A vehicle-cloud interaction encryption system and method, and a vehicle

Abstract

The application discloses a kind of vehicle cloud interaction encryption systems, methods and vehicles, it is related to information security technical field, the system includes: vehicle security chip and vehicle cloud server.Based on the vehicle security chip hardware, a vehicle security chip and vehicle cloud server need to be designed to pass multiple random numbers and encryption values, to execute subsequent encryption communication scheme.And, the scheme based on the vehicle security chip hardware is more reliable than the scheme of pure software, can be used to resist the attack to hardware level, can better protect the data information of transmission, even through professional reverse engineering, data information cannot be easily cracked, to enhance the security of vehicle cloud interaction, reduce the risk of being transmitted and stolen in the transmission process of data information.

Description

Technical Field

[0001] This application relates to the field of information security technology, and in particular to a vehicle-to-cloud interactive encryption system, method, and vehicle. Background Technology

[0002] In recent years, with the advancement of the "new four modernizations" of vehicles—electrification, connectivity, intelligence, and sharing—vehicle networking has become an important component of most vehicles. The vast amounts of data generated by vehicles need to be transmitted to the vehicle's cloud server via vehicle networking to achieve vehicle-cloud interaction.

[0003] In vehicle-to-cloud (V2X) communication, protecting the data that needs to be transmitted is not only a matter of user privacy but also of user safety. If the data is maliciously stolen or tampered with, it could lead to the leakage of personal privacy information such as location and identity information, and could also cause malfunctions in vehicle functions such as intelligent driving control systems.

[0004] Therefore, how to enhance the security of vehicle-to-cloud interaction and reduce the risk of data being transmitted or stolen during transmission has become an urgent technical problem to be solved. Summary of the Invention

[0005] This application provides a vehicle-to-cloud (V2X) interactive encryption system, method, and vehicle, which can enhance the security of V2X interaction and reduce the risk of data information being transmitted or stolen during transmission.

[0006] This application discloses the following technical solution:

[0007] In the first aspect, this application provides a vehicle-to-cloud interactive encryption system, which includes: a vehicle security chip and a vehicle cloud server;

[0008] The vehicle security chip is used to send a first random number and encryption kit to the vehicle cloud server;

[0009] The vehicle cloud server is used to select a target encryption algorithm from the encryption suite and then send a second random number and an encryption request to the vehicle security chip. The encryption request indicates that all messages transmitted between the vehicle security chip and the vehicle cloud server are encrypted using the target encryption algorithm.

[0010] The vehicle security chip is configured to respond to the encryption request by encrypting a first hash value to obtain a first encrypted value based on a first random number, a second random number, a third random number, and the target encryption algorithm, wherein the first hash value is historical data stored in the vehicle security chip; and sending the first encrypted value and the third random number to the vehicle cloud server.

[0011] The vehicle cloud server is used to decrypt the first encrypted value according to the first random number, the second random number, the third random number and the target encryption algorithm to obtain a second hash value; if the second hash value is equal to the third hash value, it indicates that the encryption request is successful, and the third hash value is historical data stored in the vehicle cloud server.

[0012] Optionally, the vehicle security chip is specifically used to: generate a first session key based on the first random number, the second random number, the third random number, and the target encryption algorithm; and encrypt the first hash value to obtain a first encrypted value based on the first session key.

[0013] The vehicle cloud server is specifically used to generate a second session key based on the first random number, the second random number, the third random number, and the target encryption algorithm; and to decrypt the first encrypted value based on the second session key.

[0014] Optionally, the system may further include: vehicle application software;

[0015] The vehicle application software is used to send a verification server certificate request to the vehicle security chip;

[0016] The vehicle security chip is specifically used to send a first random number and an encryption suite to the vehicle cloud server if the server certificate matches the root certificate stored locally on the vehicle security chip.

[0017] Optionally, the vehicle security chip is further configured to: if the server certificate does not match the root certificate, obtain the interface of the last imported root certificate; update the root certificate through the interface; if the server certificate matches the updated root certificate, send a first random number and encryption kit to the vehicle cloud server.

[0018] Optionally, the vehicle application software is integrated into the vehicle's domain controller main control chip; the vehicle application software communicates with the vehicle security chip via serial communication through the security chip application programming interface of the domain controller main control chip; the vehicle application software communicates with the vehicle cloud server through a gateway and / or a cloud service platform.

[0019] Optionally, the vehicle cloud server is specifically used to: send a second random number, an encryption request, and the server certificate to the vehicle security chip;

[0020] The vehicle security chip is specifically used to, in response to the encryption request, encrypt the first hash value to obtain a first encrypted value based on the first random number, the second random number, the third random number, and the target encryption algorithm if the connection protocol of the server certificate is consistent with the connection protocol of the root certificate.

[0021] Optionally, the vehicle security chip is specifically used for:

[0022] The third random number is encrypted using the public key carried in the server certificate to obtain an encrypted random number; the first encrypted value and the encrypted random number are then sent to the vehicle cloud server.

[0023] The vehicle cloud server is specifically used to: decrypt the encrypted random number according to the public key carried in the server certificate to obtain a fourth random number; and decrypt the first encrypted value according to the first random number, the second random number, the fourth random number and the target encryption algorithm to obtain a second hash value.

[0024] Optionally, the target encryption algorithm includes one or more of the following: hash algorithm, RSA algorithm, AES-CBC large data volume algorithm, and AES-GCM large data volume algorithm.

[0025] Secondly, this application provides a vehicle-to-cloud (V2X) encryption method, applied to a vehicle cloud server, the method comprising:

[0026] Receive the first random number and encryption suite sent by the vehicle's security chip;

[0027] After selecting a target encryption algorithm from the encryption suite, a second random number and an encryption request are sent to the vehicle security chip. The encryption request indicates that all messages transmitted between the vehicle security chip and the vehicle cloud server are encrypted using the target encryption algorithm.

[0028] Receive the first encrypted value and the third random number sent by the vehicle security chip;

[0029] Based on the first random number, the second random number, the third random number, and the target encryption algorithm, the first encrypted value is decrypted to obtain the second hash value;

[0030] If the second hash value is equal to the third hash value, it indicates that the encryption request is successful. The third hash value is historical data stored in the vehicle's cloud server.

[0031] Thirdly, this application provides a vehicle-to-cloud (V2X) encryption method for vehicle security chips, the method comprising:

[0032] Send the first random number and encryption kit to the vehicle's cloud server;

[0033] The system receives a second random number and an encryption request sent by the vehicle cloud server. The encryption request indicates that all messages transmitted between the vehicle security chip and the vehicle cloud server are encrypted using a target encryption algorithm.

[0034] In response to the encryption request, a first encrypted value is obtained by encrypting the first hash value according to the first random number, the second random number, the third random number and the target encryption algorithm. The first hash value is historical data stored in the vehicle security chip.

[0035] The first encrypted value and the third random number are sent to the vehicle's cloud server.

[0036] Fourthly, this application provides a vehicle that includes a vehicle-to-cloud interactive encryption system as described in the first aspect above.

[0037] Compared with the prior art, this application has the following beneficial effects:

[0038] This application provides a vehicle-to-cloud (V2X) encryption system, method, and vehicle. The system includes a vehicle security chip and a vehicle cloud server. The vehicle security chip sends a first random number and an encryption suite to the vehicle cloud server. The vehicle cloud server selects a target encryption algorithm from the encryption suite and then sends a second random number and an encryption request to the vehicle security chip. The encryption request indicates that all messages transmitted between the vehicle security chip and the vehicle cloud server are encrypted using the target encryption algorithm. In response to the encryption request, the vehicle security chip encrypts a first hash value using the first random number, the second random number, the third random number, and the target encryption algorithm to obtain a first encrypted value, where the first hash value is historical data stored in the vehicle security chip. The chip then sends the first encrypted value and a third random number to the vehicle cloud server. The vehicle cloud server decrypts the first encrypted value using the first random number, the second random number, the third random number, and the target encryption algorithm to obtain a second hash value. If the second hash value is equal to the third hash value, the encryption request is successful, and the third hash value is historical data stored in the vehicle cloud server. Therefore, this system, based on vehicle security chip hardware, designs a scheme where the vehicle security chip and the vehicle cloud server need to exchange random numbers and encrypted values ​​multiple times before subsequent encrypted communication can be executed. Furthermore, solutions based on vehicle security chip hardware are more reliable than pure software solutions. They can be used to resist hardware-level attacks and better protect transmitted data. Even with professional reverse engineering, the data cannot be easily cracked, thereby enhancing the security of vehicle-to-cloud interaction and reducing the risk of data being transmitted or stolen during transmission. Attached Figure Description

[0039] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0040] Figure 1 This is a schematic diagram of a vehicle-to-cloud interactive encryption system provided in an embodiment of this application;

[0041] Figure 2 A signaling diagram of a vehicle-to-cloud interactive encryption system provided in an embodiment of this application;

[0042] Figure 3 A flowchart illustrating a vehicle-to-cloud (V2X) encryption method provided in this application embodiment;

[0043] Figure 4 A flowchart of another vehicle-to-cloud interaction encryption method provided in an embodiment of this application. Detailed Implementation

[0044] As described earlier, protecting the data information that needs to be transmitted in vehicle-to-cloud interaction is not only related to the user's personal privacy, but also to the user's vehicle safety. Once the data information that needs to be transmitted is maliciously stolen or tampered with, it may not only lead to the leakage of personal privacy such as location information and identity information, but may also cause abnormalities in vehicle functions such as intelligent driving central control functions.

[0045] Therefore, how to enhance the security of vehicle-to-cloud interaction and reduce the risk of data being transmitted or stolen during transmission has become an urgent technical problem to be solved.

[0046] In view of this, this application discloses a vehicle-to-cloud (V2X) encryption system, method, and vehicle. This system, based on vehicle security chip hardware, designs a scheme where the vehicle security chip and the vehicle cloud server need to exchange random numbers and encrypted values ​​multiple times before subsequent encrypted communication can be executed. Furthermore, the hardware-based solution is more reliable than a purely software-based solution, can resist hardware-level attacks, and better protects transmitted data. Even with professional reverse engineering, the data cannot be easily cracked, thus enhancing the security of V2X interaction and reducing the risk of data being transmitted or stolen during transmission.

[0047] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of the present application.

[0048] See Figure 1 This figure is a schematic diagram of a vehicle-to-cloud (V2X) interactive encryption system provided in an embodiment of this application. Specifically, the V2X interactive encryption system 10 may include a vehicle security chip 11, a vehicle cloud server 12, and vehicle application software 13.

[0049] It should be noted that the vehicle application software 13 is integrated into the vehicle's domain controller main control chip 14. The vehicle application software 13 can communicate with the vehicle security chip 11 via a serial port such as a Universal Asynchronous Receiver / Transmitter (UART) through the application program interface (API) on the domain controller main control chip 14. Understandably, communicating via a serial port increases the complexity of data reading, thereby protecting against external hardware attacks on the domain controller main control chip 14. Furthermore, the vehicle application software 13 can communicate with the vehicle cloud server 12 through a gateway and / or a cloud service platform.

[0050] See Figure 2 The figure is a signaling diagram of a vehicle-to-cloud interactive encryption system provided in an embodiment of this application.

[0051] S201: The vehicle application software sends a verification server certificate request to the vehicle security chip.

[0052] First, the vehicle application software 13 sends a verification server certificate request to the vehicle security chip 11. This step of sending the verification server certificate request signifies that the vehicle application software 13 has initiated a business connection. The server certificate enables secure mutual identity verification between the vehicle and the cloud, thereby ensuring the security and reliability of data communication.

[0053] It is understandable that the server certificate will be pre-stored in the vehicle security chip 11. It may be pre-made at the factory or set at a time before vehicle-cloud interaction. This application does not limit the specific storage time.

[0054] S202: After the vehicle security chip passes the verification server certificate, it generates the first random number.

[0055] Upon receiving a certificate verification request from the server, the vehicle security chip 11 first verifies the root certificate stored in the vehicle security chip 11. If the server certificate and the root certificate pass the verification, i.e., they match, a first random number A can be generated. This first random number A can be generated based on a random number algorithm.

[0056] In some specific implementations, the root certificate may expire, causing the root certificate verification to fail. Therefore, it is necessary to first obtain the interface from which the vehicle security chip 11 last imported the root certificate, and then update the expired root certificate based on that interface. It should be noted that this application does not limit the specific interface used.

[0057] S203: The vehicle security chip sends a handshake request to the vehicle cloud server.

[0058] After the vehicle security chip 11 generates a first random number A, it can assemble a handshake request based on the first random number A and send the handshake request to the vehicle cloud server 12. Specifically, the handshake request may include a Transport Layer Security (TLS) version, a cipher suite, the first random number A, and supported compression algorithms.

[0059] The Transport Layer Security Protocol (TLS) is used to provide confidentiality and data integrity between two communicating applications (corresponding to the vehicle security chip and the vehicle cloud server in this application). The compression algorithm refers to the algorithm for data compression, which includes two steps: compression and decompression (or decoding and encoding).

[0060] A cryptographic suite is a combination of algorithms used to negotiate security settings during the TLS handshake. It should be noted that the cryptographic suite may include various encryption algorithms, such as hash algorithms, RSA algorithms, AES-CBC large-scale algorithms, and AES-GCM large-scale algorithms. This application does not limit the specific encryption algorithms used.

[0061] S204: The vehicle cloud server selects the target encryption algorithm and its corresponding protocol version from the encryption suite in the handshake request.

[0062] After receiving the handshake request, the vehicle cloud server 12 can select a target encryption algorithm from the encryption suite provided in the handshake request and the information supported by the vehicle cloud server 12 itself, and obtain the protocol version corresponding to the target encryption algorithm. In the subsequent data transmission process between the vehicle security chip 11 and the vehicle cloud server 12, the data can be encrypted using the target encryption algorithm, thereby enhancing the security of vehicle-cloud interaction.

[0063] In some specific implementations, if the encryption suite includes hash algorithms, RSA algorithms, AES-CBC large data volume algorithms, and AES-GCM large data volume algorithms, then the vehicle cloud server can select one or more of the above four encryption algorithms as the target encryption algorithm.

[0064] It is understood that each encryption algorithm has its corresponding protocol version. For example, hash algorithms may include four protocol versions: SHA1, SHA256, SHA384, and SHA512, while RSA algorithms may include three protocol versions: RSA1024 / 2048 enc, RSA1024 / 2048 NCRT dec, and RSA1024 / 2048 CRT dec. It should be noted that this application does not limit the specific encryption algorithm or its corresponding protocol version.

[0065] S205: The vehicle cloud server sends the protocol version of the target encryption algorithm, a second random number, and the server certificate to the vehicle security chip.

[0066] In some specific implementations, after the vehicle cloud server 12 selects the target encryption algorithm, it assembles the corresponding protocol version of the target encryption algorithm, the second random number B, and the server certificate, and then sends the assembled result to the vehicle security chip 11. The second random number B can be generated based on a random number algorithm. Furthermore, the server certificate contains the public key.

[0067] S206: The vehicle security chip verifies the validity of the server certificate based on the root certificate. If valid, proceed to step S207.

[0068] After obtaining the server certificate, the vehicle security chip 11 needs to compare it with the root certificate. If the connection protocol of the server certificate and the root certificate are the same, the server certificate is valid. Then, step S207 can be executed. Conversely, if the connection protocol of the server certificate and the root certificate are inconsistent, subsequent steps cannot be executed.

[0069] S207: The vehicle security chip generates a third random number.

[0070] If the server certificate is valid, meaning its connection protocol is consistent with the root certificate's connection protocol, then the vehicle security chip 11 can generate a third random number, the Pre-Master Key. This third random number, the Pre-Master Key, can be generated based on a random number algorithm.

[0071] S208: The vehicle security chip sends an encrypted random number to the vehicle cloud server, which is encrypted with the public key in the server certificate to a third random number.

[0072] In some specific implementations, a hash algorithm can be used to encrypt a third random number based on the public key in the server certificate. After obtaining the encrypted random number, the vehicle security chip 11 sends the encrypted random number to the vehicle cloud server 12.

[0073] S209: The vehicle security chip generates a first session key using a target encryption algorithm based on a first random number, a second random number, and a third random number.

[0074] After generating the third random number, the vehicle security chip 11 can generate the first session key based on the above three random numbers and the selected target encryption algorithm.

[0075] It should be noted that this application does not limit the execution order of steps S208 and S209. The vehicle security chip 11 may first send an encrypted random number (based on the public key in the server certificate) to the vehicle cloud server 12, which is then encrypted with the third random number. Then, based on the first, second, and third random numbers, the encryption algorithm corresponding to the target suite is used to generate the first session key. Alternatively, the order of the two steps may be reversed, or they may be performed simultaneously.

[0076] S210: The vehicle security chip encrypts the first hash value according to the first session key to obtain the first encrypted value.

[0077] Understandably, the first hash value is the encrypted value of the historical data stored in the vehicle security chip 11. After generating the first session key, the first hash value needs to be encrypted using this key to obtain the first encrypted value. This first encrypted value is used to verify whether the two session keys at both ends of the vehicle security chip 11 and the vehicle cloud server 12 are the same.

[0078] S211: The vehicle security chip sends the first encrypted value to the vehicle cloud server.

[0079] S212: The vehicle cloud server decrypts the encrypted random number based on the private key corresponding to the public key in the server certificate to obtain the fourth random number.

[0080] It is understandable that if the encryption step S208 is not performed, then the decryption step S212 may also be omitted. This application does not impose any restrictions on this.

[0081] S213: The vehicle cloud server generates a second session key based on the first random number, the second random number, and the fourth random number, using the encryption algorithm corresponding to the target kit.

[0082] It is understandable that if the third random number is not encrypted and is directly sent to the vehicle cloud server 12, then the vehicle cloud server 12 can directly generate the second session key based on the first, second, and third random numbers. This application does not limit this.

[0083] S214: The vehicle cloud server generates a second hash value based on the encrypted value of the stored historical data.

[0084] Similar to the first hash value in step S210, the vehicle cloud server 12 can also generate a second hash value based on the encrypted value of the stored historical data. It is understandable that since the vehicle cloud server 12 and the vehicle security chip 11 are connected, their historical data should correspond, therefore the first hash value and the second hash value should be equal.

[0085] S215: The vehicle cloud server decrypts the first encrypted value using the second session key to obtain the third hash value.

[0086] S216: The vehicle cloud server determines whether the second hash value and the third hash value are the same. If they are the same, subsequent encrypted communication can be executed.

[0087] If the second hash value and the third hash value are the same, it indicates that the first session key and the second session key are the same. Then, subsequent encrypted communication can be performed based on the target encryption algorithm.

[0088] In summary, this application discloses a vehicle-to-cloud (V2X) encryption system. Based on vehicle security chip hardware, this system designs a scheme where the vehicle security chip and the vehicle cloud server need to exchange random numbers and encrypted values ​​multiple times before subsequent encrypted communication can be executed. Furthermore, the hardware-based solution is more reliable than a purely software-based solution, can resist hardware-level attacks, and better protects transmitted data. Even with professional reverse engineering, the data cannot be easily cracked, thus enhancing the security of V2X interaction and reducing the risk of data being transmitted or stolen during transmission.

[0089] See Figure 3This figure is a flowchart of a vehicle-to-cloud (V2X) encryption method provided in an embodiment of this application. This V2X encryption method is applied to a vehicle security chip. The method includes:

[0090] S301: Generate the first random number.

[0091] S302: Send the first random number and encryption kit to the vehicle's cloud server.

[0092] S303: Receive a second random number and an encryption request sent by the vehicle cloud server. The encryption request indicates that all messages transmitted between the vehicle security chip and the vehicle cloud server are encrypted using the target encryption algorithm.

[0093] In some specific implementations, the target encryption algorithm mentioned above includes one or more of the following: hash algorithm, RSA algorithm, AES-CBC large data volume algorithm, and AES-GCM large data volume algorithm.

[0094] S304: In response to an encryption request, encrypt a first hash value to obtain a first encrypted value based on a first random number, a second random number, a third random number, and a target encryption algorithm. The first hash value is historical data stored in the vehicle security chip.

[0095] S305: Send the first encrypted value and the third random number to the vehicle cloud server.

[0096] In summary, this application discloses a vehicle-to-cloud (V2X) encryption method. This method, based on vehicle security chip hardware, designs a scheme where the vehicle security chip and the vehicle cloud server must exchange random numbers and encrypted values ​​multiple times before subsequent encrypted communication can be executed. Furthermore, the hardware-based solution is more reliable than a purely software-based solution, can resist hardware-level attacks, and better protects transmitted data. Even with professional reverse engineering, the data cannot be easily cracked, thus enhancing the security of V2X interaction and reducing the risk of data being transmitted or stolen during transmission.

[0097] See Figure 4 The figure is a flowchart of another vehicle-to-cloud (V2X) interaction encryption method provided in an embodiment of this application. This V2X interaction encryption method is applied to a vehicle cloud server. The method includes:

[0098] S401: Receives the first random number and encryption suite sent by the vehicle security chip.

[0099] S402: After selecting the target encryption algorithm in the encryption suite, send a second random number and an encryption request to the vehicle security chip. The encryption request indicates that all messages transmitted between the vehicle security chip and the vehicle cloud server are encrypted using the target encryption algorithm.

[0100] In some specific implementations, the target encryption algorithm mentioned above includes one or more of the following: hash algorithm, RSA algorithm, AES-CBC large data volume algorithm, and AES-GCM large data volume algorithm.

[0101] S403: Receives the first encrypted value and the third random number sent by the vehicle security chip.

[0102] S404: Decrypt the first encrypted value based on the first random number, the second random number, the third random number, and the target encryption algorithm to obtain the second hash value.

[0103] S405: If the second hash value is equal to the third hash value, it indicates that the encryption request is successful. The third hash value is the historical data stored in the vehicle's cloud server.

[0104] In summary, this application discloses a vehicle-to-cloud (V2X) encryption method. This method, based on vehicle security chip hardware, designs a scheme where the vehicle security chip and the vehicle cloud server must exchange random numbers and encrypted values ​​multiple times before subsequent encrypted communication can be executed. Furthermore, the hardware-based solution is more reliable than a purely software-based solution, can resist hardware-level attacks, and better protects transmitted data. Even with professional reverse engineering, the data cannot be easily cracked, thus enhancing the security of V2X interaction and reducing the risk of data being transmitted or stolen during transmission.

[0105] Accordingly, this application also discloses a vehicle including the vehicle-to-cloud interactive encryption system described in the foregoing embodiments.

[0106] The vehicle provided in this application embodiment has the beneficial effects of the aforementioned vehicle-to-cloud interactive encryption system.

[0107] In the embodiments of this application, the terms "first" and "second" (if they exist) are used only as name identifiers and do not represent the order of first and second.

[0108] As can be seen from the above description of the embodiments, those skilled in the art can clearly understand that all or part of the steps in the methods of the above embodiments can be implemented by means of software plus a general-purpose hardware platform. Based on this understanding, the technical solution of this application can be embodied in the form of a software product. This computer software product can be stored in a storage medium, such as a read-only memory (ROM) / RAM, magnetic disk, optical disk, etc., including several instructions to cause a computer device (which may be a personal computer, a server, or a network communication device such as a router) to execute the methods described in various embodiments or some parts of the embodiments of this application.

[0109] It should be noted that the various embodiments in this specification are described in a progressive manner, and the same or similar parts between the various embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, for the device and medium embodiments, since they are basically similar to the system and method embodiments, the description is relatively simple, and the relevant parts can be referred to the description of the method embodiments. The device and medium embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components indicated as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without creative effort.

[0110] The above description is merely one specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A vehicle-cloud interaction encryption system, characterized in that, The system comprises a vehicle security chip, a vehicle cloud server and a vehicle application software; The vehicle application software is configured to send a server certificate check request to the vehicle security chip; The vehicle security chip is configured to send a first random number and a cipher suite to the vehicle cloud server if the server certificate matches a root certificate stored locally in the vehicle security chip; The vehicle cloud server is configured to send a second random number, an encryption request and the server certificate to the vehicle security chip after selecting a target encryption algorithm from the cipher suite, wherein the encryption request indicates that messages transmitted between the vehicle security chip and the vehicle cloud server are encrypted by the target encryption algorithm; The vehicle security chip is configured to, if the connection protocol of the server certificate is consistent with the connection protocol of the root certificate, encrypt a first hash value to obtain a first encrypted value according to the first random number, the second random number, a third random number and the target encryption algorithm in response to the encryption request, wherein the first hash value is historical data stored in the vehicle security chip; and send the first encrypted value and the third random number to the vehicle cloud server; The vehicle cloud server is configured to decrypt the first encrypted value to obtain a second hash value according to the first random number, the second random number, the third random number and the target encryption algorithm; and if the second hash value is equal to a third hash value, it indicates that the encryption request is passed, wherein the third hash value is historical data stored in the vehicle cloud server.

2. The system of claim 1, wherein, The vehicle security chip is specifically configured to generate a first session key according to the first random number, the second random number, a third random number and the target encryption algorithm; and encrypt the first hash value to obtain a first encrypted value according to the first session key. The vehicle cloud server is specifically configured to generate a second session key according to the first random number, the second random number, the third random number and the target encryption algorithm; and decrypt the first encrypted value according to the second session key.

3. The system of claim 1, wherein, The vehicle security chip is further configured to, if the server certificate does not match the root certificate, acquire an interface for importing the root certificate last time; update the root certificate through the interface; and if the server certificate matches the updated root certificate, send the first random number and the cipher suite to the vehicle cloud server.

4. The system of claim 1, wherein, The vehicle application software is integrated in a domain controller master control chip of a vehicle; and the vehicle application software performs serial communication with the vehicle security chip through a security chip application program interface of the domain controller master control chip. The vehicle application software communicates with the vehicle cloud server through a gateway and / or a cloud service platform.

5. The system of claim 1, wherein, The vehicle security chip is specifically configured to: encrypt the third random number to obtain an encrypted random number according to a public key carried in the server certificate; and send the first encrypted value and the encrypted random number to the vehicle cloud server. The vehicle cloud server is specifically configured to decrypt the encrypted random number according to a private key corresponding to a public key carried in the server certificate to obtain a fourth random number; and decrypt the first encrypted value according to the first random number, the second random number, the fourth random number, and the target encryption algorithm to obtain a second hash value.

6. The system of claim 1, wherein, The target encryption algorithm includes one or more of a hash algorithm, an RSA algorithm, an AES-CBC large data volume algorithm, and an AES-GCM large data volume algorithm.

7. A vehicle-cloud interaction encryption method, characterized in that, The method is applied to a vehicle cloud server, and the method comprises: receiving a first random number and an encryption suite sent by a vehicle security chip; the first random number and the encryption suite are sent in a case where a server certificate matches a root certificate stored locally by the vehicle security chip; after selecting a target encryption algorithm from the encryption suite, sending a second random number, an encryption request, and the server certificate to the vehicle security chip; the encryption request represents that messages transmitted between the vehicle security chip and the vehicle cloud server are all encrypted by the target encryption algorithm; receiving a first encrypted value and a third random number sent by the vehicle security chip; the first encrypted value and the third random number are sent in a case where a connection protocol of the server certificate is consistent with a connection protocol of the root certificate; decrypting the first encrypted value according to the first random number, the second random number, the third random number, and the target encryption algorithm to obtain a second hash value; if the second hash value is equal to a third hash value, it is represented that the encryption request is passed, and the third hash value is historical data stored in the vehicle cloud server.

8. A vehicle-cloud interaction encryption method, characterized in that, The method is applied to a vehicle security chip, and the method comprises: receiving a verification server certificate requirement sent by vehicle application software; if a server certificate matches a root certificate stored locally by the vehicle security chip, sending a first random number and an encryption suite to a vehicle cloud server; receiving a second random number, an encryption request, and the server certificate sent by the vehicle cloud server; the encryption request represents that messages transmitted between the vehicle security chip and the vehicle cloud server are all encrypted by a target encryption algorithm; if a connection protocol of the server certificate is consistent with a connection protocol of the root certificate, in response to the encryption request, encrypting a first hash value according to the first random number, the second random number, a third random number, and the target encryption algorithm to obtain a first encrypted value; the first hash value is historical data stored in the vehicle security chip; sending the first encrypted value and the third random number to the vehicle cloud server, so that the vehicle cloud server decrypts the first encrypted value according to the first random number, the second random number, the third random number, and the target encryption algorithm; if a second hash value obtained by decryption is equal to a third hash value, it is represented that the encryption request is passed; the third hash value is historical data stored in the vehicle cloud server.

Images