UDS security access method, device, equipment, medium and product

Abstract

The invention discloses a UDS security access method, device and equipment, a medium and a product. The method comprises the following steps: requesting a seed from a vehicle-mounted computer to instruct the vehicle-mounted computer to execute the following steps: generating a random seed, determining a first key, and encrypting the random seed by adopting the first key to obtain a first ciphertext; obtaining a random seed from the vehicle-mounted computer, determining a second key according to the requested security level, and encrypting the random seed by using the second key to obtain a second ciphertext; and sending the second ciphertext to the vehicle-mounted computer, so that the vehicle-mounted computer performs consistency check on the first ciphertext and the second ciphertext, and unlocking the security level requested by security access under the condition that the first ciphertext and the second ciphertext are consistent. According to the embodiment of the invention, the security of the diagnosis service can be improved.

Description

Technical Field

[0001] The present invention relates to the field of vehicle information security technology, and in particular to a UDS security access method, device, equipment, medium and product. Background Art

[0002] UDS (Unified Diagnostic Services) is widely used for vehicle diagnosis. UDS security access service is mainly used to modify ECU (Electronic Control Unit) data stored in memory, that is, on-board computer data. Before modifying the data, the test equipment must first grant access rights through the UDS security access service. The existing UDS security access method has obvious deficiencies in security. Summary of the invention

[0003] The present invention provides a UDS security access method, device, equipment, medium and product to solve the problem of insufficient security of the existing UDS security access method.

[0004] According to one aspect of the present invention, a UDS security access method is provided, comprising:

[0005] Requesting a seed from the onboard computer to instruct the onboard computer to execute: generating a random seed, determining a first key, and encrypting the random seed with the first key to obtain a first ciphertext;

[0006] Obtaining a random seed from the onboard computer, determining a second key according to the requested security level, and encrypting the random seed with the second key to obtain a second ciphertext;

[0007] The second ciphertext is sent to the onboard computer, so that the onboard computer performs a consistency check on the first ciphertext and the second ciphertext, and unlocks the security level requested for security access if they are consistent.

[0008] According to another aspect of the present invention, a UDS security access device is provided, comprising:

[0009] A seed request module, used for requesting a seed from the onboard computer, and for instructing the onboard computer to execute: generating a random seed, determining a first key, and encrypting the random seed with the first key to obtain a first ciphertext;

[0010] A key determination module, configured to obtain a random seed from the onboard computer, determine a second key according to the requested security level, and encrypt the random seed with the second key to obtain a second ciphertext;

[0011] The ciphertext verification module is used to send the second ciphertext to the on-board computer, so that the on-board computer performs consistency check on the first ciphertext and the second ciphertext, and unlocks the security level requested by the security access if they are consistent.

[0012] According to another aspect of the present invention, a computer program product is provided, comprising a computer program, wherein when the computer program is executed by a processor, the UDS security access method according to any embodiment of the present invention is implemented.

[0013] According to another aspect of the present invention, there is provided an electronic device, the electronic device comprising:

[0014] At least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the UDS security access method described in any embodiment of the present invention.

[0015] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the UDS security access method described in any embodiment of the present invention when executed.

[0016] According to another aspect of the present invention, a computer program product is provided, comprising a computer program / instruction, wherein when the computer program / instruction is executed by a processor, the UDS security access method as described in any embodiment of the present invention is implemented.

[0017] The embodiment of the present invention determines the key used for the security access request according to the requested security level. Compared with setting a unified key for all security levels, pre-setting different keys for different security levels can significantly improve the security hierarchy and targeted protection of the system. Even if the key of a certain security level is at risk, it will not affect other levels, thereby effectively reducing the probability of the overall system being completely breached and improving the security of diagnostic services.

[0018] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0020] Figure 1 is a first flow chart of a UDS security access method provided by an embodiment of the present invention;

[0021] Figure 2 is a second flow chart of a UDS security access method provided by an embodiment of the present invention;

[0022] Figure 3 It is a structural diagram of a UDS security access device provided by an embodiment of the present invention;

[0023] Figure 4 It is a schematic diagram of the structure of an electronic device implementing an embodiment of the present invention. DETAILED DESCRIPTION

[0024] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0025] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0026] Figure 1This is the first flow chart of a UDS security access method provided by an embodiment of the present invention. This embodiment is applicable to the case of improving the security of UDS security access services. The method can be executed by a UDS security access device, which can be implemented in the form of hardware and / or software, and can be configured in an electronic device with corresponding data processing capabilities. Figure 1 As shown, the method includes:

[0027] S110, requesting a seed from the onboard computer, for instructing the onboard computer to execute: generating a random seed, determining a first key, and using the first key to encrypt the random seed to obtain a first ciphertext.

[0028] When the vehicle computer ECU is powered on or remotely initialized, it enters the default session mode. The session mode is used to define the type of communication session between the vehicle computer and the test equipment. The default session mode is the basic state of the vehicle computer and supports basic diagnostic operations, such as reading fault codes and clearing fault codes. The diagnostic instrument, i.e. the test equipment, establishes a communication connection with the vehicle computer. After the communication connection is established, the test equipment can start sending UDS service requests. Before performing the security access request service, the vehicle computer needs to be switched to the extended session mode or programming session mode through the diagnostic session control service.

[0029] Before performing sensitive operations (such as writing data), the test equipment needs to send a security access request to the on-board computer. Specifically, the test equipment sends a security access request with a sub-function number to the on-board computer, requesting a seed from the on-board computer. Among them, the sub-function number is used to distinguish different security access types and the security level requested for security access, and the security access type is used to indicate the specific security access operation that the on-board computer needs to perform, such as requesting a seed, sending a ciphertext, etc. The security level requested for security access indicates the security level that the test equipment wants the on-board device to unlock. After receiving the security access request, the on-board computer generates a random seed and sends the random seed to the test equipment through a security access response. The on-board computer determines the first key based on the security level requested for security access, and uses the first key to encrypt the random seed to obtain the first ciphertext.

[0030] S120: Obtain a random seed from the onboard computer, determine a second key according to the requested security level, and use the second key to encrypt the random seed to obtain a second ciphertext.

[0031] S130: Send the second ciphertext to the onboard computer, so that the onboard computer performs a consistency check on the first ciphertext and the second ciphertext, and unlocks the security level requested by the security access if they are consistent.

[0032] After the test device obtains the random seed from the vehicle computer, it determines the requested security level according to the sub-function number of the security access request, determines the second key according to the requested security level, and uses the second key to encrypt the random seed to obtain the second ciphertext. Send the second ciphertext to the vehicle computer. Among them, the first key is stored in the vehicle computer, the second key is stored in the test device, and the first key is the same as the second key. After the vehicle computer receives the security access request, it performs a consistency check on the first ciphertext and the second ciphertext. If the two are consistent, the verification is passed, and the vehicle computer unlocks the security level requested for security access; if they are inconsistent, the verification fails, and the vehicle computer keeps the current security level unchanged.

[0033] The embodiment of the present invention determines the key used for the security access request according to the requested security level. Compared with setting a unified key for all security levels, pre-setting different keys for different security levels can significantly improve the security hierarchy and targeted protection of the system. Even if the key of a certain security level is at risk, it will not affect other levels, thereby effectively reducing the probability of the overall system being completely breached and improving the security of diagnostic services.

[0034] Optionally, the use of the second key to encrypt the random seed to obtain the second ciphertext includes: using the electronic codebook ECB mode of the Advanced Encryption Standard AES, and encrypting the random seed according to the second key to obtain the second ciphertext. Specifically, the Advanced Encryption Standard (AES) is a widely used symmetric encryption algorithm that provides three encryption strengths of 128 bits, 192 bits and 256 bits. The AES algorithm supports multiple operation modes including the electronic codebook mode. The basic working principle of the electronic codebook (ECB) mode is to divide the plaintext data into blocks of fixed size and then encrypt each block independently. Each block uses the same key when encrypting, and there is no link or dependency between blocks in any form. The AES ECB mode divides the plaintext into blocks of fixed size and uses the same key to independently encrypt each block, which makes the encryption process relatively simple and easy to implement. At the same time, since each block is encrypted independently, the AES ECB mode supports parallel computing, which can improve the speed of encryption and decryption. In addition, during the encryption process, if an error occurs in a block, the error will not be transmitted to other blocks, thus ensuring the independence of the encryption results.

[0035] Figure 2 This is a second flow chart of a UDS security access method provided by an embodiment of the present invention. This embodiment is optimized and improved on the basis of the above embodiment. Figure 2 As shown, the method includes:

[0036] S210, requesting a seed from the onboard computer, to instruct the onboard computer to execute: generating a random seed, determining a first key, and using the first key to encrypt the random seed to obtain a first ciphertext.

[0037] S220, obtaining a random seed from the onboard computer to determine the security level requested for the secure access; based on the association relationship between the preset candidate security levels and the candidate keys, determining the candidate key associated with the security level requested for the secure access to obtain a second key.

[0038] Specifically, different keys are preset for different security levels in the test equipment and the vehicle-mounted computer. When making a security access request, the vehicle-mounted computer determines the security level requested for the security access according to the sub-function number of the security access request, and selects the corresponding key as the first key to encrypt the random seed; the test equipment determines the security level requested for the security access according to the sub-function number of the security access request, and selects the corresponding key as the second key to encrypt the random seed; the first key is the same as the second key.

[0039] Compared with setting a unified key for all security levels, pre-setting different keys for different security levels in the test equipment and on-board computers can significantly improve the system's security hierarchy and targeted protection. Even if the key of a certain security level is at risk, it will not affect other levels, thereby effectively reducing the probability of the overall system being fully breached and improving the security of diagnostic services.

[0040] Optionally, determining the security level requested for the security access includes: determining the security level requested for the security access according to the session mode requested for the security access, wherein the session mode requested for the security access includes a programming session or an extended session. Different security levels are distinguished by different session modes. The security access request includes a sub-function number, which is used to distinguish different security access types and session modes requested for the security access, and the session mode requested for the security access is determined according to the sub-function number of the security access request; and the security level requested for the security access is determined according to the session mode requested for the security access. Exemplarily, sub-function number 01 represents requesting a seed under an extended session, and sub-function number 0x09 represents requesting a seed under a programming session. Sub-function number 02 represents sending a ciphertext under an extended session, and sub-function number 0x0A represents sending a ciphertext under a programming session. Using different session modes can simplify the management of security policies, and corresponding security policies can be formulated and executed according to the session mode, thereby making it easier to control access to system resources. Different session modes can adapt to different security needs. For example, for highly sensitive data or functions, a stricter session mode can be used to strengthen protection, while for less sensitive data or functions, a relatively loose session mode can be used to improve access efficiency. Reduce the security risk of the overall system. Even if a session mode of a certain security level is threatened, session modes of other levels can still provide effective protection, thereby ensuring the overall security and stability of the system.

[0041] S230, encrypting the random seed with a second key to obtain a second ciphertext; sending the second ciphertext to the onboard computer, so that the onboard computer performs a consistency check on the first ciphertext and the second ciphertext, and unlocks the security level requested by the security access if they are consistent.

[0042] The embodiment of the present invention can significantly improve the security hierarchy and targeted protection of the system by presetting different keys for different security levels in the test equipment and the on-board computer. Even if the keys of a certain security level are at risk, it will not affect other levels, thereby effectively reducing the probability of the overall system being completely breached and improving the security of the diagnostic service.

[0043] In an optional implementation, the method of determining a candidate key associated with a security level requested for secure access to obtain a second key includes: determining a candidate key associated with a session mode requested for secure access to obtain at least two sub-keys; decrypting each sub-key based on a preset decryption algorithm; and concatenating the decrypted sub-keys to obtain the second key.

[0044] To ensure the secure storage of keys and prevent unauthorized access, each candidate key is segmented and encrypted in the test device. For example, the 128-bit candidate key is evenly divided into at least two parts, and each part is XORed with a constant to obtain at least two subkeys. The session mode requested by the secure access is determined according to the sub-function number of the secure access request, and the candidate key associated with the session mode requested by the secure access is determined to obtain at least two subkeys. Each subkey is decrypted based on a preset decryption algorithm; each decrypted subkey is spliced ​​to obtain a second key. By segmenting and encrypting the key, the key information is dispersed to reduce the risk of a single storage point being compromised, and it is convenient to implement more fine-grained access control and key management strategies, thereby improving the overall security and flexibility of the system.

[0045] Figure 3 Schematic diagram of the structure of a UDS security access device provided by an embodiment of the present invention. Figure 3 As shown, the device comprises:

[0046] The seed request module 310 is used to request a seed from the vehicle-mounted computer, and is used to instruct the vehicle-mounted computer to execute: generating a random seed, determining a first key, and encrypting the random seed with the first key to obtain a first ciphertext;

[0047] A key determination module 320, configured to obtain a random seed from the vehicle-mounted computer, determine a second key according to the requested security level, and encrypt the random seed with the second key to obtain a second ciphertext;

[0048] The ciphertext verification module 330 is used to send the second ciphertext to the onboard computer, so that the onboard computer performs consistency check on the first ciphertext and the second ciphertext, and unlocks the security level requested by the security access if they are consistent.

[0049] The UDS security access device provided in the embodiment of the present invention can execute the UDS security access method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0050] Optionally, the key determination module includes:

[0051] A security level determination unit, used to determine the security level requested for security access;

[0052] The key determination unit is used to determine the candidate key associated with the security level requested by the security access to obtain the second key based on the preset association relationship between the candidate security level and the candidate key.

[0053] Optionally, the security level determination unit is specifically used to determine the security level requested for the security access according to a session mode requested for the security access, where the session mode requested for the security access includes a programming session or an extended session.

[0054] Optionally, the key determination unit is specifically used to: determine a candidate key associated with a session mode requested for secure access to obtain at least two subkeys; decrypt each subkey based on a preset decryption algorithm; and concatenate the decrypted subkeys to obtain the second key.

[0055] Optionally, the key determination module includes: an encryption unit, used to adopt the electronic code book ECB mode of the Advanced Encryption Standard AES, and encrypt the random seed according to the second key to obtain a second ciphertext.

[0056] The further described UDS security access device can also execute the UDS security access method provided by any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0057] According to an embodiment of the present invention, the present invention also provides an electronic device, a readable storage medium and a computer program product.

[0058] Figure 4 A schematic diagram of the structure of an electronic device 40 that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0059] like Figure 4As shown, the electronic device 40 includes at least one processor 41, and a memory connected to the at least one processor 41, such as a read-only memory (ROM) 42, a random access memory (RAM) 43, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 41 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 42 or the computer program loaded from the storage unit 48 to the random access memory (RAM) 43. In the RAM 43, various programs and data required for the operation of the electronic device 40 can also be stored. The processor 41, the ROM 42, and the RAM 43 are connected to each other through a bus 44. An input / output (I / O) interface 45 is also connected to the bus 44.

[0060] A number of components in the electronic device 40 are connected to the I / O interface 45, including: an input unit 46, such as a keyboard, a mouse, etc.; an output unit 47, such as various types of displays, speakers, etc.; a storage unit 48, such as a disk, an optical disk, etc.; and a communication unit 49, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 49 allows the electronic device 40 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0061] The processor 41 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 41 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 41 executes the various methods and processes described above, such as the UDS security access method.

[0062] In some embodiments, the UDS security access method may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 48. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 40 via the ROM 42 and / or the communication unit 49. When the computer program is loaded into the RAM 43 and executed by the processor 41, one or more steps of the UDS security access method described above may be performed. Alternatively, in other embodiments, the processor 41 may be configured to execute the UDS security access method in any other appropriate manner (e.g., by means of firmware).

[0063] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0064] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0065] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0066] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0067] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0068] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0069] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0070] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A UDS security access method, characterized in that: Applied to testing equipment, the method comprises: Requesting a seed from the onboard computer to instruct the onboard computer to execute: generating a random seed, determining a first key, and encrypting the random seed with the first key to obtain a first ciphertext; Obtaining a random seed from the onboard computer, determining a second key according to the requested security level, and encrypting the random seed with the second key to obtain a second ciphertext; The second ciphertext is sent to the onboard computer, so that the onboard computer performs a consistency check on the first ciphertext and the second ciphertext, and unlocks the security level requested for security access if they are consistent.

2. The method according to claim 1, characterized in that The step of determining the second key according to the requested security level comprises: Determine the security level requested for security access; Based on the preset association relationship between the candidate security level and the candidate key, the candidate key associated with the security level requested for the security access is determined to obtain the second key.

3. The method according to claim 2, characterized in that Determining the security level requested for the security access includes: The security level requested for the security access is determined according to a session mode requested for the security access, wherein the session mode requested for the security access includes a programming session or an extended session.

4. The method according to claim 3, characterized in that The step of determining a candidate key associated with the security level requested for the security access to obtain a second key comprises: Determine a candidate key associated with the session mode requested for secure access, and obtain at least two subkeys; Decrypt each subkey based on a preset decryption algorithm; and concatenate each decrypted subkey to obtain the second key.

5. The method according to claim 1, characterized in that The step of encrypting the random seed with the second key to obtain a second ciphertext includes: The electronic codebook ECB mode of the Advanced Encryption Standard AES is adopted, and the random seed is encrypted according to the second key to obtain a second ciphertext.

6. A UDS security access device, characterized in that: The device comprises: A seed request module, used for requesting a seed from the onboard computer, and for instructing the onboard computer to execute: generating a random seed, determining a first key, and encrypting the random seed with the first key to obtain a first ciphertext; A key determination module, configured to obtain a random seed from the onboard computer, determine a second key according to the requested security level, and encrypt the random seed with the second key to obtain a second ciphertext; The ciphertext verification module is used to send the second ciphertext to the on-board computer, so that the on-board computer performs consistency check on the first ciphertext and the second ciphertext, and unlocks the security level requested by the security access if they are consistent.

7. The device according to claim 6, characterized in that The key determination module comprises: A security level determination unit, used to determine the security level requested for security access; The key determination unit is used to determine the candidate key associated with the security level requested by the security access to obtain the second key based on the preset association relationship between the candidate security level and the candidate key.

8. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively coupled to the at least one processor; The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the UDS security access method described in any one of claims 1 to 5.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the UDS security access method according to any one of claims 1 to 5 when executed.

10. A computer program product, comprising a computer program, wherein when the computer program is executed by a processor, the computer program implements the UDS security access method according to any one of claims 1 to 5.

Images