Electronic control unit login method and device, electronic equipment, storage medium and product

Abstract

The invention relates to an electronic control unit login method and device, electronic equipment, a storage medium and a product, and relates to the technical field of communication, and the method comprises the steps that a terminal sends a signature request comprising a target public key corresponding to a target electronic control unit and an identity identification code corresponding to a user to a server, the server performs permission authentication and generates a target signature according to the target public key and a target private key corresponding to the target electronic control unit, the terminal sends the target signature to the target electronic control unit for authentication after receiving the target signature returned by the server, and the target electronic control unit performs login authentication on the target signature under the condition that the target signature passes login authentication. And a user logs in the target electronic control unit through the login client on the terminal so as to manage the target electronic control unit. The signature request is sent to the server through the terminal, authority authentication can be performed through the server, and the target private key is stored in the server, so that the risk of leakage of the target private key can be reduced, and the management security of the target electronic control unit is improved.

Description

Technical Field

[0001] The present disclosure relates to the field of communication technology, and in particular to an electric control unit login method, device, electronic equipment, storage medium and product. Background Art

[0002] Vehicle software development involves the vehicle's ECU (Electronic Control Unit). During the development process, R&D personnel can use SSH (Secure Shell) to debug and manage the ECU.

[0003] In the related technology, SSH defines an identity authentication mechanism between a login client and an electronic control unit. When a user passes the authentication based on the login client, he or she can log in to the ECU and then proceed to code writing, debugging, and optimizing the ECU. Summary of the invention

[0004] In order to overcome the problems existing in the related art, the present disclosure provides an electric control unit login method, device, electronic device, storage medium and product. By storing a private key in a server, a terminal sends a signature request including a target public key corresponding to a target electric control unit and an identity identification code corresponding to a user to the server, so that the server performs authority authentication and generates a target signature according to the target public key and the target private key corresponding to the target electric control unit. After the terminal receives the target signature returned by the server, the target signature can be sent to the target electric control unit for authentication. When the target signature passes the login authentication, the user logs in to the target electric control unit through the login client on the terminal, thereby managing the target electric control unit. By sending a signature request from the terminal to the server, the authority authentication can be performed first through the server, and illegal access to the target electric control unit by illegal personnel can be avoided, thereby improving security. Moreover, by storing the target private key on the server, the risk of leakage of the target private key can be reduced, further improving the security of the management of the target electric control unit.

[0005] According to a first aspect of an embodiment of the present disclosure, there is provided an electric control unit login method, which is applied to a terminal and includes: In response to the login authentication request sent by the target electronic control unit, a signature request is sent to the server, wherein the signature request includes a target public key corresponding to the target electronic control unit and an identity identification code corresponding to the user; Receiving a target signature returned by the server in response to the signature request, wherein the target signature is generated by the server according to the target public key and a target private key corresponding to the target electronic control unit when the identity identification code passes the authority authentication, and the target private key is stored in the server; The target signature is sent to the target electronic control unit, so as to log in the target electronic control unit if the target signature passes the login authentication.

[0006] Optionally, before sending the signature request to the server, the method further includes: Display the authentication page to the user through the login client; The user information input by the user based on the identity authentication page and the identity identification code corresponding to the user are sent to the server. The user information is used by the server for identity authentication. If the identity authentication passes, the server associates and stores the identity identification code with the user's username.

[0007] Optionally, the target signature is generated by the server querying the database according to the identity identification code to obtain the user name of the user, and when the authority authentication of the user name is passed, the server generates it according to the target public key and the target private key corresponding to the target electronic control unit, wherein when the user authority corresponding to the user name includes the authority to log in to the target electronic control unit, it is determined that the authority authentication of the user name is passed.

[0008] Optionally, the signature request includes data to be signed, and the data to be signed is obtained according to the target public key.

[0009] Optionally, before sending a signature request to the server in response to the login authentication request sent by the target electronic control unit, the method further includes: When establishing a session connection with the target electronic control unit, obtaining a first version number of a security protocol of the target electronic control unit; When the second version number of the security protocol corresponding to the login client of the terminal matches the first version number, key negotiation is performed with the target electronic control unit to obtain a target session key, and the target session key is used to encrypt the transmission information between the terminal and the target electronic control unit.

[0010] Optionally, the method further comprises: In response to a user's login request for the target electronic control unit, determining a connection address of the target electronic control unit; According to the connection address, a connection request is sent to the target electronic control unit to establish a session connection with the target electronic control unit.

[0011] According to a second aspect of an embodiment of the present disclosure, there is provided an electric control unit login method, which is applied to a server and includes: In response to the signature request of the terminal, performing authority authentication on the identity identification code in the signature request; In the case where the identity identification code passes the authority authentication, generating a target signature according to a target public key corresponding to the target electronic control unit and a target private key corresponding to the target electronic control unit; The target signature is sent to the terminal, so that the terminal sends the target signature to the target electronic control unit, and when the target signature passes the login authentication, the terminal logs into the target electronic control unit.

[0012] Optionally, before performing authority authentication on the identity identification code in the signature request in response to the signature request of the terminal, the method further includes: Receiving user information sent by the terminal and the identity identification code corresponding to the user, wherein the user information is information input by the user based on an identity authentication page displayed by a login client of the terminal; The identity identification code is authenticated, and when the identity identification code passes the identity authentication, the identity identification code and the user name of the user are associated and stored.

[0013] Optionally, in response to the signature request of the terminal, performing authority authentication on the identity identification code in the signature request includes: In response to the signature request of the terminal, query the database according to the identity identification code in the signature request to obtain the user's username; Query the database according to the user's username to obtain the user authority corresponding to the username; In a case where the user authority corresponding to the user name includes the authority to log in to the target electronic control unit, it is determined that the authority authentication of the user name is passed.

[0014] Optionally, the signature request includes data to be signed, and the data to be signed is obtained by the terminal according to the target public key.

[0015] According to a third aspect of an embodiment of the present disclosure, there is provided an electronic control unit login device, comprising: A first sending module is configured to send a signature request to a server in response to a login authentication request sent by a target electronic control unit, wherein the signature request includes a target public key corresponding to the target electronic control unit and an identity identification code corresponding to the user; a receiving module, configured to receive a target signature returned by the server in response to the signature request, wherein the target signature is generated by the server according to the target public key and a target private key corresponding to the target electronic control unit when the identity identification code passes the authority authentication, and the target private key is stored in the server; The second sending module is configured to send the target signature to the target electronic control unit, so as to log in to the target electronic control unit if the target signature passes the login authentication.

[0016] According to a fourth aspect of an embodiment of the present disclosure, there is provided an electronic control unit login device, comprising: A first authentication module is configured to perform authority authentication on the identity identification code in the signature request in response to the signature request of the terminal; A generating module, configured to generate a target signature according to a target public key corresponding to a target electronic control unit and a target private key corresponding to the target electronic control unit when the identity identification code passes the authority authentication; The fifth sending module is configured to send the target signature to the terminal, so that the terminal sends the target signature to the target electronic control unit, and when the target signature passes the login authentication, the terminal logs into the target electronic control unit.

[0017] According to a fifth aspect of an embodiment of the present disclosure, there is provided an electronic device, including: processor; a memory for storing processor-executable instructions; Wherein, the processor is configured to implement the steps of the electric control unit login method provided in the first aspect or the second aspect of the present disclosure when executing.

[0018] According to a sixth aspect of an embodiment of the present disclosure, a computer-readable storage medium is provided, on which computer program instructions are stored. When the computer program instructions are executed by a processor, the steps of the electric control unit login method provided in the first aspect or the second aspect of the present disclosure are implemented.

[0019] According to a seventh aspect of an embodiment of the present disclosure, a computer program product is provided, comprising a computer program, which, when executed by a processor, implements the steps of the electric control unit login method provided in the first aspect or the second aspect of the present disclosure.

[0020] The technical solution provided by the embodiments of the present disclosure may have the following beneficial effects: By storing the private key in the server, the terminal sends a signature request including the target public key corresponding to the target electronic control unit and the identity identification code corresponding to the user to the server, so that the server can perform authority authentication and generate a target signature according to the target public key and the target private key corresponding to the target electronic control unit. After the terminal receives the target signature returned by the server, the target signature can be sent to the target electronic control unit for authentication, and when the target signature passes the login authentication, the user logs in to the target electronic control unit through the login client on the terminal, thereby managing the target electronic control unit. By sending a signature request from the terminal to the server, the authority authentication can be performed first through the server, which can avoid illegal access to the target electronic control unit by illegal personnel, improve security, and store the target private key on the server, which can reduce the risk of leakage of the target private key and further improve the security of the management of the target electronic control unit.

[0021] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present disclosure and, together with the description, serve to explain the principles of the present disclosure.

[0023] Figure 1 The figure is a schematic diagram of an application scenario of an electric control unit login method according to an exemplary embodiment.

[0024] Figure 2 The figure is a schematic diagram showing an electric control unit login system according to an exemplary embodiment.

[0025] Figure 3 The figure is a flow chart of a method for logging into an electric control unit according to an exemplary embodiment.

[0026] Figure 4 The invention is a flowchart showing a method for determining a target session key according to an exemplary embodiment.

[0027] Figure 5 The figure is a flow chart of another method for logging into an electric control unit according to an exemplary embodiment.

[0028] Figure 6 The figure is a block diagram of a device for logging into an electric control unit according to an exemplary embodiment.

[0029] Figure 7 The figure is a block diagram of another electric control unit login device according to an exemplary embodiment.

[0030] Figure 8 It is a block diagram of an electronic device according to an exemplary embodiment.

[0031] Fig. 9 is a block diagram of another electronic device according to an exemplary embodiment. DETAILED DESCRIPTION

[0032] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present disclosure. Instead, they are merely examples of devices and methods consistent with some aspects of the present disclosure as detailed in the appended claims.

[0033] The embodiments described in some embodiments of the present disclosure below do not represent all embodiments consistent with the present disclosure. Instead, they are merely examples of devices and methods consistent with some aspects of the present disclosure as detailed in the appended claims.

[0034] It should be noted that all actions of acquiring signals, information or data in the present disclosure are carried out in compliance with the relevant data protection laws and policies of the country where the device is located and with the authorization given by the owner of the corresponding device.

[0035] In the related technology, SSH defines an authentication mechanism between the login client and the electronic control unit. When the user passes the authentication based on the login client, he can log in to the ECU and then write, debug and optimize the ECU code. However, the traditional SSH authentication mechanism has the problem of being unable to achieve secure permission control, which has led to many non-R&D personnel being able to easily enter the ECU and even implant malicious programs, posing a huge security risk to the vehicle system. In traditional SSH authentication, once the user passes the verification, he can obtain access rights to the ECU, but the control of such access rights is relatively weak. This means that not only R&D personnel, but other unauthorized personnel may also be able to connect to the ECU through SSH, increasing potential risks. What's more serious is that this weak permission control may provide malicious attackers with opportunities to perform unauthorized operations in the ECU, such as implanting malicious code or tampering with system settings.

[0036] In response to the above technical problems, the embodiments of the present disclosure provide an electric control unit login method, device, electronic device, storage medium and product. By storing a private key in a server, a terminal sends a signature request including a target public key corresponding to a target electric control unit and an identity identification code corresponding to a user to the server, so that the server performs authority authentication and generates a target signature according to the target public key and the target private key corresponding to the target electric control unit. After the terminal receives the target signature returned by the server, the target signature can be sent to the target electric control unit for authentication. When the target signature passes the login authentication, the user logs in to the target electric control unit through the login client on the terminal, thereby managing the target electric control unit. By sending a signature request from the terminal to the server, the server can first perform authority authentication, which can avoid illegal access to the target electric control unit by illegal personnel, thereby improving security. Moreover, by storing the target private key on the server, the risk of leakage of the target private key can be reduced, further improving the security of the target electric control unit management.

[0037] Figure 1 is a schematic diagram of an application scenario of an electric control unit login method according to an exemplary embodiment. Figure 1 As shown, the network segment 169 may include various ECUs and SSH clients on the vehicle side. The network segment 10 may include a unified identity authentication server, a permission control server, and a database for storing user information.

[0038] Figure 2 is a schematic diagram of an electric control unit login system according to an exemplary embodiment. Figure 2 As shown, it may include a terminal, a server, an electronic control unit and a key generation center. Among them, the terminal may include a login client and a backend, the login client may be an SSH client, and the backend may be an SSH backend. The server may include a unified identity authentication server, a permission management server and a database, and the database may specifically be a permission information database. The electronic control unit may be the ECU corresponding to each vehicle.

[0039] Figure 3 is a flow chart of a method for logging into an electric control unit according to an exemplary embodiment. Figure 3 As shown, the method can be used in a terminal and includes the following steps.

[0040] In step S301, in response to a login authentication request sent by a target electronic control unit, a signature request is sent to a server, the signature request including a target public key corresponding to the target electronic control unit and an identity identification code corresponding to the user.

[0041] In this embodiment, the target electronic control unit may be an electronic control unit that is expected to be logged in and managed, and the user can connect and log in to the target electronic control unit through the login client on the terminal. Among them, the login client may be an SSH client. After successfully connecting to and logging in to the target electronic control unit, the user can remotely manage the target electronic control unit. For example, code writing, debugging, and optimization of the target electronic control unit. In order to ensure security, before logging in to the target electronic control unit, the target electronic control unit will send a login authentication request to the terminal. After the terminal receives the login authentication request sent by the target electronic control unit, in response to the login authentication request, it sends a signature request to the server in order to obtain the target signature from the server. Among them, the signature request includes the target public key corresponding to the target electronic control unit and the identity identification code corresponding to the user. The identity identification code is used by the server to authenticate the user's user rights, and the target public key is used by the server to generate a target signature in combination with the corresponding target private key.

[0042] In a possible implementation, the key configuration can be performed in advance, and the key generation center can generate a corresponding private key and public key for each electronic control unit, and each public key can be distributed to the corresponding electronic control unit for storage. In addition, the terminal can obtain the corresponding public key of each electronic control unit from the key generation center and store it, which can be stored in the software package of the login client. The key generation center can also send the private key corresponding to each electronic control unit to the server for storage.

[0043] In step S302, a target signature returned by the server in response to the signature request is received. The target signature is generated by the server according to the target public key and the target private key corresponding to the target electronic control unit when the identity identification code passes the authority authentication. The target private key is stored in the server.

[0044] In this embodiment, after the server receives the signature request sent by the terminal, it can perform permission authentication according to the identity code in the signature request. If the identity code passes the permission authentication, the target signature is generated according to the target public key in the signature request and the target private key corresponding to the target electronic control unit stored locally on the server, and then the generated target signature is sent to the terminal. After the terminal receives the target signature sent by the server, it can send the target signature to the target electronic control unit.

[0045] In step S303, the target signature is sent to the target electronic control unit, so as to log in to the target electronic control unit if the target signature passes the login authentication.

[0046] In this embodiment, the terminal can send the received target signature to the target electronic control unit. After the target electronic control unit receives the target signature sent by the terminal, it can perform login authentication on the target signature. If the login authentication passes, the terminal can log in to the target electronic control unit.

[0047] By sending a signature request to the server through the terminal, permission authentication can be performed through the server first, which can prevent illegal access to the target electronic control unit by illegal personnel and improve security. Storing the target private key on the server can reduce the risk of leakage of the target private key and further improve the security of the management of the target electronic control unit.

[0048] Figure 4 is a flow chart showing a method for determining a target session key according to an exemplary embodiment. Figure 4 As shown, in a possible implementation manner, before sending a signature request to the server in response to the login authentication request sent by the target electronic control unit, the method may further include the following steps: In step S401, when a session connection is established with a target electric control unit, a first version number of a security protocol of the target electric control unit is obtained.

[0049] In this embodiment, there may be different version numbers in the security protocol. In order to successfully perform authentication and login, the terminal may first establish a session connection with the target electronic control unit so as to be able to exchange information. A session identifier may be generated, and the first version number of the security protocol of the target electronic control unit may be obtained, so as to compare the first version number with the second version number corresponding to the terminal to confirm whether the two parties can reach an agreement on the version number, that is, the version number matches successfully.

[0050] In step S402, when the second version number of the security protocol corresponding to the login client of the terminal matches the first version number, key negotiation is performed with the target electronic control unit to obtain a target session key, which is used to encrypt the transmission information between the terminal and the target electronic control unit.

[0051] In this embodiment, the terminal can match the first version number based on the second version number of the security protocol corresponding to the login client. If the match is successful, further verification can be performed; if the match fails, the terminal login failure is confirmed, the login process is exited, and a login failure prompt message can be displayed to the user through the login client.

[0052] In the case of successful matching, the terminal can conduct key negotiation with the target ECU. The negotiation method can be: the terminal sends a key negotiation request to the target ECU, and then the terminal and the target ECU send each other the key negotiation algorithms they support, and can also send each other encryption algorithms, MAC (Message Authentication Code) algorithms, and message compression algorithms. After the terminal receives the key negotiation algorithm sent by the target ECU, it can use one of the key negotiation algorithms supported by both parties. The terminal and the target ECU negotiate a target session key, and can negotiate a target encryption algorithm, a target MAC algorithm, and a target message compression algorithm. In the subsequent information transmission between the terminal and the target ECU, the terminal and the target ECU can use the target session key to encrypt the transmission information, and can use the target encryption algorithm, the target MAC algorithm, and the target message compression algorithm for further processing, so as to ensure the security of information transmission between the terminal and the target ECU. After obtaining the target session key, the target ECU can send a login authentication request to the terminal. The login authentication request may include the authentication algorithm supported by the target ECU, so that the terminal and the target ECU can perform authentication according to the authentication algorithm supported by the target ECU.

[0053] In a possible implementation, a method for establishing a session connection between the terminal and the target electronic control unit may be: In response to a user's login request for a target electronic control unit, a connection address of the target electronic control unit is determined; and according to the connection address, a connection request is sent to the target electronic control unit to establish a session connection with the target electronic control unit.

[0054] In this embodiment, a login client is installed on the terminal. When the user wishes to log in and manage the target electronic control unit, the target electronic control unit can be determined through the login client. For example, the user opens the login client on the terminal, and the terminal displays multiple electronic control units to the user through the login client. The user can input a login request for the target electronic control unit to the terminal by operating the terminal. For example, the user can check the target electronic control unit to be logged in, thereby inputting a login request for the target electronic control unit to the terminal. The terminal determines the connection address of the target electronic control unit in response to the user's login request for the target electronic control unit based on the user's operation. The connection address of the target electronic control unit may include an IP (Internet Protocol) address and a port number.

[0055] Then, according to the connection address of the target electronic control unit, a connection request is sent to the target electronic control unit. After the target electronic control unit receives the connection request, a session connection can be established between the terminal and the target electronic control unit, so that information can be transmitted between the terminal and the target electronic control unit.

[0056] In a possible implementation manner, before sending the signature request to the server, the electronic control unit login method further includes the following steps: The identity authentication page is displayed to the user through the login client; the user information entered by the user based on the identity authentication page and the user's corresponding identity identification code are sent to the server. The user information is used by the server for identity authentication. If the identity authentication is successful, the server associates and stores the identity identification code and the user's username.

[0057] In this embodiment, in order to avoid repeated identity authentication of the same user in a short period of time, the identity code and the user's username can be pre-stored in the server. The terminal can first try to log in to the target electronic control unit using public key authentication. The terminal can obtain the public key of the target electronic control unit and obtain the identity code corresponding to the user, which can be a pre-generated identity code corresponding to the user. The identity code can also have a corresponding expiration time, which can be obtained by parsing the target file, which can be a cookie file in the json file format: ({"tmpid":"……","expiretime":"……"}), so as to obtain the identity code and the corresponding expiration time. If there is no corresponding target file, the identity code corresponding to the user is randomly generated. The expiration time can be determined according to the current time and the preset expiration time. After receiving the login authentication request sent by the target electronic control unit, the identity authentication page can be displayed to the user through the login client. Among them, the server may include a permission control server, and the identity code can be attached to the URL (Uniform Resource Location) of the permission control server, and the target browser is opened to display the identity authentication page to the user. The identity authentication page is used for users to input user information. For example, an input box can be directly displayed on the identity authentication page so that users can input user information, or an authentication QR code can be displayed on the identity authentication page. After the user scans it, the terminal can obtain the user information.

[0058] After the terminal obtains the user information, the user information and the identity identification code corresponding to the user can be sent to the server. After the server receives the user information and identity identification code sent by the terminal, it can authenticate the user information to determine whether the current user is a safe user. For example, the server may also include a unified identity authentication server, which can obtain a list of safe users and match the user information with the list of safe users to obtain an authentication result. If the match is successful, for example, the user information belongs to the list of safe users, or belongs to an internal employee, the authentication result is authentication passed. If the match is unsuccessful, the authentication result is authentication failed, and the login fails.

[0059] When the identity authentication is successful, the server can associate and store the identity identification code and the user's username in the server's database, so that when the user logs in again, the user's username can be directly queried based on the identity identification code.

[0060] In a possible implementation, the server can query the database according to the identity identification code to obtain the user's username, and determine whether the authority authentication is passed by the username. Different usernames correspond to different permissions. The permissions corresponding to the username and the target private key can be obtained, and it is determined whether the user permissions corresponding to the username include the permissions to log in to the target electronic control unit. In the case that the user permissions corresponding to the username include the permissions to log in to the target electronic control unit, it is determined that the permission authentication of the username is passed. In the case that the permission authentication of the username is passed, the server generates a target signature based on the target public key and the target private key corresponding to the target electronic control unit. Among them, the elliptic curve signature algorithm can be used to process the target public key and the target private key to obtain the target signature.

[0061] In a possible implementation, the signature request includes data to be signed, and the data to be signed is obtained according to the target public key. For example, according to the target public key, the session identifier, the user name and other information, the target algorithm, such as the message digest algorithm: SHA (Secure Hash Algorithm) 256, can be used to calculate to obtain the data to be signed, and then the signature request can be obtained according to the data to be signed, and the signature request can also include an identity identification code. Therefore, the elliptic curve signature algorithm can be used to process the data to be signed and the target private key to obtain the target signature. The server then sends the obtained target signature to the terminal, so that after the terminal obtains the target signature, the target signature and the user name and the target public key and other information are sent to the target electronic control unit. The target electronic control unit can be verified according to the target signature, the target public key and the session identifier and other information through the target detection algorithm, such as the elliptic curve signature verification algorithm, so as to perform login authentication. If the login authentication is passed, a pass message is returned to the terminal, so that a session channel is established between the terminal and the target electronic control unit, and the user successfully logs in to the target electronic control unit through the terminal, so as to manage the target electronic control unit.

[0062] Figure 5 is a flow chart of another method for logging into an electric control unit according to an exemplary embodiment. Figure 5 As shown, the method can be used in a server and includes the following steps.

[0063] In step S501, in response to a signature request from a terminal, an identity identification code in the signature request is authenticated.

[0064] In this embodiment, in order to ensure security, before logging into the target electronic control unit, the target electronic control unit will send a login authentication request to the terminal. After receiving the login authentication request sent by the target electronic control unit, the terminal responds to the login authentication request and sends a signature request to the server to obtain the target signature from the server. After receiving the signature request sent by the terminal, the server can respond to the signature request and perform authority authentication on the identity identification code in the signature request.

[0065] In a possible implementation, in response to the signature request of the terminal, the method for performing authority authentication on the identity identification code in the signature request may be: In response to the signature request of the terminal, the database is queried according to the identity identification code in the signature request to obtain the user's username; the database is queried according to the user's username to obtain the user permissions corresponding to the username; when the user permissions corresponding to the username include the permissions to log in to the target electronic control unit, it is determined that the permission authentication of the username has passed.

[0066] In this embodiment, the server can query the database according to the identity identification code to obtain the user's username, and determine whether the authority authentication is passed by the username. Different usernames correspond to different permissions, and the permissions corresponding to the username and the target private key can be obtained, and it is determined whether the user permissions corresponding to the username include the permission to log in to the target electronic control unit. In the case that the user permissions corresponding to the username include the permission to log in to the target electronic control unit, it is determined that the permission authentication of the username is passed.

[0067] In step S502, when the identity identification code passes the authority authentication, a target signature is generated according to a target public key corresponding to the target electronic control unit and a target private key corresponding to the target electronic control unit.

[0068] In this embodiment, when the user name authority authentication is passed, the server generates a target signature based on the target public key and the target private key corresponding to the target electronic control unit, wherein the target public key and the target private key can be processed using an elliptic curve signature algorithm to obtain the target signature.

[0069] In step S503, the target signature is sent to the terminal, so that the terminal sends the target signature to the target electronic control unit, and when the target signature passes the login authentication, the terminal logs into the target electronic control unit.

[0070] In this embodiment, the server sends the obtained target signature to the terminal, and the terminal can send the received target signature to the target electronic control unit. After the target electronic control unit receives the target signature sent by the terminal, it can perform login authentication on the target signature. If the login authentication is successful, the terminal can log in to the target electronic control unit.

[0071] In a possible implementation, before performing authority authentication on the identity identification code in the signature request in response to the signature request of the terminal, the method further includes: Receive user information and the user's corresponding identity code sent by the terminal, where the user information is information entered by the user on the identity authentication page displayed by the terminal's login client; authenticate the identity code, and if the identity code passes the authentication, associate the identity code with the user's username and store it.

[0072] In this embodiment, in order to avoid repeated identity authentication of the same user in a short time, the identity code and the user's username can be pre-stored in the server. The terminal can first try to log in to the target electronic control unit using public key authentication, and the terminal can obtain the public key of the target electronic control unit and obtain the identity code corresponding to the user. The identity code can be a pre-generated identification code corresponding to the user, and the identity code can also have a corresponding expiration time. The identity code and the corresponding expiration time can be obtained by parsing the target file, which can be a cookie file in the json file format: ({"tmpid":"……","expiretime":"……"}). If there is no corresponding target file, the identity code corresponding to the user is randomly generated, and the expiration time can be determined according to the current time and the preset expiration time. After receiving the login authentication request sent by the target electronic control unit, the identity authentication page can be displayed to the user through the login client. Among them, the server may include a permission control server, and the identity code can be attached to the URL (Uniform Resource Location) of the permission control server, and the target browser is opened to display the identity authentication page to the user. The identity authentication page is used for users to input user information. For example, an input box can be directly displayed on the identity authentication page so that users can input user information, or an authentication QR code can be displayed on the identity authentication page. After the user scans it, the terminal can obtain the user information.

[0073] After the terminal obtains the user information, the user information and the identity identification code corresponding to the user can be sent to the server. After the server receives the user information and identity identification code sent by the terminal, it can authenticate the user information to determine whether the current user is a safe user. For example, the server can also include a unified identity authentication server, which can obtain a list of safe users and match the user information with the list of safe users to obtain an authentication result. If the match is successful, for example, the user information belongs to the list of safe users, or belongs to an internal employee, the authentication result is authentication passed. If the match is unsuccessful, the authentication result is authentication failed, and the login fails.

[0074] When the identity authentication is successful, the server can associate and store the identity identification code and the user's username in the server's database, so that when the user logs in again, the user's username can be directly queried based on the identity identification code.

[0075] In a possible implementation, the signature request includes data to be signed, and the data to be signed is obtained according to the target public key. For example, according to the target public key, the session identifier, the user name and other information, the target algorithm, such as the message digest algorithm: SHA (Secure Hash Algorithm) 256, can be used to calculate to obtain the data to be signed, and then the signature request can be obtained according to the data to be signed, and the signature request can also include an identity identification code. Therefore, the elliptic curve signature algorithm can be used to process the data to be signed and the target private key to obtain the target signature. The server then sends the obtained target signature to the terminal, so that after the terminal obtains the target signature, the target signature and the user name and the target public key and other information are sent to the target electronic control unit. The target electronic control unit can be verified according to the target signature, the target public key and the session identifier and other information through the target detection algorithm, such as the elliptic curve signature verification algorithm, so as to perform login authentication. If the login authentication is passed, a pass message is returned to the terminal, so that a session channel is established between the terminal and the target electronic control unit, and the user successfully logs in to the target electronic control unit through the terminal, so as to manage the target electronic control unit.

[0076] Figure 6 is a block diagram of an electric control unit login device according to an exemplary embodiment. Figure 6 The electric control unit login device 600 includes a first sending module 601, a receiving module 602 and a second sending module 603.

[0077] The first sending module 601 is configured to send a signature request to the server in response to a login authentication request sent by the target electronic control unit, wherein the signature request includes a target public key corresponding to the target electronic control unit and an identity identification code corresponding to the user; The receiving module 602 is configured to receive a target signature returned by the server in response to the signature request, wherein the target signature is generated by the server according to the target public key and a target private key corresponding to the target electronic control unit when the identity identification code passes the authority authentication, and the target private key is stored in the server; The second sending module 603 is configured to send the target signature to the target electronic control unit, so as to log in to the target electronic control unit if the target signature passes the login authentication.

[0078] Optionally, the electronic control unit login device 600 further includes: A display module is configured to display an identity authentication page to a user through a login client; The third sending module is configured to send the user information input by the user based on the identity authentication page and the identity identification code corresponding to the user to the server, the user information is used by the server to perform identity authentication, and when the identity authentication passes, the server associates and stores the identity identification code and the user's username.

[0079] Optionally, the target signature is generated by the server querying the database according to the identity identification code to obtain the user name of the user, and when the authority authentication of the user name is passed, the server generates it according to the target public key and the target private key corresponding to the target electronic control unit, wherein when the user authority corresponding to the user name includes the authority to log in to the target electronic control unit, it is determined that the authority authentication of the user name is passed.

[0080] Optionally, the signature request includes data to be signed, and the data to be signed is obtained according to the target public key.

[0081] Optionally, the electronic control unit login device 600 further includes: an acquisition module, configured to acquire a first version number of a security protocol of the target electronic control unit when a session connection is established with the target electronic control unit; The first acquisition module is configured to perform key negotiation with the target electronic control unit to obtain a target session key when the second version number of the security protocol corresponding to the login client of the terminal matches the first version number, and the target session key is used to encrypt the transmission information between the terminal and the target electronic control unit.

[0082] Optionally, the electronic control unit login device 600 further includes: A first determining module is configured to determine a connection address of the target electronic control unit in response to a user's login request for the target electronic control unit; The fourth sending module is configured to send a connection request to the target electronic control unit according to the connection address to establish a session connection with the target electronic control unit.

[0083] Figure 7 FIG. 1 is a block diagram of another electronic control unit login device according to an exemplary embodiment. Figure 7 The electric control unit login device 700 includes a first authentication module 701, a generation module 702 and a fifth sending module 703.

[0084] The first authentication module 701 is configured to perform authority authentication on the identity identification code in the signature request in response to the signature request of the terminal; The generating module 702 is configured to generate a target signature according to a target public key corresponding to a target electronic control unit and a target private key corresponding to the target electronic control unit when the identity identification code passes the authority authentication; The fifth sending module 703 is configured to send the target signature to the terminal, so that the terminal sends the target signature to the target electronic control unit, and when the target signature passes the login authentication, the terminal logs into the target electronic control unit.

[0085] Optionally, the electronic control unit login device 700 further includes: A receiving module, configured to receive user information sent by the terminal and the identity identification code corresponding to the user, wherein the user information is information input by the user based on an identity authentication page displayed by a login client of the terminal; The second authentication module is configured to perform identity authentication on the identity identification code, and if the identity identification code passes the identity authentication, associate and store the identity identification code with the user name of the user.

[0086] Optionally, the first authentication module 701 includes: A second obtaining module is configured to query a database according to the identity identification code in the signature request in response to the signature request of the terminal to obtain the user name of the user; A third obtaining module is configured to query a database according to the user name of the user to obtain the user authority corresponding to the user name; The second determination module is configured to determine whether the authority authentication of the user name is passed when the user authority corresponding to the user name includes the authority to log in to the target electronic control unit.

[0087] Optionally, the signature request includes data to be signed, and the data to be signed is obtained by the terminal according to the target public key.

[0088] Regarding the electric control unit login device 600 or the electric control unit login device 700 in the above embodiments, the specific manner in which each module performs operations has been described in detail in the embodiments of the method, and will not be elaborated here.

[0089] The present disclosure also provides a computer-readable storage medium on which computer program instructions are stored. When the program instructions are executed by a processor, the steps of the electric control unit login method provided by the present disclosure are implemented.

[0090] Figure 88 is a block diagram of an electronic device according to an exemplary embodiment. For example, the electronic device 800 may be a mobile phone, a computer, a messaging device, a tablet device, etc.

[0091] Reference Figure 8 , the electronic device 800 may include one or more of the following components: a first processing component 802 , a first memory 804 , a first power component 806 , a multimedia component 808 , an audio component 810 , a first input / output interface 812 , a sensor component 814 , and a communication component 816 .

[0092] The first processing component 802 generally controls the overall operation of the electronic device 800, such as operations associated with display, phone calls, data communications, camera operations, and recording operations. The first processing component 802 may include one or more processors 820 to execute instructions to complete all or part of the steps of the above-mentioned electronic control unit login method. In addition, the first processing component 802 may include one or more modules to facilitate the interaction between the first processing component 802 and other components. For example, the first processing component 802 may include a multimedia module to facilitate the interaction between the multimedia component 808 and the first processing component 802.

[0093] The first memory 804 is configured to store various types of data to support operations on the electronic device 800. Examples of such data include instructions for any application or method operating on the electronic device 800, contact data, phone book data, messages, pictures, videos, etc. The first memory 804 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as a static random access first memory (SRAM), an electrically erasable programmable read-only first memory (EEPROM), an erasable programmable read-only first memory (EPROM), a programmable read-only first memory (PROM), a read-only first memory (ROM), a magnetic first memory, a flash first memory, a magnetic disk, or an optical disk.

[0094] The first power source component 806 provides power to various components of the electronic device 800. The first power source component 806 may include a power management system, one or more power supplies, and other components associated with generating, managing, and distributing power to the electronic device 800.

[0095] The multimedia component 808 includes a screen that provides an output interface between the electronic device 800 and the user. In some embodiments, the screen may include a liquid crystal display (LCD) and a touch panel (TP). If the screen includes a touch panel, the screen may be implemented as a touch screen to receive input signals from the user. The touch panel includes one or more touch sensors to sense touch, slide, and gestures on the touch panel. The touch sensor may not only sense the boundaries of the touch or slide action, but also detect the duration and pressure associated with the touch or slide operation. In some embodiments, the multimedia component 808 includes a front camera and / or a rear camera. When the electronic device 800 is in an operating mode, such as a shooting mode or a video mode, the front camera and / or the rear camera may receive external multimedia data. Each front camera and rear camera may be a fixed optical lens system or have a focal length and optical zoom capability.

[0096] The audio component 810 is configured to output and / or input audio signals. For example, the audio component 810 includes a microphone (MIC), and when the electronic device 800 is in an operation mode, such as a call mode, a recording mode, and a voice recognition mode, the microphone is configured to receive an external audio signal. The received audio signal can be further stored in the first memory 804 or sent via the communication component 816. In some embodiments, the audio component 810 also includes a speaker for outputting audio signals.

[0097] The first input / output interface 812 provides an interface between the first processing component 802 and a peripheral interface module, which may be a keyboard, a click wheel, buttons, etc. These buttons may include but are not limited to: a home button, a volume button, a start button, and a lock button.

[0098] The sensor assembly 814 includes one or more sensors for providing various aspects of status assessment for the electronic device 800. For example, the sensor assembly 814 can detect the open / closed state of the electronic device 800, the relative positioning of the components, such as the display and keypad of the electronic device 800, and the sensor assembly 814 can also detect the position change of the electronic device 800 or a component of the electronic device 800, the presence or absence of contact between the user and the electronic device 800, the orientation or acceleration / deceleration of the electronic device 800, and the temperature change of the electronic device 800. The sensor assembly 814 may include a proximity sensor configured to detect the presence of a nearby object without any physical contact. The sensor assembly 814 may also include an optical sensor, such as a CMOS or CCD image sensor, for use in imaging applications. In some embodiments, the sensor assembly 814 may also include an acceleration sensor, a gyroscope sensor, a magnetic sensor, a pressure sensor, or a temperature sensor.

[0099] The communication component 816 is configured to facilitate wired or wireless communication between the electronic device 800 and other devices. The electronic device 800 can access a wireless network based on a communication standard, such as WiFi, 2G or 3G, or a combination thereof. In an exemplary embodiment, the communication component 816 receives a broadcast signal or broadcast-related information from an external broadcast management system via a broadcast channel. In an exemplary embodiment, the communication component 816 also includes a near field communication (NFC) module to facilitate short-range communication. For example, the NFC module can be implemented based on radio frequency identification (RFID) technology, infrared data association (IrDA) technology, ultra-wideband (UWB) technology, Bluetooth (BT) technology and other technologies.

[0100] In an exemplary embodiment, the electronic device 800 may be implemented by one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field programmable gate arrays (FPGAs), controllers, microcontrollers, microprocessors or other electronic components to perform the above-mentioned electronic control unit login method.

[0101] In an exemplary embodiment, a non-transitory computer-readable storage medium including instructions is also provided, such as a first memory 804 including instructions, and the above instructions can be executed by a processor 820 of an electronic device 800 to complete the above-mentioned electric control unit login method. For example, the non-transitory computer-readable storage medium can be a ROM, a random access first memory (RAM), a CD-ROM, a magnetic tape, a floppy disk, an optical data storage device, etc.

[0102] In another exemplary embodiment, a computer program product is further provided. The computer program product includes a computer program executable by a programmable device. The computer program has a code portion for executing the above-mentioned electric control unit login method when executed by the programmable device.

[0103] Fig. 9 900 is a block diagram of another electronic device according to an exemplary embodiment. For example, the electronic device 900 may be provided as a server. Fig. 9 The electronic device 900 includes a second processing component 922, which further includes one or more processors, and a memory resource represented by a second memory 932, for storing instructions executable by the second processing component 922, such as an application. The application stored in the second memory 932 may include one or more modules, each corresponding to a set of instructions. In addition, the second processing component 922 is configured to execute instructions to perform the above-mentioned electric control unit login method.

[0104] The electronic device 900 may further include a second power supply component 926 configured to perform power management of the electronic device 900, a wired or wireless network interface 950 configured to connect the electronic device 900 to a network, and a second input / output interface 958. The electronic device 900 may operate based on an operating system stored in the second memory 932, such as Windows Server 2000. TM , Mac OS X TM , Unix TM , Linux TM , FreeBSD TM or similar.

[0105] Those skilled in the art may also understand that the various illustrative logical blocks and steps listed in the embodiments of the present application may be implemented by electronic hardware, computer software, or a combination of the two. Whether such functions are implemented by hardware or software depends on the specific application and the design requirements of the entire system. Those skilled in the art may use various methods to implement the functions described for each specific application, but such implementation should not be understood as exceeding the scope of protection of the embodiments of the present application.

[0106] It should be understood that the features of some embodiments of the various present disclosures described herein may be combined with each other, unless specifically stated otherwise.

[0107] Although terms such as "first", "second" and "third" can be used herein to describe various components, parts, regions, layers or sections, these components, parts, regions, layers or sections are not limited to these terms. On the contrary, these terms are only used to distinguish one component, component, region, layer or section from another component, component, region, layer or section. Therefore, without departing from the teachings of each example, the first component, component, region, layer or section mentioned in the examples described herein may also be referred to as the second component, component, region, layer or section. In addition, the terms "first" and "second" are only used for descriptive purposes and cannot be understood as indicating or implying relative importance or implicitly indicating the number of indicated technical features. Thus, the features defined as "first" and "second" may expressly or implicitly include at least one of the features. In the description herein, the meaning of "multiple" is at least two, such as two, three, etc., unless otherwise clearly and specifically defined.

[0108] In addition, the word "exemplary" is used herein to indicate serving as an example, instance, or diagram. Any aspect or design described as "exemplary" in this article is not necessarily understood to be advantageous compared to other aspects or designs. On the contrary, the use of the word exemplary is intended to present concepts in a specific way. As used herein, the term "or" is intended to represent an inclusive "or" rather than an exclusive "or". That is, unless otherwise specified or clear from the context, "X applies A or B" is intended to represent any one of the natural inclusive arrangements. That is, if X applies A; X applies B; or X applies both A and B, "X applies A or B" is satisfied under any of the aforementioned examples. In addition, unless otherwise specified or clearly pointed to a singular form from the context, the articles "one" and "an" as used in this application and the appended claims are generally understood to mean "one or more".

[0109] Likewise, although the present disclosure has been shown and described with respect to one or more implementations, equivalent variations and modifications will occur to those skilled in the art after reading and understanding the specification and drawings. The present disclosure includes all such modifications and variations and is limited only by the scope of the claims. In particular, with respect to the various functions performed by the components (e.g., elements, resources, etc.) described above, unless otherwise indicated, the terms used to describe such components are intended to correspond to any component (functionally equivalent) that performs the specific functions of the described components, even if the structure is not equivalent to the disclosed structure. In addition, although specific features of the present disclosure may have been disclosed with respect to only one of several implementations, such features may be combined with one or more other features of other implementations as may be desired and beneficial to any given or specific application. In addition, with respect to "including", "having", "having", "having", or variations thereof used in a specific embodiment or claim, such terms are intended to be inclusive in a manner similar to the term "comprising".

[0110] Those skilled in the art will readily appreciate other embodiments of the present disclosure after considering the specification and practicing the invention disclosed herein. This application is intended to cover any modification, use or adaptation of the present disclosure, which follows the general principles of the present disclosure and includes common knowledge or customary techniques in the art that are not disclosed in the present disclosure. The specification and examples are intended to be exemplary only, and the true scope and spirit of the present disclosure are indicated by the appended claims.

[0111] It should be understood that the present disclosure is not limited to the exact structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present disclosure is limited only by the appended claims.

Claims

1. A method for logging into an electronic control unit, characterized in that: Applied to terminals, including: In response to the login authentication request sent by the target electronic control unit, a signature request is sent to the server, wherein the signature request includes a target public key corresponding to the target electronic control unit and an identity identification code corresponding to the user; Receiving a target signature returned by the server in response to the signature request, wherein the target signature is generated by the server according to the target public key and a target private key corresponding to the target electronic control unit when the identity identification code passes the authority authentication, and the target private key is stored in the server; The target signature is sent to the target electronic control unit, so as to log in the target electronic control unit if the target signature passes the login authentication.

2. The method for logging into the electric control unit according to claim 1, characterized in that: Before sending the signature request to the server, the method further includes: Display the authentication page to the user through the login client; The user information input by the user based on the identity authentication page and the identity identification code corresponding to the user are sent to the server. The user information is used by the server for identity authentication. If the identity authentication passes, the server associates and stores the identity identification code with the user's username.

3. The electronic control unit login method according to claim 1, characterized in that: The target signature is generated by the server querying the database according to the identity identification code to obtain the user name of the user, and when the authority authentication of the user name is passed, the server generates it according to the target public key and the target private key corresponding to the target electronic control unit, wherein, when the user authority corresponding to the user name includes the authority to log in to the target electronic control unit, it is determined that the authority authentication of the user name is passed.

4. The electronic control unit login method according to claim 1, characterized in that: The signature request includes data to be signed, and the data to be signed is obtained according to the target public key.

5. The electronic control unit login method according to any one of claims 1 to 4, characterized in that: Before sending a signature request to the server in response to the login authentication request sent by the target electronic control unit, the method further includes: When establishing a session connection with the target electronic control unit, obtaining a first version number of a security protocol of the target electronic control unit; When the second version number of the security protocol corresponding to the login client of the terminal matches the first version number, key negotiation is performed with the target electronic control unit to obtain a target session key, and the target session key is used to encrypt the transmission information between the terminal and the target electronic control unit.

6. The method for logging into the electric control unit according to claim 5, characterized in that: The method further comprises: In response to a user's login request for the target electronic control unit, determining a connection address of the target electronic control unit; According to the connection address, a connection request is sent to the target electronic control unit to establish a session connection with the target electronic control unit.

7. A method for logging into an electronic control unit, characterized in that: Applicable to servers, including: In response to the signature request of the terminal, performing authority authentication on the identity identification code in the signature request; In the case where the identity identification code passes the authority authentication, generating a target signature according to a target public key corresponding to the target electronic control unit and a target private key corresponding to the target electronic control unit; The target signature is sent to the terminal, so that the terminal sends the target signature to the target electronic control unit, and when the target signature passes the login authentication, the terminal logs into the target electronic control unit.

8. The method for logging into the electric control unit according to claim 7, characterized in that: Before performing authority authentication on the identity identification code in the signature request in response to the signature request of the terminal, the method further includes: Receiving user information sent by the terminal and the identity identification code corresponding to the user, wherein the user information is information input by the user based on an identity authentication page displayed by a login client of the terminal; The identity identification code is authenticated, and when the identity identification code passes the identity authentication, the identity identification code and the user name of the user are associated and stored.

9. The method for logging into the electric control unit according to claim 7, characterized in that: The step of performing authorization authentication on the identity identification code in the signature request in response to the signature request of the terminal includes: In response to the signature request of the terminal, query the database according to the identity identification code in the signature request to obtain the user's username; Query the database according to the user's username to obtain the user authority corresponding to the username; In a case where the user authority corresponding to the user name includes the authority to log in to the target electronic control unit, it is determined that the authority authentication of the user name is passed.

10. The electronic control unit login method according to claim 7, characterized in that: The signature request includes data to be signed, and the data to be signed is obtained by the terminal according to the target public key.

11. An electronic control unit login device, characterized in that: include: A first sending module is configured to send a signature request to a server in response to a login authentication request sent by a target electronic control unit, wherein the signature request includes a target public key corresponding to the target electronic control unit and an identity identification code corresponding to the user; a receiving module, configured to receive a target signature returned by the server in response to the signature request, wherein the target signature is generated by the server according to the target public key and a target private key corresponding to the target electronic control unit when the identity identification code passes the authority authentication, and the target private key is stored in the server; The second sending module is configured to send the target signature to the target electronic control unit, so as to log in to the target electronic control unit if the target signature passes the login authentication.

12. An electronic control unit login device, characterized in that: include: A first authentication module is configured to perform authority authentication on the identity identification code in the signature request in response to the signature request of the terminal; A generating module, configured to generate a target signature according to a target public key corresponding to a target electronic control unit and a target private key corresponding to the target electronic control unit when the identity identification code passes the authority authentication; The fifth sending module is configured to send the target signature to the terminal, so that the terminal sends the target signature to the target electronic control unit, and when the target signature passes the login authentication, the terminal logs into the target electronic control unit.

13. An electronic device, characterized in that: include: processor; a memory for storing processor-executable instructions; Wherein, the processor is configured to implement the steps of the electric control unit login method described in any one of claims 1 to 10 when executed.

14. A computer-readable storage medium having computer program instructions stored thereon, characterized in that: When the computer program instructions are executed by a processor, the steps of the electronic control unit login method described in any one of claims 1 to 10 are implemented.

15. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the electric control unit login method described in any one of claims 1 to 10 are implemented.

Images