Standby method for communication failure of digital key main module

Abstract

The invention provides a standby method for communication failure of a digital key main module. The method comprises the following steps: wirelessly connecting with control equipment based on a main module; periodically detecting whether the wireless communication function of the main module is abnormal; if the wireless communication function of the main module is abnormal, the standby module is wirelessly connected with the control equipment; and if the wireless communication function of the main module returns to normal, wireless connection with the control equipment is carried out again based on the main module. According to the configuration, when the failure of the wireless communication function of the main module is detected, the standby module is actively started to carry out wireless communication, so that the availability of the basic function of the digital key is ensured, and the digital key can be automatically recovered to normal after the main module is recovered. According to the Bluetooth digital key system applied to the vehicle, basic vehicle control functions such as unlocking and locking of the digital key and vehicle starting can be guaranteed, the stability of the digital key system is improved, and the problem that in the prior art, the stability of the digital key is insufficient is solved.

Description

Technical Field

[0001] The present invention relates to the technical field of digital key systems, and in particular to a backup method for communication failure of a digital key main module. Background Art

[0002] With the popularization of digital keys, the stability of the digital key system has become a crucial issue. Among the many stability factors, the failure of Bluetooth communication of the digital key main module will cause the entire digital key system to be unavailable. Therefore, the stability of Bluetooth communication becomes particularly important, and corresponding backup plans need to be designed to improve the stability of the system.

[0003] That is to say, the digital key in the prior art is not stable enough. Summary of the invention

[0004] The object of the present invention is to provide a backup method for communication failure of a digital key main module, so as to solve the problem of insufficient stability of digital keys in the prior art.

[0005] In order to solve the above technical problems, the present invention provides a backup method for communication failure of a digital key main module, and the backup method for communication failure of a digital key main module includes: based on a wireless connection between the main module and a control device; periodically detecting whether the wireless communication function of the main module is abnormal; if the wireless communication function of the main module is abnormal, then based on the wireless connection between the backup module and the control device; and, if the wireless communication function of the main module recovers from an abnormal state to a normal state, then disconnecting the wireless connection between the backup module and the control device, and based on the wireless connection between the main module and the control device.

[0006] Optionally, the step of periodically detecting whether the wireless communication function of the main module is abnormal includes: periodically generating a first random number and sending it to the wireless communication unit of the auxiliary module other than the wireless communication unit of the main module; the auxiliary module adds the first random number to the broadcast data; the main module obtains the first random number based on wireless communication; and if the main module times out when obtaining the first random number, it is determined that the wireless communication function of the main module is abnormal, otherwise, it is determined that the wireless communication function of the main module is normal.

[0007] Optionally, the step of periodically detecting whether the wireless communication function of the main module is abnormal based on the auxiliary module includes: if the main module times out when acquiring the first random numbers broadcast by all the auxiliary modules, it is judged that the wireless communication function of the main module is abnormal; if the main module does not time out when acquiring the first random number broadcast by at least one of the auxiliary modules, it is judged that the wireless communication function of the main module is normal.

[0008] Optionally, the backup method for communication failure of the digital key main module also includes: when the main module is wirelessly connected to the control device for the first time, the control device sends an emergency communication root key to the main module based on a secure channel; the emergency communication root key is used to generate a temporary session key, and when the control device outputs a control instruction, the identity is verified by the temporary session key.

[0009] Optionally, the backup method for communication failure of the digital key main module also includes: when the main module is working normally, periodically updating the emergency communication root key.

[0010] Optionally, if the wireless communication function of the main module is abnormal, the step of wirelessly connecting the backup module to the control device includes: generating a second random number, generating a first intermediate key based on the second random number and the emergency communication root key; transmitting the second random number, the first intermediate key and the identification code to the backup module, activating the backup module to enter the emergency mode; the backup module generates a third random number, and adds the second random number, the third random number and the identification code to the broadcast data; and, the control device wirelessly connects to the backup module based on the identification code; generates a second intermediate key based on the second random number and the emergency communication root key, and generates the temporary session key based on the second intermediate key and the third random number.

[0011] Optionally, when the control device outputs a control instruction, the step of verifying the identity through the temporary session key includes: the control device encrypts the control instruction based on the temporary session key, and sends the ciphertext to the backup module; the backup module decrypts the ciphertext based on the first intermediate key and the third random number, and if the decryption is successful, sends the control instruction to the controlled object to drive the controlled object to act; if the decryption fails, refuses to respond.

[0012] Optionally, the step of periodically detecting whether the wireless communication function of the main module is abnormal, and the step of switching the main module and the backup module are executed by the MCU, or by the backup module.

[0013] Optionally, the main module, the backup module and the control device are wirelessly connected via Bluetooth.

[0014] Optionally, the control device is a smart phone or a smart tablet.

[0015] Compared with the prior art, the backup method for the failure of communication of the main module of a digital key provided by the present invention includes: wireless connection between the main module and the control device; periodically detecting whether the wireless communication function of the main module is abnormal; if the wireless communication function of the main module is abnormal, wireless connection between the backup module and the control device is based on the backup module; and, if the wireless communication function of the main module is restored from an abnormal state to a normal state, the wireless connection between the backup module and the control device is disconnected, and wireless connection between the backup module and the control device is based on the main module. With such a configuration, when the failure of the wireless communication function of the main module is detected, the backup module will be actively enabled for wireless communication to ensure the availability of the basic functions of the digital key, and can automatically return to normal after the main module is restored. An embodiment of the present invention is applied to the Bluetooth digital key system of a vehicle, which can ensure the basic vehicle control functions of the digital key such as unlocking and starting the vehicle, improve the stability of the digital key system, and solve the problem of insufficient stability of the digital key in the prior art. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Those skilled in the art will appreciate that the accompanying drawings are provided for a better understanding of the present invention and do not constitute any limitation on the scope of the present invention.

[0017] Figure 1 It is a flowchart of a backup method for a digital key main module communication failure according to an embodiment of the present invention;

[0018] Figure 2 It is a schematic diagram of the overall process of a backup method for a digital key main module communication failure according to an embodiment of the present invention;

[0019] Figure 3 is a schematic diagram of a flow chart of detecting whether the wireless communication function of the main module is abnormal according to an embodiment of the present invention;

[0020] Figure 4 It is a schematic diagram of a process of wirelessly connecting a standby module and a control device according to an embodiment of the present invention.

[0021] In the attached figure:

[0022] 1-vehicle control module; 2-main module; 21-MCU; 22-wireless communication unit; 23-NFC unit; 24-UWB unit; 3-spare module; 31-wireless communication unit; 32-UWB unit; 4-auxiliary module; 41-wireless communication unit; 42-UWB unit; 5-control device. DETAILED DESCRIPTION

[0023] In order to make the purpose, advantages and features of the present invention clearer, the present invention is further described in detail below in conjunction with the accompanying drawings and specific embodiments. It should be noted that the drawings are all in a very simplified form and are not drawn to scale, and are only used to conveniently and clearly assist in explaining the purpose of the embodiments of the present invention. In addition, the structure shown in the drawings is often a part of the actual structure. In particular, the emphasis of each drawing is different, and sometimes different scales are used.

[0024] As used in the present invention, the singular forms "one", "an" and "the" include plural objects, the term "or" is generally used to include the meaning of "and / or", the term "several" is generally used to include the meaning of "at least one", and the term "at least two" is generally used to include the meaning of "two or more". In addition, the terms "first", "second" and "third" are only used for descriptive purposes and cannot be understood as indicating or implying relative importance or implicitly indicating the number of technical features indicated. Therefore, the features defined as "first", "second" and "third" may explicitly or implicitly include one or at least two of the features, "one end" and "the other end" and "the proximal end" and "the distal end" generally refer to two corresponding parts, which include not only the endpoints, and the terms "installed", "connected" and "connected" should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral body; it can be a mechanical connection or an electrical connection; it can be directly connected or indirectly connected through an intermediate medium, it can be the internal connection of two elements or the interaction relationship between two elements. In addition, as used in the present invention, an element disposed on another element generally only indicates that there is a connection, coupling, cooperation or transmission relationship between the two elements, and the connection, coupling, cooperation or transmission between the two elements may be direct or indirect through an intermediate element, and cannot be understood as indicating or implying the spatial position relationship between the two elements, that is, one element may be in any orientation such as inside, outside, above, below or on one side of another element, unless otherwise clearly indicated in the content. For ordinary technicians in this field, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0025] The core idea of ​​the present invention is to provide a backup method for communication failure of a digital key main module, so as to solve the problem of insufficient stability of digital keys in the prior art.

[0026] The following description is given with reference to the accompanying drawings.

[0027] Please refer to Figure 1 This embodiment provides a backup method for a digital key main module communication failure, and the backup method for a digital key main module communication failure includes:

[0028] S100, based on wireless connection between the main module and the control device.

[0029] S200, periodically detecting whether the wireless communication function of the main module is abnormal.

[0030] S300: If the wireless communication function of the main module is abnormal, a wireless connection is established with the control device based on the backup module.

[0031] And, S400, if the wireless communication function of the main module recovers from an abnormal state to a normal state, the wireless connection between the backup module and the control device is disconnected, and the wireless connection between the main module and the control device is established.

[0032] In a specific embodiment, the wireless connection method of the main module, the backup module and the control device is Bluetooth. The control device is a smart phone or a smart tablet. The backup method for communication failure of the digital key main module is applied to vehicles. For ease of understanding, this embodiment is used as an example for description hereinafter. It can be understood that based on the design concept of the present invention, the above-mentioned backup method for communication failure of the digital key main module can also be applied to other control objects, such as smart home appliances, factory equipment, medical equipment, construction machinery, etc., and the control devices may not be limited to smart phones and smart tablets, and can also play a beneficial effect of improving the stability of wireless connections.

[0033] like Figure 2As shown, the modules involved in the digital key system include: vehicle control module 1, main module 2, spare module 3, auxiliary module 4 and control device 5. In the actual architecture, the spare module is actually a special auxiliary module, but for the sake of clarity, it is called by a special name here. Among them, the vehicle control module 1 is connected to the main module 2 through CAN (bus), CANFD (variable rate bus) or Ethernet (Ethernet) and other methods for transmitting upper-layer control signals. The main module 2 includes MCU21, wireless communication unit 22, NFC (near field communication technology) unit 23 and UWB (ultra-wideband technology) unit 24. Among them, the NFC unit 23 and the UWB unit 24 are not closely related to this embodiment and are not described in detail. In this embodiment, it is considered that the wireless communication unit 22 may fail, and whether the MCU21 fails is not within the scope of consideration of this embodiment. The main module 2 is connected to the spare module 3 and the auxiliary module 4 through PCAN, LIN (PCAN and LIN are both connection methods with specific meanings, which can be understood by those skilled in the art according to common knowledge and are not described in detail here). The standby module 3 and the auxiliary module 4 each have their own wireless communication unit 31 (or 41) and UWB unit 32 (or 42), wherein the UWB unit 32 (or 42) is not very relevant to the present embodiment and will not be described in detail. The main module 2 is wirelessly connected to the control device 5 via the wireless communication unit 22, or the standby module 3 is wirelessly connected to the control device 5 via the wireless communication unit 31.

[0034] like Figure 2 As shown, when a fault occurs, the digital key system operates according to the following steps: S01, the Bluetooth module fails, resulting in the interruption and failure of the digital key main link. S02, MCU heartbeat detection, start the backup module. And, S03, the backup module switches to broadcast mode and takes over the main module key communication link. Figure 2 In the text of each step, the position where the text is located represents the execution device of the step. Of course, in different embodiments, other devices can also be used to execute the relevant steps. Figure 3 and Figure 4 The position of the text in the steps can also be understood in this way.

[0035] Furthermore, the core of this embodiment is how to promptly transform a specific auxiliary module into a backup module when the Bluetooth communication failure of the main module is detected, and through a designed security solution, establish a backup secure Bluetooth communication channel with the mobile phone to ensure that the digital key can use basic vehicle control functions, such as unlocking doors, starting the vehicle, etc.

[0036] Please refer to Figure 3, follow the following steps to detect whether the wireless communication function of the main module is abnormal: S11, MCU generates the first random number RND1, sends it to all auxiliary modules for broadcasting, and sends it to its own wireless communication unit for filtering. S12, the first random number RND1 is sent to all auxiliary modules through PCAN or LIN. S13, the auxiliary module adds the first random number RND1 to the broadcast data. S14, the main module searches for the auxiliary module broadcast, parses the data and sends it to the MCU. And, S15, the MCU determines whether the Bluetooth of the main module is normal based on the random book broadcast by the auxiliary module.

[0037] The above process can be summarized as follows: step S200, the step of periodically detecting whether the wireless communication function of the main module is abnormal includes: periodically generating a first random number and sending it to the wireless communication unit of the auxiliary module other than the wireless communication unit of the main module; the auxiliary module adds the first random number to the broadcast data; the main module obtains the first random number based on wireless communication; and if the main module times out when obtaining the first random number, it is determined that the wireless communication function of the main module is abnormal, otherwise, it is determined that the wireless communication function of the main module is normal.

[0038] Furthermore, the following design should be considered in this solution: there should be no less than two auxiliary modules to avoid misjudgment in the event of an auxiliary module anomaly. Only when all random numbers are acquired for a timeout can the MCU determine that the Bluetooth communication of the main module is abnormal and enable the standby mode.

[0039] That is, the step of periodically detecting whether the wireless communication function of the main module is abnormal based on the auxiliary module includes: if the main module acquires the first random number broadcast by all the auxiliary modules for a timeout, then the wireless communication function of the main module is judged to be abnormal; if the main module acquires the first random number broadcast by at least one auxiliary module for a timeout, then the wireless communication function of the main module is judged to be normal. In a preferred embodiment, the number of the auxiliary modules is at least two.

[0040] Please refer to Figure 4 How can the mobile device establish secure communication with the backup module? The following solutions can be adopted:

[0041] S20, safely store the emergency communication root key K (sent to the vehicle when the mobile phone and the vehicle communicate for the first time). When the mobile device and the main module are used for the first time, the mobile device should send the emergency communication root key K through the secure channel established between the main module and the mobile device. To ensure security, the key should be updated during the subsequent authentication process of the main module and the device. The key should support AES or SM4 algorithm. After receiving the key K, the main module should store it in a secure area.

[0042] S21, MCU heartbeat monitoring, generates a second random number RND2, and enables the backup module. When the main module MCU recognizes that the main module Bluetooth function is abnormal, it generates a random number RND2, and uses the random number RND2 and K to generate a temporary key K1. The key derivation method can use but is not limited to AES128_CBC(RND,K)_9797M2. Then the main module sends RND2, K1, and the vehicle identification code to the backup module, activating the backup module to enter the emergency mode.

[0043] S22, the standby module switches the broadcast mode, generates a third random number RND3, and adds RND2, RND3, and the vehicle identification code to the broadcast. After receiving RND2, K1, and the vehicle identification code, the standby module activates and enters the emergency mode, actively switches the broadcast mode to the scannable and connectable mode, and the pairing mode can use justwork to generate the random number RND3. Then add the random number RND2, RND3, and the vehicle identification code to the broadcast of the standby module.

[0044] S23, the mobile phone actively initiates a connection and uses the preset K and RND2, RND3 to generate a temporary session key. The mobile device uses the vehicle identification code to connect to the target backup module, obtains RND2+RND3, uses K and RND2 to derive K1, and then uses RND3 and K1 to derive the temporary session key SK. The key derivation method can use but is not limited to AES128_CBC(RND2,K1)_9797M2.

[0045] S24, use the temporary session key to encrypt the vehicle control command and send it to the backup module. The mobile device then uses SK to encrypt the vehicle control command (including but not limited to unlocking, starting authorization, etc.) and sends it to the backup module.

[0046] S25, after decrypting the vehicle control data using the temporary session key, the data is sent to the main module MCU, which is then decrypted by the backup module and sent to the main module MCU for execution.

[0047] S26, the main module MCU converts the vehicle control command into a CAN signal and sends it to the vehicle control module.

[0048] The above process can be summarized as follows: The backup method for communication failure of the digital key main module also includes: when the main module is wirelessly connected to the control device for the first time, the control device sends an emergency communication root key to the main module based on a secure channel; the emergency communication root key is used to generate a temporary session key, and when the control device outputs a control instruction, the identity is verified by the temporary session key.

[0049] Preferably, the backup method for communication failure of the digital key main module also includes: when the main module is working normally, periodically updating the emergency communication root key.

[0050] If the wireless communication function of the main module is abnormal, the step of wirelessly connecting the backup module to the control device includes: generating a second random number, and generating a first intermediate key based on the second random number and the emergency communication root key; transmitting the second random number, the first intermediate key and the identification code to the backup module, activating the backup module to enter the emergency mode; the backup module generates a third random number, and adds the second random number, the third random number and the identification code to the broadcast data; and the control device is wirelessly connected to the backup module based on the identification code; generating a second intermediate key based on the second random number and the emergency communication root key, and generating the temporary session key based on the second intermediate key.

[0051] In one embodiment, the algorithm for generating the first intermediate key and the algorithm for generating the second intermediate key are the same.

[0052] In the absence of an attacker (or situations such as misconnection), in fact, the first intermediate key and the second intermediate key should be the same string. In this application, two concepts are used to describe it. One is that if an attacker exists, the contents of the first intermediate key and the second intermediate key will be different. The second is that the first intermediate key and the second intermediate key are independently calculated by the backup module and the control device, respectively, and the paths for obtaining the two are different.

[0053] When the control device outputs a control instruction, the step of verifying the identity through the temporary session key includes: the control device encrypts the control instruction based on the temporary session key and sends the ciphertext to the backup module; the backup module decrypts the ciphertext based on the first intermediate key and the third random number, and if the decryption is successful, the control instruction is sent to the controlled object to drive the controlled object to act; if the decryption fails, the response is rejected. The decryption failure corresponds to the presence of an attacker, or other smart phones are mistakenly connected near the vehicle, etc.

[0054] In the above embodiment, the step of periodically detecting whether the wireless communication function of the main module is abnormal, and the step of switching the main module and the backup module are performed by the MCU. Such a configuration does not require additional hardware costs, for example, setting an auxiliary module as a backup module. In other embodiments, the above steps can also be performed by the backup module. The physical architecture design can also support independent deployment of the backup module, and the backup module detects whether the main module is normal. These detection methods include but are not limited to detecting that the main module has no broadcasts issued within multiple broadcast cycles.

[0055] In summary, this embodiment provides a backup method for the failure of communication of the main module of a digital key. The backup method for the failure of communication of the main module of the digital key includes: wireless connection between the main module and the control device; periodically detecting whether the wireless communication function of the main module is abnormal; if the wireless communication function of the main module is abnormal, wireless connection between the backup module and the control device is based on the backup module; and, if the wireless communication function of the main module is restored from an abnormal state to a normal state, the wireless connection between the backup module and the control device is disconnected, and wireless connection between the backup module and the control device is based on the main module. In this configuration, when the failure of the wireless communication function of the main module is detected, the backup module will be actively enabled for wireless communication to ensure the availability of the basic functions of the digital key, and can automatically return to normal after the main module is restored. An embodiment of the present invention is applied to a Bluetooth digital key system of a vehicle, which can ensure the basic vehicle control functions of the digital key such as unlocking and starting the vehicle, improve the stability of the digital key system, and solve the problem of insufficient stability of the digital key in the prior art. Other embodiments of the present invention can also be applied to other digital key systems, and can also achieve the same beneficial effects.

[0056] The above description is only a description of the preferred embodiment of the present invention, and is not intended to limit the scope of the present invention. Any changes or modifications made by a person skilled in the art in the field of the present invention based on the above disclosure shall fall within the scope of protection of the technical solution of the present invention.

Claims

1. A backup method for communication failure of a digital key main module, characterized in that: The backup method for the digital key main module communication failure includes: Based on wireless connection between main module and control device; Periodically detecting whether the wireless communication function of the main module is abnormal; If the wireless communication function of the main module is abnormal, the backup module is wirelessly connected to the control device; and, If the wireless communication function of the main module recovers from an abnormal state to a normal state, the wireless connection between the backup module and the control device is disconnected, and the wireless connection between the main module and the control device is established.

2. The backup method for communication failure of the digital key main module according to claim 1, characterized in that: The step of periodically detecting whether the wireless communication function of the main module is abnormal comprises: Periodically generating a first random number and sending it to the wireless communication unit of the auxiliary module except the wireless communication unit of the main module; The auxiliary module adds the first random number to the broadcast data; The main module obtains the first random number based on wireless communication; and If the main module times out when acquiring the first random number, it is determined that the wireless communication function of the main module is abnormal; otherwise, it is determined that the wireless communication function of the main module is normal.

3. The backup method for communication failure of the digital key main module according to claim 2, characterized in that: The step of periodically detecting whether the wireless communication function of the main module is abnormal based on the auxiliary module includes: if the main module times out when acquiring the first random numbers broadcast by all the auxiliary modules, it is determined that the wireless communication function of the main module is abnormal; if the main module does not time out when acquiring the first random number broadcast by at least one auxiliary module, it is determined that the wireless communication function of the main module is normal.

4. The backup method for communication failure of the digital key main module according to claim 1, characterized in that: The backup method for the failure of communication of the digital key main module also includes: When the main module is wirelessly connected to the control device for the first time, the control device sends the emergency communication root key to the main module based on the secure channel; and The emergency communication root key is used to generate a temporary session key. When the control device outputs a control instruction, the identity is verified by the temporary session key.

5. The backup method for communication failure of the digital key main module according to claim 4, characterized in that: The backup method for communication failure of the digital key main module also includes: when the main module works normally, periodically updating the emergency communication root key.

6. The backup method for digital key master module communication failure according to claim 4, characterized in that: If the wireless communication function of the main module is abnormal, the step of wirelessly connecting the standby module to the control device comprises: Generate a second random number, and generate a first intermediate key based on the second random number and the emergency communication root key; Transmitting the second random number, the first intermediate key and the identification code to the standby module, activating the standby module to enter an emergency mode; The standby module generates a third random number, and adds the second random number, the third random number and the identification code to the broadcast data; and The control device is wirelessly connected to the backup module based on the identification code; a second intermediate key is generated based on the second random number and the emergency communication root key, and the temporary session key is generated based on the second intermediate key and the third random number.

7. The backup method for digital key master module communication failure according to claim 6, characterized in that: When the control device outputs a control instruction, the step of verifying the identity by using the temporary session key includes: The control device encrypts the control instruction based on the temporary session key and sends the ciphertext to the standby module; The backup module decrypts the ciphertext based on the first intermediate key and the third random number. If the decryption is successful, the control instruction is sent to the controlled object to drive the controlled object to act; if the decryption fails, the response is rejected.

8. The backup method for digital key master module communication failure according to claim 1, characterized in that: The step of periodically detecting whether the wireless communication function of the main module is abnormal, and the step of switching the main module and the backup module are executed by the MCU, or by the backup module.

9. The backup method for communication failure of the digital key main module according to claim 1, characterized in that: The main module, the backup module and the control device are wirelessly connected via Bluetooth.

10. The backup method for communication failure of the digital key main module according to claim 1, characterized in that: The control device is a smart phone or a smart tablet.

Images