Iot device secure communication method, apparatus, device, medium and product

Abstract

The application provides a method and device for secure communication of Internet of Things equipment, equipment, medium and product. After a wireless communication connection is established between the Internet of Things equipment and an Internet of Things equipment master, the Internet of Things equipment master receives a key request sent by the Internet of Things equipment, the key request including a device identifier of the Internet of Things equipment, the Internet of Things equipment master generates a device key corresponding to the Internet of Things equipment based on the key request and a preset communication key, and the Internet of Things equipment master sends the device key to the corresponding Internet of Things equipment, so that the Internet of Things equipment stores the device key to communicate with the Internet of Things equipment master, to realize secure binding between the Internet of Things equipment and the Internet of Things equipment master. Through the preset communication key and the key distribution based on the device identifier, the problem of lack of identity authentication in Bluetooth / WiFi direct connection is solved, and the communication security of the Internet of Things equipment and the Internet of Things equipment master is effectively ensured.

Description

Technical Field

[0001] This application relates to the field of vehicle technology, specifically to a secure communication method, apparatus, device, medium, and product for Internet of Things (IoT) devices. Background Technology

[0002] With the development of Internet of Things (IoT) technology, the functions of vehicle-related IoT devices are evolving towards diversification and intelligence, and users' demand for personalized vehicle control through convenient IoT devices is growing.

[0003] Currently, users can directly connect to the vehicle control system via Bluetooth / WiFi using IoT devices such as smartphones, tablets (portable Android devices, Pads), and in-car armrest screens to control the vehicle and related devices, including but not limited to: adjusting the color and brightness of the ambient lighting, controlling the opening and closing of door locks / windows, setting the concentration and fragrance of the fragrance system, managing the temperature and fan speed of the air conditioning system, and controlling extended IoT devices such as in-car refrigerators and camping lights.

[0004] However, Bluetooth / WiFi connections typically rely on pairing codes or open wireless networks, posing significant security risks. Attackers or malicious users may use Bluetooth / WiFi connections to intrude into the vehicle's control network, illegally control vehicle-related functions, or even control vehicle safety-related devices, thereby damaging the owner's privacy or endangering the lives and property of passengers. Summary of the Invention

[0005] Based on the defects and deficiencies of the prior art, this application proposes a secure communication method, device, equipment, medium and product for Internet of Things (IoT) devices, which can realize the secure binding between IoT devices and IoT device master controllers, prevent attackers or malicious users from illegally controlling vehicle-related functions, ensure secure communication between IoT devices and IoT device master controllers, and avoid damage to the personal privacy or even property safety of vehicle owners or passengers.

[0006] According to a first aspect of this application, a secure communication method for Internet of Things (IoT) devices is provided, comprising: After the IoT device establishes a wireless communication connection with the IoT device's main controller, The IoT device master controller receives a key request sent by the IoT device, and the key request includes the device identifier of the IoT device; The IoT device master controller generates a device key corresponding to the IoT device based on the key request and the preset communication key; The IoT device master controller sends the device key to the corresponding IoT device, so that the IoT device stores the device key to communicate with the IoT device master controller.

[0007] According to a second aspect of the embodiments of this application, a secure communication device for Internet of Things (IoT) devices is provided, comprising: The receiving module is used to receive a key request sent by the IoT device after the IoT device establishes a wireless communication connection with the IoT device master controller. The key request includes the device identifier of the IoT device. The generation module is used to generate a device key corresponding to the IoT device based on the key request and the preset communication key; The sending module is used to send the device key to the corresponding IoT device, so that the IoT device stores the device key to communicate with the IoT device master controller.

[0008] According to a third aspect of the embodiments of this application, an electronic device is provided, including a memory and a processor; The memory is connected to the processor and is used to store programs; The processor is used to implement the secure communication method for Internet of Things devices as described in the first aspect by running a program in the memory.

[0009] According to a fourth aspect of the present application, a storage medium is provided, on which a computer program is stored, and when the computer program is run by a processor, it implements the secure communication method for Internet of Things devices as described in the first aspect.

[0010] According to a fifth aspect of the embodiments of this application, a computer program product is provided, wherein the computer program instructions, when executed by a processor, cause the processor to implement the secure communication method for Internet of Things devices as described in the first aspect.

[0011] According to a sixth aspect of the embodiments of this application, a vehicle is provided, which is equipped with an Internet of Things (IoT) device and an IoT device master controller, wherein the IoT device and the IoT device master controller are communicatively connected.

[0012] In the aforementioned secure communication methods, devices, equipment, media, and products for IoT devices, after an IoT device establishes a wireless communication connection with its master controller, the master controller receives a key request from the IoT device located in the vehicle. The key request includes the device identifier of the IoT device. Based on the device identifier in the key request and a pre-set communication key corresponding to the IoT device, the master controller generates a device key corresponding to the IoT device. The master controller then sends the device key to the corresponding IoT device, enabling the IoT device to store the device key for communication with the master controller. Thus, after establishing a Bluetooth / WiFi connection between the IoT device and its master controller, compared to Bluetooth / WiFi relying on pairing codes or open wireless networks for connection and communication, the pre-set communication key and key distribution based on the device identifier enable secure binding between the IoT device and its master controller. This solves the problem of lack of authentication in direct Bluetooth / WiFi connections, effectively ensuring communication security between the IoT device and its master controller, reducing security risks associated with communication after Bluetooth / WiFi connection, and preventing unauthorized vehicle control, infringement of owner privacy, or even endangerment of passenger safety. Attached Figure Description

[0013] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of this application. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0014] Figure 1 This is a schematic diagram illustrating an application scenario provided in an embodiment of this application.

[0015] Figure 2 This is a flowchart illustrating a secure communication method for IoT devices, as provided in an embodiment of this application.

[0016] Figure 3 This is a schematic diagram illustrating a time-series secure communication process for IoT devices, as provided in an embodiment of this application.

[0017] Figure 4 This is a schematic diagram illustrating a secure communication process for IoT devices based on a system architecture, as proposed in an embodiment of this application.

[0018] Figure 5 This is a schematic diagram of the structure of a secure communication device for Internet of Things (IoT) devices proposed in an embodiment of this application.

[0019] Figure 6 This is a schematic diagram of the structure of an electronic device proposed in an embodiment of this application. Detailed Implementation

[0020] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0021] As described in the background section, with the development of IoT technology, the functions of vehicle-related IoT devices are evolving towards diversification and intelligence. Users' demand for personalized vehicle control through convenient IoT devices is growing. Currently, users can directly connect to the vehicle control system via Bluetooth / WiFi using IoT devices such as smartphones, tablets, and in-car armrest screens to control the vehicle and related devices, including but not limited to: adjusting the color and brightness of ambient lighting, controlling the opening and closing of door locks / windows, setting the concentration and fragrance of the fragrance system, managing the temperature and fan speed of the air conditioning system, and controlling extended IoT devices such as in-car refrigerators and camping lights. However, Bluetooth / WiFi connections typically rely on pairing codes or open wireless networks, posing significant security risks. Attackers or malicious users may use Bluetooth / WiFi connections to intrude into the vehicle's control network, illegally controlling vehicle functions or even vehicle safety-related devices, thereby damaging the owner's privacy and even endangering the life and property safety of passengers.

[0022] Based on this, the inventors further discovered that when IoT devices in vehicles, such as mobile phones, tablets, and smart stickers, are directly connected to the vehicle control system (i.e., the IoT device master control system) via Bluetooth / WiFi, access control is loose, making them vulnerable to various attacks such as man-in-the-middle attacks, address resolution attacks, custom attacks, and distributed denial-of-service attacks by hackers or other illegal attackers with certain cybersecurity expertise. This can lead to unauthorized control of vehicle functions and create security risks. Therefore, after establishing a wireless communication connection between the IoT device and its master controller, the master controller receives a key request from the IoT device located in the vehicle. This key request includes the device identifier of the IoT device. Based on the device identifier in the key request and a pre-set communication key corresponding to the IoT device, the master controller generates a device key corresponding to the IoT device. The master controller then sends this device key to the corresponding IoT device, enabling the IoT device to store the key for communication with the master controller. Thus, after establishing a Bluetooth / WiFi connection between the IoT device and its master controller, compared to Bluetooth / WiFi relying on pairing codes or open wireless networks for connection and communication, the pre-set communication key and key distribution based on the device identifier enable secure binding between the IoT device and its master controller. This solves the problem of lack of authentication in direct Bluetooth / WiFi connections, effectively ensuring communication security between the IoT device and its master controller, reducing security risks associated with communication after Bluetooth / WiFi connection, and preventing unauthorized vehicle control, infringement of owner privacy, or even endangerment of passenger safety.

[0023] Based on the above concept, this specification provides a secure communication method for IoT devices. The secure communication method for IoT devices will be described exemplarily below with reference to the accompanying drawings.

[0024] refer to Figure 1 , Figure 1 This provides a feasible application scenario for secure communication methods for Internet of Things (IoT) devices, which includes vehicle control systems and IoT devices.

[0025] In this vehicle control system, the vehicle gateway communicates with the intelligent driving control unit, powertrain chassis control unit, intelligent cockpit control unit, diagnostic port, and body control unit via Ethernet (ETH). The body control unit communicates with the first control module via a flexible data rate controller area network (CAN_FD) to control the doors, locks, windows, air conditioning, and lights. That is, the first control module integrates control functions for components such as doors, locks, windows, air conditioning, and lights. The intelligent cockpit control unit communicates with the second control module via CAN_FD to control the fragrance system, voice control, screen, and speakers. That is, the second control module integrates control functions for components such as fragrance system, voice control, screen, and speakers.

[0026] The smart cockpit control unit connects with IoT devices via WiFi / Bluetooth. The IoT devices used for control, such as mobile phones, tablets, smart stickers, and armrest screens, send control commands to the smart cockpit control unit through this connection. The smart cockpit control unit then sends control commands to the controlled IoT devices, such as car refrigerators, speakers, and camping lights, via WiFi / Bluetooth.

[0027] Please see Figure 2 In one exemplary embodiment, a secure communication method for Internet of Things (IoT) devices is provided, applied in any IoT device master controller, which is a cockpit domain controller or located within a cockpit domain controller. Specifically, the cockpit domain controller can refer to a user experience controller (UXC) or a display head unit (DHU). Figure 2 As shown, the secure communication method for IoT devices includes steps S201-S203: S201: After the IoT device establishes a wireless communication connection with the IoT device master controller, the IoT device master controller receives the key request sent by the IoT device.

[0028] The key request includes the device identifier of the IoT device, such as the media access control address (MAC). This key request is used to request the IoT device master to issue a device key to the IoT device.

[0029] Specifically, the wireless communication connection is either a Bluetooth connection or a WiFi connection.

[0030] After the IoT device master controller establishes a Bluetooth or WiFi connection with the IoT device, the IoT device generates a key request based on its MAC address. This key request contains the IoT device's MAC address, and then the IoT device sends the key request to the IoT device master controller.

[0031] Accordingly, the IoT device master controller receives the key request sent by the IoT device.

[0032] S202: The IoT device master controller generates a device key corresponding to the IoT device based on the preset communication key corresponding to the IoT device and the device identifier in the key request.

[0033] In response to the key request, the IoT device master controller uses a pre-set communication key corresponding to the IoT device that issued the key request to encrypt the device identifier of the IoT device in the key request, obtain encrypted information, and generate a device key corresponding to the IoT device based on the encrypted information.

[0034] Among them, the preset communication key is a key pre-generated in the main controller of the IoT device for communicating with IoT devices or other devices.

[0035] Specifically, the IoT device master controller can match a corresponding pre-set communication key based on the device type of the IoT device. That is, the pre-set communication key used by the IoT device master controller is determined based on the device type of the IoT device it needs to communicate with.

[0036] Among them, based on whether or not they are intelligent, IoT devices can be classified into smart IoT devices and ordinary IoT devices.

[0037] Depending on the actual needs, IoT devices can also be classified using other criteria. For example, according to the hierarchical structure, they can be classified into sensing layer IoT devices, network layer IoT devices, and application layer IoT devices.

[0038] S203: The IoT device master controller sends the device key to the corresponding IoT device, enabling the IoT device to store the device key for communication with the IoT device master controller.

[0039] The IoT device master controller, based on the device identifier of the IoT device in the key request, sends a device key to the corresponding IoT device (i.e., the IoT device represented by the device identifier) ​​via a wireless connection. The IoT device receives and stores the device key, and uses it to communicate with the IoT device master controller.

[0040] Afterwards, the IoT device is activated and the activation result is stored. That is, the IoT device master activates the IoT device and stores the device identifier of the IoT device in the IoT device master.

[0041] In this embodiment, after establishing a wireless communication connection between the IoT device and the IoT device master controller, the IoT device master controller receives a key request sent by the IoT device located in the vehicle. The key request includes the device identifier of the IoT device. Based on the device identifier in the key request and the preset communication key corresponding to the IoT device, the IoT device master controller generates a device key corresponding to the IoT device. The IoT device master controller sends the device key to the corresponding IoT device, enabling the IoT device to store the device key for communication with the IoT device master controller. In this way, after the IoT device and the IoT device master controller establish a Bluetooth / WiFi connection, compared to Bluetooth / WiFi relying on pairing codes or open wireless networks for connection and communication, the preset communication key and key distribution based on the device identifier can achieve secure binding between the IoT device and the IoT device master controller, solving the problem of lack of identity authentication in direct Bluetooth / WiFi connections. This effectively ensures the communication security between the IoT device and the IoT device master controller, reduces the security risks of communication after Bluetooth / WiFi connection, and avoids situations such as unauthorized control of the vehicle, infringement of the vehicle owner's privacy, or even endangerment of passenger safety.

[0042] To ensure communication security, in some embodiments, the IoT device includes smart IoT devices and ordinary IoT devices. For smart IoT devices, the key request also includes a certificate signing request, the preset communication key is a preset asymmetric key, and the device key is a device certificate issued based on the device identifier, the certificate signing request, and the preset asymmetric key; for ordinary IoT devices, the preset communication key is a preset symmetric master key, and the device key is a symmetric key obtained by encrypting the device identifier using the preset symmetric master key.

[0043] IoT devices are categorized into smart IoT devices and ordinary IoT devices based on the computing power of their built-in chips. Generally, IoT devices with high built-in chip computing power are smart IoT devices, such as mobile phones and tablets, while those with low built-in chip computing power are ordinary IoT devices, such as smart stickers, camping lights, and car refrigerators.

[0044] Specifically, the pre-configured communication key is the communication key generated and stored when the IoT device master controller first activates the vehicle control application. The vehicle control application is the application that carries the IoT business function logic of the vehicle; the name of the vehicle control application can be defined by different vehicle models or manufacturers.

[0045] For example, the IoT device controller generates an asymmetric key pair according to kp0=genKeyPair(),ECC-256, as a preset asymmetric key. Here, kp0 represents the preset asymmetric key pair, genKeyPair() represents calling the asymmetric key pair generation function, and ECC-256 is an asymmetric encryption algorithm.

[0046] Alternatively, for example, the IoT device controller randomly generates a symmetric key as a preset symmetric master key, with a key length of, for example, 128 bits.

[0047] Smart IoT devices pre-generate and store asymmetric key pairs or symmetric master keys to obtain a pre-set communication key.

[0048] A certificate signing request is used to request the IoT device master controller to sign the IoT device and obtain the IoT device certificate.

[0049] The smart IoT device pre-generates its own asymmetric key pair, and based on the asymmetric key pair and the client information on the smart IoT device, generates a certificate signing request, and based on the certificate signing request and the device identifier of the smart IoT device, generates a key request.

[0050] Specifically, smart IoT devices use the public key in their own asymmetric key pair and client information to perform encrypted calculations to obtain a certificate signing request.

[0051] Accordingly, the IoT device master controller receives the key request, decrypts it to obtain the device identifier and certificate signing request, and then uses the private key from the IoT device master controller's pre-set asymmetric key to sign the certificate signing request, obtaining the client certificate for the smart IoT device represented by the device identifier. Afterwards, the IoT device master controller distributes the client certificate to the smart IoT device represented by the device identifier, and the smart IoT device receives and stores the client certificate.

[0052] Based on this, the IoT device controller also distributes its own server certificate to the IoT device represented by the device identifier.

[0053] Among them, the server certificate is a self-signed certificate generated by the IoT device master controller based on its own information and a pre-set asymmetric key pair.

[0054] For example, when the IoT device master controller first starts the vehicle control application, it generates and stores a pre-set communication key, and at the same time generates and stores a self-signed certificate of the IoT device master controller.

[0055] For example, the IoT device master controller signs its information according to serverCert = genSelfSignedCert(kp0, serverInfo) to obtain a self-signed certificate. Here, serverCert represents the self-signed certificate of the IoT device master controller, genSelfSignedCert() represents the function that generates the self-signed certificate, kp0 represents the pre-set asymmetric key pair in the IoT device master controller, and serverInfo represents the information of the IoT device master controller.

[0056] For example, the smart IoT device generates a certificate signing request according to csr = clientInfo + kp1.publicKey, where csr represents the certificate signing request, clientInfo represents client information, kp1 represents the asymmetric key pair pre-generated by the smart IoT device, and kp1.publicKey refers to the public key in the asymmetric key pair pre-generated by the smart IoT device.

[0057] For example, the IoT device master controller generates a client certificate for the smart IoT device according to clientCert=genCert(csr, serverCert,kp0.privateKey). Here, clientCert represents the client certificate, genCert() represents the function that generates the client certificate, csr represents the certificate signing request, serverCert represents the self-signed certificate of the IoT device master controller, kp0 represents the pre-set asymmetric key pair in the IoT device master controller, and kp0.privateKey represents the private key in the pre-set asymmetric key pair in the IoT device master controller.

[0058] Ordinary IoT devices directly generate a key request based on their device identifier. The IoT device's master controller decrypts this key request to obtain the device identifier. Then, it uses the master controller's preset symmetric master key to encrypt and calculate the device identifier to obtain the IoT device's device key. This device key is then sent to the ordinary IoT device represented by the device identifier. Subsequently, the ordinary IoT device receives and stores the device key.

[0059] For example, the IoT device master controller performs encrypted calculations according to AES-128-CMAC(IOT_MasterKey, IOT device MAC) to obtain the device key of the ordinary IoT device represented by the IOT device MAC, where IOT_MasterKey represents the preset symmetric master key of the IoT device master controller, and AES-128-CMAC() represents the calculation function that calls the corresponding AES-128-CMAC algorithm.

[0060] In this embodiment, for IoT devices with different computing power, an asymmetric certificate system and a lightweight symmetric key system are adopted respectively to determine the device key used by the IoT device to communicate with the IoT device master controller, thereby realizing the secure binding of IoT devices with different performance and effectively ensuring the communication security between the IoT device and the IoT device master controller.

[0061] To ensure communication security, in some embodiments, for smart IoT devices, the key request also includes a first message authentication code, which is an authentication code obtained by encrypting the wireless connection pairing code and the certificate signing request.

[0062] Generally, smart IoT devices connect to the IoT device controller via WiFi, while ordinary IoT devices connect to the IoT device controller via Bluetooth.

[0063] Specifically, a wireless connection pairing code is entered through an IoT device.

[0064] More specifically, the wireless pairing code for smart IoT devices can be selected and displayed through the Human-Machine Interface (HMI). This pairing code can be randomly generated by the smart IoT device or selected by the user through interaction with the HMI. Interaction refers to clicking or inputting.

[0065] After determining the wireless connection pairing code, the smart IoT device generates a first message authentication code based on the wireless connection pairing code.

[0066] The smart IoT device calculates the first message authentication code based on the wireless connection pairing code and the certificate signing request.

[0067] For example, the first message authentication code is calculated according to CMAC1 = AES-128-CMAC(KeyA,csr) and KeyA = SHA256(P1). Here, CMAC1 represents the first message authentication code, AES-128-CMAC() represents the function that calls the AES-128-CMAC algorithm, P1 represents the wireless connection pairing code, KeyA represents the key calculated based on P1, and AES-128-CMAC(KeyA,csr) represents the function that calls the AES-128-CMAC algorithm to calculate the first message authentication code by combining the key calculated based on P1 with the certificate signing request.

[0068] In this embodiment, by mimicking the pairing code verification in Bluetooth connections, pairing code verification is added on top of certificate authentication during the binding process between the smart IoT device and the IoT device master controller. This can better ensure binding security, thereby guaranteeing the communication security between the smart IoT device and the IoT device master controller.

[0069] To ensure communication security, for smart IoT devices, the IoT secure communication method also includes the IoT device master controller establishing a bidirectional Transport Layer Security (TLS) channel with the IoT device based on the device certificate, and receiving and executing vehicle control commands through this channel.

[0070] The IoT device transmits vehicle control commands to the IoT device master controller via a two-way TLS channel, and the IoT device master controller receives and executes the vehicle control commands.

[0071] In this embodiment, a bidirectional TLS channel is established between the IoT device and the IoT device master controller based on the device certificate received during the binding phase. Vehicle control commands are transmitted through this channel, which can achieve end-to-end confidentiality, integrity and strong identity authentication in the transmission process of vehicle control commands. It can effectively resist man-in-the-middle attacks, eavesdropping and tampering, and can better guarantee the communication security between the smart IoT device and the IoT device master controller.

[0072] To ensure communication security, in some embodiments, for ordinary IoT devices, the IoT device master controller receives the first control instruction information from the IoT device. Based on the first control instruction information and the second count value, the IoT device master controller authenticates the vehicle control instruction and obtains the instruction authentication result. If the instruction authentication result indicates that the vehicle control instruction has been authenticated, the IoT device master controller executes the vehicle control instruction and sends the execution result of the vehicle control instruction to the IoT device.

[0073] The first control command information is determined based on the device key, the vehicle control command, and a first count value. The first count value is the cumulative number of vehicle control commands sent by the IoT device, and the second count value is the cumulative number of vehicle control commands sent by the IoT device stored in the IoT device's master controller. The command authentication result indicates whether the vehicle control command authentication is successful.

[0074] The IoT device performs encrypted calculations based on the device key, the first count value, and the vehicle control command to obtain the second message authentication code. The second message authentication code, the first count value, and the vehicle control command are then sent to the IoT device master controller as the first control command information.

[0075] For example, the IoT device determines the first control command information by taking the first 6 bytes of E1 = vehicle control command + Counter1 + CMAC2, where CMAC1 = AES-128-CMAC(IoT device key, vehicle control command + Counter1). Here, Counter1 represents the first count value, CMAC2 represents the second message authentication code, and AES-128-CMAC(IoT device key, vehicle control command + Counter1) represents the call to the AES-128-CMAC() function to calculate the message authentication code using the AES-128-CMAC algorithm, which combines the IoT device key, the vehicle control command, and the first count value. Then, the first 6 bytes of this message authentication code are taken as the second message authentication code.

[0076] The initial value of Counter1 is 1, and the value of Counter1 is incremented by 1 each time a vehicle control command is sent.

[0077] Specifically, the IoT device master controller decrypts and verifies the first control command information to obtain the second control command information. The IoT device master controller compares whether the first control command information and the second control command information are consistent, and whether the first count value is greater than the second count value. If the first control command information and the second control command information are consistent, and the first count value is greater than the second count value, then the IoT device master controller determines that the command authentication result indicates that the vehicle control command authentication is successful. For example, the second count value is represented by Counter2.

[0078] The IoT device master controller performs encrypted calculations on the first count value and the vehicle control command in the same way as the IoT device to obtain the third message verification code. Based on the third message verification code, the first count value and the vehicle control command, it generates the second control command information and determines whether the first control command information and the second control command information are consistent.

[0079] Specifically, it is determined whether the third message authentication code is consistent with the second message authentication code, and whether the first count value and vehicle control command in the second control command information are consistent with the first count value and vehicle control command in the first control command information. If they are all consistent, or if the third message authentication code is consistent with the second message authentication code, then it is determined that the first control command information and the second control command information are consistent.

[0080] The initial value of the second count is 0, and there is a correspondence between the second count and the IoT device and its stored first count. Each time the IoT device controller receives a vehicle control command and the command is successfully authenticated, the second count corresponding to the IoT device that sent the command is incremented by 1.

[0081] Only after confirming that the first control command information and the second control command information are consistent will the master controller of the IoT device determine the magnitude of the first count value and its corresponding second count value.

[0082] If the first control command information and the second control command information are inconsistent, the IoT device master controller determines that the command authentication result indicates that the vehicle control command authentication has failed. If the first control command information and the second control command information are consistent, the relationship between the first count value and its corresponding second count value is determined. If the first count value is less than or equal to its corresponding second count value, the IoT device master controller determines that the command authentication result indicates that the vehicle control command authentication has failed. If the first count value is greater than the second count value, the IoT device master controller determines that the command authentication result indicates that the vehicle control command authentication has passed.

[0083] In this embodiment, based on the comparison of the first count value, the second count value, and the message authentication code, replay verification of vehicle control commands can be achieved. When a vehicle control command is replayed, i.e., when the first count value is less than or equal to the second count value, it is determined that the vehicle control command has failed authentication. When the first count value is greater than the second count value, it is determined that the vehicle control command has passed authentication, and then the vehicle control command is executed. This can effectively avoid replay attacks on vehicle control commands, achieve anti-replay of vehicle control commands, and ensure the communication security between ordinary IoT devices and the IoT device master controller.

[0084] For example, a time-series secure communication process for IoT devices can be as follows: Figure 3 As shown.

[0085] For example, based on the system architecture of a vehicle control system, the secure communication process for IoT devices can be as follows: Figure 4 As shown, ①-④ represent the order of events. TSP refers to Telecommunications Service Provider, TCAM refers to Telematics & Connectivity Antenna Module, CroptoEngine is the encryption engine, Keystroe is the keystore, and OpenSSL is open software for generating asymmetric keys, including public and private keys.

[0086] like Figure 5 As shown in the figure, this application embodiment also provides a secure communication device for Internet of Things devices, including a receiving module 501, a generating module 502, and a sending module 503.

[0087] in, The receiving module 501 is used to receive a key request sent by the IoT device after the IoT device establishes a wireless communication connection with the IoT device master controller. The key request includes the device identifier of the IoT device, and the IoT device is located in the vehicle. The generation module 502 is used to generate a device key corresponding to the IoT device based on the preset communication key corresponding to the IoT device and the device identifier in the key request; The sending module 503 is used to send the device key to the corresponding IoT device, so that the IoT device stores the device key to communicate with the IoT device master controller.

[0088] The IoT device secure communication device provided in this embodiment belongs to the same application concept as the IoT device secure communication method provided in the above embodiments of this application. It can execute the IoT device secure communication method provided in any of the above embodiments of this application and has the corresponding functional modules and beneficial effects of executing the method. Technical details not described in detail in this embodiment can be found in the specific processing content of the IoT device secure communication method provided in the above embodiments of this application, and will not be repeated here.

[0089] Another embodiment of this application also provides an electronic device, see [link to relevant documentation] Figure 6 As shown, the electronic device includes a memory 600 and a processor 610.

[0090] The memory 600 is connected to the processor 610 and is used to store programs; The processor 610 is used to implement the secure communication method for IoT devices disclosed in any of the above embodiments by running the program stored in the memory 600.

[0091] Specifically, the electronic device may also include: a bus, a communication interface 620, an input device 630, and an output device 640.

[0092] The processor 610, memory 600, communication interface 620, input device 630, and output device 640 are interconnected via a bus. Among them: A bus can include a pathway for transmitting information between various components of a computer system.

[0093] The processor 610 can be a general-purpose processor, such as a general-purpose central processing unit (CPU), a microprocessor, etc., or an application-specific integrated circuit (ASIC), or one or more integrated circuits used to control the execution of the program of the present application. It can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), an off-the-shelf programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components.

[0094] The processor 610 may include a main processor, as well as a baseband chip, modem, etc.

[0095] The memory 600 stores a program for executing the technical solution of this application, and may also store an operating system and other key business functions. Specifically, the program may include program code, which includes computer operation instructions. More specifically, the memory 600 may include read-only memory (ROM), other types of static storage devices capable of storing static information and instructions, random access memory (RAM), other types of dynamic storage devices capable of storing information and instructions, disk storage, flash memory, etc.

[0096] Input device 630 may include a device for receiving user input data and information, such as a keyboard, mouse, camera, scanner, light pen, voice input device, touch screen, pedometer, or gravity sensor.

[0097] Output device 640 may include devices that allow information to be output to a user, such as a display screen, printer, speaker, etc.

[0098] The communication interface 620 may include a device that uses any transceiver to communicate with other devices or communication networks, such as Ethernet, Radio Access Network (RAN), Wireless Local Area Network (WLAN), etc.

[0099] The processor 610 executes the program stored in the memory 600 and calls other devices, which can be used to implement the various steps of any of the secure communication methods for IoT devices provided in the above embodiments of this application.

[0100] Those skilled in the art will understand that Figure 6 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the electronic device to which the present application is applied. The specific electronic device may include more or fewer components than shown in the figure, or combine certain components, or have different component arrangements.

[0101] This application also proposes a chip including a processor and a data interface. The processor reads and runs a program stored in a memory through the data interface to execute the IoT device secure communication method described in any of the above embodiments. For the specific processing procedure and its beneficial effects, please refer to the above embodiments of the IoT device secure communication method.

[0102] In addition to the methods and devices described above, embodiments of this application provide a computer program product comprising computer program instructions that, when executed by a processor, cause the processor to perform the steps of the secure communication methods for IoT devices according to various embodiments of this application as described in the "Exemplary Methods" section of this specification.

[0103] The computer program product can be written in any combination of one or more programming languages ​​to perform the operations of the embodiments of this application. The programming languages ​​include object-oriented programming languages ​​such as Java and C++, as well as conventional procedural programming languages ​​such as C or similar languages. The program code can be executed entirely on the user's computing device, partially on the user's computing device, as a standalone software package, partially on the user's computing device and partially on a remote computing device, or entirely on a remote computing device or server.

[0104] Furthermore, embodiments of this application also propose a storage medium storing a computer program, which is executed by a processor in the steps of the secure communication method for IoT devices according to various embodiments of this application described in the "Exemplary Methods" section above.

[0105] An embodiment of this application also proposes a vehicle equipped with an Internet of Things (IoT) device and an IoT device master controller, wherein the IoT device and the IoT device master controller are communicatively connected.

[0106] The basic principles of the present invention have been described above with reference to specific embodiments. However, it should be noted that the advantages, benefits, and effects mentioned in the present invention are merely examples and not limitations, and should not be considered as essential features of each embodiment of the present invention. Furthermore, the specific details disclosed above are for illustrative and facilitative purposes only, and are not limitations. These details do not limit the present invention to the necessity of employing the aforementioned specific details.

[0107] The block diagrams of devices, apparatuses, devices, and systems involved in this invention are merely illustrative examples and are not intended to require or imply that they must be connected, arranged, or configured in the manner shown in the block diagrams. As those skilled in the art will recognize, these devices, apparatuses, devices, and systems can be connected, arranged, and configured in any manner. Words such as “comprising,” “including,” “having,” etc., are open-ended terms meaning “including but not limited to,” and are used interchangeably with them. The terms “or” and “and” as used herein refer to the terms “and / or,” and are used interchangeably with them unless the context clearly indicates otherwise. The term “such as” as used herein refers to the phrase “such as but not limited to,” and is used interchangeably with it.

[0108] It should also be noted that in the apparatus, device, and method of the present invention, the components or steps can be disassembled and / or recombined. These disassemblies and / or recombinations should be considered as equivalent solutions of the present invention.

[0109] The above description of the disclosed aspects is provided to enable any person skilled in the art to make or use the invention. Various modifications to these aspects will be readily apparent to those skilled in the art, and the general principles defined herein can be applied to other aspects without departing from the scope of the invention. Therefore, the invention is not intended to be limited to the aspects shown herein, but rather to be carried out within the widest scope consistent with the principles and novel features disclosed herein.

[0110] It should be understood that the qualifying terms "first", "second", "third", "fourth", "fifth" and "sixth" used in the description of the embodiments of the present invention are only used to more clearly illustrate the technical solutions and are not intended to limit the scope of protection of the present invention.

[0111] The above description has been given for purposes of illustration and description. Furthermore, this description is not intended to limit the embodiments of the invention to the forms disclosed herein. Although numerous exemplary aspects and embodiments have been discussed above, those skilled in the art will recognize certain variations, modifications, alterations, additions, and sub-combinations therein.

Claims

1. A secure communication method for Internet of Things (IoT) devices, characterized in that, The method includes: After the IoT device establishes a wireless communication connection with the IoT device's main controller, The IoT device master controller receives a key request sent by the IoT device, the key request including the device identifier of the IoT device, and the IoT device is located in the vehicle; The IoT device master controller generates a device key corresponding to the IoT device based on the preset communication key corresponding to the IoT device and the device identifier in the key request; The IoT device master controller sends the device key to the corresponding IoT device, so that the IoT device stores the device key to communicate with the IoT device master controller.

2. The secure communication method for IoT devices according to claim 1, characterized in that, The IoT devices include smart IoT devices and ordinary IoT devices. For smart IoT devices, the key request also includes a certificate signing request, the preset communication key is a private key of a preset asymmetric key, and the device key is a device certificate issued based on the device identifier, the certificate signing request, and the preset asymmetric key. For ordinary IoT devices, the preset communication key is a preset symmetric master key, and the device key is a symmetric key obtained by encrypting the device identifier using the preset symmetric master key.

3. The secure communication method for IoT devices according to claim 2, characterized in that, For smart IoT devices, the key request also includes a first message authentication code, which is an authentication code obtained by encrypting the wireless connection pairing code and the certificate signing request.

4. The secure communication method for IoT devices according to claim 2, characterized in that, For smart IoT devices, the method further includes: The IoT device master controller establishes a bidirectional transport layer security protocol channel with the IoT device based on the device certificate, and receives and executes vehicle control commands through the channel.

5. The secure communication method for IoT devices according to claim 2, characterized in that, For ordinary IoT devices, the method further includes: The IoT device master controller receives the first control instruction information of the IoT device. The first control instruction information is determined based on the device key, the vehicle control instruction, and a first count value. The first count value is the cumulative number of times the IoT device has sent the vehicle control instruction. The IoT device master controller authenticates the vehicle control command based on the first control command information and the second count value to obtain the command authentication result. The second count value is the cumulative number of times the IoT device has sent vehicle control commands stored by the IoT device master controller. If the instruction authentication result indicates that the vehicle control instruction has been successfully authenticated, the IoT device master controller executes the vehicle control instruction and sends the execution result of the vehicle control instruction to the IoT device.

6. The secure communication method for IoT devices according to claim 5, characterized in that, The IoT device master controller authenticates the vehicle control command based on the first control command information and the second count value, and obtains the command authentication result, including: The IoT device master controller decrypts and verifies the first control command information to obtain the second control command information. The IoT device master controller compares whether the first control instruction information and the second control instruction information are consistent, and whether the first count value is greater than the second count value; If the first control instruction information is consistent with the second control instruction information, and the first count value is greater than the second count value, then the IoT device master controller determines that the instruction authentication result indicates that the vehicle control instruction authentication is successful.

7. A secure communication device for Internet of Things (IoT) devices, characterized in that, The device includes: The receiving module is used to receive a key request sent by the IoT device after the IoT device establishes a wireless communication connection with the IoT device master controller. The key request includes the device identifier of the IoT device. The generation module is used to generate a device key corresponding to the IoT device based on the device identifier and the preset communication key in the key request; The sending module is used to send the device key to the corresponding IoT device, so that the IoT device stores the device key to communicate with the IoT device master controller.

8. An electronic device, characterized in that, Including memory and processor; The memory is connected to the processor and is used to store programs; The processor is used to implement the secure communication method for IoT devices as described in any one of claims 1 to 6 by running a program in the memory.

9. A storage medium, characterized in that, The storage medium stores a computer program, which, when executed by a processor, implements the secure communication method for IoT devices as described in any one of claims 1 to 6.

10. A computer program product, characterized in that, It includes computer program instructions that, when executed by a processor, cause the processor to implement the secure communication method for IoT devices as described in any one of claims 1-6.

11. A vehicle, characterized in that, The vehicle is equipped with an Internet of Things (IoT) device and an IoT device master controller, and the IoT device and the IoT device master controller are communicatively connected.

Images