Method and system for establishing communication, electronic equipment and readable storage medium

Abstract

The invention discloses a method and system for establishing communication, electronic equipment and a readable storage medium, and belongs to the technical field of terminals. Comprising the following steps: responding to a first electronic device logging in an account system, obtaining authentication information of a second electronic device from a trusted storage device, the second electronic device not logging in the account system, the second electronic device and a third electronic device having networked, and the third electronic device having logged in the account system; the authentication information of the second electronic equipment is registered in the trusted storage equipment after the second electronic equipment is bound with the third electronic equipment. And in response to the fact that the distance between the first electronic equipment and the second electronic equipment is smaller than the preset distance, performing credible authentication with the second electronic equipment based on the authentication information of the second electronic equipment. And under the condition that the authentication is passed, establishing networking communication with the second electronic equipment. According to the application, the authentication information is registered to the cloud, so that the first electronic equipment and the second electronic equipment are safely networked based on the authentication information without user participation.

Description

Technical Field

[0001] The present application relates to the field of terminal technology, and in particular to a method for establishing communication, an electronic device, a system and a readable storage medium. Background Art

[0002] With the development of the Internet of Things and smart devices, mobile phones, smart home devices, tablet computers and other electronic devices are widely used in people's daily lives. In some application scenarios, two or more electronic devices are usually required to communicate in a network so that one electronic device can control other electronic devices or transmit data, such as controlling smart home devices through a mobile phone.

[0003] Normally, in order to ensure the security of network communication, several electronic devices to be networked need to undergo trusted authentication, and network communication can only be carried out if the authentication is passed. Currently, electronic devices from the same manufacturer have their own account systems, so these electronic devices usually undergo trusted authentication based on device accounts when networking.

[0004] However, in some scenarios, users may need to add electronic devices from other manufacturers to the network. Since electronic devices from other manufacturers do not have the account system, they cannot be authenticated based on the device account. Therefore, how to enable electronic devices that are not logged into the account system to perform trusted authentication to achieve secure networking communication has become an urgent problem to be solved. Summary of the invention

[0005] The present application provides a method, electronic device, system and readable storage medium for establishing communication, which can solve the problem that electronic devices that have not logged into the accountless system cannot be authenticated based on the device account trustworthiness, and thus cannot perform secure networking communication. The technical solution is as follows:

[0006] In a first aspect, a method for establishing communication is provided, which is applied to a first electronic device, where the first electronic device can log in to an account system, and the method includes:

[0007] In response to the first electronic device logging into the account system, the authentication information of the second electronic device is obtained from the trusted storage device, wherein the second electronic device has not logged into the account system, the second electronic device and the third electronic device have been networked, the third electronic device has logged into the account system, and the authentication information of the second electronic device is registered in the trusted storage device after the second electronic device and the third electronic device are bound. In response to the distance between the first electronic device and the second electronic device being less than a preset distance, a trusted authentication is performed with the second electronic device based on the authentication information of the second electronic device. If the authentication is successful, a network communication is established with the second electronic device.

[0008] The preset distance can be set according to the requirements. When the distance between the first electronic device and the second electronic device is less than the preset distance, it means that the first electronic device and the second electronic device are very close.

[0009] In one example, the first electronic device is a mobile phone B that has logged into the account system, the second electronic device is a car device C that has not logged into the account system, and the third electronic device is a mobile phone A that has logged into the account system. When the second electronic device is bound to the third electronic device, the third electronic device can register the authentication information of the second electronic device to the cloud. In this way, after the first electronic device logs into the account system, the authentication information of the second electronic device can be obtained from the cloud, so that the first electronic device and the second electronic device can perform trusted authentication without the user's awareness, so as to form a secure network and improve the networking efficiency.

[0010] As an example of the present application, the specific implementation of the trusted authentication with the second electronic device based on the authentication information of the second electronic device may include: exchanging information with the second electronic device, the exchanged information includes at least the device identification and the authentication type, and may also include the device account and the authentication type that it can support. In the case where the authentication type indicated by the second electronic device is based on the authentication information authentication, a first personal identification code is generated, such as PIN1. Based on the authentication information of the second electronic device, the first personal identification code, the first device identification (such as device ID2) of the first electronic device and the authentication information are encrypted to obtain the first identity authentication information. The first identity authentication information is sent to the second electronic device, so that the second electronic device obtains the first personal identification code, the first device identification and the authentication information of the first electronic device from the first identity authentication information based on the authentication information of the second electronic device. The second identity authentication information of the second electronic device is received, and the second identity authentication information is obtained by the second electronic device encrypting the second device identification (such as device ID1) and the second personal identification code (such as PIN2) of the second electronic device based on the authentication information of the first electronic device, and the second personal identification code is generated by the second electronic device. In the case where the second personal identification code and the second device identification are obtained from the second identity verification information based on the authentication information of the first electronic device, it indicates that the authentication information of the vehicle device C is safe and reliable. In this case, authentication is performed based on the first personal identification code, the second personal identification code, the first device identification, and the second device identification. In this way, by verifying based on the authentication information, the exchange of PIN codes is also completed when the verification passes, so that it is convenient to authenticate again based on the PIN codes of both parties and the PIN code of the self, so as to improve the effectiveness of authentication.

[0011] As an example of the present application, the specific implementation of the trusted authentication based on the first personal identification code and the second personal identification code may include: sending an authentication request to the second electronic device, the authentication request including information of the PAKE protocol to instruct the second electronic device to perform trusted authentication based on the first personal identification code and the second personal identification code through the PAKE protocol. Afterwards, the first electronic device performs trusted authentication with the second electronic device through the PAKE protocol based on the first personal identification code and the second personal identification code. And after the authentication is passed according to the authentication information, authentication is performed again according to the PIN code to improve the reliability of the authentication.

[0012] As an example of the present application, the specific implementation of obtaining the authentication information of the second electronic device from the trusted storage device may include: sending an information pull request to the trusted storage device, and then receiving an information pull response sent by the trusted storage device in response to the information pull request, the information pull response carrying the authentication information of the second electronic device. That is, the first electronic device can actively pull the authentication information from the trusted storage device, so that the first electronic device can obtain the latest authentication information of the second electronic device, avoiding the authentication information being updated in the trusted storage device, thereby improving the effectiveness of the authentication.

[0013] In one example, the trusted storage device may be a cloud, or the trusted storage device may be a trusted storage device, such as trusted storage device X.

[0014] As an example of the present application, the specific implementation of obtaining the authentication information of the second electronic device from the trusted storage device may include: monitoring the authentication information of the second electronic device sent by the trusted storage device. That is, the cloud may also actively push the authentication information, avoiding the need for the first electronic device to pull it by itself.

[0015] As an example of the present application, after authentication based on the first personal identification code and the second personal identification code, the first electronic device can store the authentication result so that before the next authentication based on the authentication information, it can first query whether the authentication result has been authenticated, and trigger the subsequent authentication process if it has not been authenticated. If it has been authenticated, it can directly exchange information to avoid repeated authentication.

[0016] In a second aspect, a method for establishing communication is provided, which is applied to a second electronic device, where the second electronic device is not logged into an account system, and the method includes:

[0017] In response to the distance between the second electronic device and the first electronic device being less than the preset distance, a trusted authentication is performed with the first electronic device based on the authentication information of the second electronic device, wherein the trusted authentication is triggered by the first electronic device, and the first electronic device obtains the authentication information of the second electronic device from the trusted storage device when logging into the account system, and the authentication information of the second electronic device is registered in the trusted storage device after the second electronic device is bound to the third electronic device, and the third electronic device has logged into the account system. If the authentication is passed, a network communication is established with the first electronic device.

[0018] In this way, after the first electronic device logs in to the account system, the authentication information of the second electronic device can be obtained from the cloud, so that when the first electronic device and the second electronic device are close to each other, a user-imperceptible trusted authentication can be performed based on the authentication information, thereby ensuring secure networking and improving networking efficiency.

[0019] As an example of the present application, in response to the distance between the second electronic device and the first electronic device being less than a preset distance, before the trusted authentication with the first electronic device based on the authentication information of the second electronic device, the second electronic device displays a first interface in response to the first user operation, and the first interface includes a third person identification code (such as PIN0). When the distance between the second electronic device and the third electronic device is less than the preset distance, in response to the authentication request of the third electronic device, the second electronic device is bound to the third electronic device based on the third person identification code, and the authentication request is triggered by the third electronic device after receiving the personal identification code input by the user according to the third person identification code. In this way, by displaying the third person identification code, the user binds the second electronic device to the third electronic device, and the reliability of the authentication information registered to the trusted storage device after binding can be guaranteed.

[0020] As an example of the present application, when the distance between the second electronic device and the third electronic device is less than the preset distance, after binding with the third electronic device based on the third personal identification code, if the binding is successful, the second electronic device receives the authentication information acquisition request sent by the third electronic device, and in response to the authentication information acquisition request, sends the authentication information of the second electronic device to the third electronic device, so as to register the authentication information of the second electronic device to the trusted storage device through the third electronic device. In this way, by registering the authentication information to the trusted storage device through the second electronic device, other accounted devices (such as the first electronic device) can obtain the authentication information from the trusted storage device when they join in the future, which is more convenient for the other accounted devices to perform user-unnoticed trusted authentication with the second electronic device based on the authentication information.

[0021] As an example of the present application, when the distance between the second electronic device and the third electronic device is less than a preset distance, after binding with the third electronic device based on a third person identification code, if the binding is successful, the second electronic device receives the registration information sent by the third electronic device, and the registration information is obtained by the third electronic device after binding with the second electronic device. Based on the registration information, a registration negotiation is performed with the trusted storage device, and if the registration negotiation is passed, the authentication information of the second electronic device is registered to the trusted storage device. In this way, the registration information is applied for through the third electronic device, and then the registration information is sent to the second electronic device, so that the second electronic device can use the registration information to register its own authentication information to the cloud, avoiding the need to register through the third electronic device.

[0022] As an example of the present application, the second electronic device is capable of communicating with a trusted storage device. In this case, when the distance between the second electronic device and the third electronic device is less than a preset distance, after binding with the third electronic device based on a third personal identification code, the second electronic device receives an authentication information upload instruction, which is sent by the third electronic device after binding with the second electronic device. In response to the authentication information upload instruction, the authentication information of the second electronic device is registered to the trusted storage device. That is, the second electronic device can register the authentication information to the trusted storage device by itself, avoiding the need to register through the third electronic device.

[0023] In a third aspect, a system for establishing communication is provided, the system comprising a first electronic device, a second electronic device, a third electronic device, and a trusted storage device, including:

[0024] The first electronic device is used to obtain authentication information of the second electronic device from the trusted storage device in response to logging into the account system, the second electronic device has not logged into the account system, the authentication information of the second electronic device is registered in the trusted storage device after the second electronic device is bound to the third electronic device, the second electronic device and the third electronic device have been networked, and the third electronic device has logged into the system account;

[0025] The first electronic device is configured to perform trusted authentication with the second electronic device based on authentication information of the second electronic device in response to a distance between the first electronic device and the second electronic device being less than a preset distance;

[0026] The second electronic device is used to perform trusted authentication with the first electronic device based on the authentication information of the second electronic device;

[0027] The first electronic device is used to establish network communication with the second electronic device when the authentication is successful.

[0028] In a fourth aspect, an electronic device is provided, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the method for establishing communication as described in the first aspect or the second aspect is implemented.

[0029] In a fifth aspect, a computer-readable storage medium is provided, wherein instructions are stored in the computer-readable storage medium, and when the computer-readable storage medium is executed on a computer, the computer executes the method for establishing communication described in the first aspect or the second aspect.

[0030] In a sixth aspect, a computer program product comprising instructions is provided, which, when executed on a computer, enables the computer to execute the method for establishing communication described in the first aspect or the second aspect.

[0031] The technical effects obtained by the fourth, fifth and sixth aspects are similar to the technical effects obtained by the corresponding technical means in the first and / or second aspects, and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] Figure 1 is a schematic diagram showing a same-account networking according to an exemplary embodiment;

[0033] Figure 2 is a schematic diagram of networking of a device with an account and a device without an account according to an exemplary embodiment;

[0034] Figure 3 is a schematic diagram of networking of a device with an account and a device without an account according to an exemplary embodiment;

[0035] Figure 4 is a schematic diagram of an interface of a vehicle machine device according to an exemplary embodiment;

[0036] Figure 5 is a schematic diagram of a mobile phone interface according to an exemplary embodiment;

[0037] Figure 6 is a schematic diagram showing an application scenario according to an exemplary embodiment;

[0038] Figure 7 is a schematic diagram of a process of logging into an account system according to an exemplary embodiment;

[0039] Figure 8 is a schematic diagram of an application scenario according to another exemplary embodiment;

[0040] Fig. 9 is a schematic diagram of a software system of an electronic device according to an exemplary embodiment;

[0041] Fig.10 is a flow chart of a method for establishing communication according to an exemplary embodiment;

[0042] Fig.11 is a schematic diagram of a process of binding between devices according to an exemplary embodiment;

[0043] Fig.12 is a flow chart of a method for establishing communication according to another exemplary embodiment;

[0044] Fig.13 is a flow chart of a method for establishing communication according to another exemplary embodiment;

[0045] Fig.14 is a schematic diagram of a method for establishing communication according to another exemplary embodiment;

[0046] Fig.15 The diagram is a schematic structural diagram of an electronic device according to an exemplary embodiment. DETAILED DESCRIPTION

[0047] In order to make the objectives, technical solutions and advantages of the present application more clear, the implementation methods of the present application will be further described in detail below with reference to the accompanying drawings.

[0048] It should be understood that the "multiple" mentioned in this application refers to two or more. In the description of this application, unless otherwise specified, " / " means or, for example, A / B can mean A or B; "and / or" in this article is only a description of the association relationship of associated objects, indicating that there can be three relationships, for example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. In addition, in order to facilitate the clear description of the technical solution of this application, the words "first" and "second" are used to distinguish between the same items or similar items with basically the same functions and effects. Those skilled in the art can understand that the words "first" and "second" do not limit the quantity and execution order, and the words "first" and "second" do not limit them to be different.

[0049] References to "one embodiment" or "some embodiments" etc. described in the specification of this application mean that one or more embodiments of the present application include specific features, structures or characteristics described in conjunction with the embodiment. Therefore, the statements "in one embodiment", "in some embodiments", "in some other embodiments", "in some other embodiments", etc. that appear in different places in this specification do not necessarily refer to the same embodiment, but mean "one or more but not all embodiments", unless otherwise specifically emphasized in other ways. The terms "including", "comprising", "having" and their variations all mean "including but not limited to", unless otherwise specifically emphasized in other ways.

[0050] In daily life, people often need to control other electronic devices or transmit data through an electronic device, such as controlling TVs, air conditioners, printers, car equipment, etc. through mobile phones. Usually, electronic devices can control other electronic devices or transmit data through communication methods such as Bluetooth, mobile networks, the Internet, and near field communication (NFC). Short-range or area-restricted link communications such as Bluetooth, local area networks, and NFC are usually referred to as near-field communications, while long-range link communications such as mobile networks and the Internet are usually referred to as far-field communications. Near-field or far-field communications between two or more electronic devices based on a certain trusted relationship are usually referred to as networking communications. In the networking process, for electronic devices from the same manufacturer, since these electronic devices can log in to the manufacturer's account system (such as Honor's account system), these electronic devices are generally based on device accounts (such as Honor accounts) for trusted authentication, and trusted networking communications can be established if the authentication is passed. For example, Figure 1 As shown, the electronic devices with device accounts include electronic device A and electronic device B. During the networking process, electronic device A and electronic device B can perform trusted authentication based on the device account. If the authentication is passed, electronic device A and electronic device B perform networking communication. If the authentication is not passed, electronic device A and electronic device B do not perform networking communication. In some embodiments, trusted authentication based on device accounts for two or more electronic devices (from the same manufacturer) of the same user can be called same-account authentication.

[0051] However, in one possible scenario, an electronic device with a device account has not logged into the account system. In this case, same-account authentication cannot be performed during networking. In another possible scenario, users need to be able to network electronic devices across manufacturers securely. For example, when using Honor's multiple electronic devices to network, users need to add electronic devices from other manufacturers to the network, or users need to network Honor's electronic devices with electronic devices from other manufacturers. However, since other manufacturers do not have Honor's account system, that is, for the electronic devices in the network, the electronic devices from other manufacturers are electronic devices without device accounts, which also makes it impossible to authenticate the same account. For ease of description, the electronic devices in the above two possible scenarios are referred to as account-free devices, and the electronic devices that have logged into the account system are referred to as account-enabled devices.

[0052] In some embodiments, in order to enable a secure network between a device without an account and a device with an account, the user can manually bind the device with an account to the device without an account. In this way, if there are multiple devices with an account, the user needs to manually bind the device without an account to each of the multiple devices with an account, for example, see Figure 2 In Figure (a), if account device A, account device B, and no-account device C need to be securely networked, the user needs to manually bind no-account device C with account device A, and the user needs to manually bind no-account device C with account device B, which results in low network communication efficiency. See also Figure 2 In Figure (b), if a new device N with an account is connected after the network is established, the user needs to manually bind the device C without an account with the device N with an account again, which is a cumbersome operation.

[0053] In other embodiments, see Figure 3 In Figure (a), the user can manually bind the account device A and the accountless device C. After that, the account device A can share the device, that is, the account device A sends the device information or device capabilities of the accountless device C to the account device B in the network through a trusted transmission. At this time, the account device B can communicate directly with the accountless device C without any authentication. However, in this scenario, in order to ensure the security or privacy of the control or operation of the accountless device C, there is a master-slave relationship between the account device A and the account device B, that is, the account device A is the master device and the account device B is the slave device. If the master device is not around, the slave device cannot establish a communication relationship with the accountless device C. For example, see Figure 3In (b) of the figure, when a new account device N (slave device) is connected, if the account device A is still there, the device can be shared through trusted transmission, so that the account device N and the accountless device C can establish a communication relationship; otherwise, if the account device A is not there, the account device N cannot establish a communication relationship with the accountless device C. In this way, since the account devices are not in a peer-to-peer relationship, but a master-slave relationship, secure networking cannot be performed in some scenarios.

[0054] To this end, an embodiment of the present application provides a method for establishing communication, which can enable an electronic device without a device account to conveniently and securely communicate with one or more electronic devices with device accounts without the need for multiple user participation, and multiple devices with accounts are in a peer-to-peer relationship, that is, there is no master-slave relationship.

[0055] For ease of understanding, several exemplary scenarios of networking communications involved in the embodiments of the present application are introduced below:

[0056] Scenario 1: A device without an account is networking with a device with an account for the first time, that is, a device without an account joins the network.

[0057] In an exemplary application scenario, there are mobile phone A (device with an account) and vehicle device C (device without an account). Before networking, mobile phone A and vehicle device C are not networked with other electronic devices. When the user wants to establish networking communication between mobile phone A and vehicle device C, on the vehicle device C side, the user can turn on the Bluetooth of vehicle device C. In addition, please refer to Figure 4 In Figure (a), the user can turn on "mobile phone interconnection" on the vehicle device C so that the vehicle device C displays the device interconnection interface U1. The device interconnection interface U1 includes a device adding control 41, and the user can click the device adding control 41. In response to the user's triggering operation on the device adding control 41, the vehicle device C starts to broadcast a device discovery message. The device discovery message includes but is not limited to the device name, device identification, category, address and other information of the vehicle device C itself, so that the mobile phone A can find the vehicle device C. Among them, the device name is the name of the vehicle device C, such as XX; the device identification is an identification used to uniquely identify the vehicle device C, such as the device identification is a device ID or a unique device identifier (UDID); the category is used to indicate the category to which the vehicle device C belongs. Please also refer to Figure 4In (b) of FIG. 1 , in response to the user's triggering operation of adding a control 41 to the device, the vehicle device C also displays a pop-up window 42, which includes a mobile phone interconnection connection code, such as 43662. The mobile phone interconnection connection code is a personal identification number (PIN). In addition, the pop-up window 42 may also include prompt information to prompt the user what to do next, such as the prompt information "Turn on Bluetooth on the mobile phone > Get close to the vehicle PAD > Enter the above connection code on the mobile phone".

[0058] On the phone A side, the user can turn on the Bluetooth of phone A, so that phone A starts scanning for device discovery messages. When phone A is close to vehicle device C, refer to Figure 5 In Figure (a), when mobile phone A discovers vehicle device C by scanning device discovery messages, mobile phone A displays a pop-up window 51, which includes relevant information of the discovered vehicle device C, such as "xx car". The pop-up window 51 also includes prompt information to prompt the user to bind mobile phone A with vehicle device C, such as "bind with the vehicle through the local smart interconnection service". In addition, the pop-up window 51 also includes a "bind" control 52. If the user confirms that he wants to bind mobile phone A with vehicle device C, he can click the "bind" control 52. See Figure 5 In (b) of FIG. 1 , in response to the user clicking the "bind" control 52, the mobile phone A displays a connection code input box 53, and the user can enter the mobile phone interconnection connection code displayed in the pop-up window 42 of the vehicle device C based on the connection code input box 53, that is, enter 43662. Then, the "OK" control provided in the connection code input box 53 can be clicked. Figure 5 In FIG. (c), in response to the user triggering the "confirm" control in the connection code input box 53, the mobile phone A is bound to the vehicle device C, and a "binding" prompt is displayed. In one example, see Figure 5 In Figure (d), after the binding is successful, mobile phone A displays a successful binding prompt message in the smart interconnection interface, such as "Binding is successful, xx car has joined the smart interconnection". In addition, as an example but not a limitation, on the vehicle device C side, after the binding is successful, a successful binding prompt message may also be displayed, such as Figure 4 In Figure (c), a prompt window 43 is displayed on the side of the vehicle device C, and the prompt window 43 displays information of the bound mobile phone A, for example, "Honor 5.0 is connected".

[0059] It should be noted that the above is an example of a user binding mobile phone A with vehicle device C through a PIN code to establish a trusted relationship between the two. In another example, the user can also bind mobile phone A with vehicle device C in other ways, such as through NFC proximity discovery connection, user authorization, etc., which is not limited in this embodiment of the present application.

[0060] As an example of this application, see Figure 6 , after binding with the vehicle device C, mobile phone A can obtain the authentication information (including public key or certificate) required for trusted authentication from the vehicle device C through the established communication connection, that is, mobile phone A obtains the authentication information of the vehicle device C. Afterwards, mobile phone A can register the obtained authentication information to the cloud, or store the obtained authentication information in a trusted storage device X. Among them, storage device X is usually used to store trusted data of electronic devices of the manufacturer where mobile phone A is located. In this way, when other accounted devices join the network in the future, other accounted devices can quickly perform trusted authentication with the vehicle device C based on the authentication information of the vehicle device C stored in the cloud or storage device X. For specific implementation, please refer to scenario 2.

[0061] Scenario 2: After a device without an account joins the network, other devices with accounts join the network.

[0062] Based on scenario 1, another device with an account (such as mobile phone B) joins the network. That is, after mobile phone A and vehicle device C form a network, a new device with an account (i.e. mobile phone B) joins the network. Figure 7 When mobile phone B joins the network, it first logs into the account system. For example, Figure 7 As shown in Figure (a), the user clicks the "Login Account" option in the setting interface U2 displayed on mobile phone B. Figure 7 As shown in FIG. (b), in response to the user clicking the "Login Account" option, mobile phone B displays a quick login interface U3, which includes a "One-click Login Registration" control, and the user can click the "One-click Login Registration" control. Figure 7 In Figure (c), in response to the user triggering the "one-click login registration" control, mobile phone B displays a login interface U4, which provides an account input box, a password input box and a login control, so that the user can log in to the device account in the account input box, and enter the password in the password input box, and then click the login control. In response to the user triggering the login control, mobile phone B logs in to the account system. When mobile phone B logs in to the account system, mobile phone B will actively register with the cloud (or storage device X), so that the cloud can perceive mobile phone B. In one possible implementation, Figure 6As shown, the cloud (or storage device X) actively pushes the authentication information of the vehicle device C to the mobile phone B. In this way, when the mobile phone B is close to the vehicle device C, the mobile phone B performs a trusted authentication with the vehicle device C based on the authentication information. If the authentication is successful, the mobile phone B establishes a communication connection with the vehicle device C, so that the mobile phone B and the vehicle device C establish a trusted network communication. Since the user does not need to manually bind the mobile phone B to perform a user-insensitive trusted authentication with the vehicle device C to establish a trusted network, the user manual operation is avoided, that is, no user participation is required, so the efficiency of the network is improved.

[0063] Of course, during the networking process, since both mobile phone B and mobile phone A can log in to the account system, mobile phone B and mobile phone A can perform trusted authentication based on the device account to establish a trusted network. This embodiment of the present application will not introduce this in detail.

[0064] It should be noted that the embodiment of the present application is described by taking the example that mobile phone B starts to log in to the account system when joining the network. In another example, if mobile phone B has logged in to the account system in advance, that is, has logged in to the account system before joining the network, in a possible implementation, if mobile phone B is disconnected from the network and then connected to the network again, mobile phone B can actively pull the authentication information of the vehicle device C from the cloud (or storage device X), so that when mobile phone B is close to the vehicle device C, it can automatically perform a user-unnoticed trusted authentication based on the pulled authentication information.

[0065] See also Figure 8 After mobile phone A, mobile phone B, and vehicle device C are networked, if there is a newly connected account device N, then the account device N can also obtain the authentication information of the vehicle device C from the cloud (or storage device X), and then when the account device N is close to the vehicle device C, it can perform user-insensitive trusted authentication based on the authentication information of the vehicle device C to establish a peer-to-peer trusted relationship with the vehicle device C. It can be seen that for users with multiple account devices, when networking with accountless devices, at most only one account device needs the user's participation in binding, and the user's other account devices can establish user-insensitive trusted authentication with accountless devices, which can greatly improve the user experience.

[0066] It should be noted that the above is explained by taking the example of an account-free device that is an electronic device that cannot log in to the account system. In another example, if an electronic device that can log in to the account system has not logged in to the account system, it is also an account-free device. In other words, for an electronic device that can log in to the account system, it is an account-enabled device if it has logged in to the account system, and an account-free device if it has not logged in to the account system. For example, if mobile phone A has not logged in to the account system, it is an account-free device. The embodiment of this application is explained by taking mobile phone A logging in to the account system as an example.

[0067] As an example of the present application, the software system of the electronic device involved in each of the above embodiments may have a layered architecture, an event-driven architecture, a micro-core architecture, a micro-service architecture, or a cloud architecture. The present application embodiment takes the Android system with a layered architecture as an example to exemplify the software system of the electronic device.

[0068] Fig. 9 is a block diagram of a software system of an electronic device provided in an embodiment of the present application. Fig. 9 The layered architecture divides the software into several layers, each with clear roles and division of labor. The layers communicate with each other through software interfaces. In some embodiments, the Android system is divided into four layers, from top to bottom, namely, the application layer, the application framework layer, the Android runtime (Android runtime) and the system layer, and the kernel layer.

[0069] The application layer can include a series of application packages. Fig. 9 As shown, the application package may include system applications, camera, gallery, call, map, navigation, WLAN, Bluetooth, music, video, short message and other applications. The system application may be a setting application or smart travel or mobile phone interconnection, etc., and the number of system applications may be one or more. For example, when the electronic device is a mobile phone, the system application may include setting application and smart travel, and when the electronic device is a car device, the system application may be mobile phone interconnection.

[0070] The application framework layer provides an application programming interface (API) and a programming framework for the applications in the application layer. The application framework layer includes some predefined functions. As an example of this application, Fig. 9As shown, the application framework layer may include but is not limited to a proximity discovery module, a device management module, a device trust registration module, a device binding authentication module, a device networking module, an authentication service module, etc. Among them, the proximity discovery module is used for electronic devices to discover other electronic devices when triggered, or for electronic devices to be discovered by other electronic devices. The device management module is used to manage the device information, device online, device offline and other states of the electronic device. The device trust registration module is used to register the electronic device to the cloud (or storage device X), and to send the information that the electronic device needs to be registered to the cloud (or storage device X) to the cloud (or storage device X), that is, the device trust registration module is mainly used to interact with the cloud (or storage device X). The device binding authentication module is used to securely bind the electronic device to other electronic devices. The device networking module can be used to control the device to go online. In one example, the device networking module can periodically broadcast device discovery messages during the operation of the electronic device so that other electronic devices can discover the electronic device, and periodically scan the device discovery messages of the attachments to discover other electronic devices, wherein the scanning period and the broadcast period may be different. The authentication service module is used to perform trusted authentication between devices.

[0071] It should be noted that the embodiments of the present application are described by taking the above modules as being located in the application framework layer. In one example, one of the above modules may also exist in an Android installation package (APK), in which case the module is located in the application layer. That is, one or some modules in each module may include multiple forms of existence, which is not limited in the embodiments of the present application.

[0072] Android Runtime includes core libraries and virtual machines. Android runtime is responsible for scheduling and management of the Android system.

[0073] The kernel layer is the layer between hardware and software. The kernel layer contains at least display driver, camera driver, and audio driver.

[0074] exist Fig. 9 Based on the illustrated embodiments, the method for establishing communication is introduced through the following embodiments.

[0075] See also Fig.10 , Fig.10 is a schematic diagram of a method for establishing communication according to an exemplary embodiment. The method is applied to the above scenario 1, that is, implemented by the interaction between mobile phone A, vehicle equipment C and the cloud. As an example but not a limitation, mobile phone A has Fig. 9 The software system shown, and the vehicle equipment C also have Fig. 9 The software system shown. The method may include some or all of the following contents:

[0076] S1001: The Bluetooth of mobile phone A is activated after receiving the Bluetooth activation operation.

[0077] As an example, when the user needs mobile phone A to establish communication with vehicle device C, the user can turn on the Bluetooth of mobile phone A, and the Bluetooth of mobile phone A starts after detecting the user's Bluetooth activation operation.

[0078] S1002: The Bluetooth of mobile phone A triggers the proximity discovery module of mobile phone A to start.

[0079] The proximity discovery module in mobile phone A provides a proximity discovery function. As an example, mobile phone A starts the proximity discovery function when Bluetooth is turned on to scan nearby device discovery messages through the proximity discovery function, thereby facilitating the discovery of other nearby electronic devices.

[0080] S1003: The proximity discovery module of mobile phone A performs message scanning.

[0081] In one example, after the proximity discovery module is started, it starts to perform message scanning to detect whether there is a discoverable electronic device nearby. Exemplarily, the proximity discovery module can perform message scanning periodically.

[0082] In addition, see Fig.10 When mobile phone A logs in to the account system, the device management module of mobile phone A sends the device account used by mobile phone A to log in to the device trust registration module, and calls the device trust registration module to request that mobile phone A be registered to the cloud. Accordingly, the device trust registration module registers the device account of mobile phone A to the cloud, and further, the device ID of mobile phone A can also be registered to the cloud together. The cloud can store the device account and device ID of device A accordingly.

[0083] S1004: The Bluetooth of the vehicle device C is started after receiving the Bluetooth activation operation.

[0084] When the user needs mobile phone A to establish secure communication with vehicle device C, it is necessary not only to turn on the Bluetooth of mobile phone A, but also to turn on the Bluetooth of vehicle device C, so as to perform near-field binding of mobile phone A and vehicle device C via Bluetooth.

[0085] It should be noted that the embodiment of the present application is only described by taking near-field binding via Bluetooth as an example. In another example, mobile phone A and vehicle device C can also be bound via other communication methods, for example, wireless fidelity (WiFi) network or far-field communication, etc., which is not limited in the embodiment of the present application.

[0086] It should be noted that there is no strict execution order between S1001 to S1003 and S1004.

[0087] S1005: Application 2 of the vehicle device C receives a device adding operation.

[0088] The application 2 may be a system application of the vehicle device C, such as mobile phone interconnection.

[0089] Since the vehicle device C is a device without an account, when the vehicle device C is connected to the mobile phone A with an account for the first time, the user usually needs to participate, that is, the user needs to manually bind. Figure 4 , the vehicle device C can be bound to the mobile phone A based on the PIN code. To this end, the user can open the device interconnection interface U1 on the vehicle device C, and then trigger the device adding control 41 in the device interconnection interface U1 to trigger the device adding operation. Accordingly, the vehicle device C detects the device adding operation triggered by the user.

[0090] S1006: Application 2 triggers the proximity discovery module of vehicle device C to start.

[0091] As an example, for the vehicle device C, after the Bluetooth is started, the proximity discovery module of the vehicle device C may not be triggered to start, but it can be started when it is needed to avoid the vehicle device C from frequently broadcasting device discovery messages.

[0092] For example, when application 2 receives a device adding operation, it indicates that the proximity discovery function needs to be used to broadcast a device discovery message so that the vehicle device C can be discovered. Therefore, the vehicle device C responds to the device adding operation and starts the proximity discovery module to provide the proximity discovery function through the proximity discovery module.

[0093] S1007: The proximity discovery module of the vehicle device C broadcasts a message.

[0094] That is, after the proximity discovery module of the vehicle device C is started, it starts broadcasting the device discovery message.

[0095] As an example, after application 2 starts the proximity discovery module of vehicle device C, the proximity discovery module of vehicle device C can feedback the call result to application 2 to indicate that the startup is successful, for example, a call result such as OK can be sent to application 2.

[0096] S1008: Application 2 generates PIN0.

[0097] As an example of the present application, application 2 randomly generates a PIN code, which is recorded as PIN0.

[0098] Optionally, application 2 can also set a binding timeout, which is used to limit the maximum duration of binding between vehicle device C and mobile phone A. That is, if the binding is completed within this binding timeout, the binding is successful; if the binding is not completed within this binding timeout, the binding fails.

[0099] S1009: Application 2 sends PIN0 to the device binding authentication module of vehicle device C.

[0100] That is, after the application 2 generates PIN0, it sends PIN0 to the device binding authentication module so that the device binding authentication module can know what the PIN code used by the vehicle device C in the subsequent authentication process is.

[0101] Optionally, when the application 2 also sets a binding timeout, the application 2 also sends the binding timeout to the device binding authentication module, so that the device binding authentication module monitors whether the binding is completed within the specified time according to the binding timeout.

[0102] S1010: Application 2 registers a status callback to the device binding authentication module of vehicle device C.

[0103] Application 2 registers a status callback with the device binding authentication module of vehicle device C, so that the device binding authentication module feeds back the binding result to application 2 when the binding is completed or fails.

[0104] As an example, application 2 can register the status callback with the device binding authentication module of vehicle device C through the device management module and the device trust registration module of vehicle device C in sequence. Exemplarily, application 2 can send the status callback registration to the device management module of vehicle device C, the device management module of vehicle device C sends the status callback registration to the device trust registration module of vehicle device C, and then the device trust registration module of vehicle device C sends the status callback registration to the device binding authentication module of vehicle device C, thereby registering the status callback.

[0105] It should be noted that there is no strict execution order between S1009 and S1010.

[0106] S1011: Application 2 displays a pop-up window P1, which includes PIN0.

[0107] As an example of the present application, after the application 2 of the vehicle device C generates PIN0, a pop-up window P1 is displayed, and the generated PIN0 is displayed in the pop-up window P1, for example Figure 4 As shown in Figure (c), pop-up window P1 is pop-up window 42, and the displayed PIN0 is 43662.

[0108] It should be noted that there is no strict order of execution between the operation of application 2 triggering the start of the proximity discovery module and the operation of displaying the pop-up window P1, that is, there is no strict order of execution between S1006 to S1007 and S1008 to S1011. In one example, these two operations can be executed in parallel, that is, application 2 can display the pop-up window P1 while starting the proximity discovery module.

[0109] S1012: When mobile phone A and vehicle-mounted device C are close to each other, the proximity detection module of mobile phone A detects vehicle-mounted device C.

[0110] Since the proximity discovery module of mobile phone A starts scanning device discovery messages after being started, and the proximity discovery function of vehicle device C starts broadcasting device discovery messages after being started, when the distance between mobile phone A and vehicle device C is close enough, mobile phone A can scan the device discovery messages broadcast by the proximity discovery module of vehicle device C through its own proximity discovery module, thereby discovering vehicle device C.

[0111] It should be noted that the embodiment of the present application is described by taking the example of mobile phone A discovering vehicle device C. In a possible implementation, mobile phone A can also be discovered by vehicle device C, for example, mobile phone A can also broadcast its own device discovery message, and vehicle device C can also scan device discovery messages, so when mobile phone A and vehicle device C are close to each other, vehicle device C can also discover mobile phone A, and the embodiment of the present application is not limited to this.

[0112] S1013: The proximity discovery module of mobile phone A sends the device information of vehicle device C to application 1 of mobile phone A.

[0113] Application 1 may be a system application in mobile phone A, for example, application 1 is smart travel in mobile phone A.

[0114] As an example, the device information may include information such as the name and category (i.e., type) of the vehicle device C. For example, the device information includes XX car, that is, the name of the vehicle device C is XX and the category is car. In addition, the device information may also include a device ID, etc.

[0115] In one example, the proximity discovery module of mobile phone A can obtain the device information of vehicle device C by parsing the scanned device discovery message. In addition, mobile phone A may also obtain the address information of vehicle device C by parsing the device discovery message.

[0116] S1014: Application 1 displays a pop-up window P2, which displays device information of the vehicle device C.

[0117] After receiving the device information of the vehicle device C, the application 1 displays a pop-up window P2, and displays the device information of the vehicle device C in the pop-up window P2. Figure 5 In the figure (a), the pop-up window P2 displayed by the mobile phone A is the pop-up window 51 in the figure, and the device information of the vehicle device C is XX car. In this way, the user can know which nearby electronic device the mobile phone A currently scans, so that the user can decide whether to bind the scanned electronic device.

[0118] S1015: Application 1 receives a binding operation triggered by the user according to the displayed device information in pop-up window P2.

[0119] In one example, see Figure 5 In Figure (a), a "bind" control 52 is provided in the pop-up window P2. When the user determines to bind, the user can click the "bind" control 52. Accordingly, mobile phone A receives the binding operation.

[0120] S1016: In response to the binding operation, application 1 displays a connection code input box.

[0121] When the user triggers the binding operation, it indicates that the user confirms to bind the mobile phone A to the vehicle device C. In response to the binding operation, the mobile phone A displays a connection code input box so that the user can enter the PIN code (ie, PIN0) displayed in the vehicle device C in the connection code input box. For example, the connection code input box displayed by the mobile phone A is as follows: Figure 5 As shown in Figure (b).

[0122] S1017: Application 1 sends an authentication method query instruction (carrying the category identification of vehicle device C) to the device management module of mobile phone A.

[0123] The category identifier is used to indicate the category to which the vehicle-mounted device C belongs. As an example, after receiving the device information sent by the proximity discovery module, the application 1 can determine the category identifier of the vehicle-mounted device C according to the device discovery information, that is, determine which category of electronic device the vehicle-mounted device C belongs to. When the user decides to bind the mobile phone A to the vehicle-mounted device C, the application 1 sends the category identifier of the vehicle-mounted device C to the device management module of the mobile phone A to query which authentication method is currently used for trusted authentication.

[0124] S1018: The device management module of mobile phone A determines the authentication type according to the category identifier.

[0125] As an example of the present application, the device management module of mobile phone A stores the correspondence between the category identifier and the authentication type. Thus, after the device management module of mobile phone A receives the authentication method query instruction sent by application 1, in response to the authentication method query instruction, the device management module of mobile phone A can determine the authentication type corresponding to the category identifier in the authentication method query instruction according to the correspondence. For example, the authentication type can be, but is not limited to, PIN code-based authentication, authentication information-based authentication, and device account-based authentication.

[0126] Among them, PIN code authentication is based on the PIN code, authentication information based authentication is based on the public key or certificate, and device account based authentication is the same account authentication.

[0127] S1019: The device management module of mobile phone A sends the authentication type to application 1.

[0128] As an example of the present application, the currently determined authentication type is PIN code-based authentication, that is, when mobile phone A and vehicle device C are networked for the first time, authentication based on the PIN code is required.

[0129] S1020: Application 1 receives the PIN code entered by the user in the connection code input box.

[0130] In one example, see Figure 5 As shown in Figure (b), the user can enter the PIN code in the connection code input box.

[0131] It should be noted that the embodiment of the present application is described by taking the PIN code including 5 digits as an example. In another example, the PIN code may also include more or fewer digits, for example, it may include 6 digits, etc. The embodiment of the present application is not limited to this.

[0132] It should also be noted that the embodiment of the present application is described by taking the user inputting the PIN code as an example. In another example, the vehicle device C may also send PIN0 to the mobile phone A, so that after the application 1 displays the connection code input box, PIN0 can be directly displayed in the connection code input box to avoid the need for the user to enter it manually, and the embodiment of the present application does not limit this.

[0133] It should also be noted that there is no strict execution order between S1016 to S1019 and S1020.

[0134] S1021: Application 1 sends a binding instruction (carrying the address information of the vehicle device C, the PIN code entered by the user, and the authentication type) to the device binding authentication module of mobile phone A.

[0135] As mentioned above, the address information of the vehicle device C can be parsed by the proximity discovery module from the scanned device discovery message and then sent to the application 1.

[0136] S1022: The device binding authentication module of mobile phone A is bound to the device binding authentication module of vehicle device C.

[0137] As an example of the present application, in response to the binding instruction, the specific implementation of the binding of the device binding authentication module of the mobile phone A with the device binding authentication module of the vehicle device C can be seen in Fig.11 The embodiment shown may specifically include the following steps:

[0138] A1. In response to the binding instruction, the device binding authentication module of mobile phone A sends the device ID, device account, and authentication type of mobile phone A to the vehicle device C based on the address information of the vehicle device C.

[0139] The device ID and device account may be obtained by the device binding authentication module of mobile phone A from the device management module of mobile phone A. As an example but not a limitation, after mobile phone A is turned on, the device management module sends the device ID and device account of mobile phone A to the device binding authentication module.

[0140] When receiving the binding instruction, the device binding authentication module of mobile phone A sends its own device ID, device account, and authentication type to the vehicle device C. Optionally, the device binding authentication module of mobile phone A can also send the authentication type that it can support to the vehicle device C.

[0141] A2. The device binding authentication module of the vehicle device C receives the device ID, device account, and authentication type of the mobile phone A.

[0142] That is, the vehicle device C receives the device ID, device account, authentication type of the mobile phone A through its own device binding authentication module, and optionally, the authentication type supported by the mobile phone A. Afterwards, the device binding authentication module of the vehicle device C stores the received information.

[0143] A3. The device binding authentication module of the vehicle device C sends the device ID and authentication type of the vehicle device C to the mobile phone A.

[0144] Since the vehicle device C is an account-less device, the device account sent by the vehicle device C to the mobile phone A is empty, that is, only its own device ID and authentication type are sent to the mobile phone A. The authentication type of the vehicle device C can be sent by the device management module of the vehicle device C to the device binding authentication module of the vehicle device C after startup, wherein the device management module of the vehicle device C is started after the vehicle device C is turned on. In addition, the device management module of the vehicle device C can also send information such as category identification to the device binding authentication module of the vehicle device C after startup.

[0145] Optionally, the device binding authentication module of the vehicle device C may also send to the mobile phone A the authentication types that it can support.

[0146] A4. The device binding authentication module of mobile phone A receives the device ID and authentication type of vehicle device C.

[0147] That is, the mobile phone receives the device ID and authentication type of the vehicle device C through its own device binding authentication module. Optionally, the received information also includes the authentication type supported by the vehicle device C. Then, the device binding authentication module of the mobile phone A stores the received information.

[0148] In this way, mobile phone A and vehicle device C exchanged device ID, device account, and initial authentication type. Furthermore, they also exchanged authentication types that they can support. Exchanging initial authentication types allows mobile phone A and vehicle device C to determine which method to use for trusted authentication next. The device ID can be used to identify who the other end is.

[0149] A5. When PIN code authentication is determined according to the authentication type, the device binding authentication module of mobile phone A sends the PIN code entered by the user, the device ID of mobile phone A and the device ID of vehicle device C to the authentication service module of mobile phone A.

[0150] After the device binding authentication module of mobile phone A determines that trusted authentication is required through a PIN code based on the authentication type sent by the vehicle device C, the device binding authentication module of mobile phone A sends the PIN code entered by the user to the authentication service module of mobile phone A so that trusted authentication can be performed based on the PIN code through the authentication service module of mobile phone A.

[0151] A6. The authentication service module of mobile phone A sends an authentication request (carrying PAKE protocol information) to the device authentication service module of vehicle device C.

[0152] The PAKE protocol information is used to indicate that the protocol adopted in the authentication process is the PAKE protocol.

[0153] It should be noted that the embodiment of the present application only takes the example of carrying PAKE protocol information in the authentication request. In implementation, the authentication request may also carry other parameters required for use in the authentication process, which is not described in detail in the embodiment of the present application.

[0154] It should also be noted that the embodiment of the present application takes the PAKE protocol for authentication as an example. In another example, authentication can also be performed through other protocols, and the embodiment of the present application does not limit this.

[0155] A7. The authentication service module of the vehicle device C sends a processing request to the device binding authentication module of the vehicle device C.

[0156] The vehicle device C receives the authentication request sent by the mobile phone A through its own authentication service module, and then sends a processing request to the device binding authentication module of the vehicle device C to request the device binding authentication module to process the authentication request.

[0157] A8. In response to the processing request, the device binding authentication module of the vehicle device C sends PIN0, the device ID of the mobile phone A and the device ID of the vehicle device C to the authentication service module of the vehicle device C.

[0158] According to the previous records, after application 2 generates PIN0, it sends PIN0 to the device binding authentication module of vehicle device C. Therefore, when receiving the processing request, the device binding authentication module of vehicle device C determines to perform trusted authentication. In this case, the PIN0 generated by application 2 is sent to the authentication service module of vehicle device C, so that trusted authentication is performed based on PIN0 through the authentication service module of vehicle device C.

[0159] A9. The authentication service module of mobile phone A and the authentication service module of vehicle device C perform trusted authentication through the PAKE protocol based on the PIN code and device ID.

[0160] In one example, the authentication service module of mobile phone A and the authentication service module of vehicle device C exchange the random numbers generated by each of them, for example, the random number generated by the authentication service module of mobile phone A is R1, and the random number generated by the authentication service module of vehicle device C is R2. After that, the authentication service module of mobile phone A calculates through the PAKE protocol based on the PIN code input by the user, the device ID of mobile phone A, the device ID of vehicle device C, R1 and R2, and the authentication service module of vehicle device C calculates through the PAKE protocol based on PIN0, the device ID of mobile phone A, the device ID of vehicle device C, R1 and R2. If the calculation results on both sides are consistent, it is determined that the authentication is passed. Otherwise, if the calculation results are inconsistent, it is determined that the authentication is not passed.

[0161] It should be noted that the authentication method described here is only exemplary. In another example, random numbers may not be used, or other methods may be used for authentication. The embodiments of the present application are not limited to this.

[0162] A10. After the authentication is passed, the authentication service module of mobile phone A sends the binding key to the device binding authentication module of mobile phone A.

[0163] The binding key can be obtained through negotiation between the authentication service module of mobile phone A and the authentication service module of vehicle device C after mobile phone A and vehicle device C are authenticated. The binding key is used to encrypt business data when mobile phone A and vehicle device C interact with each other in the future.

[0164] A11. After the authentication is passed, the authentication service module of the vehicle device C sends the binding key to the device binding authentication module of the vehicle device C.

[0165] A12. The authentication service module of mobile phone A exchanges authentication credentials with the authentication service module of vehicle device C.

[0166] The authentication credential is used to indicate that mobile phone A and vehicle device C have been authenticated based on a PIN code and the authentication has passed. In this way, after restarting, if mobile phone A needs to bind with vehicle device C based on a PIN code again, if the authentication credential of vehicle device C is found to be stored locally, it does not need to perform trusted authentication with vehicle device C, and subsequent binding operations can be performed directly. Similarly, after restarting, if vehicle device C needs to bind with mobile phone A based on a PIN code again, if the authentication credential of mobile phone A is found to be stored locally, it does not need to perform authentication with mobile phone A, and subsequent binding operations can be performed directly.

[0167] A13. The authentication service module of mobile phone A sends the authentication result to the device binding authentication module of mobile phone A.

[0168] The authentication result is used to indicate that the authentication has been completed.

[0169] A14. The authentication service module of the vehicle device C sends the authentication result to the device binding authentication module of the vehicle device C.

[0170] It should be noted that there is no strict execution order between A13 and A14.

[0171] A15. The device binding authentication module of the vehicle device C generates a public key or certificate.

[0172] It should be noted that the embodiment of the present application is described by taking the device binding authentication module of the vehicle device C generating a public key or certificate after receiving the authentication result as an example. In an optional embodiment, the vehicle device C can query whether a public key or certificate is stored locally. If a public key or certificate exists, the public key or certificate can be directly obtained. If a public key or certificate is not stored locally, a public key or certificate is generated.

[0173] The public key or certificate may be stored in a designated storage location of the vehicle device C, and the designated storage location may be set as required.

[0174] A16. The device binding authentication module of mobile phone A exchanges and verifies the public key or certificate with the device binding authentication module of vehicle device C.

[0175] The device binding authentication module of mobile phone A sends its own public key or certificate to vehicle device C, and vehicle device C receives the public key or certificate of mobile phone A through its own device binding authentication module. Similarly, the device binding authentication module of vehicle device C sends its own public key or certificate to mobile phone A, and mobile phone A receives the public key or certificate of vehicle device C through its own device binding authentication module.

[0176] After exchanging the public key or certificate, further verification can be performed to perform the binding authentication between devices again, thereby improving the reliability of the authentication. In one example, the device binding authentication module of mobile phone A can generate a random number, and then use the public key or certificate of vehicle device C to encrypt the random number, and then send it to vehicle device C. After vehicle device C receives the encrypted random number through its own device binding authentication module, it uses the public key or certificate of vehicle device C to decrypt it. If the random number can be decrypted, it is determined that the verification is passed. Otherwise, if the random number cannot be decrypted, the verification fails. Similarly, the device binding authentication module of vehicle device C can also generate a random number, and then use the public key or certificate of mobile phone A to encrypt the generated random number, and send the encrypted random number to mobile phone A. After mobile phone A receives the encrypted random number through its own device binding authentication module, it uses the public key or certificate of mobile phone A to decrypt it. If the random number can be decrypted, it is determined that the verification is passed. Otherwise, if the random number cannot be decrypted, it is determined that the verification fails.

[0177] If the verification fails, the binding between mobile phone A and vehicle device C fails. If the verification passes, continue to perform the following A17 and subsequent operations.

[0178] A17. The device binding authentication module of mobile phone A exchanges information with the device binding authentication module of vehicle device C.

[0179] After the verification is passed, the device binding authentication module of mobile phone A exchanges information with the device binding authentication module of vehicle device C, such as exchanging each other's P2P channel information, device UDID, media access control (MAC) address and other detailed information related to the electronic device. The exchanged information can be used for the subsequent reliable transmission of business data between mobile phone A and vehicle device C.

[0180] As an example of the present application, during the information exchange process, the device binding authentication module of mobile phone A and the device binding authentication module of vehicle device C can use a public key or certificate for encryption to ensure the security of data exchange.

[0181] A18. The device binding authentication module of mobile phone A and the device binding authentication module of vehicle device C close the channel.

[0182] After exchanging information, mobile phone A and vehicle device C close the current transmission channel, which means that the two have been bound. When business data needs to be transmitted later, the business data transmission channel can be re-established based on the information exchanged. In this way, closing the channel after binding can save channel resources and avoid resource waste.

[0183] A19. The device binding authentication module of mobile phone A stores the device account and the device ID of vehicle device C.

[0184] As mentioned above, since the device ID and device account are exchanged between mobile phone A and vehicle device C, the device ID of vehicle device C exists in the device binding authentication module of mobile phone A. Since the aforementioned authentication process is performed when mobile phone A logs in to the device account, the device account can be used as the device account of vehicle device C. In addition, the device account and device ID of mobile phone A exist in the device binding authentication module of vehicle device C. In this way, after mobile phone A is bound to vehicle device C, the device binding authentication module of mobile phone A can store the device account and device ID in correspondence, so that it can be known later that the trusted authentication has been passed with vehicle device C under the device account.

[0185] A20. The device binding authentication module of mobile phone A sends a device online notification to application 1 through the device management module of mobile phone A.

[0186] In this way, the application 1 can know that the mobile phone A and the vehicle device C have been bound.

[0187] As an example but not limitation, after receiving the device online notification, the application 1 can update and display the current interface, for example, Figure 5 The interface shown in Figure (c).

[0188] A21. The device binding authentication module of the vehicle device C stores the device account and the device ID of the mobile phone A.

[0189] Similarly, on the vehicle device C side, the binding events between the mobile phone A and the vehicle device C can also be stored locally.

[0190] A22. The device binding authentication module of the vehicle device C sends a device online notification to the application 2 through the device management module of the vehicle device C.

[0191] Since application 2 registered a status callback with the device binding authentication module of vehicle device C in S1010, after mobile phone A is bound to vehicle device C, the device binding authentication module of vehicle device C performs a status callback, i.e., notifies application 2 that vehicle device C has been bound to mobile phone A, thereby allowing application 2 to know that the binding has been completed.

[0192] In one example, when a binding timeout is set, if the binding operation is completed within the binding timeout, the device binding authentication module of the vehicle device C calls back the device online notification; otherwise, if the binding operation is not completed within the binding timeout, the device binding authentication module of the vehicle device C calls back the binding timeout notification, that is, sends the binding timeout notification to the application 2 through the device management module.

[0193] After mobile phone A is bound to vehicle device C, mobile phone A can obtain the authentication information of vehicle device C from vehicle device C, and then register the authentication information of vehicle device C to the cloud. As an example, the specific implementation of mobile phone A registering the authentication information of vehicle device C to the cloud may include the following steps:

[0194] S1023. Application 1 sends a registration request to the device management module of mobile phone A.

[0195] The registration request is used to request to obtain the authentication information of the vehicle device C and register the authentication information of the vehicle device C to the cloud.

[0196] That is, after the mobile phone A and the vehicle device C are bound in the near field, the application 1 of the mobile phone A calls the device management module of the mobile phone A to request to register the authentication information of the vehicle device C to the cloud.

[0197] S1024. The device management module of mobile phone A sends a registration request to the device trust registration module of mobile phone A.

[0198] As mentioned above, mobile phone A interacts with the cloud through the device trust registration module, so the device management module of mobile phone A can call the device trust registration module of mobile phone A to obtain the authentication information of the vehicle device C through the device trust registration module and register it to the cloud.

[0199] S1025. The device trust registration module of mobile phone A sends an authentication information acquisition request to vehicle device C.

[0200] The authentication information acquisition request is used to request the authentication information of the vehicle device C.

[0201] S1026. The device trust registration module of the vehicle device C sends authentication information to the device trust registration module of the mobile phone A.

[0202] The vehicle device C receives the authentication information acquisition request through its own device trust registration module, then queries its own authentication information from the vehicle device C, and then sends the authentication information to the mobile phone A. The mobile phone A receives the authentication information through its own device trust registration module.

[0203] S1027. The device trust registration module of mobile phone A registers the authentication information to the cloud.

[0204] In one example, mobile phone A can send an authentication information registration request to the cloud, which can carry the authentication information of the vehicle device C and information used to represent the vehicle device C, such as the device ID of the vehicle device C. After receiving the authentication information registration request, the cloud can associate the authentication information of the vehicle device C, the device account logged in by mobile phone A, and the device ID of the vehicle device C, for example, they can be stored in the device list, indicating that in addition to mobile phone A, there is also an associated vehicle device C under the device account.

[0205] S1028. The device trust registration module of mobile phone A sends the registration result to application 1 through the device management module of mobile phone A.

[0206] The registration result is used to indicate that the authentication information of the vehicle device C has been registered to the cloud, which means that the networking is successful.

[0207] During implementation, the device trust registration module of mobile phone A sends the registration result to the device management module of mobile phone A, and the device management module of mobile phone A sends the registration result to application 1 to report the networking success to application 1.

[0208] S1029. Application 1 displays a notification of successful networking.

[0209] In one example, when the application 1 receives the registration result and the registration result indicates that the authentication information has been successfully registered to the cloud, the binding relationship can be displayed, for example, Figure 5 As shown in Figure (d) in the figure, the user is informed that the secure networking between mobile phone A and vehicle device C has been achieved.

[0210] S1030. The device trust registration module of mobile phone A sends the registration result to vehicle device C.

[0211] That is, after registering the authentication information of the vehicle device C to the cloud, the device trust registration module of the mobile phone A can send the registration result to the vehicle device C to notify the vehicle device C that the registration of the authentication information is completed.

[0212] As an example, the registration result sent by the device trust registration module of mobile phone A to the vehicle device C may carry the device ID of the vehicle device C registered on the cloud, the device ID of mobile phone A, the device account, etc.

[0213] It should be noted that there is no strict execution order between S1028 to S1029 and S1030.

[0214] S1031. The device trust registration module of the vehicle device C sends the registration result to the application 2 through the device management module of the vehicle device C.

[0215] The vehicle device C receives the registration result sent by the mobile phone A through its own device trust registration module, and then sends the registration result to the device management module of the vehicle device C. The device management module of the vehicle device C sends the registration result to the application 2 to notify the application 2 that the networking is successful.

[0216] S1032. Application 2 displays the binding relationship.

[0217] That is, after receiving the registration result sent by the device management module of the vehicle device C, the application 2 determines that the network is successfully established. In this case, the binding relationship can be displayed, for example, see Figure 4 In Figure (c), the connected mobile phone “Honor 5.0” is displayed in window 43.

[0218] In the embodiment of the present application, when mobile phone A and vehicle device C are networked for the first time, binding is performed through user participation, which can improve the security of binding. In addition, after binding, the authentication information of vehicle device C is registered to the cloud, so that when other accounted devices are subsequently connected, the authentication information can be obtained from the cloud, and based on the authentication information, the user can perform trusted authentication with vehicle device C without feeling, thereby improving the networking efficiency. It avoids the need for user participation to bind a new accounted device to vehicle device C every time it is connected, and there is a peer-to-peer relationship between accounted devices, so that the newly connected accounted device can be securely networked with vehicle device C without relying on mobile phone A.

[0219] exist Fig.10 Based on the embodiment shown, see Fig.12 , Fig.12is a schematic diagram of a method for establishing communication according to another exemplary embodiment. The method is applied to the above scenario 2 and is implemented by the interaction between mobile phone B, vehicle equipment C and the cloud. As an example but not a limitation, mobile phone B also has Fig. 9 The software system shown is described below using the example that the Bluetooth of vehicle B is turned on. The method may include some or all of the following contents:

[0220] S1201: When mobile phone B logs into the account system, the device management module of mobile phone B obtains the device account.

[0221] As an example of this application, see Figure 7 , users can follow Figure 7 The process shown triggers mobile phone B to log into the account system. Accordingly, the device management module of mobile phone B can obtain the device account used by mobile phone B to log into the account system, for example, it can be sent by the setting application of mobile phone B to the device management module of mobile phone B.

[0222] The embodiment of the present application is described by taking the example that mobile phone B and mobile phone A use the same device account to log into the account system.

[0223] S1202: The device management module of mobile phone B sends the device account to the device trust registration module of mobile phone B.

[0224] S1203: The device management module of mobile phone B sends a device registration request to the device trust registration module of mobile phone B.

[0225] S1204: In response to the device registration request, the device trust registration module of mobile phone B registers the device account of mobile phone B with the cloud.

[0226] In this way, the cloud can know that mobile phone B has logged into the account system, that is, mobile phone B has access to the Internet.

[0227] S1205: The device trust registration module of mobile phone B feeds back the device registration result to the device management module of mobile phone B.

[0228] After the registration is completed, the device trust registration module of mobile phone B can feedback the device registration result to the device management module of mobile phone B, so that the device management module of mobile phone B can know that mobile phone B has been registered with the cloud.

[0229] S1206: The device management module of mobile phone B sends an information pulling instruction to the device trust registration module of mobile phone B.

[0230] The information pull instruction is used to instruct the device trust registration module of mobile phone B to pull the device list from the cloud. The device list includes the device ID and authentication information associated with the device account, such as the device account, the device ID of the vehicle device C (the device ID1 is used as an example below) and the authentication information.

[0231] S1207: The device trust registration module of mobile phone B obtains a device list (including device ID1 and authentication information of vehicle device C) from the cloud.

[0232] As an example, the device trust registration module of mobile phone B can send an information pull request to the cloud, and the information pull request can carry the device account of mobile phone B, so that when the cloud determines that the device list can be sent to mobile phone B based on the device account of mobile phone B, the cloud will feedback the device list to the device trust registration module of mobile phone B through an information pull response.

[0233] In an example, the device list also includes a device account, and the device account is stored corresponding to the device ID1 and authentication information of the vehicle device C.

[0234] In another example, after receiving the information pull request, the cloud can query the information associated with the device account of mobile phone B (such as the device ID1 and authentication information of the vehicle device C), and then send the information associated with the device account of mobile phone B to the device trust registration module of mobile phone B, such as by feeding back the device pull response to the device trust registration module of mobile phone B.

[0235] S1208: The device trust registration module of mobile phone B sends the device list to the device binding authentication module of mobile phone B.

[0236] S1209: The device binding authentication module of mobile phone B writes the device list into the local device knowledge base.

[0237] It is worth mentioning that after registering to the cloud, mobile phone B actively pulls the device list from the cloud to obtain the latest device list, thereby determining the relevant information of all electronic devices logged in to the cloud, so that it can quickly network with these electronic devices in the future. And because the authentication information obtained is the latest, the effectiveness of subsequent trusted authentication can be improved.

[0238] It should be noted that the embodiment of the present application is described by taking the example of mobile phone B actively pulling the device list from the cloud after logging into the account system. In another example, after mobile phone B is registered with the cloud, the cloud can also push the device list to mobile phone B, which is not limited in the embodiment of the present application.

[0239] S1210: The device binding authentication module of mobile phone B marks and stores device ID1 according to the authentication information.

[0240] For a device ID, if the device ID has authentication information, it means that the device ID is an accountless device, such as vehicle device C. In order to facilitate the subsequent authentication of mobile phone B based on the authentication information when it finds vehicle device C, the device binding authentication module of mobile phone B marks device ID1 to indicate that trusted authentication is performed based on the authentication information when the vehicle device C corresponding to device ID1 is networked.

[0241] S1211: When mobile phone B is close to vehicle device C, the device networking module of mobile phone B discovers vehicle device C.

[0242] As an example of the present application, the device networking module of mobile phone B runs after mobile phone B is turned on. As mentioned above, the device networking module can periodically scan device discovery messages and broadcast device discovery messages after running. Similarly, the device networking module of vehicle device C runs after vehicle device C is turned on, and periodically scans device discovery messages and broadcasts device messages after running. In this way, when mobile phone B is close to vehicle device C, the device networking module of mobile phone B can scan the device discovery messages broadcast by the device networking module of vehicle device C, so that vehicle device C can be discovered.

[0243] It should be noted that the embodiment of the present application is described by taking the example of mobile phone B discovering vehicle device C. In a possible implementation, the vehicle device C may also discover the mobile phone B, for example, the device networking module of the vehicle device C scans the device discovery message broadcast by the device networking module of the mobile phone B, thereby discovering the mobile phone B, which is not limited in the embodiment of the present application.

[0244] S1212: The device networking module of mobile phone B sends a query request (carrying device ID1) to the device binding authentication module of mobile phone B to query whether device ID1 is marked.

[0245] As an example, the device networking module of mobile phone B can parse the device ID of vehicle device C from the scanned device discovery message. Then, the device networking module of mobile phone B queries whether device ID1 is marked from the device binding authentication module of mobile phone B, and sends a query request to the device binding authentication module of mobile phone B to query whether there is authentication information of vehicle device C.

[0246] S1213: The device binding authentication module of mobile phone B feeds back the query result to the device networking module of mobile phone B, and the query result indicates that device ID1 is marked.

[0247] As can be seen from the foregoing, after pulling the device list from the cloud, the device binding authentication module of mobile phone B locally marks the device ID1 of the vehicle device C, so after receiving the query request, the device binding authentication module of mobile phone B feeds back the query result to the device networking module of mobile phone B, indicating that the device ID1 is marked through the query result. Afterwards, the device networking module of mobile phone B executes the operation of S1214.

[0248] Of course, if the device ID of the vehicle device C is not marked, subsequent operations may not be performed.

[0249] It should be noted that for vehicle device C, if mobile phone B is found during the scanning process, the device networking module of vehicle device C can also query the device binding authentication module of vehicle device C whether the device ID of mobile phone B is marked. Since mobile phone B is not marked and stored, the device networking module of vehicle device C does not perform other operations. That is, even when vehicle device C and mobile phone B are close, vehicle device C finds mobile phone B through its own device networking module, and the authentication operation will not be triggered, but will be triggered by mobile phone B.

[0250] S1214: The device networking module of mobile phone B sends an authentication instruction to the device binding authentication module of mobile phone B.

[0251] The authentication instruction is used to instruct authentication to be performed based on the authentication information.

[0252] S1215: The device binding authentication module of mobile phone B exchanges device ID, device account, authentication type, and authentication disk indication information with the device binding authentication module of vehicle device C.

[0253] The authentication type refers to the method currently required for trusted authentication. For example, for mobile phone B, since the device ID1 of vehicle device C is marked locally, it is determined that authentication needs to be performed through authentication information.

[0254] The authentication disk indication information is used to indicate whether the other end has been authenticated locally based on the authentication information. For example, for mobile phone A, since it has passed the authentication and the corresponding relationship between the device account and the device ID1 of the vehicle device C is stored locally, it is determined that the vehicle device C has been authenticated locally. For mobile phone B, since it has not been authenticated with the vehicle device C through the authentication information, that is, the corresponding relationship between the device account and the device ID1 of the vehicle device C is not stored locally, the authentication disk indication information of mobile phone B indicates that it has not been authenticated based on the authentication information. In this way, the authentication disk indication information is exchanged between mobile phone B and vehicle device C to avoid repeated authentication.

[0255] If the authentication disk indication information indicates that the other party has not passed the authentication based on the authentication information locally, execute S1216 operation; otherwise, if the authentication disk indication information indicates that the other party has passed the authentication based on the authentication information locally, you can directly execute the following S1234 and subsequent operations.

[0256] Of course, exchanging the authentication disk placement indication information is an optional operation. In another example, the exchange may not be performed and the subsequent S1216 operation may be performed directly.

[0257] It should be noted that, for the vehicle device C, since the vehicle device C does not obtain the device ID and device account of the mobile phone B, the device ID and device account must be exchanged between the mobile phone B and the vehicle device C.

[0258] S1216: After the device binding authentication module of mobile phone B determines that the authentication type is authentication based on authentication information, PIN1 is generated.

[0259] Since the device binding authentication module of vehicle device C and the device binding authentication module of mobile phone B have exchanged authentication types, the device binding authentication of mobile phone B can determine the authentication method adopted by both parties for authentication. After consensus is reached for authentication based on the authentication information, the device binding authentication module generates PIN1, which can be randomly generated, for example.

[0260] S1217: The device binding authentication module of mobile phone B uses the authentication information of vehicle device C to encrypt its own device ID2, authentication information and PIN1 to obtain first identity authentication information.

[0261] S1218: The device binding authentication module of mobile phone B sends first identity authentication information to the binding authentication module of vehicle device C.

[0262] S1219: The device binding authentication module of the vehicle device C uses its own authentication information to decrypt the first identity authentication information.

[0263] After decrypting the first identity authentication information, the device ID2, authentication information and PIN1 of mobile phone B can be obtained.

[0264] S1220: The device binding authentication module of the vehicle device C generates PIN2.

[0265] S1221: The device binding authentication module of the vehicle device C uses the authentication information of the mobile phone B to encrypt its own device ID1 and PIN2 to obtain the second identity authentication information.

[0266] Optionally, the device binding authentication module of the vehicle device C may also add its own authentication information to the second identity authentication information to avoid updates to the authentication information of the vehicle device C.

[0267] S1222: The device binding authentication module of the vehicle device C sends second identity authentication information to the device binding authentication module of the mobile phone B.

[0268] S1223: The device binding authentication module of mobile phone B uses its own authentication information to decrypt the second identity authentication information.

[0269] After decrypting the second identity authentication information, the device ID1 and PIN2 of the vehicle device C can be obtained.

[0270] S1224: The device binding authentication module of mobile phone B sends PIN1, PIN2, device ID1 and device ID2 to the authentication service module of mobile phone B.

[0271] S1225: The authentication service module of mobile phone B sends an authentication request (carrying PAKE protocol information) to the authentication service module of vehicle device C.

[0272] S1226: The authentication service module of the vehicle device C sends a processing request to the device binding authentication module of the vehicle device C.

[0273] S1227: The device binding authentication module of the vehicle device C sends PIN1, PIN2, device ID1 and device ID2 to the authentication service module of the vehicle device C.

[0274] S1228: The authentication service module of mobile phone B and the authentication service module of vehicle device C perform trusted authentication through the PAKE protocol based on PIN1, PIN2 and device ID.

[0275] For its specific implementation, please refer to Fig.11 A9 in the embodiment shown.

[0276] S1229: After the authentication is passed, the authentication service module of mobile phone B sends the binding key to the device binding authentication module of mobile phone B.

[0277] S1230: After the authentication is passed, the authentication service module of the vehicle device C sends a binding key to the device binding authentication module of the vehicle device C.

[0278] S1231: The authentication service module of mobile phone B exchanges authentication credentials with the authentication service module of vehicle device C.

[0279] S1232: The authentication service module of mobile phone B sends the authentication result to the device binding authentication module of mobile phone B.

[0280] S1233: The authentication service module of the vehicle device C sends the authentication result to the device binding authentication module of the vehicle device C.

[0281] S1234: The device binding authentication module of mobile phone B exchanges information with the device binding authentication module of vehicle device C.

[0282] S1235: The device binding authentication module of mobile phone B and the device binding authentication module of vehicle device C close the channel.

[0283] S1236: The device binding authentication module of mobile phone B stores the device account and device ID1.

[0284] S1237: The device binding authentication module of mobile phone B sends a device online notification to application 3 of mobile phone B through the device management module of mobile phone B.

[0285] In the case of receiving the device online notification, the application 3 determines that the networking is successful. In one example, the application 3 can display the relevant notification that the networking with the vehicle machine device C is successful.

[0286] S1238: The device binding authentication module of the vehicle device C stores the device account and device ID1.

[0287] S1239: The device binding authentication module of the vehicle device C sends a device online notification to the application 2 of the vehicle device C through the device management module of the vehicle device C.

[0288] In the case of receiving the device online notification, application 2 determines that the networking is successful. Similarly, application 2 can display the relevant notification of the successful networking of mobile phone B.

[0289] In an embodiment of the present application, mobile phone B obtains the authentication information of the vehicle device C from the cloud when logging into the account system. In this way, when mobile phone B is close to the vehicle device C, mobile phone B can perform a user-imperceptible trusted authentication with the vehicle device C based on the authentication information, that is, secure networking can be achieved without user participation, thereby improving the efficiency of networking.

[0290] It should be noted that the above is only explained by taking the case where there is only one accountless device in the network as an example. In one possible case, there may be multiple accountless devices in the network. In this case, the cloud (or storage device X) stores the authentication information of each accountless device among the multiple accountless devices. The authentication information of each accountless device can be registered by an accounted device (such as mobile phone A) in the network after binding. After mobile phone B logs in to the account system, the cloud (or storage device X) can push the authentication information of all accountless devices to mobile phone B, or mobile phone B actively obtains the authentication information of all accountless devices from the cloud (or storage device X). Afterwards, when mobile phone B is close to any of these accountless devices, it can perform trusted authentication based on the authentication information of any of the accountless devices to establish a trusted network with any of the accountless devices.

[0291] For ease of understanding, the following Fig.13 The illustrated embodiment introduces the networking processes of the above-mentioned scenarios 1 and 2.

[0292] S1301. In response to a Bluetooth activation operation triggered by the user, mobile phone A turns on Bluetooth and starts a proximity discovery function.

[0293] S1302. In response to the Bluetooth activation operation triggered by the user, the vehicle device C turns on Bluetooth.

[0294] S1303. In response to the device adding operation triggered by the user, the vehicle device C starts the proximity discovery function.

[0295] S1304. The vehicle device C displays a pop-up window P1, which includes PIN0.

[0296] The vehicle device C generates PIN0, then displays a pop-up window P1, and displays PIN0 in the pop-up window P1.

[0297] There is no strict execution order between S1304 and S1303. In one example, the two operations are executed in parallel.

[0298] S1305. When mobile phone A is close to vehicle-mounted device C, mobile phone A discovers vehicle-mounted device C.

[0299] S1306. Mobile phone A displays a pop-up window P2, which displays device information of the vehicle device C.

[0300] S1307. In response to the binding operation received in the pop-up window P2, mobile phone A displays a connection code input box.

[0301] S1308. Mobile phone A receives the PIN code entered by the user in the connection code input box according to PIN0.

[0302] S1309. Mobile phone A binds to vehicle device C based on the PIN code entered by the user.

[0303] The specific implementation of binding mobile phone A with vehicle device C based on the PIN code entered by the user can be found in Fig.11 The embodiment shown.

[0304] S1310. Mobile phone A obtains authentication information of vehicle device C from vehicle device C.

[0305] The authentication information may include a public key, or the authentication information may include a certificate, or the authentication information may include a public key and a certificate.

[0306] S1311. Mobile phone A sends an authentication information registration request to the cloud, and the authentication information registration request carries the authentication information of the vehicle device C.

[0307] In one example, mobile phone A may also carry information such as the device ID of vehicle device C in the authentication information registration request.

[0308] Of course, mobile phone A can also send the device ID of the vehicle device C to the cloud separately, which is not limited in this embodiment of the present application.

[0309] S1312. The cloud stores the authentication information of the vehicle device C.

[0310] As an example of the present application, the cloud associates the authentication information and device ID of the vehicle device C with the device account of mobile phone A, indicating that there is also a vehicle device C under the device account that has passed the security authentication.

[0311] S1313. The cloud returns the registration result to mobile phone A.

[0312] The registration result is used to notify mobile phone A whether the authentication information of vehicle device C has been successfully stored.

[0313] As an example of the present application, for mobile phone A, after receiving the registration result and the registration result indicates that the authentication information of the vehicle device C has been successfully stored, mobile phone A internally reports that the network with the vehicle device C has been successfully established.

[0314] S1314. Mobile phone B logs into the system account and registers to the cloud.

[0315] S1315. The cloud pushes the authentication information of vehicle device C to mobile phone B.

[0316] Alternatively, mobile phone B actively pulls the authentication information of vehicle device C from the cloud. Afterwards, the authentication information of vehicle device C is stored, and the device ID of vehicle device C is marked.

[0317] S1316. When mobile phone B approaches vehicle device C, it detects vehicle device C.

[0318] S1317. Mobile phone B performs trusted authentication with vehicle device C based on the authentication information.

[0319] For specific implementation, see Fig.12 The embodiment shown.

[0320] S1318. If the authentication is successful, mobile phone B reports internally that the network with vehicle equipment C is successfully established.

[0321] S1319. If the authentication is successful, the vehicle equipment C reports internally that the networking with the mobile phone B is successful.

[0322] In an embodiment of the present application, mobile phone B obtains the authentication information of the vehicle device C from the cloud when logging into the account system. In this way, when mobile phone B is close to the vehicle device C, mobile phone B can perform a user-imperceptible trusted authentication with the vehicle device C based on the authentication information, that is, secure networking can be achieved without user participation, thereby improving the efficiency of networking.

[0323] It should be noted that the above embodiment is described by taking the example that after mobile phone A is bound to vehicle device C, mobile phone A registers the authentication information of vehicle device C to the cloud. In another example, after mobile phone A is bound to vehicle device C, vehicle device C can also register the authentication information of vehicle device C to the cloud. For example, in one possible case, vehicle device C has the ability to interact with the cloud, such as vehicle device C has the authority to interact with the cloud, and vehicle device C can perform remote communication. In this case, after mobile phone A is bound to vehicle device C, mobile phone A can instruct vehicle device C to store the authentication information of vehicle device C to the cloud, for example, vehicle device C can register its own authentication information to the cloud through its own device trust registration module. In another example, after mobile phone A is bound to vehicle device C, mobile phone A can also assist vehicle device C in registering the authentication information of vehicle device C to the cloud. For example, in implementation, after binding with vehicle device C, mobile phone A can apply for registration information to the cloud, and then mobile phone A sends the registration information to vehicle device C. In this way, the vehicle device C can perform registration negotiation with the cloud based on the registration information. If the negotiation is successful, the vehicle device C will register its own authentication information to the cloud.

[0324] It should also be noted that the above embodiment is described by taking the case where mobile phone B and mobile phone A are devices with the same account as an example. In another example, when mobile phone B and mobile phone A are devices with different accounts, if security management such as authorization protection is based on certain conditions, the method provided in the embodiment of the present application can also be applied. In one example, a method for implementing different accounts is as follows: Fig.14As shown, it is assumed that the device account logged in by mobile phone A is account 1, and the device account logged in by mobile phone B is account 2. After mobile phone A is bound to vehicle device C, while registering the authentication information of vehicle device C to the cloud, account 2 can also be uploaded to the cloud, wherein account 2 can be obtained by mobile phone A through information exchange during the process of establishing a connection with mobile phone B. In this way, the cloud can know that vehicle device C allows the use of electronic devices logged in to account 2. For example, if mobile phone B logs in to account 2, when mobile phone B is registered to the cloud, the cloud can push the authentication information of vehicle device C to mobile phone B, so that when mobile phone B is close to vehicle device C, it can perform user-unnoticed trusted authentication based on the authentication information. In this way, the applicability of this method is improved.

[0325] It should be noted that whether it is far-field communication, near-field communication, or other communication methods, they are all means or implementation methods for data interaction between devices. The communication method between any devices should not be affected by the communication methods provided by the above-mentioned embodiments. For example, the communication between mobile phone A and vehicle device C can be near-field communication or far-field communication.

[0326] It should also be noted that the embodiments of the present application can be used for access scenarios between other different accounts or devices from different manufacturers. Moreover, the method provided by the embodiments of the present application can also be applied to software projects that require modular adaptive loading.

[0327] Fig.15 is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. Fig.15 The electronic device 100 may include a processor 110, an external memory interface 120, an internal memory 121, a universal serial bus (USB) interface 130, a charging management module 140, a power management module 141, a battery 142, an antenna 1, an antenna 2, a mobile communication module 150, a wireless communication module 160, an audio module 170, a speaker 170A, a receiver 170B, a microphone 170C, an earphone interface 170D, a sensor module 180, a button 190, a motor 191, an indicator 192, a camera 193, a display screen 194, and a subscriber identification module (SIM) card interface 195, etc. Among them, the sensor module 180 may include a pressure sensor 180A, a gyroscope sensor 180B, an air pressure sensor 180C, a magnetic sensor 180D, an acceleration sensor 180E, a distance sensor 180F, a proximity light sensor 180G, a fingerprint sensor 180H, a temperature sensor 180J, a touch sensor 180K, an ambient light sensor 180L, a bone conduction sensor 180M, etc.

[0328] It is to be understood that the structure illustrated in the embodiment of the present application does not constitute a specific limitation on the electronic device 100. In other embodiments of the present application, the electronic device 100 may include more or fewer components than shown in the figure, or combine some components, or split some components, or arrange the components differently. The components shown in the figure may be implemented in hardware, software, or a combination of software and hardware.

[0329] The processor 110 may include one or more processing units, for example, the processor 110 may include an application processor (AP), a modem processor, a graphics processor (GPU), an image signal processor (ISP), a controller, a memory, a video codec, a digital signal processor (DSP), a baseband processor, and / or a neural-network processing unit (NPU), etc. Different processing units may be independent devices or integrated into one or more processors.

[0330] The controller may be the nerve center and command center of the electronic device 100. The controller may generate an operation control signal according to the instruction operation code and the timing signal to complete the control of fetching and executing instructions.

[0331] The processor 110 may also be provided with a memory for storing instructions and data. In some embodiments, the memory in the processor 110 is a cache memory. The memory may store instructions or data that the processor 110 has just used or cyclically used. If the processor 110 needs to use the instruction or data again, it may be directly called from the memory. This avoids repeated access, reduces the waiting time of the processor 110, and thus improves the efficiency of the system.

[0332] In some embodiments, the processor 110 may include one or more interfaces, such as an inter-integrated circuit (I2C) interface, an inter-integrated circuit sound (I2S) interface, a pulse code modulation (PCM) interface, a universal asynchronous receiver / transmitter (UART) interface, a mobile industry processor interface (MIPI), a general-purpose input / output (GPIO) interface, a subscriber identity module (SIM) interface, and / or a universal serial bus (USB) interface, etc.

[0333] The charging management module 140 is used to receive charging input from the charger. The power management module 141 is used to connect the battery 142, the charging management module 140 and the processor 110. The power management module 141 receives input from the battery 142 and / or the charging management module 140 to power the processor 110, the internal memory 121, the external memory, the display screen 194, the camera 193 and the wireless communication module 160.

[0334] The wireless communication function of the electronic device 100 can be implemented through the antenna 1, the antenna 2, the mobile communication module 150, the wireless communication module 160, the modem processor and the baseband processor.

[0335] The mobile communication module 150 can provide solutions for wireless communications including 2G / 3G / 4G / 5G, etc., applied to the electronic device 100. The wireless communication module 160 can provide solutions for wireless communications including wireless local area networks (WLAN) (such as wireless fidelity (Wi-Fi) networks), Bluetooth (BT), global navigation satellite system (GNSS), frequency modulation (FM), near field communication (NFC), infrared technology (IR), etc., applied to the electronic device 100.

[0336] In some embodiments, antenna 1 of electronic device 100 is coupled to mobile communication module 150, and antenna 2 is coupled to wireless communication module 160, so that electronic device 100 can communicate with the network and other devices through wireless communication technology.

[0337] The electronic device 100 implements the display function through a GPU, a display screen 194, and an application processor.

[0338] The electronic device 100 can realize the shooting function through ISP, camera 193, video codec, GPU, display screen 194 and application processor.

[0339] The external memory interface 120 can be used to connect an external memory card, such as a Micro SD card, to expand the storage capacity of the electronic device 100. The external memory card communicates with the processor 110 through the external memory interface 120 to implement a data storage function, such as storing music, video and other files in the external memory card.

[0340] The internal memory 121 can be used to store computer executable program codes, which include instructions. The processor 110 executes various functional applications and data processing of the electronic device 100 by running the instructions stored in the internal memory 121. The internal memory 121 may include a program storage area and a data storage area. Among them, the program storage area may store an operating system, an application required for at least one function (such as a sound playback function, an image playback function, etc.), etc. The data storage area may store data created by the electronic device 100 during use (such as audio data, a phone book, etc.), etc. In addition, the internal memory 121 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, a universal flash storage (UFS), etc.

[0341] The electronic device 100 can implement audio functions, such as music playback, recording, etc., through the audio module 170, the speaker 170A, the receiver 170B, the microphone 170C, the headphone interface 170D and the application processor.

[0342] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network or other programmable device. The computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions may be transmitted from a website site, computer, server or data center by wired (such as: coaxial cable, optical fiber, data subscriber line (Digital Subscriber Line, DSL)) or wireless (such as: infrared, wireless, microwave, etc.) mode to another website site, computer, server or data center. The computer-readable storage medium may be any available medium that a computer can access, or a data storage device such as a server or data center that includes one or more available media integrations. The available medium may be a magnetic medium (such as a floppy disk, a hard disk, a magnetic tape), an optical medium (such as a digital versatile disc (DVD)), or a semiconductor medium (such as a solid state disk (SSD)).

[0343] The above are optional embodiments provided for the present application and are not intended to limit the present application. Any modifications, equivalent substitutions, improvements, etc. made within the technical scope disclosed in the present application shall be included in the protection scope of the present application.

Claims

1. A method for establishing communication, characterized in that Applied in a first electronic device, the first electronic device is capable of logging into an account system, and the method includes: In response to the first electronic device logging into the account system, obtaining authentication information of the second electronic device from the trusted storage device, wherein the second electronic device has not logged into the account system, the second electronic device has been networked with a third electronic device, the third electronic device has logged into the account system, and the authentication information of the second electronic device is registered in the trusted storage device after the second electronic device is bound to the third electronic device; In response to the distance between the first electronic device and the second electronic device being less than a preset distance, performing trusted authentication with the second electronic device based on authentication information of the second electronic device; If the authentication is successful, network communication is established with the second electronic device.

2. The method according to claim 1, characterized in that In response to the distance between the first electronic device and the second electronic device being less than a preset distance, performing trusted authentication with the second electronic device based on authentication information of the second electronic device, comprises: In response to the distance between the first electronic device and the second electronic device being less than the preset distance, exchanging information with the second electronic device, where the exchanged information includes at least a device identification and an authentication type; If the authentication type indicated by the second electronic device is based on authentication information authentication, generating a first personal identification code; Based on the authentication information of the second electronic device, encrypt the first personal identification code, the first device identification of the first electronic device and the authentication information to obtain first identity authentication information; Sending the first identity authentication information to the second electronic device, so that the second electronic device obtains the first personal identification code, the first device identifier, and the authentication information of the first electronic device from the first identity authentication information based on the authentication information of the second electronic device; Receiving second identity authentication information of the second electronic device, where the second identity authentication information is obtained by encrypting a second device identifier and a second personal identification code of the second electronic device by the second electronic device based on the authentication information of the first electronic device, and the second personal identification code is generated by the second electronic device; In the case where the second personal identification code and the second device identification are acquired from the second identity verification information based on the authentication information of the first electronic device, trusted authentication is performed based on the first personal identification code and the second personal identification code.

3. The method according to claim 2, characterized in that said performing trusted authentication based on the first personal identification code and the second personal identification code in a case where the second personal identification code and the second device identification are obtained from the second identity verification information based on the authentication information of the first electronic device; In a case where the second personal identification code and the second device identification are obtained from the second identity verification information based on the authentication information of the first electronic device, sending an authentication request to the second electronic device, the authentication request including information of the PAKE protocol, the authentication request being used to instruct the second electronic device to perform trusted authentication through the PAKE protocol; Based on the first personal identification code, the second personal identification code, the first device identification and the second device identification, trusted authentication is performed with the second electronic device through the PAKE protocol.

4. The method according to any one of claims 1 to 3, characterized in that The acquiring authentication information of the second electronic device from the trusted storage device in response to the first electronic device logging into the account system includes: In response to the first electronic device logging into the account system, sending an information pull request to the trusted storage device; An information pull response sent by the trusted storage device in response to the information pull request is received, wherein the information pull response carries the authentication information of the second electronic device.

5. The method according to any one of claims 1 to 3, characterized in that The acquiring authentication information of the second electronic device from the trusted storage device in response to the first electronic device logging into the account system includes: In response to the first electronic device logging into the account system, the authentication information of the second electronic device sent by the trusted storage device is monitored.

6. A method for establishing communication, characterized in that Applied to a second electronic device, where the second electronic device is not logged into an account system, the method includes: In response to the distance between the second electronic device and the first electronic device being less than a preset distance, performing trusted authentication with the first electronic device based on authentication information of the second electronic device, wherein the trusted authentication is triggered by the first electronic device, the first electronic device obtains the authentication information of the second electronic device from a trusted storage device when logging into the account system, the authentication information of the second electronic device is registered in the trusted storage device after the second electronic device is bound to a third electronic device, and the third electronic device has logged into the account system; If the authentication is successful, network communication is established with the first electronic device.

7. The method according to claim 6, characterized in that Before the second electronic device and the first electronic device perform trusted authentication based on the authentication information of the second electronic device in response to the distance between the second electronic device and the first electronic device being less than a preset distance, the method further includes: In response to a first user operation, displaying a first interface, wherein the first interface includes a third personal identification code; When the distance between the second electronic device and the third electronic device is less than the preset distance, in response to an authentication request sent by the third electronic device, binding is performed with the third electronic device based on the third personal identification code, and the authentication request is triggered by the third electronic device after receiving a personal identification code input by a user based on the third personal identification code.

8. The method according to claim 7, characterized in that In the case where the distance between the second electronic device and the third electronic device is less than the preset distance, after binding with the third electronic device based on the third personal identification code, the method further includes: If the binding is successful, receiving an authentication information acquisition request sent by the third electronic device; In response to the authentication information acquisition request, the authentication information of the second electronic device is sent to the third electronic device, so that the authentication information of the second electronic device is registered in the trusted storage device through the third electronic device.

9. The method according to claim 7, characterized in that In the case where the distance between the second electronic device and the third electronic device is less than the preset distance, after binding with the third electronic device based on the third personal identification code, the method further includes: In the case of successful binding, receiving registration information sent by the third electronic device, the registration information being obtained by the third electronic device applying to the trusted storage device after binding with the second electronic device; Based on the registration information, performing registration negotiation with the trusted storage device; If the registration negotiation is successful, the authentication information of the second electronic device is registered in the trusted storage device.

10. The method according to claim 9, characterized in that The second electronic device is capable of communicating with the trusted storage device; In the case where the distance between the second electronic device and the third electronic device is less than the preset distance, after binding with the third electronic device based on the third personal identification code, the method further includes: receiving an authentication information upload instruction, wherein the authentication information upload instruction is sent by the third electronic device after being bound to the second electronic device; In response to the authentication information upload instruction, the authentication information of the second electronic device is registered in the trusted storage device.

11. A system for establishing communication, characterized in that The system includes a first electronic device, a second electronic device, a third electronic device and a trusted storage device, including: The first electronic device is used to obtain the authentication information of the second electronic device from the trusted storage device in response to logging into the account system, the second electronic device has not logged into the account system, the authentication information of the second electronic device is registered in the trusted storage device after the second electronic device is bound to the third electronic device, the second electronic device and the third electronic device have formed a network, and the third electronic device has logged into the system account; the first electronic device, configured to perform trusted authentication with the second electronic device based on authentication information of the second electronic device in response to a distance between the first electronic device and the second electronic device being less than a preset distance; The second electronic device is used to perform trusted authentication with the first electronic device based on the authentication information of the second electronic device; The first electronic device is used to establish network communication with the second electronic device when the authentication is successful.

12. An electronic device, characterized in that: The electronic device includes a memory, a processor, and a computer program stored in the memory and executable on the processor, and when the processor executes the computer program, the method according to any one of claims 1 to 5 is implemented, or the method according to any one of claims 6 to 10 is implemented.

13. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores instructions, which, when executed on a computer, enable the computer to execute the method according to any one of claims 1 to 5, or implement the method according to any one of claims 6 to 10.

Images