A vehicle controller identity authentication method, system, device and equipment

Abstract

The application provides a vehicle controller identity authentication method, system, device and equipment, comprising: a first controller starts an identity authentication process with a second controller, and obtains a first number of times of identity authentication with the second controller. When the first number of times meets a key update condition, the first controller sends a key update request to the second controller. The second controller sends a second identifier to the first controller. The first controller generates a first key based on the first identifier and the second identifier. The first controller encrypts the second identifier based on the first key to obtain ciphertext. The first controller sends the ciphertext and the first identifier to the second controller. The second controller generates a second key based on the first identifier and the second identifier, decrypts the ciphertext based on the second key, matches the decrypted plaintext with the second identifier to obtain a check result, and sends the check result to the first controller. When the check result is passed, the first controller performs identity authentication with the second controller based on the first key.

Description

Technical Field

[0001] This application relates to the field of vehicle information security technology, specifically to an identity authentication method, system, device, and equipment for a vehicle controller. Background Technology

[0002] To meet car anti-theft requirements, the engine typically needs to be authenticated between the powertrain controller and the steering, transmission, or braking system controller before it can be started. Only after successful authentication can the engine be started normally.

[0003] Common authentication methods rely on keys between two controllers for authentication, and the way these keys are stored significantly impacts the security and reliability of this authentication process. During development, OEMs distribute keys to controller suppliers, who then embed them into the controllers. However, this process involves many personnel, making keys easily susceptible to leakage. Furthermore, currently, controller keys for the same vehicle model are fixed. Once the key of one controller is obtained, the authentication process for all controllers of the same model can be compromised, resulting in low security for the controller authentication process. Summary of the Invention

[0004] In view of this, this application aims to provide a method, system, apparatus and device for identity authentication of vehicle controllers, so as to improve the security of identity authentication of vehicle controllers.

[0005] In a first aspect, this application provides an authentication method for a vehicle controller, the method being applied to a first controller of a vehicle, the method comprising:

[0006] In response to initiating the authentication process with the second controller, the first number of authentication attempts with the second type controller is obtained, and the second type controller has the same message address as the second controller.

[0007] When the first number of attempts meets the key update condition, a key update request is sent to the second controller;

[0008] Receive the second identifier of the second controller sent by the second controller;

[0009] A first key is generated based on the first identifier and the second identifier of the first controller;

[0010] The second identifier is encrypted using the first key to obtain ciphertext;

[0011] Send the ciphertext and the first identifier to the second controller;

[0012] In response to the process of the second controller decrypting the ciphertext based on the second key and matching the decrypted plaintext with the second identifier, the system receives the verification result returned by the second controller, wherein the second key is generated by the second controller based on the first identifier and the second identifier;

[0013] When the verification result is successful, the first controller performs identity authentication with the second controller based on the first key.

[0014] In one possible implementation, the key update condition includes: the first number of times is 0 or a preset number of times is reached.

[0015] In one possible implementation, when the first number of times reaches the preset number of times, the method further includes:

[0016] Update the first count to 1.

[0017] In one possible implementation, receiving the second identifier of the second controller sent by the second controller includes:

[0018] Receive the second random seed and the second identifier sent by the second controller;

[0019] The generation of the first key based on the first identifier and the second identifier of the first controller includes:

[0020] Generate the first random seed;

[0021] The first key is generated based on the first identifier, the second identifier, the first random seed, and the second random seed;

[0022] The encryption of the second identifier based on the first key to obtain ciphertext includes:

[0023] The second identifier and the second random seed are encrypted using the first key to obtain the ciphertext;

[0024] Sending the ciphertext and the first identifier to the second controller includes:

[0025] The ciphertext, the first identifier, and the first random seed are sent to the second controller.

[0026] In one possible implementation, the first controller initially stores a first initial key, and the method further includes:

[0027] If the first number of attempts does not meet the key update condition, an authentication request is sent to the second controller;

[0028] In response to the second controller acquiring a second number of authentication attempts with the first type controller and the second number of attempts not satisfying the key update condition, the second controller performs authentication with the first initial key, wherein the first type controller and the first controller have the same message address.

[0029] In one possible implementation, the first controller authenticates with the second controller based on the first key, including:

[0030] Receive a random seed sent by the second controller;

[0031] The random seed is encrypted using the first key to obtain the first ciphertext;

[0032] Send the first ciphertext to the second controller;

[0033] In response to the process of the second controller decrypting the first ciphertext based on the second key and matching the decrypted first plaintext with the random seed, the system receives the authentication result returned by the second controller.

[0034] When the identity authentication result is successful, the first count is incremented by 1.

[0035] In one possible implementation, the method further includes:

[0036] In response to the first controller receiving a key update instruction, the system executes a request to send a key update to the second controller and subsequent steps.

[0037] Secondly, this application provides an identity authentication system for a vehicle controller, the system comprising a first controller and a second controller for the vehicle;

[0038] The first controller is used to initiate an authentication process with the second controller and obtain the first number of authentication attempts with the second controller, wherein the second controller and the second controller have the same message address.

[0039] The first controller is further configured to send a key update request to the second controller when it determines that the first number of times satisfies the key update condition;

[0040] The second controller is configured to send a second identifier of the second controller to the first controller;

[0041] The first controller is further configured to generate a first key based on a first identifier and a second identifier of the first controller; encrypt the second identifier based on the first key to obtain ciphertext; and send the ciphertext and the first identifier to the second controller.

[0042] The second controller is further configured to generate a second key based on the first identifier and the second identifier; decrypt the ciphertext based on the second key to obtain decrypted plaintext; match the decrypted plaintext with the second identifier to obtain a verification result; send the verification result to the first controller; and store the second key when the verification result is successful.

[0043] The first controller is further configured to perform identity authentication with the second controller based on the first key when the verification result is successful.

[0044] Thirdly, this application provides an identity authentication device for a vehicle controller, the device comprising:

[0045] The acquisition module is used to acquire the first number of authentication attempts with the second controller in response to the initiation of the authentication process with the second controller, wherein the second controller and the second controller have the same message address.

[0046] The first sending module is used to send a key update request to the second controller when the first number of times meets the key update condition;

[0047] The first receiving module is used to receive the second identifier of the second controller sent by the second controller;

[0048] The key generation module is used to generate a first key based on the first identifier and the second identifier of the first controller;

[0049] An encryption module is used to encrypt the second identifier based on the first key to obtain ciphertext;

[0050] The second sending module is used to send the ciphertext and the first identifier to the second controller;

[0051] The second receiving module is configured to receive a verification result returned by the second controller in response to the process of the second controller decrypting the ciphertext based on the second key and matching the decrypted plaintext with the second identifier, wherein the second key is generated by the second controller based on the first identifier and the second identifier;

[0052] The identity authentication module is used to perform identity authentication with the second controller based on the first key when the verification result is successful.

[0053] Fourthly, this application provides an electronic device, the device comprising: a memory and a processor;

[0054] The memory is used to store the relevant program code;

[0055] The processor is used to call the program code to execute the vehicle controller authentication method described in any of the implementations of the first aspect above.

[0056] Fifthly, this application provides a computer-readable storage medium for storing a computer program for executing the vehicle controller authentication method described in any implementation of the first aspect.

[0057] Sixthly, this application provides a computer program product, which includes a computer program / instruction, and when the computer program / instruction is executed by a processor, it implements the vehicle controller authentication method described in any of the implementations of the first aspect above.

[0058] In the above implementation of this application, after the first controller initiates the authentication process with the second controller, the first controller can obtain the first number of authentication attempts with the second controller recorded internally. The second controller and the second controller share the same message address. That is, if the second controller is replaced with another controller belonging to the second type of controller, the first number of authentication attempts recorded internally by that other controller will continue to accumulate after authentication. When the first controller determines that the first count meets the key update condition, it sends a key update request to the second controller. Upon receiving the key update request, the second controller sends its second identifier to the first controller. The first controller generates a first key based on the first and second identifiers. Then, it encrypts the second identifier using the first key to obtain ciphertext. It sends the ciphertext and the first identifier to the second controller. The second controller generates a second key based on the first and second identifiers, decrypts the ciphertext using the second key, and matches the decrypted plaintext with the second identifier to obtain a verification result. The second controller returns the verification result to the first controller. When the verification result is successful, the first controller authenticates with the second controller using the first key. In other words, the first controller has an updated first key, and the second controller has an updated second key. The first controller and the second controller perform authentication based on the updated keys. Using the method provided in this application, when the number of authentication attempts between the first controller and the second controller meets the key update condition, the keys of the first controller and the second controller can be updated. The key update process does not involve external personnel, and the updated key is different from the initial keys of other controllers. Authentication based on the updated key can improve the security of the authentication process. Attached Figure Description

[0059] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments provided in this application. For those skilled in the art, other drawings can be obtained based on these drawings.

[0060] Figure 1 A flowchart illustrating a vehicle controller authentication method provided in this application embodiment.

[0061] Figure 2 A flowchart of another vehicle controller authentication method provided in an embodiment of this application.

[0062] Figure 3 This is a schematic diagram of an identity authentication system for a vehicle controller provided in an embodiment of this application.

[0063] Figure 4A flowchart of another vehicle controller authentication method provided in this application embodiment.

[0064] Figure 5 This is a schematic diagram of an identity authentication device for a vehicle controller provided in an embodiment of this application.

[0065] Figure 6 This is a schematic diagram of an electronic device provided in an embodiment of this application. Detailed Implementation

[0066] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. The described embodiments are merely exemplary implementations of this application and not all implementation methods. Those skilled in the art can obtain other embodiments in conjunction with the embodiments of this application without creative effort, and these embodiments are also within the protection scope of this application.

[0067] To meet vehicle anti-theft requirements, authentication is typically required between the powertrain controller and the steering, transmission, or braking system controllers. The engine can only be started after successful authentication. For critical controllers in the vehicle, to prevent unauthorized replacement, there is also an authentication process between that controller and other controllers.

[0068] Common authentication methods rely on keys between two controllers for authentication, and the way these keys are stored significantly impacts the security and reliability of this authentication process. During development, OEMs distribute keys to controller suppliers, who then embed them into the controllers. However, this process involves many personnel, making keys easily susceptible to leakage. Furthermore, currently, controller keys for the same vehicle model are fixed. Once the key of one controller is obtained, the authentication process for all controllers of the same model can be compromised, resulting in low security for the controller authentication process.

[0069] Based on this, this application provides a vehicle controller authentication method to improve the security of controller authentication. Specifically, when the first controller initiates the authentication process with the second controller, the first controller can obtain the first number of authentication attempts with the second type of controller recorded internally. The second type of controller and the second controller share the same message address. That is, if the second controller is replaced with another controller belonging to the second type of controller, the first number of authentication attempts recorded internally by the other controller will continue to accumulate after authentication. When the first controller determines that the first count meets the key update condition, it sends a key update request to the second controller. Upon receiving the key update request, the second controller sends its second identifier to the first controller. The first controller generates a first key based on the first and second identifiers. Then, it encrypts the second identifier using the first key to obtain ciphertext. It sends the ciphertext and the first identifier to the second controller. The second controller generates a second key based on the first and second identifiers, decrypts the ciphertext using the second key, and matches the decrypted plaintext with the second identifier to obtain a verification result. The second controller returns the verification result to the first controller. When the verification result is successful, the first controller performs identity authentication with the second controller based on the first key. That is, the first controller has an updated first key, and the second controller has an updated second key; the first and second controllers perform identity authentication based on the updated keys. Through the method provided in this application embodiment, when the number of authentication attempts between the first and second controllers meets the key update condition, the keys of the first and second controllers can be updated. The key update process does not involve external personnel, and each updated key is different from the original key. Authentication based on the updated key can improve the security of the identity authentication process.

[0070] To facilitate understanding of the technical solutions provided in the embodiments of this application, a detailed description will be given below in conjunction with the accompanying drawings.

[0071] See Figure 1 The diagram shown is a flowchart of an identity authentication method for a vehicle controller provided in an embodiment of this application.

[0072] In this embodiment, identity authentication between the first controller and the second controller of a vehicle is taken as an example. This method can be executed by the first controller and mainly includes the following steps:

[0073] S101: In response to the first controller initiating the authentication process with the second controller, obtain the first number of authentication attempts with the second controller.

[0074] For example, the first controller can be a powertrain controller used to control the engine. The second controller can be a controller for a steering lock system, transmission lock system, or brake lock system, and can be configured by the OEM. To meet vehicle anti-theft requirements, the engine can only be started after authentication between the first and second controllers. When the first controller is powered on, it can initiate the authentication process with the second controller. The first controller retrieves the first number of authentication attempts with the second controller recorded internally.

[0075] In this context, the second type of controller refers to a controller with the same message address as the first controller. For example, when controllers communicate by sending messages via the CAN bus, controllers of the same type share the same message address. That is, when the second controller is the first controller of the same type to authenticate with the first controller, the initial count starts from 0. Each time the first controller and the second controller successfully authenticate, the initial count is incremented by 1. Optionally, when the second controller replaces another controller belonging to the second type that previously authenticated with the first controller (i.e., the second controller is a newly replaced controller), and the total number of authentication attempts between the other controller and the first controller is the initial count, the number of authentication attempts between the second controller and the first controller after the second controller replaces the other controller does not start from 0 but continues to accumulate based on the initial count. Therefore, the first controller internally records the first number of authentication attempts with the second type of controller.

[0076] S102: When the key update condition is met for the first time, a key update request is sent to the second controller.

[0077] After obtaining the first data, the first controller determines whether the first data meets the key update conditions. If the first data meets the key update conditions, the first controller can initiate the key update process and send a key update request to the second controller. If the first data does not meet the key update conditions, the specific process is described in subsequent embodiments and will not be elaborated here.

[0078] In one possible implementation, the key update conditions include: the first count being 0 or the first count reaching a preset number of times. When the first count is 0, it indicates that the first controller may be a newly replaced controller. To prevent the initial key stored in the first controller from being leaked, the key update process of the first controller can be initiated to generate a new key, which is then used for authentication. When the first count reaches the preset number of times, it indicates that the authentication between the first controller and the second controller has been performed many times. To prevent the first controller's key from being leaked and still being used, a new key for the first controller can be generated, and the new key is used for authentication, thereby improving the security of the authentication between the first controller and the second controller.

[0079] S103: Receive the second identifier of the second controller sent by the second controller.

[0080] After receiving a key update request from the first controller, the second controller sends its second identifier to the first controller. Each controller has a unique identifier. For example, this second identifier could be the second controller's serial number.

[0081] S104: Generate a first key based on the first identifier and the second identifier of the first controller.

[0082] After receiving the second identifier from the second controller, the first controller can generate a first key based on the first and second identifiers of the first controller. For example, a key derivation algorithm can be used to generate the first key.

[0083] S105: Encrypt the second identifier based on the first key to obtain the ciphertext.

[0084] For example, the first controller can use a first key to encrypt the second identifier based on a symmetric encryption algorithm to obtain the encrypted ciphertext.

[0085] S106: Send the ciphertext and the first identifier to the second controller.

[0086] After the first controller encrypts the second identifier to obtain ciphertext, it sends the ciphertext and the first identifier of the first controller to the second controller.

[0087] S107: In response to the process of the second controller decrypting the ciphertext based on the second key and matching the decrypted plaintext with the second identifier, receive the verification result returned by the second controller.

[0088] After receiving the ciphertext and the first identifier, the second controller can generate a second key based on the first and second identifiers. It then uses the second key to decrypt the ciphertext, obtaining the decrypted plaintext. Since the ciphertext is obtained by encrypting the second identifier, the verification result between the first and second controllers can be determined by matching the decrypted plaintext with the second identifier. When the decrypted plaintext matches the second identifier, the verification result is successful, meaning the key update between the first and second controllers is complete. When the decrypted plaintext does not match the second identifier, the verification result is unsuccessful, meaning the key update between the first and second controllers is not complete.

[0089] The second controller sends the verification result to the first controller, and the first controller determines whether to complete the key update after receiving the verification result.

[0090] In one possible implementation, according to this embodiment, the first controller can encrypt the second identifier based on a symmetric encryption algorithm and a first key, facilitating key update verification between the first and second controllers. Based on this, the key derivation algorithm used by the second controller to generate the second key is the same as the key derivation algorithm used by the first controller to generate the first key, meaning the resulting second key is identical to the first key. Therefore, the ciphertext can be decrypted using the second key based on a decryption algorithm corresponding to the symmetric encryption algorithm.

[0091] S108: When the verification result is successful, the first controller performs identity authentication with the second controller based on the first key.

[0092] When the verification result is successful, the key update between the first controller and the second controller is completed. At this point, the first controller can store the newly generated first key, and the second controller can store the newly generated second key. Since the newly generated key cannot be accessed by external personnel, and the key is generated based on the unique identifier of the two mutually authenticated controllers, unlike the keys of other controllers, the first and second controllers can subsequently perform identity authentication based on the new key, which can improve the security and reliability of identity authentication. The specific identity authentication process can be found in subsequent embodiments.

[0093] In one possible implementation, after the initial count reaches a preset number, the first controller initiates a key update process to generate a first key. At this point, the first controller can update the initial count to 1 and restart the counting. This allows the key update process to be restarted during subsequent authentication when the initial count again meets the key update condition.

[0094] In one possible implementation, step S103, "receiving the second identifier of the second controller sent by the second controller," can also be achieved in the following way:

[0095] To ensure that the keys generated during each key update process between the first and second controllers are different, when the second controller receives a key update request from the first controller, it can generate a second random seed and send the second random seed and the second identifier to the first controller. The first controller receives the second random seed and the second identifier from the second controller. The second random seed is randomly generated.

[0096] To generate a new key (the first key), the first controller can also generate a first random seed, and then generate the first key based on the first identifier, the second identifier, the first random seed, and the second random seed. Optionally, the first key can be generated using a Hash Message Authentication Code-Based Key Derivation Function (HKDF). For example, the first and second identifiers can be used as unique context information, and the first and second random seeds can be used as random vectors. The unique context information and the random vectors can be concatenated, pruned, and shifted to generate a key material of fixed length (determined according to the key derivation algorithm). The HKDF algorithm is then used to calculate the key material to generate the first key.

[0097] Since the first and second random seeds are generated randomly, and the random seeds generated in each key update process are different, it can be guaranteed that the new key generated in each key update process is different, thereby improving the security of identity authentication after the key update.

[0098] After generating the first key, the first controller can encrypt the received second identifier and second random seed to obtain the encrypted ciphertext. For example, a symmetric encryption algorithm can be used to encrypt the second identifier and second random seed. The ciphertext, the first identifier, and the generated first random seed are then sent to the second controller, which generates a new key for authentication.

[0099] After receiving the ciphertext, the first identifier, and the first random seed, the second controller can generate a second key based on the first identifier, the second identifier, the first random seed, and the second random seed. Optionally, when the first and second controllers authenticate each other using a symmetric encryption algorithm, the second controller uses the same key derivation algorithm as the first controller, and the generated second key is also the same as the first key. The second controller uses the second key to decrypt the ciphertext, obtaining the decrypted plaintext. Since the ciphertext is obtained by encrypting the second identifier and the second random seed, the decrypted plaintext can be matched with the second identifier and the second random seed. When the decrypted plaintext matches the second identifier and the second random seed, the verification result is successful, meaning the key update between the first and second controllers is complete.

[0100] In one possible implementation, during the normal operation of the first controller, a key update instruction can be sent to the first controller based on actual needs. Upon receiving the key update instruction, the first controller initiates a key update process, which involves sending a key update request to the second controller and executing subsequent steps to generate a first key and perform the key update process with the second controller. For example, this key update instruction can be forwarded to the first controller by a telematics box (Tbox).

[0101] The above embodiments describe a key update process initiated by the first controller when the first count meets the key update conditions. In one possible implementation, if the first count does not meet the key update conditions, the first controller continues the authentication process and sends an authentication request to the second controller. After receiving the authentication request from the first controller, the second controller can obtain the second number of authentication attempts with the first controller and determine whether the second count meets the key update conditions. The first controller and the second controller share the same message address.

[0102] When the key update condition is met for the second time, the second controller initiates the key update process. That is, the second controller sends a key update request to the first controller and executes the key update steps that were originally executed by the first controller in the above embodiments. After the second controller sends the key update request, the first controller executes the key update steps that were originally executed by the second controller in the above embodiments. The specific implementation process can be found in the above embodiments and will not be repeated here.

[0103] In one possible implementation, when neither the first nor the second count satisfies the key update condition, neither the first nor the second controller needs to update the key. The first controller stores a first initial key, and the second controller stores a second initial key. The first initial key can be the key used when the first controller was manufactured, or it can be a previously updated key. In this case, the first and second controllers continue the authentication process based on the first and second initial keys.

[0104] As described in the above embodiments, after the key update is completed between the first controller and the second controller, the first controller stores the first key, and the second controller stores the second key. The first controller and the second controller perform authentication based on the first key and the second key. When neither the first count nor the second count meets the key update condition, the first controller and the second controller do not need to update the keys, and they perform authentication based on the first initial key and the second initial key. It should be noted that the two authentication processes described above are based on the same principle. The following description uses the authentication process performed by the first controller and the second controller based on the first key and the second key as an example.

[0105] For details, please refer to Figure 2 The diagram shown is a flowchart of another vehicle controller authentication method provided in an embodiment of this application.

[0106] This method mainly includes the following steps A1-A6:

[0107] A1: In response to receiving an authentication request from the first controller, the second controller generates a random seed and sends the random seed to the first controller.

[0108] A2: The first controller encrypts the random seed based on the first key to obtain the first ciphertext, and sends the first ciphertext to the second controller;

[0109] A3: The second controller decrypts the first ciphertext based on the second key to obtain the decrypted first plaintext;

[0110] The first controller and the second controller can use a symmetric encryption algorithm for identity authentication.

[0111] A4: The second controller matches the first plaintext with the random seed to obtain the authentication result, and then sends the authentication result to the first controller;

[0112] Specifically, when the first plaintext matches the random seed, the first controller and the second controller successfully authenticate each other, meaning the authentication result is successful. When the first plaintext does not match the random seed, the first controller and the second controller fail to authenticate each other, meaning the authentication result is unsuccessful.

[0113] A5: When the identity authentication result is successful, the second controller will increment the second number by 1;

[0114] A6: When the identity authentication result is successful, the first controller will increment the first number by 1.

[0115] When the identity authentication result is unsuccessful, the first and second counts remain unchanged.

[0116] The process of identity authentication by the first controller and the second controller based on the first initial key and the second initial key can be referred to in the above embodiments, and will not be repeated here.

[0117] It should be noted that the above-described identity authentication process is one implementation method provided by the embodiments of this application. Other implementable key-based identity authentication methods are also within the protection scope of this application. For example, identity authentication can also be performed by combining hash algorithms and symmetric encryption algorithms. The hash algorithm is used to calculate the initial value, and the random seed is encrypted based on the initial value, the key, and the symmetric encryption algorithm.

[0118] Based on the above method embodiments, this application also provides an identity authentication system for a vehicle controller. See also... Figure 3 The diagram shown is a schematic of an identity authentication system for a vehicle controller provided in an embodiment of this application.

[0119] The system 300 may include a first controller 301 and a second controller 302 for the vehicle. The first controller 301 and the second controller 302 perform identity authentication.

[0120] For details on the identity authentication process, please refer to [link / reference]. Figure 4 , Figure 4 A flowchart of another vehicle controller authentication method provided in this application embodiment.

[0121] The method may include the following steps B1-B10:

[0122] B1: The first controller initiates the authentication process with the second controller and obtains the first number of authentication attempts with the second controller.

[0123] Among them, the second type of controller has the same message address as the second controller.

[0124] B2: The first controller determines whether the first count meets the key update conditions. If the key update conditions are met, it sends a key update request to the second controller.

[0125] B3: The second controller sends its second identifier to the first controller;

[0126] B4: The first controller generates a first key based on the first identifier and the second identifier of the first controller;

[0127] B5: The first controller encrypts the second identifier based on the first key to obtain ciphertext, and sends the ciphertext and the first identifier to the second controller;

[0128] B6: The second controller generates a second key based on the first identifier and the second identifier;

[0129] B7: The second controller decrypts the ciphertext based on the second key to obtain the decrypted plaintext;

[0130] B8: The second controller matches the decrypted plaintext with the second identifier to obtain the verification result, and sends the verification result to the first controller;

[0131] B9: When the verification result is successful, the second controller stores the second key;

[0132] B10: When the verification result is successful, the first controller stores the first key and performs identity authentication with the second controller based on the first key.

[0133] The specific implementation process of the first controller and the second controller can be found in the above method embodiments, and will not be described in detail here.

[0134] Based on the above method embodiments, this application also provides an identity authentication device for a vehicle controller. See details... Figure 5 The diagram shown is a schematic of an identity authentication device for a vehicle controller provided in an embodiment of this application.

[0135] The device 500 includes:

[0136] The acquisition module 501 is used to acquire the first number of times the identity authentication process with the second controller is initiated in response to the start of the identity authentication process with the second controller. The second controller has the same message address as the second controller.

[0137] The first sending module 502 is used to send a key update request to the second controller when the first number of times meets the key update condition;

[0138] The first receiving module 503 is used to receive the second identifier of the second controller sent by the second controller;

[0139] Key generation module 504 is used to generate a first key based on the first identifier and the second identifier of the first controller;

[0140] The encryption module 505 is used to encrypt the second identifier based on the first key to obtain ciphertext;

[0141] The second sending module 506 is used to send the ciphertext and the first identifier to the second controller;

[0142] The second receiving module 507 is configured to receive a verification result returned by the second controller in response to the process of the second controller decrypting the ciphertext based on the second key and matching the decrypted plaintext with the second identifier, wherein the second key is generated by the second controller based on the first identifier and the second identifier;

[0143] The identity authentication module 508 is used to perform identity authentication between the first controller and the second controller based on the first key when the verification result is passed.

[0144] In one possible implementation, the key update condition includes: the first number of times is 0 or a preset number of times is reached.

[0145] In one possible implementation, the device further includes an update module, configured to update the first count to 1 when the first count reaches the preset count.

[0146] In one possible implementation, the first receiving module 503 is specifically used to receive the second random seed and the second identifier sent by the second controller;

[0147] The key generation module 504 is specifically used to generate a first random seed; and to generate the first key based on the first identifier, the second identifier, the first random seed, and the second random seed.

[0148] The encryption module 505 is specifically used to encrypt the second identifier and the second random seed based on the first key to obtain the ciphertext;

[0149] The second sending module 506 is specifically used to send the ciphertext, the first identifier, and the first random seed to the second controller.

[0150] In one possible implementation, the first controller initially stores a first initial key, and the first sending module 502 is further configured to send an authentication request to the second controller when the first number of attempts does not meet the key update condition.

[0151] The identity authentication module 508 is further configured to, in response to the second controller obtaining a second number of identity authentication attempts with the first type controller and the second number of attempts not satisfying the key update condition, authenticate with the second controller based on the first initial key, wherein the first type controller and the first controller have the same message address.

[0152] In one possible implementation, the first receiving module 503 is further configured to receive a random seed sent by the second controller;

[0153] The encryption module 505 is further configured to encrypt the random seed based on the first key to obtain the first ciphertext;

[0154] The second sending module 506 is further configured to send the first ciphertext to the second controller;

[0155] The second receiving module 507 is further configured to receive the authentication result returned by the second controller in response to the process of the second controller decrypting the first ciphertext based on the second key and matching the decrypted first plaintext with the random seed;

[0156] The update module is further configured to increment the first count by 1 when the identity authentication result is successful.

[0157] In one possible implementation, the apparatus is further configured to: in response to the first controller receiving a key update instruction, execute a request to send a key update to the second controller and subsequent steps.

[0158] Based on the above method and device embodiments, this application also provides an electronic device. The following description will be provided in conjunction with the accompanying drawings.

[0159] See Figure 6 , Figure 6 This is a schematic diagram of an electronic device provided in an embodiment of this application.

[0160] The device 600 includes: a memory 601 and a processor 602;

[0161] The memory 601 is used to store relevant program code;

[0162] The processor 602 is used to call the program code and execute the vehicle controller authentication method described in the above method embodiment.

[0163] Furthermore, embodiments of this application also provide a computer-readable storage medium for storing a computer program for executing the vehicle controller authentication method described in the above method embodiments.

[0164] This application also provides a computer program product, which includes a computer program / instruction. When the computer program / instruction is executed by a processor, it implements the vehicle controller authentication method described in the above method embodiments.

[0165] It should be noted that the computer-readable medium described above in this application may be a computer-readable signal medium or a computer-readable storage medium, or any combination thereof. A computer-readable storage medium may be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof.

[0166] The computer program product can be written in any combination of one or more programming languages ​​to perform the operations of the embodiments of this application. The programming languages ​​include object-oriented programming languages ​​such as Java and C++, as well as conventional procedural programming languages ​​such as C or similar languages. The program code can be executed entirely on the user's computing device, partially on the user's computing device, as a standalone software package, partially on the user's computing device and partially on a remote computing device, or entirely on a remote computing device or server.

[0167] It should be noted that the various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. In particular, for system or device embodiments, since they are basically similar to method embodiments, the description is relatively simple, and relevant parts can be referred to the descriptions in the method embodiments. The device embodiments described above are merely illustrative. The units or modules described as separate components may or may not be physically separate. The components shown as units or modules may or may not be physical modules; that is, they may be located in one place or distributed across multiple network units. Some or all of the units or modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without creative effort.

[0168] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functions, and operations that may be implemented by methods, apparatuses, and devices according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0169] It should be understood that in this application, "at least one (item)" means one or more, and "more than" means two or more. "And / or" is used to describe the relationship between related objects, indicating that three relationships can exist. For example, "A and / or B" can represent three cases: only A exists, only B exists, and both A and B exist simultaneously, where A and B can be singular or plural. The character " / " generally indicates that the preceding and following related objects are in an "or" relationship. "At least one (item) of the following" or similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one (item) of a, b, or c can represent: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, and c can be single or multiple.

[0170] It should also be noted that, in this application, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0171] The steps of the methods or algorithms described in conjunction with the embodiments disclosed in this application can be implemented directly by hardware, a software module executed by a processor, or a combination of both. The software module can be located in random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other form of storage medium known in the art.

[0172] The above description of the disclosed embodiments enables those skilled in the art to make or use this application. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of this application. Therefore, this application is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A vehicle controller authentication method, characterized in that, The method is applied to a first controller of a vehicle, and the method includes: In response to initiating the authentication process with the second controller, the first number of authentication attempts with the second type controller is obtained, and the second type controller has the same message address as the second controller. When the first number of attempts meets the key update condition, a key update request is sent to the second controller; Receive the second identifier of the second controller sent by the second controller; A first key is generated based on the first identifier and the second identifier of the first controller; The second identifier is encrypted using the first key to obtain ciphertext; Send the ciphertext and the first identifier to the second controller; In response to the process of the second controller decrypting the ciphertext based on the second key and matching the decrypted plaintext with the second identifier, the system receives the verification result returned by the second controller, wherein the second key is generated by the second controller based on the first identifier and the second identifier; When the verification result is successful, the first controller performs identity authentication with the second controller based on the first key.

2. The method according to claim 1, characterized in that, The key update conditions include: the first number of times is 0 or the preset number of times is reached.

3. The method according to claim 2, characterized in that, When the first number of times reaches the preset number of times, the method further includes: Update the first count to 1.

4. The method according to claim 1, characterized in that, The receipt of the second identifier of the second controller sent by the second controller includes: Receive the second random seed and the second identifier sent by the second controller; The generation of the first key based on the first identifier and the second identifier of the first controller includes: Generate the first random seed; The first key is generated based on the first identifier, the second identifier, the first random seed, and the second random seed; The encryption of the second identifier based on the first key to obtain ciphertext includes: The second identifier and the second random seed are encrypted using the first key to obtain the ciphertext; Sending the ciphertext and the first identifier to the second controller includes: The ciphertext, the first identifier, and the first random seed are sent to the second controller.

5. The method according to claim 1, characterized in that, The first controller initially stores a first initial key, and the method further includes: If the first number of attempts does not meet the key update condition, an authentication request is sent to the second controller; In response to the second controller acquiring a second number of authentication attempts with the first type controller and the second number of attempts not satisfying the key update condition, the second controller performs authentication with the first initial key, wherein the first type controller and the first controller have the same message address.

6. The method according to claim 1, characterized in that, The first controller performs identity authentication with the second controller based on the first key, including: Receive a random seed sent by the second controller; The random seed is encrypted using the first key to obtain the first ciphertext; Send the first ciphertext to the second controller; In response to the process of the second controller decrypting the first ciphertext based on the second key and matching the decrypted first plaintext with the random seed, the system receives the authentication result returned by the second controller. When the identity authentication result is successful, the first count is incremented by 1.

7. The method according to any one of claims 1 to 6, characterized in that, The method further includes: In response to the first controller receiving a key update instruction, the system executes a request to send a key update to the second controller and subsequent steps.

8. An identity authentication system for a vehicle controller, characterized in that, The system includes a first controller and a second controller for the vehicle; The first controller is used to initiate an authentication process with the second controller and obtain the first number of authentication attempts with the second controller, wherein the second controller and the second controller have the same message address. The first controller is further configured to send a key update request to the second controller when it determines that the first number of times satisfies the key update condition; The second controller is configured to send a second identifier of the second controller to the first controller; The first controller is further configured to generate a first key based on the first identifier and the second identifier of the first controller; The second identifier is encrypted using the first key to obtain ciphertext; the ciphertext and the first identifier are then sent to the second controller. The second controller is further configured to generate a second key based on the first identifier and the second identifier; The ciphertext is decrypted using the second key to obtain the decrypted plaintext; the decrypted plaintext is then matched with the second identifier to obtain a verification result. The verification result is sent to the first controller; when the verification result is successful, the second key is stored. The first controller is further configured to perform identity authentication with the second controller based on the first key when the verification result is successful.

9. An authentication device for a vehicle controller, characterized in that, The device is applied to a first controller of a vehicle, and the device includes: The acquisition module is used to acquire the first number of authentication attempts with the second controller in response to the initiation of the authentication process with the second controller, wherein the second controller and the second controller have the same message address. The first sending module is used to send a key update request to the second controller when the first number of times meets the key update condition; The first receiving module is used to receive the second identifier of the second controller sent by the second controller; The key generation module is used to generate a first key based on the first identifier and the second identifier of the first controller; An encryption module is used to encrypt the second identifier based on the first key to obtain ciphertext; The second sending module is used to send the ciphertext and the first identifier to the second controller; The second receiving module is configured to receive a verification result returned by the second controller in response to the process of the second controller decrypting the ciphertext based on the second key and matching the decrypted plaintext with the second identifier, wherein the second key is generated by the second controller based on the first identifier and the second identifier; The identity authentication module is used to perform identity authentication with the second controller based on the first key when the verification result is successful.

10. An electronic device, characterized in that, The device includes: a memory and a processor; The memory is used to store the relevant program code; The processor is used to call the program code to execute the vehicle controller authentication method according to any one of claims 1 to 7.

Images