrity of the data.

[0073] In an embodiment of the present application, after obtaining the first diagnostic moment of vehicle diagnosis for a target vehicle and the VIN code of the target vehicle, it is determined whether a JWE key exists in the first hardware security module. If no JWE key exists, the JWE key continues to be generated. Otherwise, it is determined whether the JWE key in the first hardware security module needs to be updated, thereby improving the security of data encryption.

[0074] In a specific embodiment, it is first determined whether there is a JWE key in the first hardware security module. If there is no JWE key in the first hardware security module, an operation of generating a JWE key is performed, and then the data can be encrypted according to the newly generated JWE key. If there is a JWE key in the first hardware security module, a second diagnostic time for performing vehicle diagnosis on the target vehicle is obtained, wherein the second diagnostic time is before the first diagnostic time, and the second diagnostic time refers to the time point recorded when the target vehicle was last diagnosed before the first diagnostic time, that is, by reviewing the previous diagnostic history, it is determined whether the key needs to be updated.

[0075] Furthermore, the JWE key corresponding to the second diagnostic moment is obtained to obtain the third JWE key. The target diagnostic time interval is determined according to the first diagnostic moment and the second diagnostic moment, the number of data communications within the target diagnostic time interval is obtained, and then the frequency of data communications is calculated to obtain the target communication frequency. When the target diagnostic time interval is greater than or equal to the preset diagnostic time interval threshold, or the target communication frequency is greater than or equal to the preset communication frequency threshold, the first JWE key is determined according to the third JWE key, the first diagnostic moment, the VIN code and the first character string according to the key update algorithm, otherwise, the third JWE key is used as the first JWE key. After determining the first JWE key, the data is encrypted according to the first JWE key. The JWE key is managed and updated according to the actual situation of the vehicle diagnosis, so as to ensure the security and accuracy of the vehicle diagnostic data in different usage scenarios.

[0076] Optionally, the step of determining the first JWE key according to the third JWE key, the first diagnosis time, the VIN code and the first character string specifically includes the following steps:

[0077] Encrypt the first character string based on the third JWE key to obtain a second character string;

[0078] The first JWE key is generated according to the first diagnosis time, the VIN code and the second character string, and the first JWE key is stored in the first hardware security module.

[0079] In a specific embodiment, if the third JWE key is updated to obtain the first JWE key, the first character string can be encrypted based on the third JWE key to obtain the second character string, wherein the third JWE key is an encryption key corresponding to the historical diagnosis time related to the target vehicle, and the specific encryption process can be encrypted using a symmetric encryption algorithm (AES). Through this encryption processing method, on the one hand, the existing security attributes of the third JWE key are used, and on the other hand, by encrypting the first character string, it can be combined with the historical key information to integrate new encryption elements, laying the foundation for the subsequent generation of an updated first JWE key.

[0080] After obtaining the second character string, a first JWE key can be generated according to the first diagnostic time, the VIN code and the second character string, and the first JWE key can be stored in the first hardware security module. By accurately updating and securely storing the first JWE key, the vehicle diagnostic equipment can adapt to different situations during the vehicle diagnostic process, thereby continuously ensuring the security of the vehicle diagnostic data during transmission and storage.

[0081] S205. Encrypt the target diagnostic data according to the first JWE key to obtain target encrypted data.

[0082] In a specific embodiment, the target diagnostic data is key data used to accurately analyze vehicle conditions, troubleshoot faults, and understand vehicle performance change trends, so encryption processing is required to prevent data leakage and illegal access. Specifically, the first JWE key can be extracted from the first hardware security module, and the target diagnostic data can be encrypted by an encryption algorithm based on the first JWE key to obtain target encrypted data. After the encryption operation is completed, the generated target encrypted data will be verified to check whether it meets the output specification of the encryption algorithm and whether there is data loss or error, for example, to verify whether the length of the target encrypted data is within the expected range, whether the format of the ciphertext is correct, etc. If the verification is passed, the target encrypted data can be stored or transmitted. Encrypting the target diagnostic data using the first JWE key can effectively protect the security of the vehicle diagnostic data and ensure that it is not obtained and tampered with by unauthorized third parties throughout its life cycle.

[0083] Optionally, before encrypting the target diagnostic data according to the first JWE key to obtain the target encrypted data, the following steps may also be included:

[0084] Obtain access control information; obtain preset access permission information stored in the first hardware security module; verify the first hardware security module according to the access control information and the preset access permission information to obtain a target verification result; when the target verification result is passed, obtain the first JWE key from the first hardware security module.

[0085] The access control information may include at least one of the following: password information, biometric information or device hardware token, etc., which are not limited here. The preset access permission information is a key data set stored in the first hardware security module, which is used to clearly define the access permissions of different subjects to the first JWE key, and it indicates which subjects have the permission to access the first JWE key and the corresponding permission level.

[0086] In a specific embodiment, the access control information can be obtained through a combination of a user name and password input by an operator, or a unique identification code transmitted based on biometric technology or device hardware. Next, the preset access permission information stored in the first hardware security module is obtained, and the first hardware security module is verified according to the access control information and the preset access permission information to obtain a target verification result. Specifically, it can be found whether there is a record in the preset access permission information that matches the subject identifier in the access control information. If a matching record is found, further check whether other relevant information provided (such as password, access time, IP address, etc.) meets the corresponding permission conditions. When the target verification result is passed, it means that the current access subject has the legal authority to obtain the first JWE key, and then a key acquisition request is sent to the first hardware security module. After receiving the request and confirming that the source of the request is legal, the first hardware security module will extract the first JWE key from its internal part.

[0087] Optionally, the step of encrypting the target diagnostic data according to the first JWE key to obtain target encrypted data specifically includes the following steps:

[0088] Preprocess the target diagnostic data to obtain first diagnostic data in a standard data format; encode the first diagnostic data using Base64 encoding to obtain second diagnostic data; generate a target initialization vector using a random number generator; the target initialization vector is a random number; encrypt the second diagnostic data according to the first JWE key and the target initialization vector to obtain target ciphertext data; generate a target authentication tag according to the first JWE key, the target ciphertext data and the target initialization vector; encapsulate the target ciphertext data, the target initialization vector and the target authentication tag based on the JWE specification to obtain the target encrypted data.

[0089] In a specific embodiment, the target diagnostic data may include various numerical values, text descriptions, and binary format data collected from different sensors and electronic control units of the vehicle. Therefore, the target diagnostic data needs to be preprocessed. For example, the fault code and related description information recorded in text form are converted into a unified character encoding format according to the set encoding rules (such as UTF-8 encoding), and the numerical data is normalized according to the set data type to unify its precision and representation range, and then the first diagnostic data in the standard data format can be obtained.

[0090] The first diagnostic data may be encoded using Base64 encoding to obtain the second diagnostic data, and the first diagnostic data may be processed using Base64 encoding to further optimize the data format so that it can better adapt to subsequent operations based on encryption algorithms and JWE specifications.

[0091] A target initialization vector is generated by a random number generator, wherein the random number generator is a tool that can generate a random digital sequence according to a specific algorithm, and the target initialization vector is a random number used to increase the randomness and security of the encryption algorithm. Since the present application uses a symmetric encryption algorithm to encrypt diagnostic data, the same key is used to encrypt the same data multiple times. If there is no introduction of an initialization vector, the same encryption result may be produced, which makes it easy for attackers to analyze and crack it. By introducing a randomly generated target initialization vector, even if the same second diagnostic data is encrypted using the same first JWE key, different encryption results will be obtained each time due to different initialization vectors, thereby improving the security and anti-analysis capabilities of encryption.

[0092] Based on the JWE specification and security requirements, this application uses a symmetric encryption algorithm to encrypt the second diagnostic data according to the first JWE key and the target initialization vector, and the target ciphertext data can be obtained. Then, a target authentication tag is generated according to the first JWE key, the target ciphertext data and the target initialization vector, which is used to verify the integrity of the data and the legitimacy of the source of the authentication data. During the data transmission and storage process, the receiver can verify the tag to confirm whether the data has been tampered with during the transmission process, and ensure that the data is generated by a legitimate sender with the correct key. Finally, the target ciphertext data, the target initialization vector and the target authentication tag are encapsulated based on the JWE specification to obtain the target encrypted data.

[0093] It should be noted that the JWE specification is a standard format for securely transmitting encrypted information in a network environment. It defines how to structure and encapsulate encrypted data and related auxiliary information (such as initialization vectors, authentication tags, etc.) to enable secure and reliable interaction between different systems.

[0094] S206. Send the target encrypted data to the remote server, so that the remote server decrypts the target encrypted data according to the second JWE key to obtain the target diagnostic data.

[0095] In a specific embodiment, in the automobile diagnostic data processing flow, after the automobile diagnostic device obtains the target encrypted data by encrypting the target diagnostic data, it will send it to the remote server. The remote server decrypts the received target encrypted data according to the established decryption algorithm based on the second JWE key stored in the second hardware security module, and finally obtains the original target diagnostic data, so that vehicle fault analysis, performance evaluation and other related work can be carried out.

[0096] Optionally, the automobile diagnostic device further includes: a pressure sensor, a vibration sensor, and a temperature sensor; the first hardware security module further includes a hardware self-destruction circuit, and the method may further include the following steps:

[0097] The automobile diagnostic device is monitored according to the pressure sensor, the vibration sensor and the temperature sensor to obtain target monitoring sensor data; if the target monitoring sensor data meets the preset normal range conditions, it is determined that the automobile diagnostic device is in a normal working state; if the target monitoring sensor data does not meet the preset normal range conditions, it is determined that the automobile diagnostic device is in a damaged state, and an automatic destruction instruction is generated; in response to the automatic destruction instruction, the hardware self-destruction circuit is started; the hardware self-destruction circuit is used to apply a high voltage pulse or a strong magnetic field to the first hardware security module so that the first JWE key in the first hardware security module is destroyed.

[0098] Among them, the preset normal range conditions refer to a series of standard range values ​​pre-set for the data collected by the pressure sensors, vibration sensors and temperature sensors in the automobile diagnostic equipment to measure whether the equipment is in normal working condition. Once the data collected by the sensor exceeds these corresponding ranges, the automobile diagnostic equipment can promptly determine that the equipment is in a damaged state, and then activate protection mechanisms such as hardware self-destruction circuits to ensure data security.

[0099] In the embodiment of the present application, the pressure sensor is mainly responsible for detecting the pressure on the outside of the device. For example, the pressure sensor can detect the situation when the automotive diagnostic equipment is subjected to external force, such as squeezing, collision, etc., which may affect the integrity of its internal structure. The vibration sensor is used to monitor the vibration of the equipment during operation. Under normal circumstances, the vibration generated by the automotive diagnostic equipment when it is working is within a certain reasonable range. When the internal parts of the equipment are loose, malfunctioning, or subjected to abnormal impact, the frequency, amplitude and other parameters of the vibration will exceed the normal range. The vibration sensor can capture these changes and generate corresponding vibration data feedback. The temperature sensor is used to monitor the temperature condition inside the equipment. If the electronic components in the automotive diagnostic equipment have problems such as poor heat dissipation and circuit short circuit, the temperature inside the automotive diagnostic equipment may rise sharply. The temperature sensor can detect the temperature change value in real time to facilitate subsequent analysis of whether the equipment is in a normal state.

[0100] In a specific embodiment, the automobile diagnostic device is monitored in real time by the pressure sensor, vibration sensor and temperature sensor, and the target monitoring sensor data can be obtained. If the target monitoring sensor data meets the preset normal range conditions, it is determined that the automobile diagnostic device is in a normal working state. Otherwise, if the target monitoring sensor data does not meet the preset normal range conditions, it means that the automobile diagnostic device may have a fault or suffer an abnormal situation, and then it is determined that the automobile diagnostic device is in a damaged state. In order to prevent the key data (JWE key, etc.) stored in the first hardware security module from being illegally obtained or used, an automatic destruction instruction can be generated. In response to the automatic destruction instruction, the automobile diagnostic device starts the hardware self-destruction circuit of the first hardware security module. After the hardware self-destruction circuit is started, the first hardware security module can be acted on in a specific way, such as applying a high voltage pulse or a strong magnetic field to it, so that the data storage medium stored in the first hardware security module is irreversibly damaged, so that the first JWE key stored therein is completely destroyed, so as to ensure the security and confidentiality of the automobile diagnostic data.

[0101] In summary, by implementing the embodiments of the present application, after obtaining the first diagnostic moment and VIN code for the target vehicle, the automobile diagnostic device generates or updates the first JWE key according to the specific situation. The collected target diagnostic data is encrypted using the first JWE key, and the generated target encrypted data that complies with the JWE specification is sent to the remote server, which decrypts it with the corresponding second JWE key. At the same time, the automobile diagnostic equipment is equipped with various sensors for monitoring its own status. If the monitoring data exceeds the preset normal range, the equipment is determined to be damaged and the hardware self-destruction circuit is activated to destroy the first JWE key in the first hardware security module. It can be seen that through the combination of JWE keys and hardware security modules, secure key management and encryption and decryption processes can be performed to ensure the confidentiality, integrity and authenticity of automobile diagnostic data during transmission and storage.

[0102] See also Figure 3 , Figure 3 : is a structural diagram of a data transmission encryption device provided in an embodiment of the present application, wherein the data transmission encryption device 300 is applied to an automobile diagnostic device, wherein the automobile diagnostic device includes a first hardware security module, wherein the automobile diagnostic device is connected to a remote server for communication, and wherein the remote server includes a second hardware security module; the data transmission encryption device 300 includes: a data acquisition unit 301, a secret key generation unit 302, a first data transmission unit 303, a data encryption unit 304, and a second data transmission unit 305, wherein:

[0103] The data acquisition unit 301 is used to acquire a first diagnosis time of performing vehicle diagnosis on a target vehicle and a VIN code of the target vehicle;

[0104] The key generation unit 302 is used to generate a first JWE key according to the first diagnosis time, the VIN code and the first character string, and store the first JWE key in the first hardware security module; the first character string is an initial character string agreed upon by the vehicle diagnostic device and the remote server;

[0105] The first data transmission unit 303 is used to send the first diagnosis time and the VIN code to the remote server, generate a second JWE key according to the first diagnosis time, the VIN code and the first character string through the remote server, and store the second JWE key in the second hardware security module;

[0106] The data acquisition unit 301 is further used to acquire target diagnostic data corresponding to the first diagnostic moment;

[0107] The data encryption unit 304 is used to encrypt the target diagnostic data according to the first JWE key to obtain target encrypted data;

[0108] The second data transmission unit 305 is used to send the target encrypted data to the remote server, so that the remote server decrypts the target encrypted data according to the second JWE key to obtain the target diagnostic data.

[0109] Optionally, in the aspect of generating the first JWE key according to the first diagnosis time, the VIN code and the first character string, the key generation unit 302 is further specifically used for:

[0110] Performing hash processing on the first diagnosis time and the VIN code to obtain a target secret key factor;

[0111] Concatenate the target secret key factor with the first character string to obtain a target concatenated character string;

[0112] Generate the first JWE key according to the target concatenated string based on a preset encryption algorithm.

[0113] Optionally, before encrypting the target diagnostic data according to the first JWE key to obtain target encrypted data, the data transmission encryption device 300 is further specifically used to:

[0114] Get access control information;

[0115] Obtaining preset access permission information stored in the first hardware security module;

[0116] Verify the first hardware security module according to the access control information and the preset access permission information to obtain a target verification result;

[0117] When the target verification result is passed, the first JWE key is obtained from the first hardware security module.

[0118] Optionally, in the aspect of encrypting the target diagnostic data according to the first JWE key to obtain target encrypted data, the data encryption unit 304 is further specifically used for:

[0119] Preprocessing the target diagnostic data to obtain first diagnostic data in a standard data format;

[0120] Encoding the first diagnostic data using Base64 encoding to obtain second diagnostic data;

[0121] Generate a target initialization vector by a random number generator; the target initialization vector is a random number;

[0122] Encrypting the second diagnostic data according to the first JWE key and the target initialization vector to obtain target ciphertext data;

[0123] Generate a target authentication tag according to the first JWE key, the target ciphertext data and the target initialization vector;

[0124] The target ciphertext data, the target initialization vector and the target authentication tag are encapsulated based on the JWE specification to obtain the target encrypted data.

[0125] Optionally, after obtaining the first diagnosis time of performing vehicle diagnosis on the target vehicle and the VIN code of the target vehicle, the data transmission encryption device 300 is further specifically used for:

[0126] Determining whether a JWE key exists in the first hardware security module;

[0127] If the JWE key does not exist in the first hardware security module, executing the step of generating a first JWE key according to the first diagnosis time, the VIN code and the first character string;

[0128] If the JWE key exists in the first hardware security module, obtaining a second diagnosis time for performing vehicle diagnosis on the target vehicle; the second diagnosis time is before the first diagnosis time;

[0129] Obtaining the JWE key corresponding to the second diagnosis moment to obtain a third JWE key;

[0130] determining a target diagnostic time interval according to the first diagnostic time and the second diagnostic time;

[0131] Acquire the frequency of data communication within the target diagnostic time interval to obtain a target communication frequency;

[0132] When the target diagnostic time interval is greater than or equal to a preset diagnostic time interval threshold, or the target communication frequency is greater than or equal to a preset communication frequency threshold, determining the first JWE key according to the third JWE key, the first diagnostic time, the VIN code, and the first character string;

[0133] Executing the step of acquiring the target diagnostic data corresponding to the first diagnostic moment;

[0134] Otherwise, the third JWE key is used as the first JWE key to execute the step of obtaining the target diagnostic data corresponding to the first diagnostic moment.

[0135] Optionally, in the aspect of determining the first JWE key according to the third JWE key, the first diagnosis time, the VIN code and the first character string, the data transmission encryption device 300 is further specifically used for:

[0136] Encrypt the first character string based on the third JWE key to obtain a second character string;

[0137] The first JWE key is generated according to the first diagnosis time, the VIN code and the second character string, and the first JWE key is stored in the first hardware security module.

[0138] Optionally, the automobile diagnostic device further includes: a pressure sensor, a vibration sensor and a temperature sensor; the first hardware security module further includes a hardware self-destruction circuit; the data transmission encryption device 300 is further specifically used for:

[0139] Monitor the automobile diagnostic device according to the pressure sensor, the vibration sensor and the temperature sensor to obtain target monitoring sensor data;

[0140] If the target monitoring sensor data meets the preset normal range conditions, it is determined that the vehicle diagnostic device is in a normal working state;

[0141] If the target monitoring sensor data does not meet the preset normal range conditions, it is determined that the vehicle diagnostic device is in a damaged state and an automatic destruction instruction is generated;

[0142] In response to the automatic destruction instruction, the hardware self-destruction circuit is started; the hardware self-destruction circuit is used to apply a high voltage pulse or a strong magnetic field to the first hardware security module so that the first JWE key in the first hardware security module is destroyed.

[0143] The data transmission encryption device 300 described in the present application can enable the automobile diagnostic equipment to generate or update the first JWE key according to the specific situation after obtaining the first diagnostic moment and the VIN code of the target automobile. The collected target diagnostic data is encrypted using the first JWE key, and the generated target encrypted data that complies with the JWE specification is sent to the remote server, which is decrypted with the corresponding second JWE key. At the same time, the automobile diagnostic equipment is equipped with various sensors to monitor its own status. If the monitoring data exceeds the preset normal range, the equipment is judged to be damaged and the hardware self-destruction circuit is activated to destroy the first JWE key in the first hardware security module. It can be seen that through the combination of JWE keys and hardware security modules, secure key management and encryption and decryption processes can be carried out to ensure the confidentiality, integrity and authenticity of automobile diagnostic data during transmission and storage.

[0144] See also Figure 4 , Figure 4 : is a structural diagram of an electronic device provided in an embodiment of the present application, the electronic device may include a processor, a memory, a communication interface and one or more programs, the processor, the memory and the communication interface may be interconnected through a bus; the one or more programs are stored in the memory and are configured to be executed by the processor; in an embodiment of the present application, the electronic device is applied to an automobile diagnostic device, the automobile diagnostic device includes a first hardware security module, the automobile diagnostic device is communicatively connected with a remote server, the remote server includes a second hardware security module, and the program includes instructions for executing the following steps:

[0145] Obtaining a first diagnosis time of performing vehicle diagnosis on a target vehicle and a VIN code of the target vehicle;

[0146] Generate a first JWE key according to the first diagnosis time, the VIN code and the first character string, and store the first JWE key in the first hardware security module; the first character string is an initial character string agreed upon by the vehicle diagnostic device and the remote server;

[0147] Sending the first diagnosis time and the VIN code to the remote server, generating a second JWE key by the remote server according to the first diagnosis time, the VIN code and the first character string, and storing the second JWE key in the second hardware security module;

[0148] Acquiring target diagnostic data corresponding to the first diagnostic moment;

[0149] Encrypting the target diagnostic data according to the first JWE key to obtain target encrypted data;

[0150] The target encrypted data is sent to the remote server, so that the remote server decrypts the target encrypted data according to the second JWE key to obtain the target diagnostic data.

[0151] The electronic device described in the present application can enable the automobile diagnostic device to generate or update the first JWE key according to the specific situation after obtaining the first diagnostic moment and VIN code of the target car. The collected target diagnostic data is encrypted using the first JWE key, and the generated target encrypted data that complies with the JWE specification is sent to the remote server, which is decrypted with the corresponding second JWE key. At the same time, the automobile diagnostic equipment is equipped with various sensors to monitor its own status. If the monitoring data exceeds the preset normal range and the equipment is determined to be damaged, the hardware self-destruction circuit is activated to destroy the first JWE key in the first hardware security module. It can be seen that through the combination of JWE keys and hardware security modules, secure key management and encryption and decryption processes can be carried out to ensure the confidentiality, integrity and authenticity of automobile diagnostic data during transmission and storage.

[0152] An embodiment of the present application also provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program for electronic data exchange, wherein the computer program enables a computer to execute part or all of the steps of any method described in the above method embodiments, and the above computer includes an electronic device.

[0153] The embodiment of the present application also provides a computer program product, the computer program product includes a non-transitory computer-readable storage medium storing a computer program, the computer program is operable to cause a computer to execute some or all of the steps of any method described in the method embodiment. The computer program product may be a software installation package, and the computer includes an electronic device.

[0154] Those skilled in the art can understand that to implement all or part of the processes in the above-mentioned embodiments, the processes can be completed by computer programs to instruct related hardware, and the programs can be stored in computer-readable storage media. When the programs are executed, they can include the processes of the above-mentioned method embodiments. The aforementioned storage media include: ROM or random access memory RAM, magnetic disk or optical disk and other media that can store program codes.

[0155] The steps of the method or algorithm described in the embodiments of the present application can be implemented in hardware or by executing software instructions by a processor. The software instructions can be composed of corresponding software modules, and the software modules can be stored in RAM, flash memory, ROM, EPROM, electrically erasable programmable read-only memory (electrically EPROM, EEPROM), registers, hard disks, mobile hard disks, read-only compact disks (CD-ROMs) or any other form of storage medium known in the art. An exemplary storage medium is coupled to the processor so that the processor can read information from the storage medium and write information to the storage medium. Of course, the storage medium can also be a component of the processor. The processor and the storage medium can be located in an ASIC. In addition, the ASIC can be located in a terminal device or a management device. Of course, the processor and the storage medium can also be present in a terminal device or a management device as discrete components.

[0156] Those skilled in the art should be aware that in one or more of the above examples, the functions described in the embodiments of the present application can be implemented in whole or in part by software, hardware, firmware, or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiments of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from a website site, computer, server, or data center to another website site, computer, server, or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (digital subscriber line, DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more available media integrations. The available medium may be a magnetic medium (eg, a floppy disk, a hard disk, a magnetic tape), an optical medium (eg, a digital video disc (DVD)), or a semiconductor medium (eg, a solid state disk (SSD)).

[0157] The modules / units included in the devices and products described in the above embodiments may be software modules / units or hardware modules / units, or may be partially software modules / units and partially hardware modules / units. For example, for the devices and products applied to or integrated in the chip, the modules / units included therein may all be implemented in the form of hardware such as circuits, or at least some of the modules / units may be implemented in the form of software programs, which run on the processor integrated inside the chip, and the remaining (if any) modules / units may be implemented in the form of hardware such as circuits; for the devices and products applied to or integrated in the chip module, the modules / units included therein may all be implemented in the form of hardware such as circuits, and different modules / units may be located in the same component (such as a chip, circuit module, etc.) or in different components of the chip module, or at least some of the modules / units may be implemented in the form of software programs. The software programs run on the processor integrated inside the chip, and the remaining (if any) modules / units may be implemented in the form of hardware such as circuits. It is implemented in the form of a software program, which runs on a processor integrated inside the chip module, and the remaining (if any) modules / units can be implemented in hardware such as circuits; for various devices and products applied to or integrated in the terminal equipment, the various modules / units contained therein can be implemented in hardware such as circuits, and different modules / units can be located in the same component (for example, chip, circuit module, etc.) or in different components in the terminal equipment, or, at least some modules / units can be implemented in the form of a software program, which runs on a processor integrated inside the terminal equipment, and the remaining (if any) modules / units can be implemented in hardware such as circuits.

[0158] The specific implementation methods described above further illustrate the purpose, technical solutions and beneficial effects of the embodiments of the present application. It should be understood that the above description is only the specific implementation method of the embodiments of the present application and is not intended to limit the protection scope of the embodiments of the present application. Any modifications, equivalent substitutions, improvements, etc. made on the basis of the technical solutions of the embodiments of the present application should be included in the protection scope of the embodiments of the present application.

Claims

1. A data transmission encryption method, characterized in that: Applied to an automobile diagnostic device, the automobile diagnostic device includes a first hardware security module, the automobile diagnostic device is communicatively connected with a remote server, and the remote server includes a second hardware security module; the method includes: Obtaining a first diagnosis time of performing vehicle diagnosis on a target vehicle and a VIN code of the target vehicle; Generate a first JWE key according to the first diagnosis time, the VIN code and the first character string, and store the first JWE key in the first hardware security module; the first character string is an initial character string agreed upon by the vehicle diagnostic device and the remote server; Sending the first diagnosis time and the VIN code to the remote server, generating a second JWE key by the remote server according to the first diagnosis time, the VIN code and the first character string, and storing the second JWE key in the second hardware security module; Acquiring target diagnostic data corresponding to the first diagnostic moment; Encrypting the target diagnostic data according to the first JWE key to obtain target encrypted data; The target encrypted data is sent to the remote server, so that the remote server decrypts the target encrypted data according to the second JWE key to obtain the target diagnostic data.

2. The method according to claim 1, characterized in that The generating a first JWE key according to the first diagnosis time, the VIN code and the first character string includes: Performing hash processing on the first diagnosis time and the VIN code to obtain a target secret key factor; Concatenate the target secret key factor with the first character string to obtain a target concatenated character string; Generate the first JWE key according to the target concatenated string based on a preset encryption algorithm.

3. The method according to claim 1, characterized in that Before encrypting the target diagnostic data according to the first JWE key to obtain target encrypted data, the method further includes: Get access control information; Obtaining preset access permission information stored in the first hardware security module; Verify the first hardware security module according to the access control information and the preset access permission information to obtain a target verification result; When the target verification result is passed, the first JWE key is obtained from the first hardware security module.

4. The method according to any one of claims 1 to 3, characterized in that: The step of encrypting the target diagnostic data according to the first JWE key to obtain target encrypted data includes: Preprocessing the target diagnostic data to obtain first diagnostic data in a standard data format; Encoding the first diagnostic data using Base64 encoding to obtain second diagnostic data; Generate a target initialization vector by a random number generator; the target initialization vector is a random number; Encrypting the second diagnostic data according to the first JWE key and the target initialization vector to obtain target ciphertext data; Generate a target authentication tag according to the first JWE key, the target ciphertext data and the target initialization vector; The target ciphertext data, the target initialization vector and the target authentication tag are encapsulated based on the JWE specification to obtain the target encrypted data.

5. The method according to any one of claims 1 to 3, characterized in that: After obtaining the first diagnosis time of performing vehicle diagnosis on the target vehicle and the VIN code of the target vehicle, the method further includes: Determining whether a JWE key exists in the first hardware security module; If the JWE key does not exist in the first hardware security module, executing the step of generating a first JWE key according to the first diagnosis time, the VIN code and the first character string; If the JWE key exists in the first hardware security module, obtaining a second diagnosis time for performing vehicle diagnosis on the target vehicle; the second diagnosis time is before the first diagnosis time; Obtaining the JWE key corresponding to the second diagnosis moment to obtain a third JWE key; determining a target diagnostic time interval according to the first diagnostic time and the second diagnostic time; Acquire the frequency of data communication within the target diagnostic time interval to obtain a target communication frequency; When the target diagnostic time interval is greater than or equal to a preset diagnostic time interval threshold, or the target communication frequency is greater than or equal to a preset communication frequency threshold, determining the first JWE key according to the third JWE key, the first diagnostic time, the VIN code, and the first character string; Executing the step of acquiring the target diagnostic data corresponding to the first diagnostic moment; Otherwise, the third JWE key is used as the first JWE key to execute the step of obtaining the target diagnostic data corresponding to the first diagnostic moment.

6. The method according to claim 5, characterized in that The determining the first JWE key according to the third JWE key, the first diagnosis time, the VIN code and the first character string includes: Encrypt the first character string based on the third JWE key to obtain a second character string; The first JWE key is generated according to the first diagnosis time, the VIN code and the second character string, and the first JWE key is stored in the first hardware security module.

7. The method according to claim 1 or 2, characterized in that: The automobile diagnostic device further includes: a pressure sensor, a vibration sensor and a temperature sensor; the first hardware security module further includes a hardware self-destruct circuit; the method further includes: Monitor the automobile diagnostic device according to the pressure sensor, the vibration sensor and the temperature sensor to obtain target monitoring sensor data; If the target monitoring sensor data meets the preset normal range conditions, it is determined that the vehicle diagnostic device is in a normal working state; If the target monitoring sensor data does not meet the preset normal range conditions, it is determined that the vehicle diagnostic device is in a damaged state and an automatic destruction instruction is generated; In response to the automatic destruction instruction, the hardware self-destruction circuit is started; the hardware self-destruction circuit is used to apply a high voltage pulse or a strong magnetic field to the first hardware security module so that the first JWE key in the first hardware security module is destroyed.

8. A data transmission encryption device, characterized in that: Applied to automobile diagnostic equipment, the automobile diagnostic equipment includes a first hardware security module, the automobile diagnostic equipment is connected to a remote server for communication, and the remote server includes a second hardware security module; the data transmission encryption device includes: a data acquisition unit, a key generation unit, a first data transmission unit, a data encryption unit, and a second data transmission unit, wherein: The data acquisition unit is used to acquire a first diagnosis time of performing vehicle diagnosis on a target vehicle and a VIN code of the target vehicle; The key generation unit is used to generate a first JWE key according to the first diagnosis time, the VIN code and the first character string, and store the first JWE key in the first hardware security module; the first character string is an initial character string agreed upon by the vehicle diagnostic device and the remote server; The first data transmission unit is used to send the first diagnosis time and the VIN code to the remote server, generate a second JWE key according to the first diagnosis time, the VIN code and the first character string by the remote server, and store the second JWE key in the second hardware security module; The data acquisition unit is further used to acquire target diagnostic data corresponding to the first diagnostic time; The data encryption unit is used to encrypt the target diagnostic data according to the first JWE key to obtain target encrypted data; The second data transmission unit is used to send the target encrypted data to the remote server, so that the remote server decrypts the target encrypted data according to the second JWE key to obtain the target diagnostic data.

9. An electronic device, characterized in that: include: A processor, a memory, a communication interface, and one or more programs; The one or more programs are stored in the memory and configured to be executed by the processor, the programs comprising instructions for executing the steps in the method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, wherein the computer program includes program instructions, and when the program instructions are executed by a processor, the processor is caused to perform the method according to any one of claims 1 to 7.

Images