Method for accessing an on-board diagnostic interface and storage medium

Abstract

Embodiments of the present application provide an access method of an on-board diagnostic interface and a storage medium. The method comprises: authenticating a host computer to verify whether the host computer currently has access authority according to a validity period of a security code, and sending a dynamic random code to a gateway controller and triggering a security authentication process when the host computer has the access authority; the host computer acquires a first security code sent by the gateway controller, the first security code being generated by the gateway controller through an encryption operation according to the dynamic random code; the host computer generates a second security code through the same encryption operation according to the dynamic random code, and compares the first security code with the second security code; when the comparison is consistent, the host computer sends an opening instruction to the gateway controller, so that the gateway controller opens a communication connection between the gateway controller and a vehicle network. The method is used to improve the accuracy of access authority verification, shorten the invalid exposure time of the diagnostic interface, and enhance the effect of preventing and controlling unauthorized access, copying and using out of range.

Description

Technical Field

[0001] This application relates to the field of information security, and in particular to a method for accessing an on-board diagnostic interface and a storage medium thereof. Background Technology

[0002] On-board diagnostic interfaces are typically used as external access channels for vehicle debugging, fault diagnosis, and software upgrades. Existing solutions often use interface access combined with on-board network-side authentication control to achieve access management.

[0003] However, existing solutions mainly focus on network authentication after external access, and do not impose sufficient constraints on the use of debugging device software, which can easily lead to unauthorized copying and use. Furthermore, the duration of access after authentication is not effectively controlled, which increases the exposure time of the interface and further affects the security and control accuracy of vehicle network access.

[0004] The urgent issue is how to improve the security and timeliness of access control while ensuring the normal use of the vehicle diagnostic interface, so as to reduce the risk of unauthorized access. Summary of the Invention

[0005] This application provides an access method and storage medium for an on-board diagnostic interface, which can improve the accuracy of access permission verification, shorten the time when the diagnostic interface is exposed to invalidity, and enhance the ability to prevent unauthorized access, copying and reuse, and use beyond the scope.

[0006] In a first aspect, embodiments of this application provide a method for accessing an on-board diagnostic interface, including:

[0007] The authentication host computer verifies whether it has access rights based on the validity period of the security code. When it has access rights, it sends a dynamic random code to the gateway controller and triggers the security authentication process.

[0008] The authentication host computer obtains the first security code sent by the gateway controller. The first security code is generated by the gateway controller through encryption operation based on the dynamic random code.

[0009] The authentication host computer generates a second security code based on the dynamic random code through the same encryption operation, and compares the first security code with the second security code;

[0010] When the comparison is successful, the authentication host computer sends an enable command to the gateway controller, so that the gateway controller can open the communication connection with the vehicle network.

[0011] In one possible embodiment, the authentication host computer verifies whether it currently has access rights based on the validity period of the security code, including:

[0012] The authentication host computer reads the security code and corresponding expiration time from the local storage, compares the current system time with the expiration time, and determines that it has access rights when the current system time is earlier than or equal to the expiration time.

[0013] In one possible embodiment, before the authentication host computer sends a dynamic random code to the gateway controller and triggers the security authentication process, the process further includes:

[0014] The authentication host computer generates a security code according to preset rules. The security code contains at least one of a random number, a timestamp, and a device identifier, and sets the validity period of the security code.

[0015] In one possible embodiment, after the authentication host computer sends the enable command to the gateway controller, the process further includes:

[0016] The authentication host computer obtains the gateway opening time fed back by the gateway controller, monitors the duration of the communication connection in real time based on the gateway opening time, and sends a shutdown command to the gateway controller when the duration exceeds a preset time threshold, so that the gateway controller closes the communication connection with the vehicle network.

[0017] In one possible embodiment, the authentication host computer monitors the duration of the communication connection in real time based on the gateway's open time, including:

[0018] The authentication host computer periodically obtains the current system time and calculates the difference between the current system time and the gateway startup time as the duration.

[0019] When the difference exceeds the preset time threshold, the authentication host computer determines that the communication connection has timed out.

[0020] In one possible embodiment, the first security code is generated by the gateway controller through cryptographic operations based on a dynamic random code, including:

[0021] The gateway controller takes a dynamic random code as input, calculates a first security code using a symmetric encryption algorithm or a hash algorithm, and sends the first security code to the authentication host computer.

[0022] In one possible embodiment, the authentication host computer generates a second security code based on the dynamic random code through the same encryption operation, including:

[0023] The authentication host computer uses a dynamic random code as input and calculates the second security code using the same encryption algorithm as the gateway controller.

[0024] In one possible embodiment, the dynamic random code is randomly generated by the authentication host computer, and the dynamic random code generated in each security authentication process is different; the vehicle network is a controller area network bus network.

[0025] Secondly, this application provides an access device for an on-board diagnostic interface, including: a permission module, used to authenticate the host computer to verify whether it has access permission based on the validity period of the security code, and when it has access permission, to send a dynamic random code to the gateway controller and trigger a security authentication process;

[0026] The first security module is used for the authentication host computer to obtain the first security code sent by the gateway controller. The first security code is generated by the gateway controller through encryption operation based on the dynamic random code.

[0027] The second security module is used by the authentication host computer to generate a second security code based on the dynamic random code through the same encryption operation, and to compare the first security code with the second security code.

[0028] The communication module is used so that when the comparison is consistent, the authentication host computer sends an enable command to the gateway controller, so that the gateway controller can open the communication connection with the vehicle network.

[0029] Thirdly, embodiments of this application provide an access device for an on-board diagnostic interface, including: a memory and a processor;

[0030] The memory stores computer-executed instructions;

[0031] The processor executes computer execution instructions stored in the memory, causing the processor to perform the first aspect and / or various possible implementations of the first aspect as described above.

[0032] Fourthly, embodiments of this application provide a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, are used to implement the first aspect and / or various possible implementations of the first aspect.

[0033] Fifthly, embodiments of this application provide a computer program product, including a computer program that, when executed by a processor, implements the first aspect and / or various possible implementations of the first aspect.

[0034] The vehicle diagnostic interface access method and storage medium provided in this application embodiment verify whether the current access permission is granted by the authentication host computer based on the validity period of the security code. When the access permission is granted, a dynamic random code is sent to the gateway controller to trigger the security authentication process. This can restrict the access of host computers that are not in the valid authorization period before the access is established. By having the gateway controller and the authentication host computer perform encryption calculations based on the dynamic random code and compare the generated results, the authentication consistency and request legitimacy of the two communicating parties can be verified. Only when the comparison is consistent is an opening command sent to the gateway controller to open the communication connection with the vehicle network. This achieves fine-grained control over the timing and access objects of the vehicle diagnostic interface access, reducing the security risks caused by unauthorized copying and use and prolonged exposure of the interface. Attached Figure Description

[0035] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0036] Figure 1 A flowchart illustrating the method for accessing the on-board diagnostic interface provided in this application. Figure 1 ;

[0037] Figure 2 A schematic diagram of the structure of the access device for the on-board diagnostic interface provided in this application;

[0038] Figure 3 A schematic diagram of the structure of the access device for the on-board diagnostic interface provided in this application.

[0039] The accompanying drawings illustrate specific embodiments of this application, which will be described in more detail below. These drawings and descriptions are not intended to limit the scope of the concept in any way, but rather to illustrate the concept of this application to those skilled in the art through reference to particular embodiments. Detailed Implementation

[0040] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.

[0041] On-board diagnostic interface access control technology is widely used in fault diagnosis, debugging, maintenance, and software upgrade scenarios for new energy vehicles and intelligent connected vehicles. In a typical architecture, an external host computer connects to the vehicle-side gateway controller via the on-board diagnostic interface, and then the gateway controller establishes data communication with the vehicle network to realize the reading of diagnostic data, the issuance of control commands, or related maintenance operations.

[0042] Existing solutions typically involve the vehicle side performing network authentication control after external devices are connected. Once authentication is successful, the host computer is allowed to access the vehicle network via the on-board diagnostic interface. The basic idea behind this type of solution is to focus access control on the gateway or on-board network side, using an authentication mechanism to determine the legitimacy of the access request before deciding whether to open the communication link, thereby meeting routine debugging and diagnostic needs.

[0043] However, this type of solution lacks sufficient constraints on the use of debugging equipment software, making it difficult to effectively restrict unauthorized copying, resale, or use beyond the scope of the authentication host computer. Meanwhile, after network authentication is successful, access permissions often lack a continuous verification mechanism combined with validity periods, resulting in excessively long interface open times. Once an external device is in an authenticated state, it may continuously maintain its communication capability with the vehicle network.

[0044] As a result, while the on-board diagnostic interface can meet the requirements of maintenance convenience, it is difficult to accurately control the exposure time of the interface and the boundaries of software use. This can easily increase the risk of unauthorized access, repeated use of existing authentication conditions, and expansion of the exposure surface of the on-board network, thereby affecting the security and timeliness of access control.

[0045] In light of this, ensuring the normal operation of the on-board diagnostic interface while improving the accuracy of access permission verification and shortening the invalid exposure time has become an urgent technical problem to be solved. To address these issues, a method for accessing the on-board diagnostic interface is provided. When the authentication host computer verifies the current access permission based on the security code validity period, it sends a dynamic random code to the gateway controller and triggers the security authentication process. Subsequently, the gateway controller generates a first security code based on the dynamic random code through encryption operations. The authentication host computer generates a second security code based on the same encryption operations and compares them. When they match, an enable command is sent to the gateway controller to enable the communication connection between the gateway controller and the vehicle network. This technical approach is still applicable to vehicle access architectures consisting of an external host computer, the on-board diagnostic interface, the gateway controller, and the vehicle network. By combining validity period verification, dynamic random codes, and dual security code comparison, the security and timeliness of access control are improved.

[0046] The technical solution of this application and how the technical solution of this application solves the above-mentioned technical problems are described in detail below with specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments. The embodiments of this application will now be described with reference to the accompanying drawings.

[0047] Figure 1 A flowchart illustrating the method for accessing the on-board diagnostic interface provided in this application. Figure 1 ,like Figure 2 As shown, the method includes:

[0048] S101: The authentication host computer verifies whether it has access rights based on the validity period of the security code. When it has access rights, it sends a dynamic random code to the gateway controller and triggers the security authentication process.

[0049] In this application, the authentication host computer is an external terminal that executes the access control process. It can be a dedicated diagnostic instrument, a maintenance computer, or an industrial control terminal with authentication software installed. This terminal establishes a physical connection with the vehicle-side gateway controller via the on-board diagnostic interface. The on-board diagnostic interface serves as the diagnostic communication entry point between the vehicle and external devices, and can utilize a standard vehicle diagnostic connector and its corresponding communication link. The gateway controller connects to the vehicle network and is responsible for forwarding control of diagnostic access. The security code characterizes whether the authentication host computer has access rights within the current time period. The dynamic random code is a temporarily generated random input value for this security authentication process, used to drive the gateway controller and the authentication host computer to generate corresponding security verification results, thus ensuring that each session has independent authentication criteria.

[0050] In practical implementation, after a user initiates a diagnostic access operation, the authentication host computer reads the security code and its associated validity period information, and determines whether it currently has access rights based on this validity period information. Once the authentication host computer confirms that it has access rights, it generates a dynamic random code and sends it to the gateway controller. During transmission, the authentication host computer encapsulates an authentication request message through the communication protocol stack corresponding to the vehicle diagnostic interface. The message includes the information required for the authentication request and is then transmitted to the gateway controller via the physical interface. Upon receiving this message, the gateway controller enters a security authentication response state for subsequent security authentication processing.

[0051] Based on the above analysis, this step sets the access validity period verification at the beginning of the security authentication process. It first determines whether the security code is still within the authorized time range, and then decides whether to allow the generation and sending of a dynamic random code. This ensures that subsequent security authentication is only triggered when the current authorization is still valid. In this way, the usage boundary of the authentication host computer is limited to a predetermined time interval, and the gateway controller only responds to sessions that have passed the validity period pre-verification, shortening the processing chain for invalid access. It should be understood that the above example is for demonstration purposes only and is not a limitation.

[0052] S102: The authentication host computer obtains the first security code sent by the gateway controller. The first security code is generated by the gateway controller through encryption operation based on the dynamic random code.

[0053] In this application, the first security code is the authentication result calculated by the gateway controller based on the dynamic random code sent by the authentication host computer in S101. Its function is to incorporate the encryption capabilities held by the gateway controller into this access session, enabling the authentication host computer to verify whether the gateway controller has processed the same dynamic random code according to the agreed rules. The gateway controller is the control unit responsible for access control on the vehicle side. It includes a communication receiving module, an authentication processing module, a key management module, and a connection control module. After receiving the dynamic random code, the authentication processing module calls relevant processing resources to perform encryption operations and generate the first security code corresponding to the dynamic random code.

[0054] In practical implementation, after receiving the authentication request message, the gateway controller parses out the dynamic random code and performs a preset encryption operation based on the dynamic random code to obtain the first security code. After generating the first security code, the gateway controller sends it to the authentication host computer through the corresponding response message of the on-board diagnostic interface. After receiving the response message, the authentication host computer completes message reception and decapsulation through the protocol stack, and then extracts the first security code for the next step of local generation and consistency comparison.

[0055] Based on the above analysis, it can be seen that the first security code is not constructed unilaterally by the authentication host computer, but is independently calculated and returned by the gateway controller based on the same dynamic random code, thereby establishing an interactive link for vehicle-side security authentication. Since there is a correspondence between the first security code and the current dynamic random code, the same authorized terminal can only complete subsequent consistency verification after receiving a correct response from the gateway controller. Access control thus expands from a simple local validity period judgment to session-level interactive security authentication. It should be understood that the above example is for illustrative purposes only and is not a limitation.

[0056] S103: The authentication host computer generates a second security code based on the dynamic random code through the same encryption operation, and compares the first security code with the second security code.

[0057] In this application, the second security code is the authentication result calculated locally by the authentication host computer based on the dynamic random code generated and sent in S101, according to the same encryption operation rules corresponding to the gateway controller. The first security code is output from the gateway controller side, and the second security code is output from the authentication host computer side. The two form a comparable data pair based on the same input and the same operation rules, thus constituting a key verification node before access is established. The same encryption operation here refers to both sides performing corresponding encryption processing on the same dynamic random code, so that if the input is correct and both parties have consistent security authentication capabilities, the same security code result can be generated.

[0058] In practical implementation, after receiving the first security code, the authentication host computer performs the same encryption operation as the gateway controller based on the dynamic random code to generate a second security code. After generating the second security code, the authentication host computer performs a comparison process. The comparison can be performed byte-by-byte or overall consistency. The authentication host computer compares the first security code with the second security code. If they match, the authentication is considered successful; if they do not match, the authentication is considered failed, and the current session state is set to authentication failure. When authentication fails, the authentication host computer does not send an enable command.

[0059] Based on the above analysis, this step extends the security authentication process from static authorization to dynamic session verification by locally replicating the gateway controller's encryption process on the authentication host computer and performing consistency checks on the results from both sides. Since the second security code depends on the current session's dynamically randomized code and must match the first security code returned by the gateway controller, the authentication host computer will only enter the connection opening phase when both the validity period condition and the session security authentication condition are met simultaneously. This gives access permission verification a dual attribute of time constraint and real-time session constraint. It should be understood that the above example is for demonstration purposes only and is not limiting.

[0060] S104: When the comparison is successful, the authentication host computer sends an enable command to the gateway controller to enable the gateway controller to open the communication connection with the vehicle network.

[0061] In this application, the enable command is a control command sent by the authentication host computer to the gateway controller after confirming that the first security code and the second security code are consistent. This command drives the vehicle side to switch from the security authentication state to the communication open state. In this step, the gateway controller not only receives the security authentication result but also performs in-vehicle network connection control. Specifically, it establishes an association between the in-vehicle diagnostic interface session and the diagnostic communication path on the in-vehicle network side according to the enable command, enabling the authentication host computer to access the target in-vehicle network node via the gateway controller. The in-vehicle network can be an internal vehicle communication network or other in-vehicle communication bus. The gateway controller forwards the authenticated diagnostic messages to the corresponding network according to pre-configured routing rules.

[0062] In practical implementation, after the authentication host computer determines a match in S103, it generates an enable command message. This enable command message includes at least a command type field, and in this application, it may also include information to identify the current access session, enabling the gateway controller to clearly identify the access session corresponding to this enable action. The authentication host computer sends the enable command to the gateway controller through the vehicle diagnostic interface, and the gateway controller executes the enable action upon receiving it. The enable action can manifest as setting the diagnostic interface port and the vehicle network forwarding channel to a conducting state, allowing diagnostic request messages from the authentication host computer to pass through.

[0063] Once the communication connection is established, the authentication host computer can send diagnostic data read requests, control commands, or maintenance messages to the gateway controller via the vehicle diagnostic interface. The gateway controller then sends these messages to the target control unit in the vehicle network based on the established forwarding relationship and transmits the data returned by the target control unit back to the authentication host computer via the original path.

[0064] Based on the above analysis, this step strictly limits the establishment of the communication connection to after the security code verification. The gateway controller does not immediately open the vehicle network after access, but only executes connection opening after receiving the opening command corresponding to the securely authenticated session. In this way, the access establishment action is directly related to the result of the preceding dynamic security authentication. The vehicle network remains closed before successful security authentication, and only the diagnostic communication path is opened to the corresponding session after successful authentication, thus controlling the interface exposure to the actual session stage required. It should be understood that the above example is for demonstration purposes only and is not a limitation.

[0065] Based on the above analysis, this application provides a method for accessing an on-board diagnostic interface, including: an authentication host computer verifying whether it has current access rights based on the validity period of a security code; when access rights are granted, sending a dynamic random code to the gateway controller and triggering a security authentication process; the authentication host computer obtaining a first security code sent by the gateway controller, which is generated by the gateway controller through encryption operations based on the dynamic random code; the authentication host computer generating a second security code based on the dynamic random code through the same encryption operations, and comparing the first security code with the second security code; when the comparison matches, the authentication host computer sending an opening command to the gateway controller to enable the gateway controller to open the communication connection with the vehicle network. In this application, by setting the security code validity period verification as a prerequisite for access, and combining the consistency verification between the dynamic random code generated by the authentication host computer, the first security code generated by the gateway controller, and the second security code generated locally by the authentication host computer, the access process of the on-board diagnostic interface is simultaneously constrained by the authorization time and the current session security authentication result. The gateway controller only opens the communication connection with the vehicle network after the comparison matches and an opening command is received, thereby achieving controlled management of the timing of opening the on-board diagnostic interface.

[0066] In one possible implementation, the authentication host computer verifies whether it currently has access rights based on the validity period of the security code, including:

[0067] The authentication host computer reads the security code and corresponding expiration time from the local storage, compares the current system time with the expiration time, and determines that it has access rights when the current system time is earlier than or equal to the expiration time.

[0068] In actual processing, the permission determination unit reads the security code and expiration time from the local storage unit and compares the current system time with the expiration time using a timestamp. When the current system time is earlier than or equal to the expiration time, the permission determination unit outputs a judgment result indicating that access is granted, allowing the authentication host computer to continue performing subsequent security authentication interactions; when the current system time is later than the expiration time, it outputs a judgment result indicating that access is denied and terminates subsequent access requests. The expiration time can be synchronously written to local storage after the security code is generated, or it can be bound to the security code and stored by the authentication host computer when receiving the security code, thus ensuring that the usable time range of the security code remains consistent.

[0069] In practical implementation, local storage can employ flash memory, solid-state storage, or other non-volatile storage media to retain the security code and its expiration information even after power failure. The comparison between the current system time and the expiration time can be completed through a digit-by-digit comparison of the time field, or the time can be converted to a timestamp before numerical comparison. The timestamp can be in seconds, milliseconds, or other standardized units. This time verification mechanism ensures that the authentication host computer performs a timeliness check before accessing the vehicle diagnostic interface, proceeding only to the subsequent security authentication stage if the permissions are still within the valid window.

[0070] By performing localized verification of the security code's validity period, the authentication host computer can complete permission screening before initiating an access request and directly apply time constraints to the access control results, thereby ensuring that the access permissions are consistent with the preset validity period and reducing the possibility of expired security codes continuing to participate in access security authentication.

[0071] In one possible implementation, before the authentication host computer sends a dynamic random code to the gateway controller and triggers the security authentication process, the following steps are also included:

[0072] The authentication host computer generates a security code according to preset rules. The security code contains at least one of a random number, a timestamp, and a device identifier, and sets the validity period of the security code.

[0073] In this solution, the authentication host computer first generates a security code containing a random number, timestamp, or device identifier, and sets a corresponding validity period. Within this validity period, it sends a dynamic random code to the gateway controller, triggering the security authentication process. This ensures that subsequent security authentication is based on time-limited validity and device-associated characteristics. Because the security code is bound to time and device information during generation and is subject to validity constraints, it can serve as a pre-access permission check, forming a seamless security control mechanism together with the dynamic random code security authentication.

[0074] By adopting this method, the security code has time constraints and content binding features, which enables the authentication host computer to complete the access qualification restriction before initiating dynamic random code security authentication, thereby improving the accuracy of security authentication and shortening the time window for invalid security authentication conditions to be reused.

[0075] Based on the foregoing embodiments, after the authentication host computer sends the enable command to the gateway controller, it further includes:

[0076] The authentication host computer obtains the gateway opening time fed back by the gateway controller, monitors the duration of the communication connection in real time based on the gateway opening time, and sends a shutdown command to the gateway controller when the duration exceeds a preset time threshold, so that the gateway controller closes the communication connection with the vehicle network.

[0077] In this embodiment, after sending the activation command, the authentication host computer receives the gateway activation time returned by the gateway controller and records this time as the starting point for calculating the duration. The authentication host computer can periodically obtain the current time based on the local system clock and perform a difference calculation between the current time and the gateway activation time to obtain the duration of the communication connection. When the difference result is greater than a preset time threshold, the authentication host computer generates a shutdown command and sends it to the gateway controller. After confirming the shutdown command, the gateway controller closes the communication connection with the vehicle network. The preset time threshold can be pre-configured by the diagnostic service type, maintenance window length, or security management strategy. In practical applications, this threshold can also be adjusted according to the vehicle status, which is not limited in this application.

[0078] This implementation introduces a duration monitoring and timeout shutdown mechanism after the gateway is turned on, enabling the authentication host computer to constrain the open time of the communication connection and actively terminate the access link after the limited duration is reached, so that the gateway controller can close the communication connection with the vehicle network in a timely manner under timeout conditions.

[0079] With this implementation method, the open duration of the communication connection can be precisely controlled, and the gateway controller will not maintain access to the vehicle network for an extended period of time. This allows the diagnostic interface to meet normal access requirements while having a clear time limit.

[0080] In one possible implementation, the authentication host computer monitors the duration of the communication connection in real time based on the gateway's open time, including:

[0081] The authentication host computer periodically obtains the current system time and calculates the difference between the current system time and the gateway startup time as the duration.

[0082] When the difference exceeds the preset time threshold, the authentication host computer determines that the communication connection has timed out.

[0083] In actual operation, after obtaining the gateway's opening time, the authentication host computer repeatedly reads the current system time at preset time intervals and compares each reading result with the gateway's opening time to calculate and update the duration. This preset time interval can be set from hundreds of milliseconds to several seconds; the specific value depends on the balance requirements between timeliness and system load, and this application does not limit it. After calculating the duration, the authentication host computer compares it with a preset time threshold. When the duration exceeds the preset time threshold, a timeout flag is generated, and this flag serves as the trigger for subsequently closing the communication connection. The communication connection timeout determination result can be written to a local log or directly sent to the gateway controller, so that the gateway controller can close the data channel with the vehicle network based on the result.

[0084] By employing a periodic time comparison method based on gateway opening time, the authentication host computer can continuously monitor the duration of the communication connection and promptly determine timeout when it exceeds a preset time threshold. This method makes the calculation benchmark for the duration clear, and the timeout determination condition singular and controllable, thus making the triggering basis for the shutdown command clear and ensuring that the open duration of the communication connection remains within a controllable range.

[0085] In one possible implementation, the first security code is generated by the gateway controller through encryption operations based on the dynamic random code, including: the gateway controller takes the dynamic random code as input, calculates the first security code through a symmetric encryption algorithm or a hash algorithm, and sends the first security code to the authentication host computer.

[0086] Based on the above method, the gateway controller can directly generate the first security code based on the dynamic random code and send it to the authentication host computer, thereby enabling both parties to form corresponding verification data under the same input conditions. Since the first security code is calculated in real time by the gateway controller and maintains a corresponding relationship with the dynamic random code, it can provide a definite security authentication basis for subsequent consistency comparison.

[0087] By adopting this technical feature, the gateway controller's response to the dynamic random code is real-time. The generation process of the first security code is bound to the current security authentication session, enabling the authentication host computer to obtain a valid verification value for comparison and matching the security code generation result with the current access request, thereby improving the accuracy and timeliness of security authentication control.

[0088] Based on the aforementioned embodiments, the authentication host computer further generates a second security code based on the dynamic random code through the same encryption operation, including: the authentication host computer uses the dynamic random code as input and calculates the second security code through the same encryption algorithm as the gateway controller.

[0089] In this embodiment, the same encryption algorithm can be a symmetric encryption algorithm, a hash algorithm, or a pre-shared key-based operation. The authentication host computer pre-stores algorithm configuration parameters, key materials, or digest rules consistent with those of the gateway controller, and completes the calculation by calling the local encryption module. This encryption module can be integrated into the software program of the authentication host computer or deployed in the hardware security unit. The processor reads the dynamic random code, generates a second security code, and outputs it to the comparison module. If the algorithm parameters stored in the authentication host computer are consistent with those on the gateway controller side, the generated second security code can establish a one-to-one correspondence with the first security code.

[0090] In this way, the authentication host computer can locally generate a second security code based on the dynamic random code and verify its consistency with the first security code. This ensures that the security authentication process does not rely on the output result of a single side, improving the determinism of the security authentication comparison. Since the second security code is obtained by the same encryption operation as the gateway controller, the authentication result can directly reflect the matching status between the dynamic random code and the algorithm parameters, thus providing a reliable basis for subsequently establishing a communication connection.

[0091] Based on the aforementioned embodiments, the dynamic random code is further generated randomly by the authentication host computer, and the dynamic random code generated in each security authentication process is different; the vehicle network is a controller area network bus network.

[0092] In practical implementation, the authentication host computer can generate a dynamic random code based on a hardware random source or a pseudo-random algorithm with seed perturbation. The length of the random code can be set to 8 bytes, 16 bytes, or 32 bytes to meet the balance requirements of authentication message carrying and computational overhead. The authentication host computer regenerates the dynamic random code at the beginning of each security authentication process and binds this dynamic random code to the current security authentication session, ensuring that the dynamic random codes are different between different security authentication processes. If authentication messages need to be sent repeatedly within the same security authentication process, the dynamically random code generated in that process can be reused to ensure consistency of security authentication data within the session. This dynamic random code can be directly encapsulated in the authentication message payload and sent to the gateway controller. The gateway controller uses this code to generate the corresponding security code and complete the comparison and security authentication. For scenarios where the vehicle network uses a controller area network (CAN) bus, the gateway controller can communicate with each electronic control unit of the vehicle via standard CAN frames or extended CAN frames. After the random code security authentication message sent by the authentication host computer is forwarded or processed by the gateway controller, the communication connection with the CAN bus network is only opened when the security authentication is successful. In practical applications, other models of the authentication host computer can also be selected, and this application does not limit this.

[0093] Since the dynamic random codes in each security authentication process are randomly generated by the authentication host computer and are different from each other, the authentication messages have stronger session uniqueness. Combined with the connection form of the vehicle network using the controller area network bus network, the gateway controller can access the vehicle internal network only under controlled security authentication state, thereby reducing the possibility of repeated security authentication data being reused and shortening the unauthorized open time of the controller area network bus network communication link.

[0094] In this application, an auto repair shop provides ECU remapping services for a new energy vehicle. Repair personnel connect to the vehicle via the OBD interface, read fault codes, and update the powertrain software. The vehicle's OBD interface is directly connected to the vehicle's CAN network, and the in-vehicle network is a Controller Area Network (CAN) bus network. In this after-sales service scenario, the authentication host computer generates a security code according to preset rules before initiating access. The security code contains at least one of a random number, a timestamp, and a device identifier, and a validity period is set for the security code. The security code and its corresponding expiration time are stored locally. In this example, the repair personnel first generate a dynamic random code through the host computer. The dynamic random code is generated by the host computer based on the current timestamp and an encryption algorithm such as AES to ensure that each generation is unique. Then, the repair personnel submit a permission approval request to the permission administrator through the repair shop's internal system. The request includes the dynamic random code and an estimated operation time of 2 hours. After reviewing the request, the permission administrator generates the corresponding security code and binds the security code with the dynamic random code and the valid usage time range within 2 hours.

[0095] After receiving the security code assigned by the access administrator, the authentication host computer reads the security code and expiration time from local storage, obtains the current system time and compares it with the expiration time, and simultaneously compares the dynamic random code with the security code using an encryption algorithm. If the current system time is earlier than or equal to the expiration time and the comparison result matches, it determines that the user has access rights and allows the host computer to enter the gateway authentication process. If the comparison fails or the current system time exceeds the valid time range of 2 hours, the host computer cannot continue to operate, and the authentication process terminates. If the maintenance personnel attempt to connect to the vehicle more than 2 hours after submitting the approval request, the authentication host computer refuses authentication. After determining that access rights are granted, the authentication host computer randomly generates a dynamic random code. The dynamic random code generated for each security authentication process is different. It generates an authentication request using an encryption algorithm such as RSA and sends the dynamic random code, device fingerprint, and timestamp to the gateway controller. The device fingerprint consists of a hardware serial number and a software feature code.

[0096] Upon receiving the authentication request and the dynamic random code, the gateway controller uses the dynamic random code as input and performs encryption operations using a symmetric encryption algorithm or a hash algorithm to obtain a first security code, which is then sent to the authentication host computer. The authentication host computer, upon receiving the first security code, uses the same dynamic random code as input and performs operations using the same encryption algorithm as the gateway controller to generate a second security code, comparing the first and second security codes. Simultaneously, the gateway controller verifies the authentication request, first checking if the dynamic security code matches the security code assigned by the access administrator, then comparing the device fingerprint to match the pre-registered device, and finally checking if the timestamp is within the 2-hour validity period of the security code. If the authentication host computer finds a match between the first and second security codes, it sends an activation command to the gateway controller. When the dynamic security code matches, the device fingerprint matches the pre-registered device, and the timestamp is within the 2-hour validity period, the gateway controller responds to the activation command, opens the communication connection with the vehicle network, activates the debug CAN channel, allows the host computer to access the vehicle network, and sends the gateway activation time back to the authentication host computer. If any verification fails, the gateway controller rejects authentication and closes the debug channel. When an attacker attempts to connect to a vehicle using a forged device fingerprint, the gateway controller refuses authentication due to the fingerprint mismatch.

[0097] After receiving the gateway's activation time, the authentication host computer periodically obtains the current system time and calculates the difference between the current system time and the gateway's activation time as the duration of the communication connection. It also monitors in real time whether the duration exceeds a preset time threshold, which is 2 hours in this example. After successful authentication, the gateway controller is only allowed to keep the debugging CAN channel open for 2 hours. If the technician fails to disconnect within 2 hours after completing the ECU flashing, the authentication host computer determines that the communication connection has timed out after detecting a difference greater than 2 hours and sends a shutdown command to the gateway controller. The gateway controller responds to the shutdown command by closing the communication connection with the vehicle network and automatically shutting down the debugging channel to prevent other testing devices from accessing the vehicle network via the OBD interface without authorization. If the technician's operation is interrupted for any reason, the authentication process must be restarted within 2 hours; otherwise, a new security code must be applied for.

[0098] During this process of fault diagnosis, ECU remapping, or software upgrade via the OBD interface, the gateway controller stores access records in a distributed manner using blockchain technology. These records include authentication time, device fingerprint, and operation details. Operation details include reading fault codes, updating powertrain software, and diagnostic or remapping activities interacting with the vehicle network. Even in cases of abnormal access behavior during maintenance, such as high-frequency data reading, the corresponding authentication time, device fingerprint, and operation details are still written to the distributed blockchain storage. An attacker deleting logs cannot alter the already stored access records.

[0099] The vehicle diagnostic interface access method provided in this application embodiment verifies whether the current access permission is granted by the authentication host computer based on the validity period of the security code. When the access permission is granted, a dynamic random code is sent to the gateway controller to trigger the security authentication process. This method can restrict the access of host computers that are not in a valid authorization period before the access is established. By having the gateway controller and the authentication host computer perform encryption calculations based on the dynamic random code and compare the generated results, the method can verify the consistency of authentication and the legality of the request between the two communicating parties. Only when the comparison is consistent is an opening command sent to the gateway controller to open the communication connection with the vehicle network. This achieves fine-grained control over the timing and access objects of vehicle diagnostic interface access, reducing the security risks caused by unauthorized copying and use and prolonged exposure of the interface.

[0100] Figure 2 A schematic diagram of the structure of the access device for the on-board diagnostic interface provided in this application is shown below. Figure 2 As shown, the on-board diagnostic interface access device 40 provided in this embodiment includes:

[0101] The permission module 401 is used to authenticate the host computer to verify whether it has access rights based on the validity period of the security code. When it has access rights, it sends a dynamic random code to the gateway controller and triggers the security authentication process.

[0102] The first security module 402 is used to authenticate the host computer to obtain the first security code sent by the gateway controller. The first security code is generated by the gateway controller through encryption operation based on the dynamic random code.

[0103] The second security module 403 is used to authenticate the host computer to generate a second security code based on the dynamic random code through the same encryption operation, and compare the first security code with the second security code;

[0104] The communication module 404 is used to send an enable command from the authentication host computer to the gateway controller when the comparison is consistent, so that the gateway controller can open the communication connection with the vehicle network.

[0105] In one possible implementation, the permission module 401 is used to authenticate the host computer by reading the security code and the corresponding expiration time stored locally, comparing the current system time with the expiration time, and determining that the user has access rights when the current system time is earlier than or equal to the expiration time.

[0106] In one possible implementation, the above-mentioned device further includes: a generation module (not shown in the figure), used to generate a security code by the authentication host computer according to preset rules, the security code including at least one of a random number, a timestamp and a device identifier, and setting the validity period of the security code.

[0107] In one possible implementation, the communication module 404 is used to authenticate the host computer to obtain the gateway opening time fed back by the gateway controller, monitor the duration of the communication connection in real time based on the gateway opening time, and send a shutdown command to the gateway controller when the duration exceeds a preset time threshold, so that the gateway controller closes the communication connection with the vehicle network.

[0108] In one possible implementation, the communication module 404 is used to periodically obtain the current system time from the authentication host computer and calculate the difference between the current system time and the gateway opening time as the duration.

[0109] When the difference exceeds the preset time threshold, the authentication host computer determines that the communication connection has timed out.

[0110] In one possible implementation, the first security module 402 is used by the gateway controller to calculate the first security code by taking the dynamic random code as input and using a symmetric encryption algorithm or a hash algorithm, and then sending the first security code to the authentication host computer.

[0111] In one possible implementation, the second security module 403 is used to authenticate the host computer by using a dynamic random code as input and calculating the second security code through the same encryption algorithm as the gateway controller.

[0112] In one possible implementation, the above device further includes: an authentication module (not shown in the figure) for generating a dynamic random code randomly by an authentication host computer, wherein the dynamic random code generated in each security authentication process is different; and the vehicle network is a controller local area network bus network.

[0113] The on-board diagnostic interface access device provided in this embodiment can execute the method provided in the above method embodiment. Its implementation principle and technical effect are similar, and will not be described in detail here.

[0114] Figure 3 A schematic diagram of the structure of the access device for the on-board diagnostic interface provided in this application. (See attached diagram.) Figure 3 As shown, the electronic device 50 provided in this embodiment includes at least one processor 501 and a memory 502. Optionally, the device 50 further includes a communication component 503. The processor 501, memory 502, and communication component 503 are connected via a bus 504.

[0115] In a specific implementation, at least one processor 501 executes computer execution instructions stored in memory 502, causing at least one processor 501 to perform the above-described method.

[0116] The specific implementation process of processor 501 can be found in the above method embodiments, and its implementation principle and technical effect are similar. It will not be repeated here.

[0117] In the above embodiments, it should be understood that the processor can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), etc. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in this invention can be directly implemented by a hardware processor, or implemented by a combination of hardware and software modules within the processor.

[0118] The memory may include random access memory (RAM) and may also include non-volatile memory (NVM), such as at least one disk storage device.

[0119] The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. Buses can be categorized as address buses, data buses, control buses, etc. For ease of illustration, the buses shown in the accompanying drawings are not limited to a single bus or a single type of bus.

[0120] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the above-described method.

[0121] This application also provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, implement the above-described method.

[0122] The aforementioned readable storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk. The readable storage medium can be any available medium accessible to a general-purpose or special-purpose computer.

[0123] An exemplary readable storage medium is coupled to a processor, enabling the processor to read information from and write information to the readable storage medium. Of course, the readable storage medium can also be a component of the processor. The processor and the readable storage medium can reside in an Application Specific Integrated Circuit (ASIC). Alternatively, the processor and the readable storage medium can exist as discrete components in the device.

[0124] The division of units is merely a logical functional division; in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be indirect coupling or communication connection through some interfaces, devices, or units, and may be electrical, mechanical, or other forms.

[0125] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0126] In addition, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0127] If a function is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0128] Those skilled in the art will understand that all or part of the steps of the above-described method embodiments can be implemented by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When executed, the program performs the steps of the above-described method embodiments; and the aforementioned storage medium includes various media capable of storing program code, such as ROM, RAM, magnetic disks, or optical disks.

[0129] Finally, it should be noted that other embodiments of the invention will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This invention is intended to cover any variations, uses, or adaptations of the invention that follow the general principles of the invention and include common knowledge or customary techniques in the art not disclosed herein, and is not limited to the precise structures described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of the invention is limited only by the appended claims.

Claims

1. A method for accessing an on-board diagnostic interface, characterized in that, include: The authentication host computer verifies whether it has access rights based on the validity period of the security code. When it has access rights, it sends a dynamic random code to the gateway controller and triggers the security authentication process. The authentication host computer obtains the first security code sent by the gateway controller, which is generated by the gateway controller through encryption operation based on the dynamic random code. The authentication host computer generates a second security code based on the dynamic random code through the same encryption operation, and compares the first security code with the second security code; When the comparison is successful, the authentication host computer sends an activation command to the gateway controller, so that the gateway controller can open the communication connection with the vehicle network.

2. The method according to claim 1, characterized in that, The authentication host computer verifies whether it currently has access rights based on the validity period of the security code, including: The authentication host computer reads the security code and corresponding expiration time stored locally, obtains the current system time and compares it with the expiration time. When the current system time is earlier than or equal to the expiration time, it determines that the user has access rights.

3. The method according to claim 1, characterized in that, The method further includes: The authentication host computer generates a security code according to preset rules. The security code includes at least one of a random number, a timestamp, and a device identifier, and sets the validity period of the security code.

4. The method according to claim 1, characterized in that, After the authentication host computer sends the enable command to the gateway controller, it also includes: The authentication host computer obtains the gateway opening time fed back by the gateway controller, monitors the duration of the communication connection in real time based on the gateway opening time, and sends a shutdown command to the gateway controller when the duration exceeds a preset time threshold, so that the gateway controller closes the communication connection with the vehicle network.

5. The method according to claim 4, characterized in that, The authentication host computer monitors the duration of the communication connection in real time based on the gateway's opening time, including: The authentication host computer periodically obtains the current system time and calculates the difference between the current system time and the gateway opening time as the duration. When the difference is greater than the preset time threshold, the authentication host computer determines that the communication connection has timed out.

6. The method according to claim 1, characterized in that, The first security code is generated by the gateway controller through encryption operations based on the dynamic random code, including: The gateway controller takes the dynamic random code as input, calculates the first security code using a symmetric encryption algorithm or a hash algorithm, and sends the first security code to the authentication host computer.

7. The method according to claim 1, characterized in that, The authentication host computer generates a second security code based on the dynamic random code through the same encryption operation, including: The authentication host computer uses the dynamic random code as input and calculates the second security code using the same encryption algorithm as the gateway controller.

8. The method according to any one of claims 1 to 7, characterized in that, The dynamic random code is randomly generated by the authentication host computer, and the dynamic random code generated in each security authentication process is different; the vehicle network is a controller area network bus network.

9. A device for accessing an on-board diagnostic interface, characterized in that, include: The permission module is used to authenticate the host computer to verify whether it has access rights based on the validity period of the security code. When it has access rights, it sends a dynamic random code to the gateway controller and triggers the security authentication process. The first security module is used for the authentication host computer to obtain the first security code sent by the gateway controller. The first security code is generated by the gateway controller through encryption operation based on the dynamic random code. The second security module is used by the authentication host computer to generate a second security code based on the dynamic random code through the same encryption operation, and to compare the first security code with the second security code. The communication module is used so that when the comparison is consistent, the authentication host computer sends an enable command to the gateway controller, so that the gateway controller can open the communication connection with the vehicle network.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement the method as described in any one of claims 1-8.

Images