Data transmission method, system and medium

Abstract

The invention discloses a data transmission method and system and a medium, and belongs to the technical field of communication, and the method comprises the steps: initiating an authentication request to a cloud through a request message; the cloud checks the legality of the vehicle platform equipment identifier; generating a session key through a random number generator of the cloud side in response to verification validity of the vehicle side platform equipment identifier; the cloud side generates an exchange message through encryption of the session key, and sends the exchange message to the vehicle side; the vehicle end decrypts the exchange message and performs identity verification on the cloud end according to a decryption result; in response to successful cloud identity verification, the vehicle end generates a response message through the decrypted session key, and sends the response message to the cloud; and in response to successful verification of the identity of the vehicle end, performing encrypted two-way transmission of service data between the vehicle cloud ends through the session key. According to the application, through a mode of combining pre-shared key verification with the session key, dual assurance of identity authentication authenticity and data transmission confidentiality is realized.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of communication, in particular to a data transmission method, system and medium. BACKGROUND

[0002] At present, the communication between the vehicle and the cloud generally adopts the TLS protocol to realize transmission encryption and identity authentication. The protocol system is mature, has high standardization degree, has perfect ecological support, and can meet the data encryption and identity verification requirements in general scenarios. However, the encryption algorithm and certificate system relied on by the related TLS (Transport Layer Security) protocol are mainly based on international general algorithm system (such as RSA, ECC, AES, SHA, etc.), which is different from the commercial cryptographic algorithm system, and cannot be directly used in the vehicle networking and vehicle-end secure communication scenarios with high password compliance requirements.

[0003] In order to meet the compliance requirements of commercial cryptographic algorithms, the industry proposes a TLCP protocol (Transport Layer Cryptographic Protocol) based on the transformation of national cryptographic algorithms. The protocol replaces the core algorithm with SM2, SM3, SM4 and other commercial cryptographic algorithms on the basis of following the TLS framework structure, and introduces a certificate system conforming to the standard of commercial cryptographic algorithms, so as to realize the encryption protection and bidirectional identity authentication of the vehicle-cloud communication link, and ensure that the communication process meets the standard requirements.

[0004] However, there are still many practical problems in the engineering landing of this scheme. On the one hand, the TLCP protocol has greatly transformed the TLS communication stack in the implementation, which needs to re-adapt the algorithm library, certificate system and handshake process, resulting in poor compatibility with existing systems, high development and debugging costs; on the other hand, the application, issuance, update and revocation of the commercial cryptographic certificate system are relatively complex, and it is difficult to realize efficient operation and maintenance in a large-scale vehicle-end device environment. In addition, the TLCP protocol involves multiple SM2 public key operations and certificate chain verification in the handshake and algorithm negotiation stage, so the calculation amount and communication delay are significantly increased, which is not conducive to the real-time communication and rapid connection requirements of the vehicle-end power-limited devices. SUMMARY

[0005] In order to overcome the above technical defects, the purpose of the present application is to provide a data transmission method, system and medium, the method comprising: the vehicle end creates a request message and initiates an authentication request to the cloud end through the request message, and the request message comprises a vehicle platform device identifier; the cloud end verifies the legality of the vehicle platform device identifier; in response to the vehicle platform device identifier being verified as legal, the cloud end generates a session key through a random number generator of the cloud end; the cloud end generates an exchange message by encrypting the session key and sends the exchange message to the vehicle end; the vehicle end decrypts the exchange message and verifies the identity of the cloud end according to the decryption result; in response to the identity of the cloud end being verified successfully, the vehicle end generates a response message through the decrypted session key and sends the response message to the cloud end; the cloud end verifies the identity of the vehicle end according to the response message; in response to the identity of the vehicle end being verified successfully, the cloud end obtains the session key verified successfully by the vehicle and the cloud, and performs encrypted bidirectional transmission of business data between the vehicle and the cloud through the session key verified successfully by the vehicle and the cloud. The present application realizes double protection of the authenticity of identity authentication and the confidentiality of data transmission by combining pre-shared key verification with a session key.

[0006] The specific technical solutions provided by the embodiments of the present application are as follows: In a first aspect, the present application provides a data transmission method, which is applied to a data transmission system comprising a vehicle end and a cloud end, and the method comprises: The vehicle end creates a request message and initiates an authentication request to the cloud end through the request message, and the request message comprises a vehicle platform device identifier. The cloud end verifies the legality of the vehicle platform device identifier. In response to the vehicle platform device identifier being verified as legal, the cloud end generates a session key through a random number generator of the cloud end. The cloud end generates an exchange message by encrypting the session key and sends the exchange message to the vehicle end. The vehicle end decrypts the exchange message and verifies the identity of the cloud end according to the decryption result. In response to the identity of the cloud end being verified successfully, the vehicle end generates a response message through the decrypted session key and sends the response message to the cloud end. The cloud end verifies the identity of the vehicle end according to the response message. In response to the identity of the vehicle end being verified successfully, the cloud end obtains the session key verified successfully by the vehicle and the cloud, and performs encrypted bidirectional transmission of business data between the vehicle and the cloud through the session key verified successfully by the vehicle and the cloud.

[0007] In a second aspect, the present application further provides a data transmission system comprising a vehicle end and a cloud end, The vehicle end is configured to create a request message and initiate an authentication request to the cloud end through the request message, and the request message includes a vehicle platform device identifier; The cloud end is configured to verify the legality of the vehicle platform device identifier; In response to the verification of the legality of the vehicle platform device identifier, the cloud end is configured to generate a session key through a random number generator of the cloud end; The cloud end is configured to generate an exchange message through encryption of the session key and send the exchange message to the vehicle end; The vehicle end is configured to decrypt the exchange message and perform identity verification on the cloud end according to the decryption result; In response to the successful identity verification on the cloud end, the vehicle end is configured to generate a response message through the decrypted session key and send the response message to the cloud end; The cloud end is configured to perform identity verification on the vehicle end according to the response message; In response to the successful identity verification on the vehicle end, the cloud end is configured to obtain the session key for the successful identity verification between the vehicle and the cloud, and perform bidirectional transmission of business data through encryption of the session key for the successful identity verification between the vehicle and the cloud.

[0008] The third aspect further provides a data transmission device, comprising: one or more processors; a storage device configured to store one or more programs; When the one or more programs are executed by the one or more processors, the one or more processors implement the data transmission method according to any one of the first aspect.

[0009] The fourth aspect further provides a computer device, comprising: a memory, a processor, and a computer program stored in the memory, wherein the processor executes the computer program to implement the steps of the data transmission method according to any one of the first aspect.

[0010] The fifth aspect further provides a computer program product, comprising a computer program which, when executed by a processor, implements the steps of the data transmission method according to any one of the first aspect.

[0011] The sixth aspect further provides a computer storage medium, comprising: a computer program stored thereon, which, when executed by a processor, implements the steps of the data transmission method according to any one of the first aspect.

[0012] Compared with the prior art, the technical scheme provided by the embodiment of the application comprises: the vehicle end creates a request message and initiates an authentication request to the cloud end through the request message, the request message comprising a vehicle platform device identifier; the cloud end verifies the legality of the vehicle platform device identifier; in response to the vehicle platform device identifier being verified as legal, the cloud end generates a session key through a random number generator of the cloud end; the cloud end generates an exchange message by encrypting through the session key and sends the exchange message to the vehicle end; the vehicle end decrypts the exchange message and performs identity verification on the cloud end according to the decryption result; in response to the identity verification on the cloud end being successful, the vehicle end generates a response message through the decrypted session key and sends the response message to the cloud end; the cloud end performs identity verification on the vehicle end according to the response message; and in response to the identity verification on the vehicle end being successful, the cloud end obtains the session key for the identity verification of the vehicle and cloud ends and performs bidirectional transmission of business data between the vehicle and cloud ends through the session key for the identity verification of the vehicle and cloud ends. The application realizes double protection of identity authentication authenticity and data transmission confidentiality through a combination of pre-shared key verification and a session key.

[0013] The technical scheme provided by the embodiment of the application can significantly reduce implementation complexity and system transformation cost; the scheme does not need to replace a TLS protocol stack or adapt a commercial cryptographic certificate system, and only needs to implement data encryption and identity verification through a lightweight application layer module, thereby avoiding the complex process of TLS in handshake, algorithm negotiation and certificate management and facilitating rapid integration and deployment in a vehicle end embedded environment.

[0014] The technical scheme provided by the embodiment of the application can improve communication performance and real-time performance; the scheme reuses the secure handshake mechanism of TLS, omits the multiple rounds of commercial cryptographic handshake and certificate verification process, significantly reduces delay and calculation overhead, and uses SM4-CBC mode for symmetric encryption, thereby having the advantages of fast operation speed and low resource occupation and being able to stably operate on a vehicle end device with limited resources.

[0015] The technical scheme provided by the embodiment of the application can enhance communication security and data integrity protection capability; through a combination of pre-shared key verification and a dynamically generated session key, identity authenticity and data confidentiality are double-protected; SM3 hash verification and SM4-CMAC message authentication mechanisms are introduced, so that the transmission data is ensured not to be tampered with and middleman attacks and replay attacks are prevented.

[0016] The technical scheme provided by the embodiment of the application has good compatibility and landing feasibility; the scheme is fully compatible with existing TLS secure channels and application layer communication logic, does not need to rely on proprietary hardware or reconstruct a communication protocol stack, can be smoothly integrated in an existing vehicle networking architecture, and facilitates rapid application in a multi-vehicle type and multi-platform environment. BRIEF DESCRIPTION OF DRAWINGS

[0017] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings needed to be used in the embodiment description will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without any creative effort on the basis of these drawings.

[0018] Figure 1 The first flowchart of the data transmission method provided by the embodiments of the present application; Figure 2 The second flowchart of the data transmission method provided by the embodiments of the present application; Figure 3 The third flowchart of the data transmission method provided by the embodiments of the present application; Figure 4 The fourth flowchart of the data transmission method provided by the embodiments of the present application; Figure 5 The exemplary system provided by the embodiments of the present application can be used to implement various embodiments described in the present application. DETAILED DESCRIPTION

[0019] In order to make the purposes, technical solutions and advantages of the present application clearer, the technical solutions in the embodiments of the present application will be described clearly and completely in combination with the drawings in the embodiments of the present application. Obviously, the described embodiments are only some of the embodiments of the present application, not all. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without any creative effort are within the scope of protection of the present application.

[0020] It should be noted that, unless the context clearly requires otherwise, throughout the description and the claims, "comprise", "comprising", and like terms are to be construed as inclusive or open-ended terms (i.e., the terms "comprising", "comprise", "comprises" when used in this specification and claims shall not be interpreted as closed or limiting, or as meaning instead only "consisting of"). That is, the term "comprising" should not be interpreted as being closed or limiting, or as meaning instead only "consisting of".

[0021] In addition, in the description of the present application, "multiple" means two or more, unless otherwise specified.

[0022] The technical defects of the related TLCP and TLS protocols are: Complex implementation and poor compatibility: the existing TLCP protocol needs to deeply modify the original TLS communication stack in the landing process, and introduce commercial cipher algorithm modules and national secret certificate system; this not only requires the underlying communication library to be recompiled and adapted, but also needs to adjust the calling logic at the application layer, which has high overall development cost, long maintenance period, and poor compatibility with the existing international standard TLS implementation.

[0023] Long handshake time and large amount of calculation: The commercial cryptographic algorithm needs to perform multiple SM2 asymmetric encryption, decryption and signature verification operations in the handshake phase, which has high computational complexity, resulting in a significant increase in handshake latency; for vehicle-end embedded devices with limited computing power, it will cause the communication response delay to rise, affecting the stability of real-time control and remote instruction execution.

[0024] Complicated certificate management and high operation and maintenance cost: The TLCP protocol relies on the commercial cryptographic certificate system, and needs to complete the whole life cycle management of certificate application, issuance, update, revocation and verification; due to the large number of vehicles and wide distribution, it is difficult to manage and maintain the certificates regularly, increasing the system deployment and later operation and maintenance cost.

[0025] The causes of the technical defects of TLCP and TLS protocols: Structural differences lead to complex adaptation: The TLCP protocol replaces and modifies the structure of the TLS protocol stack at the bottom level in design, including algorithm interface, handshake process and session management modules, which need to be re-implemented, making it difficult to directly reuse the existing TLS library, and additional development and testing work is needed.

[0026] Algorithm characteristics cause performance bottlenecks: Commercial cryptographic algorithms (such as SM2, SM3, SM4) involve multiple public key operations and certificate chain verification in the handshake and certificate verification process, which has large computational overhead, especially on embedded platforms that lack hardware acceleration, which will significantly increase the processor CPU load and communication delay.

[0027] In general, although the TLCP protocol supports the commercial cryptographic algorithm system in design and has good compliance, due to the many bottom-level modifications to the existing TLS communication stack, the development and integration cost is high. At the same time, the high computational complexity of commercial cryptographic algorithms in the handshake and verification phase makes the vehicle-end embedded device face performance bottlenecks when establishing a connection. In addition, the management and maintenance process of commercial cryptographic certificates is relatively complicated, which further increases the deployment and operation and maintenance burden of the system, so these problems jointly limit the large-scale landing and popularization of the TLCP protocol in the Internet of Vehicles scenario.

[0028] Embodiment one The embodiment of the application provides a data transmission method, as shown in the figure, the method is applied to a data transmission system, the system includes a vehicle end and a cloud end, and the method comprises the following steps: Figure 1 The vehicle end creates a request message and initiates an authentication request to the cloud end through the request message, and the request message includes a vehicle platform device identifier. The cloud end verifies the legality of the vehicle platform device identifier. ​In response to the vehicle terminal platform device identification verification being legal, a session key is generated by a random number generator in the cloud; The cloud encrypts the exchange message by using the session key, and sends the exchange message to the vehicle terminal; The vehicle terminal decrypts the exchange message, and performs identity verification on the cloud according to the decryption result; In response to the identity verification on the cloud being successful, the vehicle terminal generates a response message by using the decrypted session key, and sends the response message to the cloud; The cloud performs identity verification on the vehicle terminal according to the response message; In response to the identity verification on the vehicle terminal being successful, the session key for the identity verification on the vehicle terminal and the cloud is obtained, and the encrypted bidirectional transmission of business data between the vehicle terminal and the cloud is performed by using the session key for the identity verification on the vehicle terminal and the cloud.

[0029] Specifically, the technical scheme of the present application aims to establish a lightweight and controllable vehicle-cloud communication mechanism on the basis of the TLS channel, meet the relevant compliance requirements, ensure that the vehicle terminal components can verify the identity of the cloud, and securely obtain the session key for business data encryption.

[0030] The technical scheme provided by the embodiment of the present application has the following beneficial effects: The technical scheme provided by the embodiment of the present application can significantly reduce the implementation complexity and system modification cost; the present scheme does not need to replace the TLS protocol stack or adapt the commercial cryptographic certificate system, and only needs to implement data encryption and identity verification through a lightweight application layer module, thereby avoiding the complex process of the TLS CP in the handshake, algorithm negotiation and certificate management, and facilitating the rapid integration and deployment in the embedded environment of the vehicle terminal.

[0031] The technical scheme provided by the embodiment of the present application can improve the communication performance and real-time performance; the scheme reuses the secure handshake mechanism of the TLS, omits the multiple rounds of commercial cryptographic handshake and certificate verification process, significantly reduces the delay and calculation overhead, and uses the SM4-CBC mode for symmetric encryption, which has the advantages of fast operation speed and low resource occupation, and can stably operate on the vehicle terminal device with limited resources.

[0032] The technical scheme provided by the embodiment of the present application can enhance the communication security and data integrity protection capability; the identity authenticity and data confidentiality are double-protected by combining the pre-shared key verification with the dynamically generated session key; the SM3 hash verification and the SM4-CMAC message authentication mechanism are introduced, so as to ensure that the transmission data is not tampered with, and to prevent man-in-the-middle attacks and replay attacks.

[0033] Embodiment two The embodiment of the present application provides a data transmission method, which comprises the following steps: Figure 2As shown, the method is applied to a data transmission system, the system including a vehicle end and a cloud end, and the method includes: Step S01, setting a communication message format; The setting of the communication message format includes: Setting the communication message format, the message format including a message version number, a message type, a message payload length, and a corresponding message payload. The message type includes one or more of a request message (AuthInit), an exchange message (KeyExchange), a response message (AuthAck), a secure message (SecureData), and an error message (Error).

[0034] Specifically, to ensure that the vehicle and the cloud can uniformly analyze the message information in the communication process, the present scheme defines the communication message format; as shown in Table 1 below: all messages start with a uniform message header, including a version number (Version), a message type (MsgType), a payload length (PayloadLen), and a corresponding payload (PayLoad). As shown in Table 2 below: the message type can be distinguished as: AuthInit, KeyExchange, AuthAck, SecureData, Error, and a total of five types.

[0035] Among them, the AuthInit message is used to initiate an authentication request, carrying a vehicle unique identifier PDID (17 bytes) and a NonceV random number information; the KeyExchange message is generated by the cloud and includes an encrypted SM4 session key, cloud Nonce, and other information; the AuthAck message is used to confirm the authentication status; the SecureData message is used to carry encrypted business data; and the Error message is used to transmit error status, wherein the corresponding error code and error message are included in the related payload.

[0036] Table 1

[0037] Table 2

[0038] Step S02, the vehicle end creates a request message and initiates an authentication request to the cloud end through the request message, the request message including a vehicle platform device identifier. The cloud end verifies the legality of the vehicle platform device identifier. In response to the vehicle platform device identifier being verified as legal, a session key is generated by a random number generator of the cloud end.

[0039] Specifically, in the private protocol, the same pre-shared key is preset between the vehicle and the cloud, and the identity authenticity of both parties is verified by verifying the pre-shared key. In the subsequent business message transmission process, the cloud directly issues an SM4 session key, and the vehicle part obtains the corresponding SM4 session key and stores it in the cryptographic module of the vehicle part.

[0040] Both parties perform SM4-CBC encryption via the session key to realize the confidentiality of the business messages of both parties. After receiving the authentication request, the cloud verifies the legality of the identifier PDID and the state of the vehicle and the part, confirms that the part has legal access authority, generates a new session key SessionKey, and if the identifier PDID is not in the list, the cloud sends an error message Error. The key is generated by the random number generator of the cloud, and the cloud controls the expiration time of SeesionKey, with a default period of the first threshold (12 hours). After expiration, the cloud sends an Error message, and the session key needs to be reissued.

[0041] Here, a dynamically generated session key is selected instead of directly encrypting business data using a pre-shared key, mainly because it is more secure: even if the pre-shared key PSK is leaked, the historical session data is still safe.

[0042] Among them, SM4-CBC algorithm encryption refers to a way of encrypting data using the national commercial cipher standard SM4 block cipher algorithm in the CBC (Cipher Block Chaining, Cipher Block Chaining) working mode.

[0043] The creation request message includes: Obtain the vehicle platform device identifier and the vehicle part random number information; Splice the vehicle platform device identifier and the vehicle part random number information to obtain the request message.

[0044] Specifically, the vehicle part sends an AuthInit message to the cloud to initiate an authentication request, and the AuthInit message carries the vehicle unique identifier PDID and the vehicle part randomly generated information NonceV, which is used to prevent replay attacks.

[0045] Here, the vehicle identifier PDID is selected instead of VIN or other identifiers because the vehicle identifier PDID can be used as a unique identifier; a random number is selected instead of a fixed value to ensure that the ciphertext generated each time the authentication request is different, avoiding attackers from replaying or guessing the key by capturing historical messages.

[0046] Vehicle part → Cloud: AuthInit message (0xA1) The vehicle unique identifier PDID and the vehicle-end component random number NonceV are spliced to obtain a request message.

[0047] Payload = PDID || NonceV In step S03, the cloud end generates an exchange message by encrypting using the session key, and sends the exchange message to the vehicle end.

[0048] In step S031, a pre-shared key is obtained. The session key is bound to the vehicle platform device identifier. The vehicle-end component random number information is used as an initial vector. The session key bound to the vehicle platform device identifier is encrypted in SM4 algorithm ciphertext linking mode by using the pre-shared key and the vehicle-end component random number information, to obtain an encrypted data body. The session key is subjected to SM3 hash operation to obtain a first hash value. The encrypted data body and the first hash value are spliced to obtain an exchange message, and the exchange message is sent to the vehicle end.

[0049] The SM3 hash operation refers to a Cryptographic Hash Function published by the National Institute of Standards and Technology, and belongs to one of the national cryptographic algorithm systems independently designed by China.

[0050] Specifically, after the cloud end generates a session key SessionKey and binds it to the vehicle platform device identifier PDID, the cloud end uses the same pre-shared key (Pre-Shared Key, PSK) as the vehicle-end component to encrypt the session key SessionKey in SM4-CBC algorithm, and uses the vehicle-end component random number NonceV as an initial vector (IV) during encryption.

[0051] Meanwhile, the SM3 hash value of the session key SessionKey is calculated for calculating the integrity, and is spliced with the session key SessionKey encrypted in SM4-CBC algorithm to jointly form a KeyExchange message.

[0052] Here, SM4-CBC algorithm is selected instead of SM4-ECB algorithm or other symmetric algorithms, mainly because the ECB (Electronic Codebook Mode) mode has a plaintext pattern leakage problem, and the CBC (Cipher Block Chaining) mode can use the random number NonceV as the initial vector IV to make each encryption result unique and enhance security.

[0053] Cloud -> Vehicle Part: KeyExchange message (0xA2) The encrypted data body EncKey and the SM3 hash value Hash are spliced; Payload = Hash || EncKey The vehicle part random number NonceV is used as an initial vector IV to perform SM4_CBC algorithm encryption, and the SM3 hash value is spliced; The session key SessionKey is subjected to SM3 hash operation: Hash = SM3(SessionKey); After the cloud generates the session key SessionKey and binds it with the identifier PDID, the cloud uses the same pre-shared key (PSK) as the vehicle part to perform SM4-CBC algorithm encryption on the session key SessionKey, and uses the vehicle part random number NonceV as the initial vector (IV) during encryption: EncKey = SM4_CBC_Encrypt(K_psk, NonceV, SessionKey) The session key SessionKey is directly generated by the cloud through a secure random number generator and is issued.

[0054] Step S04, the vehicle end decrypts the exchange message, and performs identity verification on the cloud according to the decryption result.

[0055] Step S041, obtain the pre-shared key and the vehicle part random number information; The encrypted data body of the exchange message is decrypted by the pre-shared key and the vehicle part random number information in the SM4 algorithm in the ciphertext chaining mode to obtain the decrypted session key; The decrypted session key is subjected to SM3 hash operation to obtain a second hash value; The second hash value is compared with the first hash value; In response to the second hash value being consistent with the first hash value and the pre-shared key and the vehicle part random number information successfully decrypting the encrypted data body of the exchange message in the SM4 algorithm in the ciphertext chaining mode, the identity verification on the cloud is successful, and the identity authentication of the cloud is completed.

[0056] Specifically, the vehicle-end component also pre-stores the same pre-shared key psk, which is securely stored in the cryptographic module of the vehicle-end component. After receiving the exchange message KeyExchange, the vehicle-end component performs SM4-CBC algorithm decryption using the pre-shared key. If a valid session key SessionKey can be correctly recovered and the SM3 hash value is consistent, it indicates that the cloud-end identity is trusted, and the implicit authentication of the cloud end is completed. If the verification fails, the vehicle-end component sends an Error message (error message) to the server.

[0057] The same pre-shared key is used to perform SM4-CBC algorithm decryption on EncKey to obtain SeesionKey: SessionKey = SM4_CBC_Decrypt(K_psk, NonceV, EncKey) ; The decrypted session key SeesionKey is subjected to SM3 hash operation: Hash = SM3(SessionKey).

[0058] Step S05, in response to the successful verification of the cloud-end identity, the vehicle-end generates a response message through the decrypted session key, and sends the response message to the cloud end. The cloud end verifies the identity of the vehicle-end according to the response message.

[0059] Step S051, the vehicle-end concatenates the vehicle platform device identifier with the vehicle-end component random number information to obtain first identification concatenation data; Obtain the decrypted session key; The first identification concatenation data is subjected to SM4 algorithm encryption through the decrypted session key to obtain a first message authentication code; The first message authentication code is concatenated with the vehicle platform device identifier to obtain a response message, and the response message is sent to the cloud end. The cloud end verifies the identity of the vehicle-end according to the response message, comprising: The cloud end concatenates the vehicle platform device identifier with the vehicle-end component random number information to obtain second identification concatenation data; The second identification concatenation data is subjected to SM4 algorithm encryption through the decrypted session key to obtain a second message authentication code; The second message authentication code is compared with the first message authentication code in the response message. In response to the consistency of the second message authentication code and the first message authentication code, the identity of the vehicle-end is verified successfully.

[0060] Specifically, after the cloud identity verification succeeds, the vehicle-end component sends an AuthAck message to the cloud: Vehicle-end component -> Cloud: AuthAck (0xA3); The first message authentication code CMAC is generated by using the decrypted session key to calculate the data after splicing the identification PDID and the random number NonceV: CMAC = SM4_CMAC(SessionKey, PDID || NonceV); The vehicle device identification PDID and the message authentication code CMAC are spliced: Payload = PDID || CMAC, to obtain the response message AuthAck.

[0061] The cloud calculates the CMAC value sent by the vehicle-end component through the same steps, and if the verification is passed, the parties can use the negotiated SM4 session key for subsequent SM4-CBC encryption communication. If the calculation is incorrect, the cloud sends an Error message to the vehicle end. The cloud verifies the vehicle end in detail as follows: The cloud calculates the same CMAC value as the vehicle end: CMAC = SM4_CMAC(SessionKey, PDID || NonceV); The calculated CMAC value of the cloud and the CMAC value sent by the vehicle-end component are compared. If they are consistent, the transmission of business data is performed. If they are not consistent, an error message Error is sent.

[0062] It can be understood that the vehicle-end component will securely store the session key SessionKey by the vehicle-end component password module under the premise of not receiving the Error message, which is only used for this communication session. The session key SessionKey will be used by the vehicle and the cloud for subsequent communication.

[0063] Here, the error message Error is: if the identity verification in the above session key establishment process fails, or the key transmission expires, the key is leaked, etc., the vehicle-end component number or the cloud can send the Error message.

[0064] Vehicle-end component Cloud (0xFF); Payload = ErrorCode || ErrorMessage; The above ErrorCode is defined by the specific error condition, and the ErrorMessage is the description of the specific error condition, wherein the content is a specific error description information string.

[0065] Through the above mechanism, the vehicle and the cloud realize lightweight identity verification and key distribution process on the TLS channel, and provide security guarantee for subsequent encrypted transmission of business data.

[0066] Step S06, in response to the successful identity verification of the vehicle, the session key of the successful identity verification of the vehicle and the cloud is obtained, and the encrypted bidirectional transmission of business data is performed between the vehicle and the cloud through the session key of the successful identity verification of the vehicle and the cloud.

[0067] Step S061, the vehicle obtains the business data and the session key of the successful identity verification of the vehicle and the cloud. The vehicle part random number information is used as an initialization vector. The business data is encrypted by SM4 algorithm in cipher text linking mode through the session key of the successful identity verification of the vehicle and the cloud and the initialization vector, and encrypted business data is obtained. The vehicle platform device identifier, the initialization vector and the encrypted business data are spliced to obtain a secure message, and the secure message is sent to the cloud.

[0068] Specifically, after completing identity verification and session key distribution, the vehicle and the cloud enter the encrypted communication stage, all business data is symmetrically encrypted and transmitted by SM4-CBC algorithm through the session key SessionKey generated by negotiation, and the initialization vector IV is attached in the spliced file Payload in each transmission process to ensure the confidentiality of communication.

[0069] Before the vehicle part sends the business request data (such as remote control, sensitive personal information transmission, software upgrade and the like), the password module interface is called, the business data is encrypted by SM4-CBC algorithm using the current effective session key SessionKey, then the vehicle part encapsulates the secure message SecureData, assembles the above message header, assembles the corresponding secure message in combination with the identifier PDID and the corresponding initialization vector IV, and ensures that the cloud can identify the corresponding session information.

[0070] Vehicle end Cloud (secure message 0x10); The device identifier PDID, the initialization vector IV and the encrypted business data EncPayload are spliced: Payload = PDID || IV || EncPayload. EncPayload = SM4_CBC_Encrypt(SessionKey, IV, PlainBytes), the plaintext business data PlainBytes is encrypted in CBC mode using the session key SessionKey and the initialization vector IV.

[0071] Step S062, the cloud acquires the encrypted service data in the security message, and the session key after the vehicle cloud identity verification is successful; The vehicle end component random number information is used as an initialization vector; The encrypted service data is decrypted by using the session key after the vehicle cloud identity verification is successful and the initialization vector in a cipher text linking mode algorithm of SM4 algorithm, to obtain the service data.

[0072] Specifically, after receiving the security message SecureData, the cloud matches the corresponding session key SessionKey through the identifier PDID, extracts the initialization vector IV in the message, and decrypts the service data: The plain text service data PlainBytes is decrypted in an SM4_CBC mode by using the session key and the initialization vector IV extracted from the message: PlainBytes = SM4_CBC_Decrypt(SessionKey, IV, EncPayload).

[0073] During reverse communication, the cloud also uses the session key SessionKey to encrypt the response data and returns the vehicle end component, so as to realize full-duplex secure and compliant communication.

[0074] Step S07, acquiring the session key after the vehicle cloud identity verification is successful; It is judged whether the period time of the session key after the vehicle cloud identity verification is successful is greater than a first threshold (12 hours); In response to the period time of the session key being less than or equal to the first threshold, the encrypted bidirectional transmission of service data is performed between the vehicle cloud by using the session key after the vehicle cloud identity verification is successful; In response to the period time of the session key being greater than the first threshold, the error message is sent to the cloud by the vehicle end.

[0075] Specifically, the cloud controls the expiration time of the session key SeesionKey, and the default period is 12 hours; greater than 12 hours, after expiration, the cloud sends an Error message, and the session key needs to be reissued.

[0076] Here, the dynamically generated session key is selected instead of directly encrypting the service data by using the pre-shared key, and the reason is that the dynamically generated session key is more secure: even if the pre-shared key PSK is leaked, the historical session data is still safe.

[0077] As Figure 3 , Figure 4As shown, the application realizes the compliance requirements of commercial cryptographic algorithms without modifying the communication stack by superimposing the SM4 algorithm encryption mechanism of the application layer on the existing TLS communication framework.

[0078] That is, the technical scheme of the application proposes a lightweight secure channel establishment and data protection mechanism based on a TLS channel. In view of the limited computing power of the vehicle terminal device, the long session period, and the requirement that the algorithm should meet the commercial cryptographic algorithm standard, the scheme designs a layered encryption system combining pre-shared key PSK and session key distribution. The mechanism can realize vehicle cloud identity authentication, dynamic session key distribution, and business data encryption transmission without modifying the existing TLS communication architecture, and takes into account the lightweight and national cryptographic compliance.

[0079] Compared with the related art, the key points of the technical scheme of the application include: 1. Superimpose a lightweight session key negotiation mechanism on the traditional TLS communication architecture to realize a compliant key distribution and authentication process at the application layer, effectively solving the problem that the TLS international algorithm system does not meet the national cryptographic compliance requirements.

[0080] 2. Propose a lightweight authentication and key distribution process composed of “AuthInit—KeyExchange—AuthAck” messages to realize vehicle cloud bidirectional identity authentication and dynamic session key derivation, and ensure the security of the key life cycle and the confidentiality of the communication data.

[0081] 3. Use the random number NonceV as the initial vector and the anti-replay factor, combine SM4-CBC algorithm encryption and SM3 hash verification, realize integrated design of encryption and integrity verification, reduce the computing overhead of the vehicle terminal, and enhance the protection strength.

[0082] The technical scheme of the application introduces layered encryption and lightweight authentication mechanism while maintaining the compatibility of the existing TLS architecture, taking into account the national cryptographic algorithm compliance and the realistic demand of limited resources of the vehicle terminal device, and has high realizability and engineering adaptability, and has certain popularization value in the field of vehicle cloud security communication.

[0083] The method for data transmission provided by the embodiments of the application can also be improved and optimized without departing from the technical scheme of the application, and these improvements and optimizations should also be considered as the protection scope of the application.

[0084] The technical scheme provided by the embodiments of the application has the following beneficial effects: The technical scheme provided by the embodiment of the application can improve communication performance and real-time performance; the scheme reuses the security handshake mechanism of TLS, omits the multi-round commercial password handshake and certificate verification process, significantly reduces delay and calculation overhead, and uses SM4-CBC mode for symmetric encryption, which has the advantages of fast operation speed and low resource occupation, and can stably operate on a resource-limited vehicle terminal device.

[0085] The technical scheme provided by the embodiment of the application can enhance communication security and data integrity protection capability; the combination of pre-shared key verification and dynamically generated session key realizes double protection of identity authenticity and data confidentiality; the introduction of SM3 hash check and SM4-CMAC message authentication mechanism ensures that the transmission data is not tampered with, and prevents man-in-the-middle attacks and replay attacks.

[0086] The technical scheme provided by the embodiment of the application has good compatibility and landing feasibility; the scheme is fully compatible with the existing TLS security channel and application layer communication logic, does not need to rely on special hardware or reconstruct the communication protocol stack, can be smoothly integrated in the existing Internet of Vehicles architecture, and facilitates rapid application in a multi-vehicle type and multi-platform environment.

[0087] Embodiment three The application provides a data transmission system, the system comprising a vehicle terminal and a cloud terminal, The vehicle terminal is configured to create a request message and initiate an authentication request to the cloud terminal through the request message, and the request message comprises a vehicle platform device identifier; The cloud terminal is configured to verify the legality of the vehicle platform device identifier; In response to the verification of the legality of the vehicle platform device identifier, the cloud terminal is configured to generate a session key through a random number generator of the cloud terminal; The cloud terminal is configured to generate an exchange message by encrypting the session key, and send the exchange message to the vehicle terminal; The vehicle terminal is configured to decrypt the exchange message, and perform identity verification on the cloud terminal according to the decryption result; In response to the successful identity verification of the cloud terminal, the vehicle terminal is configured to generate a response message through the decrypted session key, and send the response message to the cloud terminal; The cloud terminal is configured to perform identity verification on the vehicle terminal according to the response message; In response to the successful identity verification of the vehicle terminal, the cloud terminal is configured to obtain the session key for the successful identity verification of the vehicle and the cloud terminal, and perform bidirectional transmission of business data between the vehicle and the cloud terminal through the session key for the successful identity verification of the vehicle and the cloud terminal.

[0088] In the embodiment, the cloud terminal is configured to obtain a pre-shared key; The session key is bound to the vehicle platform device identifier; The vehicle end component random number information is used as an initial vector; The vehicle platform device identification bound session key is encrypted by the SM4 algorithm in a ciphertext link mode through the pre-shared key and the vehicle end component random number information, to obtain an encrypted data body; The session key is subjected to SM3 hash operation, to obtain a first hash value; The encrypted data body and the first hash value are spliced to obtain an exchange message, and the exchange message is sent to the vehicle end.

[0089] In one of the embodiments, the vehicle end is configured to obtain a pre-shared key and vehicle end component random number information; The encrypted data body of the exchange message is decrypted by the SM4 algorithm in a ciphertext link mode through the pre-shared key and the vehicle end component random number information, to obtain a decrypted session key; The decrypted session key is subjected to SM3 hash operation, to obtain a second hash value; The second hash value and the first hash value are compared; In response to the second hash value being consistent with the first hash value and the encrypted data body of the exchange message being successfully decrypted by the SM4 algorithm in a ciphertext link mode through the pre-shared key and the vehicle end component random number information, the cloud end identity verification is successful, and the identity authentication of the cloud end is completed.

[0090] In one of the embodiments, the vehicle end is configured to splice the vehicle platform device identification and the vehicle end component random number information, to obtain first identification splicing data; The decrypted session key is obtained; The first identification splicing data is encrypted by the SM4 algorithm through the decrypted session key, to obtain a first message authentication code; The first message authentication code and the vehicle platform device identification are spliced to obtain a response message, and the response message is sent to the cloud end; The cloud end is configured to splice the vehicle platform device identification and the vehicle end component random number information, to obtain second identification splicing data; The second identification splicing data is encrypted by the SM4 algorithm through the decrypted session key, to obtain a second message authentication code; The second message authentication code and the first message authentication code in the response message are compared; In response to the second message authentication code being consistent with the first message authentication code, the vehicle end identity verification is successful.

[0091] In one of the embodiments, the vehicle end is configured to obtain the service data, and the session key of the successful identity verification between the vehicle and the cloud end; The vehicle end part random number information is used as an initialization vector; The service data is encrypted by using the SM4 algorithm in a cipher text chaining mode through the session key of the successful identity verification between the vehicle and the cloud end and the initialization vector, to obtain encrypted service data; The vehicle platform device identifier, the initialization vector and the encrypted service data are spliced to obtain a secure message, and the secure message is sent to the cloud end.

[0092] In one of the embodiments, the cloud end is configured to obtain the encrypted service data in the secure message and the session key of the successful identity verification between the vehicle and the cloud end; The vehicle end part random number information is used as an initialization vector; The encrypted service data is decrypted by using the SM4 algorithm in a cipher text chaining mode through the session key of the successful identity verification between the vehicle and the cloud end and the initialization vector, to obtain the service data.

[0093] In one of the embodiments, the vehicle end is configured to determine whether the period of the session key of the successful identity verification between the vehicle and the cloud end is greater than a first threshold value; In response to the period of the session key being less than or equal to the first threshold value, the encrypted bidirectional transmission of the service data between the vehicle and the cloud end is performed through the session key of the successful identity verification between the vehicle and the cloud end; In response to the period of the session key being greater than the first threshold value, an error message is sent from the vehicle end to the cloud end.

[0094] The technical scheme provided by the embodiments of the application has the following beneficial effects: The technical scheme provided by the embodiments of the application can significantly reduce the implementation complexity and system transformation cost; the scheme does not need to replace the TLS protocol stack or adapt the commercial cryptographic certificate system, and only a lightweight module in the application layer is needed to realize data encryption and identity verification, thereby avoiding the complex process of the TLS protocol in the handshake, algorithm negotiation and certificate management, and facilitating the rapid integration and deployment in the embedded environment of the vehicle end.

[0095] The technical scheme provided by the embodiments of the application can improve the communication performance and real-time performance; the scheme reuses the secure handshake mechanism of the TLS, omits the multiple rounds of commercial cryptographic handshake and certificate verification process, significantly reduces the delay and calculation overhead, and uses the SM4-CBC mode for symmetric encryption, which has the advantages of fast operation speed and low resource occupation, and can stably operate on the vehicle end device with limited resources.

[0096] The technical scheme provided by the embodiment of the application can enhance communication security and data integrity protection capability; through a combination of pre-shared key verification and a dynamically generated session key, dual protection of identity authenticity and data confidentiality is realized; SM3 hash check and SM4-CMAC message authentication mechanism are introduced to ensure that the transmission data is not tampered with and to prevent man-in-the-middle attacks and replay attacks.

[0097] The technical scheme provided by the embodiment of the application has good compatibility and landing feasibility; the scheme is fully compatible with the existing TLS secure channel and application layer communication logic, does not need to rely on special hardware or reconstruct the communication protocol stack, and can be smoothly integrated in the existing vehicle networking architecture, facilitating rapid application in a multi-vehicle and multi-platform environment.

[0098] Embodiment four The application further provides a data transmission device, comprising: one or more processors; a storage device for storing one or more programs; when the one or more programs are executed by the one or more processors, the one or more processors execute the data transmission method described below: the vehicle end creates a request message and initiates an authentication request to the cloud end through the request message, and the request message comprises a vehicle platform device identifier; the cloud end checks the legality of the vehicle platform device identifier; in response to the vehicle platform device identifier being checked as legal, the cloud end generates a session key through a random number generator of the cloud end; the cloud end encrypts the exchange message through the session key and sends the exchange message to the vehicle end; the vehicle end decrypts the exchange message and performs identity checking on the cloud end according to the decryption result; in response to the identity checking on the cloud end being successful, the vehicle end generates a response message through the decrypted session key and sends the response message to the cloud end; the cloud end performs identity checking on the vehicle end according to the response message; in response to the identity checking on the vehicle end being successful, the session key for the identity checking on the vehicle end being successful is obtained, and the encrypted bidirectional transmission of business data between the vehicle end and the cloud end is performed through the session key for the identity checking on the vehicle end being successful.

[0099] The technical scheme provided by the embodiment of the application has the beneficial effects that: The technical scheme provided by the embodiment of the application can enhance communication security and data integrity protection capability; through the combination of pre-shared key verification and dynamically generated session key, the dual protection of identity authenticity and data confidentiality is realized; the SM3 hash check and SM4-CMAC message authentication mechanism are introduced to ensure that the transmission data is not tampered with, and to prevent man-in-the-middle attacks and replay attacks.

[0100] Embodiment five The application provides a computer device, comprising a memory, a processor and a computer program stored in the memory and executable on the processor, and the processor can execute the following data transmission method when executing the computer program: The vehicle end creates a request message and initiates an authentication request to the cloud end through the request message, and the request message comprises a vehicle platform device identifier; The cloud end checks the legality of the vehicle platform device identifier; In response to the fact that the vehicle platform device identifier is legal, the cloud end generates a session key through a random number generator; The cloud end generates an exchange message by encryption through the session key and sends the exchange message to the vehicle end; The vehicle end decrypts the exchange message and performs identity checking on the cloud end according to the decryption result; In response to the fact that the identity checking on the cloud end is successful, the vehicle end generates a response message through the decrypted session key and sends the response message to the cloud end; The cloud end performs identity checking on the vehicle end according to the response message; In response to the fact that the identity checking on the vehicle end is successful, the session key for the successful identity checking of the vehicle and the cloud end is obtained, and the encrypted bidirectional transmission of business data between the vehicle and the cloud end is performed through the session key for the successful identity checking of the vehicle and the cloud end.

[0101] The technical scheme provided by the embodiment of the application has the following beneficial effects: The technical scheme provided by the embodiment of the application can enhance communication security and data integrity protection capability; through the combination of pre-shared key verification and dynamically generated session key, the dual protection of identity authenticity and data confidentiality is realized; the SM3 hash check and SM4-CMAC message authentication mechanism are introduced to ensure that the transmission data is not tampered with, and to prevent man-in-the-middle attacks and replay attacks.

[0102] Embodiment six The application further provides a computer program product, comprising a computer program, which can realize the following data transmission method when executed by a processor: The vehicle end creates a request message, initiates an authentication request to the cloud end through the request message, and the request message includes a vehicle platform device identifier; The cloud end checks the legality of the vehicle platform device identifier; In response to the vehicle platform device identifier being legal, the cloud end generates a session key through a random number generator of the cloud end; The cloud end generates an exchange message through encryption of the session key, and sends the exchange message to the vehicle end; The vehicle end decrypts the exchange message, and performs identity verification on the cloud end according to a decryption result; In response to the identity verification on the cloud end being successful, the vehicle end generates a response message through the decrypted session key, and sends the response message to the cloud end; The cloud end performs identity verification on the vehicle end according to the response message; In response to the identity verification on the vehicle end being successful, the cloud end obtains the session key for successful identity verification between the vehicle and the cloud, and performs bidirectional transmission of business data between the vehicle and the cloud through the session key for successful identity verification between the vehicle and the cloud.

[0103] The technical scheme provided by the embodiment of the application has the following beneficial effects: The technical scheme provided by the embodiment of the application can enhance the communication security and data integrity protection capability; the combination of pre-shared key verification and dynamically generated session key realizes double protection of identity authenticity and data confidentiality; the introduction of SM3 hash verification and SM4-CMAC message authentication mechanism ensures that the transmission data is not tampered with, and prevents man-in-the-middle attacks and replay attacks.

[0104] Embodiment seven The application provides a computer storage medium, including a memory, a processor, and a computer program stored on the memory and executable on the processor, and the processor implements the following steps when executing the computer program: The vehicle end creates a request message, initiates an authentication request to the cloud end through the request message, and the request message includes a vehicle platform device identifier; The cloud end checks the legality of the vehicle platform device identifier; In response to the vehicle platform device identifier being legal, the cloud end generates a session key through a random number generator of the cloud end; The cloud end generates an exchange message through encryption of the session key, and sends the exchange message to the vehicle end; The vehicle end decrypts the exchange message, and performs identity verification on the cloud end according to a decryption result; In response to the cloud identity verification being successful, the vehicle end generates a response message by using the decrypted session key, and sends the response message to the cloud end; The cloud end performs identity verification on the vehicle end according to the response message; In response to the vehicle end identity verification being successful, a session key for vehicle-cloud end identity verification is obtained, and the encrypted bidirectional transmission of service data is performed between the vehicle end and the cloud end by using the session key for vehicle-cloud end identity verification.

[0105] In one of the embodiments, before the authentication request is initiated to the cloud end by using the request message, the following steps are included: The format of the communication message is set; The format of the communication message is set, and includes: The format of the communication message is set, and includes: The message type includes one or more of the request message, the exchange message, the response message, the security message and the error message; The request message is created, and includes: The vehicle platform device identifier and the vehicle end component random number information are obtained; The vehicle platform device identifier and the vehicle end component random number information are spliced to obtain the request message.

[0106] In one of the embodiments, the exchange message is generated by using the session key, and the exchange message is sent to the vehicle end, and includes: The pre-shared key is obtained; The session key is bound to the vehicle platform device identifier; The vehicle end component random number information is used as an initial vector; The session key bound to the vehicle platform device identifier is encrypted by using the SM4 algorithm in the ciphertext link mode according to the pre-shared key and the vehicle end component random number information, to obtain an encrypted data body; The session key is subjected to SM3 hash operation to obtain a first hash value; The encrypted data body and the first hash value are spliced to obtain the exchange message, and the exchange message is sent to the vehicle end.

[0107] In one of the embodiments, the vehicle end decrypts the exchange message, and performs identity verification on the cloud end according to the decryption result, and includes: The pre-shared key and the vehicle end component random number information are obtained; The vehicle-end component random number information decrypts, through the pre-shared key, encrypted data of the exchange message in a cipher text chaining mode of an SM4 algorithm to obtain a decrypted session key; The decrypted session key is subjected to an SM3 hash operation to obtain a second hash value; The second hash value is compared with the first hash value; In response to the second hash value being consistent with the first hash value and the vehicle-end component random number information successfully decrypting, through the pre-shared key, the encrypted data of the exchange message in the cipher text chaining mode of the SM4 algorithm, the cloud-end identity verification is successful, and the identity authentication of the cloud end is completed.

[0108] In one of the embodiments, the vehicle end generates a response message through the decrypted session key and sends the response message to the cloud end, including: The vehicle end splices the vehicle platform device identifier and the vehicle-end component random number information to obtain first identification splicing data; The decrypted session key is obtained; The first identification splicing data is subjected to SM4 algorithm encryption through the decrypted session key to obtain a first message authentication code; The first message authentication code is spliced with the vehicle platform device identifier to obtain a response message, and the response message is sent to the cloud end; The cloud end performs identity verification on the vehicle end according to the response message, including: The cloud end splices the vehicle platform device identifier and the vehicle-end component random number information to obtain second identification splicing data; The second identification splicing data is subjected to SM4 algorithm encryption through the decrypted session key to obtain a second message authentication code; The second message authentication code is compared with the first message authentication code in the response message; In response to the second message authentication code being consistent with the first message authentication code, the identity verification of the vehicle end is successful.

[0109] In one of the embodiments, the session key successfully verified by the vehicle-cloud end identity is used for bidirectional transmission of encrypted business data between the vehicle and the cloud end, including: The vehicle end obtains business data and the session key successfully verified by the vehicle-cloud end identity; The vehicle-end component random number information is used as an initialization vector; The business data is subjected to cipher text chaining mode algorithm encryption of the SM4 algorithm through the session key successfully verified by the vehicle-cloud end identity and the initialization vector to obtain encrypted business data; Splice the vehicle platform device identity, the initialization vector and the encrypted service data to obtain a secure message, and send the secure message to the cloud.

[0110] In one of the embodiments, the encrypted bidirectional transmission of the service data between the vehicle and the cloud through the session key verified successfully by the vehicle and the cloud further includes: The cloud obtains the encrypted service data in the secure message and the session key verified successfully by the vehicle and the cloud; The vehicle-end component random number information is used as the initialization vector; The encrypted service data is decrypted by the SM4 algorithm in the ciphertext linkage mode through the session key verified successfully by the vehicle and the cloud and the initialization vector, to obtain the service data.

[0111] In one of the embodiments, the method further includes: Judging whether the period of the session key verified successfully by the vehicle and the cloud is greater than a first threshold value; In response to the period of the session key being less than or equal to the first threshold value, the encrypted bidirectional transmission of the service data between the vehicle and the cloud through the session key verified successfully by the vehicle and the cloud; In response to the period of the session key being greater than the first threshold value, the vehicle sends an error message to the cloud.

[0112] The technical scheme provided by the embodiments of the application can enhance the communication security and the data integrity protection capability; the combination of the pre-shared key verification and the dynamically generated session key realizes the dual protection of the identity authenticity and the data confidentiality; the introduction of the SM3 hash check and the SM4-CMAC message authentication mechanism ensures that the transmission data is not tampered with, and prevents the man-in-the-middle attack and the replay attack.

[0113] Figure 5 The exemplary system provided by the seventh embodiment of the application can be used to implement various embodiments described in the application. As Figure 5 shown, in some embodiments, the system can be used as the above-mentioned device for data transmission in any of the embodiments. In some embodiments, the system can include one or more computer-readable media (for example, system memory or NVM / storage device) having results and one or more processors (for example, processor(s)) coupled with the one or more computer-readable media and configured to execute the results to implement modules to perform the actions described in the application.

[0114] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a non-volatile computer readable storage medium, and when the computer program is executed, the processes of the above-mentioned embodiments of the methods can be included. Any reference to memory, storage, databases, or other media in this application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. As an illustration but not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDR SDRAM), enhanced SDRAM (ESDRAM), Synchlink DRAM (SLDRAM), Rambus direct RAM (RDRAM), direct RAMbus dynamic RAM (DRDRAM), and Rambus dynamic RAM (RDRAM), etc.

[0115] The technical features of the above embodiments can be combined in any way. In order to make the description simple, all possible combinations of the technical features in the above embodiments are not described, but as long as the combination of the technical features does not exist, it should be considered as the scope of the present application.

[0116] The above embodiments only express several implementation manners of the present application, and the description is more specific and detailed, but it should not be understood as a limitation on the scope of the patent. It should be pointed out that for ordinary skilled in the art, without departing from the concept of the present application, some modifications and improvements can be made, which are all within the scope of the present application. Therefore, the scope of the patent protection of the present application should be subject to the appended claims.

Claims

1. A data transmission method, characterized by, The method comprises: The vehicle end creates a request message and initiates an authentication request to the cloud end through the request message, wherein the request message comprises a vehicle platform device identifier; The cloud end verifies the legality of the vehicle platform device identifier; In response to the verification of the legality of the vehicle platform device identifier, a session key is generated by a random number generator of the cloud end; The cloud end encrypts an exchange message through the session key and sends the exchange message to the vehicle end; The vehicle end decrypts the exchange message and verifies the identity of the cloud end according to the decryption result; In response to the successful verification of the identity of the cloud end, the vehicle end generates a response message through the decrypted session key and sends the response message to the cloud end; The cloud end verifies the identity of the vehicle end according to the response message; In response to the successful verification of the identity of the vehicle end, the session key for the successful verification of the identity of the vehicle and the cloud end is obtained, and the encrypted bidirectional transmission of business data between the vehicle and the cloud end is performed through the session key.

2. The data transmission method of claim 1, wherein, Before the authentication request to the cloud end through the request message, the following steps are included: The format of the communication message is set; The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including:

3. The data transmission method of claim 1, wherein, The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including:

4. The data transmission method of claim 3, wherein, The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication message is set, including: The format of the communication 5. The data transmission method of claim 4, wherein, The vehicle-mounted device generates a response message using the decrypted session key and sends the response message to the cloud, including: The vehicle end concatenates the vehicle platform equipment identifier with the random number information of the vehicle end components to obtain the first identifier concatenation data body; Obtain the decrypted session key; The first identifier concatenation data body is encrypted using the SM4 algorithm with the decrypted session key to obtain the first message authentication code. The first message authentication code is concatenated with the vehicle platform device identifier to obtain a response message, which is then sent to the cloud. The cloud platform verifies the vehicle's identity based on the response message, including: The cloud concatenates the vehicle platform device identifier with the random number information of the vehicle-end components to obtain a second identifier concatenation data body; The second identifier concatenated data body is encrypted using the SM4 algorithm with the decrypted session key to obtain the second message authentication code. Compare the second message authentication code with the first message authentication code in the response message; If the second message authentication code matches the first message authentication code, then the vehicle-side identity verification is successful.

6. The data transmission method of claim 1, wherein, The session key, which has been successfully verified through the vehicle-to-cloud identity verification, is used for encrypted bidirectional transmission of business data between the vehicle and the cloud, including: The vehicle-side obtains business data, and the cloud-side obtains the session key for successful identity verification. Use the random number information of the vehicle-end components as the initialization vector; The business data is encrypted using the SM4 algorithm's ciphertext link mode algorithm based on the session key and initialization vector that were successfully verified by the vehicle cloud identity verification, resulting in encrypted business data. The vehicle platform device identifier, initialization vector, and encrypted business data are concatenated to obtain a security message, which is then sent to the cloud.

7. The data transmission method of claim 6, wherein, The session key, which has been successfully verified through the vehicle-to-cloud identity verification, is used for encrypted bidirectional transmission of business data between the vehicle and cloud platforms, and further includes: The cloud obtains the encrypted business data from the security message, and the session key that the vehicle's identity verification with the cloud is successful. Use the random number information of the vehicle-end components as the initialization vector; The encrypted business data is decrypted using the SM4 algorithm's ciphertext linking mode algorithm, based on the session key and initialization vector used in the successful identity verification of the vehicle-to-cloud platform.

8. The data transmission method of claim 1, wherein, The method further includes: Determine whether the period of the session key for successful vehicle-to-cloud identity verification is greater than the first threshold; If the session key period is less than or equal to a first threshold, the session key that has been successfully verified by the vehicle-to-cloud identity will be used for encrypted bidirectional transmission of business data between the vehicle and the cloud. If the session key period exceeds a first threshold, an error message is sent from the vehicle to the cloud.

9. A data transmission system, characterized by The system includes vehicle-side and cloud-side components. The vehicle terminal is used to create a request message and initiate an authentication request to the cloud through the request message. The request message includes the vehicle platform device identifier. The cloud platform is used to verify the legality of the vehicle platform device identifier; If the vehicle-side platform device identifier verification is valid, a session key is generated through a random number generator in the cloud. The cloud is used to encrypt and generate exchange messages using the session key, and then send the exchange messages to the vehicle. The vehicle terminal is used to decrypt the exchanged messages and perform identity verification on the cloud based on the decryption result; In response to successful verification of the identity in the cloud, the vehicle terminal generates a response message using the decrypted session key and sends the response message to the cloud. The cloud platform is used to verify the identity of the vehicle based on the response message. In response to the successful verification of the vehicle-side identity, the session key for successful verification of the vehicle-cloud identity is obtained, and the encrypted bidirectional transmission of business data between the vehicle and the cloud is performed using the session key for successful verification of the vehicle-cloud identity.

10. A computer-readable storage medium having stored thereon a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the data transmission method according to any one of claims 1 to 8.

Images