Vehicle cloud interaction encryption system and method and vehicle

Abstract

The invention discloses a vehicle cloud interactive encryption system and method and a vehicle, and relates to the technical field of information security, and the system comprises a vehicle security chip and a vehicle cloud server. According to the system, based on vehicle security chip hardware, a scheme that a vehicle security chip and a vehicle cloud server need to transmit random numbers and encryption values for multiple times to execute subsequent encryption communication is designed. Moreover, the scheme based on the vehicle security chip hardware is more reliable than the scheme of pure software, can be used for resisting attacks aiming at the hardware level, can better protect the transmitted data information, and cannot easily crack the data information even through professional reverse engineering, so that the security of vehicle cloud interaction is enhanced, and the safety of the vehicle cloud interaction is improved. And the risk that the data information is transmitted and stolen in the transmission process is reduced.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and in particular to a vehicle-cloud interaction encryption system, method and vehicle. Background Art

[0002] In recent years, with the advancement of the new four trends of "electrification, networking, intelligence, and sharing", the Internet of Vehicles has become an important part of most vehicles. The large amount of data and information generated by vehicles needs to be transmitted to the vehicle's cloud server through the Internet of Vehicles to achieve vehicle-cloud interaction.

[0003] In vehicle-cloud interaction, protecting the data information that needs to be transmitted is not only related to the user's personal privacy, but also to the user's vehicle safety. Once the data information that needs to be transmitted is maliciously stolen or tampered with, it may not only lead to the leakage of personal privacy such as location information and identity information, but also cause abnormal vehicle functions such as intelligent driving central control functions.

[0004] Therefore, how to enhance the security of vehicle-cloud interaction and reduce the risk of data information being transmitted and stolen during transmission has become a technical problem that needs to be solved urgently. Summary of the invention

[0005] The present application provides a vehicle-cloud interaction encryption system, method and vehicle, which can enhance the security of vehicle-cloud interaction and reduce the risk of data information being transmitted and stolen during the transmission process.

[0006] This application discloses the following technical solutions:

[0007] In a first aspect, the present application provides a vehicle-cloud interactive encryption system, the system comprising: a vehicle security chip and a vehicle cloud server;

[0008] The vehicle security chip is used to send a first random number and an encryption suite to the vehicle cloud server;

[0009] The vehicle cloud server is configured to send a second random number and an encryption request to the vehicle safety chip after selecting a target encryption algorithm from the encryption suite, wherein the encryption request indicates that all messages transmitted between the vehicle safety chip and the vehicle cloud server are encrypted using the target encryption algorithm;

[0010] The vehicle security chip is used to respond to the encryption request, encrypt the first hash value according to the first random number, the second random number, the third random number and the target encryption algorithm to obtain a first encrypted value, wherein the first hash value is the historical data stored in the vehicle security chip; and send the first encrypted value and the third random number to the vehicle cloud server;

[0011] The vehicle cloud server is used to decrypt the first encrypted value according to the first random number, the second random number, the third random number and the target encryption algorithm to obtain a second hash value; if the second hash value is equal to the third hash value, it indicates that the encryption request is passed, and the third hash value is the historical data stored in the vehicle cloud server.

[0012] Optionally, the vehicle security chip is specifically used to: generate a first session key according to the first random number, the second random number, the third random number and the target encryption algorithm; and encrypt the first hash value according to the first session key to obtain a first encrypted value;

[0013] The vehicle cloud server is specifically used to generate a second session key based on the first random number, the second random number, the third random number and the target encryption algorithm; and decrypt the first encrypted value based on the second session key.

[0014] Optionally, the system further comprises: vehicle application software;

[0015] The vehicle application software is used to send a request for verification of a server certificate to the vehicle security chip;

[0016] The vehicle security chip is specifically used to send a first random number and an encryption suite to the vehicle cloud server if the server certificate matches the root certificate locally stored in the vehicle security chip.

[0017] Optionally, the vehicle security chip is also used to: if the server certificate does not match the root certificate, obtain the interface for importing the root certificate last time; update the root certificate through the interface; if the server certificate matches the updated root certificate, send a first random number and encryption suite to the vehicle cloud server.

[0018] Optionally, the vehicle application software is integrated into the vehicle's domain controller main control chip; the vehicle application software communicates serially with the vehicle security chip through the security chip application program interface of the domain controller main control chip; the vehicle application software communicates with the vehicle cloud server through a gateway and / or a cloud service platform.

[0019] Optionally, the vehicle cloud server is specifically used to: send a second random number, an encryption request and the server certificate to the vehicle security chip;

[0020] The vehicle security chip is specifically used to encrypt the first hash value to obtain a first encryption value according to the first random number, the second random number, the third random number and the target encryption algorithm in response to the encryption request if the connection protocol of the server certificate is consistent with the connection protocol of the root certificate.

[0021] Optionally, the vehicle safety chip is specifically used for:

[0022] Encrypting the third random number according to the public key carried in the server certificate to obtain an encrypted random number; sending the first encrypted value and the encrypted random number to the vehicle cloud server;

[0023] The vehicle cloud server is specifically used to: decrypt the encrypted random number according to the public key carried in the server certificate to obtain a fourth random number; decrypt the first encrypted value according to the first random number, the second random number, the fourth random number and the target encryption algorithm to obtain a second hash value.

[0024] Optionally, the target encryption algorithm includes one or more of a hash algorithm, an RSA algorithm, an AES-CBC large data volume algorithm, and an AES-GCM large data volume algorithm.

[0025] In a second aspect, the present application provides a vehicle-cloud interaction encryption method, which is applied to a vehicle cloud server, and the method includes:

[0026] receiving a first random number and an encryption suite sent by a vehicle security chip;

[0027] After selecting a target encryption algorithm in the encryption suite, sending a second random number and an encryption request to the vehicle security chip, the encryption request indicating that messages transmitted between the vehicle security chip and the vehicle cloud server are all encrypted by the target encryption algorithm;

[0028] Receiving a first encrypted value and a third random number sent by the vehicle security chip;

[0029] Decrypt the first encrypted value according to the first random number, the second random number, the third random number and the target encryption algorithm to obtain a second Hash value;

[0030] If the second hash value is equal to the third hash value, it indicates that the encryption request is passed, and the third hash value is the historical data stored in the vehicle cloud server.

[0031] In a third aspect, the present application provides a vehicle-cloud interaction encryption method, which is applied to a vehicle security chip, and the method includes:

[0032] Sending a first random number and an encryption suite to a vehicle cloud server;

[0033] receiving a second random number and an encryption request sent by the vehicle cloud server, wherein the encryption request indicates that messages transmitted between the vehicle security chip and the vehicle cloud server are encrypted by a target encryption algorithm;

[0034] In response to the encryption request, encrypting the first Hash value according to the first random number, the second random number, the third random number and the target encryption algorithm to obtain a first encrypted value, wherein the first Hash value is the historical data stored in the vehicle safety chip;

[0035] The first encrypted value and the third random number are sent to the vehicle cloud server.

[0036] In a fourth aspect, the present application provides a vehicle, which includes a vehicle-cloud interaction encryption system as described in the first aspect above.

[0037] Compared with the prior art, this application has the following beneficial effects:

[0038] The present application provides a vehicle-cloud interaction encryption system, method and vehicle, the system includes: a vehicle safety chip and a vehicle cloud server; the vehicle safety chip is used to send a first random number and an encryption suite to the vehicle cloud server; the vehicle cloud server is used to select a target encryption algorithm in the encryption suite, and then send a second random number and an encryption request to the vehicle safety chip, the encryption request indicating that the messages transmitted between the vehicle safety chip and the vehicle cloud server are encrypted by the target encryption algorithm; the vehicle safety chip is used to respond to the encryption request, according to the first random number, the second random number, the third random number and the target encryption algorithm, encrypt the first hash value to obtain a first encryption value, the first hash value is the historical data stored in the vehicle safety chip; send the first encryption value and the third random number to the vehicle cloud server; the vehicle cloud server is used to decrypt the first encryption value according to the first random number, the second random number, the third random number and the target encryption algorithm to obtain a second hash value; if the second hash value is equal to the third hash value, it indicates that the encryption request is passed, and the third hash value is the historical data stored in the vehicle cloud server. It can be seen that the system is based on the vehicle safety chip hardware, and a solution is designed that the vehicle safety chip and the vehicle cloud server need to transmit random numbers and encryption values ​​multiple times before executing subsequent encrypted communications. In addition, solutions based on vehicle security chip hardware are more reliable than pure software solutions. They can be used to resist hardware-level attacks and better protect transmitted data information. Even through professional reverse engineering, data information cannot be easily cracked, thereby enhancing the security of vehicle-cloud interaction and reducing the risk of data information being transmitted and stolen during transmission. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0040] Figure 1 A schematic diagram of a vehicle-cloud interactive encryption system provided in an embodiment of the present application;

[0041] Figure 2 A signaling diagram of a vehicle-cloud interactive encryption system provided in an embodiment of the present application;

[0042] Figure 3 A flow chart of a vehicle-cloud interaction encryption method provided in an embodiment of the present application;

[0043] Figure 4 A flowchart of another vehicle-cloud interaction encryption method provided in an embodiment of the present application. DETAILED DESCRIPTION

[0044] As described above, in vehicle-cloud interaction, protecting the data information that needs to be transmitted is not only related to the user's personal privacy, but also to the user's vehicle safety. Once the data information that needs to be transmitted is maliciously stolen or tampered with, it may not only lead to the leakage of personal privacy such as location information and identity information, but also cause abnormal vehicle functions such as intelligent driving central control functions.

[0045] Therefore, how to enhance the security of vehicle-cloud interaction and reduce the risk of data information being transmitted and stolen during transmission has become a technical problem that needs to be solved urgently.

[0046] In view of this, the present application discloses a vehicle-cloud interaction encryption system, method and vehicle. The system is based on the vehicle security chip hardware and designs a solution that requires multiple transmissions of random numbers and encryption values ​​between the vehicle security chip and the vehicle cloud server before subsequent encrypted communications can be performed. In addition, the solution based on the vehicle security chip hardware is more reliable than the pure software solution, and can be used to resist attacks on the hardware level, and can better protect the transmitted data information. Even through professional reverse engineering, the data information cannot be easily cracked, thereby enhancing the security of vehicle-cloud interaction and reducing the risk of data information being transmitted and stolen during the transmission process.

[0047] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0048] See also Figure 1 , which is a schematic diagram of a vehicle-cloud interactive encryption system provided in an embodiment of the present application. Specifically, the vehicle-cloud interactive encryption system 10 may include a vehicle security chip 11, a vehicle cloud server 12 and a vehicle application software 13.

[0049] It should be noted that the vehicle application software 13 is integrated into the vehicle's domain controller main control chip 14. The vehicle application software 13 can communicate with the vehicle safety chip 11 through the security chip application program interface (Application Program Interface, API) on the domain controller main control chip 14 through the serial port such as the Universal Asynchronous Receiver / Transmitter (UART). It can be understood that communicating through the serial port can increase the complexity of data information reading, thereby resisting external hardware attacks on the domain controller main control chip 14. In addition, the vehicle application software 13 can communicate with the vehicle cloud server 12 through the gateway and / or cloud service platform.

[0050] See also Figure 2 , this figure is a signaling diagram of a vehicle-cloud interactive encryption system provided in an embodiment of the present application.

[0051] S201: The vehicle application software sends a request to verify the server certificate to the vehicle security chip.

[0052] First, the vehicle application software 13 sends a request for verifying the server certificate to the vehicle security chip 11. The step of sending the request for verifying the server certificate indicates that the vehicle application software 13 starts to initiate a service connection. The server certificate can ensure the mutual confirmation of the identities of the vehicle and the cloud, thereby ensuring the security and reliability of data information communication.

[0053] It is understandable that the server certificate will be pre-stored in the vehicle security chip 11. It can be pre-made at the factory or set at other times before the vehicle-cloud interaction. This application does not limit the specific storage time.

[0054] S202: After the vehicle security chip passes the verification of the server certificate, it generates a first random number.

[0055] After receiving the request to verify the server certificate, the vehicle security chip 11 needs to first verify the root certificate stored in the vehicle security chip 11. If the server certificate and the root certificate pass the verification, that is, the two match, a first random number A can be generated. The first random number A can be generated based on a random number algorithm.

[0056] In some specific implementations, the root certificate may be expired, resulting in failure to verify the root certificate. Then, it is necessary to first obtain the interface for importing the root certificate last time on the vehicle safety chip 11, and update the expired root certificate based on the interface. It should be noted that this application does not limit the specific interface.

[0057] S203: The vehicle safety chip sends a handshake request to the vehicle cloud server.

[0058] After the vehicle security chip 11 generates the first random number A, a handshake request can be assembled based on the first random number A, and the handshake request can be sent to the vehicle cloud server 12. Specifically, the handshake request may include a secure transport layer protocol version (TLS Version), an encryption suite, the first random number A, and a supported compression algorithm.

[0059] Among them, the Transport Layer Security Protocol (TLS) is used to provide confidentiality and data integrity between two communicating applications (corresponding to the vehicle security chip and the vehicle cloud server of this application). The compression algorithm refers to the algorithm for data compression, including two steps: compression and restoration (or decoding and encoding).

[0060] A cipher suite is a combination of algorithms used to negotiate security settings during a TLS handshake. It should be noted that a cipher suite may include multiple encryption algorithms, such as a hash algorithm, an RSA algorithm, an AES-CBC large data volume algorithm, and an AES-GCM large data volume algorithm. This application does not limit the specific encryption algorithm.

[0061] S204: The vehicle cloud server selects a target encryption algorithm and its corresponding protocol version from the encryption suite of the handshake request.

[0062] After receiving the handshake request, the vehicle cloud server 12 can select the target encryption algorithm from the encryption suite in the handshake request and obtain the protocol version corresponding to the target encryption algorithm based on the encryption suite provided in the handshake request and the support of the vehicle cloud server 12 itself. In this way, in the subsequent data information transmission process between the vehicle safety chip 11 and the vehicle cloud server 12, encryption can be performed using the target encryption algorithm, thereby enhancing the security of vehicle-cloud interaction.

[0063] In some specific implementations, if the encryption suite includes a hash algorithm, an RSA algorithm, an AES-CBC large data volume algorithm, and an AES-GCM large data volume algorithm, then the vehicle cloud server can select one or more of the above four encryption algorithms as the target encryption algorithm.

[0064] It is understandable that each encryption algorithm has its corresponding protocol version. Exemplarily, the hash algorithm may include four protocol versions: SHA1, SHA256, SHA384, and SHA512, and the RSA algorithm may include three protocol versions: RSA1024 / 2048enc, RSA1024 / 2048NCRT dec, and RSA1024 / 2048CRT dec. It should be noted that this application does not limit the specific encryption algorithm and its corresponding protocol version.

[0065] S205: The vehicle cloud server sends the protocol version of the target encryption algorithm, the second random number and the server certificate to the vehicle security chip.

[0066] In some specific implementations, after the vehicle cloud server 12 selects the target encryption algorithm, it can assemble the protocol version corresponding to the target encryption algorithm, the second random number B and the server certificate, and send the assembly result to the vehicle security chip 11. The second random number B can be generated based on a random number algorithm. In addition, the server certificate contains a public key.

[0067] S206: The vehicle security chip verifies whether the server certificate is valid based on the root certificate. If valid, execute step S207.

[0068] After obtaining the server certificate, the vehicle security chip 11 needs to compare it with the root certificate. If the connection protocol of the server certificate is consistent with the connection protocol of the root certificate, it means that the server certificate is valid. Then, step S207 can be executed. On the contrary, if the connection protocol of the server certificate is inconsistent with the connection protocol of the root certificate, the subsequent steps cannot be executed.

[0069] S207: The vehicle safety chip generates a third random number.

[0070] If the server certificate is valid, that is, the connection protocol of the server certificate is consistent with the connection protocol of the root certificate, then the vehicle security chip 11 can generate a third random number Pre-MasterKey. The third random number Pre-MasterKey can be generated based on a random number algorithm.

[0071] S208: The vehicle security chip sends the encrypted random number obtained by encrypting the third random number based on the public key in the server certificate to the vehicle cloud server.

[0072] In some specific implementations, a hash algorithm may be used to encrypt the third random number based on the public key in the server certificate, and after obtaining the encrypted random number, the vehicle safety chip 11 sends the encrypted random number to the vehicle cloud server 12 .

[0073] S209: The vehicle security chip generates a first session key based on the first random number, the second random number and the third random number using a target encryption algorithm.

[0074] After generating the third random number, the vehicle security chip 11 can generate a first session key based on the above three random numbers and the selected target encryption algorithm.

[0075] It should be noted that the present application does not limit the execution order of steps S208 and S209. The vehicle security chip 11 may first send an encrypted random number encrypted by the third random number based on the public key in the server certificate to the vehicle cloud server 12, and then generate the first session key based on the first random number, the second random number and the third random number using the encryption algorithm corresponding to the target suite, or the two may be performed in reverse order or simultaneously.

[0076] S210: The vehicle safety chip encrypts the first hash value according to the first session key to obtain a first encrypted value.

[0077] It is understandable that the first hash value is the encrypted value of the historical data stored in the vehicle security chip 11. After the first session key is generated, the first hash value needs to be encrypted by the key to obtain a first encrypted value, which is used to verify whether the two session keys at both ends of the vehicle security chip 11 and the vehicle cloud server 12 are the same.

[0078] S211: The vehicle safety chip sends a first encrypted value to the vehicle cloud server.

[0079] S212: The vehicle cloud server decrypts the encrypted random number based on the public key in the server certificate to obtain a fourth random number.

[0080] It is understandable that if the encryption step of S208 is not performed, the decryption step of S212 may not be performed. This application does not limit this.

[0081] S213: The vehicle cloud server generates a second session key according to the first random number, the second random number and the fourth random number using an encryption algorithm corresponding to the target suite.

[0082] It is understandable that if the third random number is not encrypted but directly sent to the vehicle cloud server 12, the vehicle cloud server 12 can directly generate the second session key according to the first random number, the second random number and the third random number. This application does not limit this.

[0083] S214: The vehicle cloud server generates a second hash value based on the encrypted value of the stored historical data.

[0084] Similar to the first hash value in step S210, the vehicle cloud server 12 can also generate a second hash value based on the encrypted value of the stored historical data. It is understandable that since the vehicle cloud server 12 and the vehicle safety chip 11 have established a connection, the historical data of the two should correspond, so the first hash value and the second hash value should be equal.

[0085] S215: The vehicle cloud server decrypts the first encrypted value using the second session key to obtain a third hash value.

[0086] S216: The vehicle cloud server determines whether the second hash value and the third hash value are the same. If they are the same, subsequent encrypted communication can be performed.

[0087] If the second hash value is the same as the third hash value, it indicates that the first session key is the same as the second session key, and then subsequent encrypted communication can be performed based on the target encryption algorithm.

[0088] In summary, the present application discloses a vehicle-cloud interaction encryption system. The system is based on the vehicle security chip hardware and designs a solution that requires multiple transmissions of random numbers and encryption values ​​between the vehicle security chip and the vehicle cloud server in order to perform subsequent encrypted communications. In addition, the solution based on the vehicle security chip hardware is more reliable than the pure software solution, and can be used to resist attacks on the hardware level, and can better protect the transmitted data information. Even through professional reverse engineering, the data information cannot be easily cracked, thereby enhancing the security of vehicle-cloud interaction and reducing the risk of data information being transmitted and stolen during the transmission process.

[0089] See also Figure 3, which is a flow chart of a vehicle-cloud interaction encryption method provided in an embodiment of the present application. The vehicle-cloud interaction encryption method is applied to a vehicle security chip. The method includes:

[0090] S301: Generate a first random number.

[0091] S302: Send a first random number and an encryption suite to the vehicle cloud server.

[0092] S303: Receive a second random number and an encryption request sent by the vehicle cloud server, where the encryption request indicates that all messages transmitted between the vehicle safety chip and the vehicle cloud server are encrypted using a target encryption algorithm.

[0093] In some specific implementations, the target encryption algorithm includes one or more of a hash algorithm, an RSA algorithm, an AES-CBC large data volume algorithm, and an AES-GCM large data volume algorithm.

[0094] S304: In response to the encryption request, encrypt the first hash value according to the first random number, the second random number, the third random number and the target encryption algorithm to obtain a first encrypted value, where the first hash value is the historical data stored in the vehicle safety chip.

[0095] S305: Send the first encrypted value and the third random number to the vehicle cloud server.

[0096] In summary, the present application discloses a vehicle-cloud interaction encryption method, which is based on the vehicle security chip hardware and designs a solution that requires multiple transmissions of random numbers and encryption values ​​between the vehicle security chip and the vehicle cloud server in order to perform subsequent encrypted communications. In addition, the solution based on the vehicle security chip hardware is more reliable than the pure software solution, and can be used to resist attacks at the hardware level, and can better protect the transmitted data information. Even through professional reverse engineering, the data information cannot be easily cracked, thereby enhancing the security of vehicle-cloud interaction and reducing the risk of data information being transmitted and stolen during the transmission process.

[0097] See also Figure 4 , which is a flow chart of another vehicle-cloud interaction encryption method provided by an embodiment of the present application. The vehicle-cloud interaction encryption method is applied to a vehicle cloud server. The method includes:

[0098] S401: Receive a first random number and encryption suite sent by a vehicle security chip.

[0099] S402: After selecting a target encryption algorithm in the encryption suite, a second random number and an encryption request are sent to the vehicle safety chip, where the encryption request indicates that messages transmitted between the vehicle safety chip and the vehicle cloud server are encrypted using the target encryption algorithm.

[0100] In some specific implementations, the target encryption algorithm includes one or more of a hash algorithm, an RSA algorithm, an AES-CBC large data volume algorithm, and an AES-GCM large data volume algorithm.

[0101] S403: Receive the first encryption value and the third random number sent by the vehicle safety chip.

[0102] S404: Decrypt the first encrypted value according to the first random number, the second random number, the third random number and the target encryption algorithm to obtain a second Hash value.

[0103] S405: If the second hash value is equal to the third hash value, it indicates that the encryption request is passed, and the third hash value is the historical data stored in the vehicle cloud server.

[0104] In summary, the present application discloses a vehicle-cloud interaction encryption method, which is based on the vehicle security chip hardware and designs a solution that requires multiple transmissions of random numbers and encryption values ​​between the vehicle security chip and the vehicle cloud server in order to perform subsequent encrypted communications. In addition, the solution based on the vehicle security chip hardware is more reliable than the pure software solution, and can be used to resist attacks at the hardware level, and can better protect the transmitted data information. Even through professional reverse engineering, the data information cannot be easily cracked, thereby enhancing the security of vehicle-cloud interaction and reducing the risk of data information being transmitted and stolen during the transmission process.

[0105] Correspondingly, the present application also discloses a vehicle, including the vehicle-cloud interaction encryption system as introduced in the aforementioned embodiments.

[0106] A vehicle provided in an embodiment of the present application has the beneficial effects of the vehicle-cloud interactive encryption system introduced above.

[0107] The "first" and "second" in the names such as "first" and "second" (if any) mentioned in the embodiments of the present application are only used as name identifiers and do not represent the first or second in order.

[0108] Through the description of the above implementation methods, it can be known that those skilled in the art can clearly understand that all or part of the steps in the above-mentioned embodiment method can be implemented by means of software plus a general hardware platform. Based on such an understanding, the technical solution of the present application can be embodied in the form of a software product, which can be stored in a storage medium, such as a read-only memory (ROM) / RAM, a magnetic disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network communication device such as a router) to execute the methods described in each embodiment of the present application or some parts of the embodiments.

[0109] It should be noted that the various embodiments in this specification are described in a progressive manner, and the same and similar parts between the various embodiments can refer to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the device and medium embodiments, since they are basically similar to the system and method embodiments, the description is relatively simple, and the relevant parts can refer to the partial description of the method embodiment. The device and medium embodiments described above are merely schematic, in which the units described as separate components may or may not be physically separated, and the components indicated as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules can be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0110] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed in the present application should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A vehicle-cloud interactive encryption system, characterized in that: The system includes: a vehicle safety chip and a vehicle cloud server; The vehicle security chip is used to send a first random number and an encryption suite to the vehicle cloud server; The vehicle cloud server is configured to send a second random number and an encryption request to the vehicle safety chip after selecting a target encryption algorithm from the encryption suite, wherein the encryption request indicates that all messages transmitted between the vehicle safety chip and the vehicle cloud server are encrypted using the target encryption algorithm; The vehicle security chip is used to respond to the encryption request, encrypt the first hash value according to the first random number, the second random number, the third random number and the target encryption algorithm to obtain a first encrypted value, wherein the first hash value is the historical data stored in the vehicle security chip; and send the first encrypted value and the third random number to the vehicle cloud server; The vehicle cloud server is used to decrypt the first encrypted value according to the first random number, the second random number, the third random number and the target encryption algorithm to obtain a second hash value; if the second hash value is equal to the third hash value, it indicates that the encryption request is passed, and the third hash value is the historical data stored in the vehicle cloud server.

2. The system according to claim 1, characterized in that The vehicle security chip is specifically used to: generate a first session key according to the first random number, the second random number, the third random number and the target encryption algorithm; and encrypt the first hash value according to the first session key to obtain a first encrypted value; The vehicle cloud server is specifically used to generate a second session key based on the first random number, the second random number, the third random number and the target encryption algorithm; and decrypt the first encrypted value based on the second session key.

3. The system according to claim 1, characterized in that The system also includes: vehicle application software; The vehicle application software is used to send a request for verification of a server certificate to the vehicle security chip; The vehicle security chip is specifically used to send a first random number and an encryption suite to the vehicle cloud server if the server certificate matches the root certificate locally stored in the vehicle security chip.

4. The system according to claim 3, characterized in that The vehicle security chip is also used to: if the server certificate does not match the root certificate, obtain the interface for importing the root certificate last time; update the root certificate through the interface; if the server certificate matches the updated root certificate, send a first random number and encryption suite to the vehicle cloud server.

5. The system according to claim 3, characterized in that The vehicle application software is integrated into the vehicle's domain controller main control chip; the vehicle application software communicates with the vehicle's security chip through a security chip application program interface of the domain controller main control chip; The vehicle application software communicates with the vehicle cloud server via a gateway and / or a cloud service platform.

6. The system according to claim 3, characterized in that The vehicle cloud server is specifically used to: send a second random number, an encryption request and the server certificate to the vehicle security chip; The vehicle security chip is specifically used to encrypt the first hash value to obtain a first encryption value according to the first random number, the second random number, the third random number and the target encryption algorithm in response to the encryption request if the connection protocol of the server certificate is consistent with the connection protocol of the root certificate.

7. The system according to claim 6, characterized in that The vehicle safety chip is specifically used for: Encrypting the third random number according to the public key carried in the server certificate to obtain an encrypted random number; sending the first encrypted value and the encrypted random number to the vehicle cloud server; The vehicle cloud server is specifically used to: decrypt the encrypted random number according to the public key carried in the server certificate to obtain a fourth random number; decrypt the first encrypted value according to the first random number, the second random number, the fourth random number and the target encryption algorithm to obtain a second hash value.

8. The system according to claim 1, characterized in that The target encryption algorithm includes one or more of a hash algorithm, an RSA algorithm, an AES-CBC large data volume algorithm, and an AES-GCM large data volume algorithm.

9. A vehicle-cloud interaction encryption method, characterized in that: Applied to a vehicle cloud server, the method includes: receiving a first random number and an encryption suite sent by a vehicle security chip; After selecting a target encryption algorithm in the encryption suite, sending a second random number and an encryption request to the vehicle security chip, the encryption request indicating that messages transmitted between the vehicle security chip and the vehicle cloud server are all encrypted by the target encryption algorithm; Receiving a first encrypted value and a third random number sent by the vehicle security chip; Decrypt the first encrypted value according to the first random number, the second random number, the third random number and the target encryption algorithm to obtain a second Hash value; If the second hash value is equal to the third hash value, it indicates that the encryption request is passed, and the third hash value is the historical data stored in the vehicle cloud server.

10. A vehicle-cloud interaction encryption method, characterized in that: Applied to a vehicle safety chip, the method comprises: Sending a first random number and an encryption suite to a vehicle cloud server; receiving a second random number and an encryption request sent by the vehicle cloud server, wherein the encryption request indicates that messages transmitted between the vehicle security chip and the vehicle cloud server are encrypted by a target encryption algorithm; In response to the encryption request, encrypting the first Hash value according to the first random number, the second random number, the third random number and the target encryption algorithm to obtain a first encrypted value, wherein the first Hash value is the historical data stored in the vehicle safety chip; The first encrypted value and the third random number are sent to the vehicle cloud server.

11. A vehicle, characterized in that: The vehicle includes a vehicle-cloud interaction encryption system as described in claims 1 to 8.

Images