Method and device for renewing the certificate list

Abstract

Embodiments of the present application provide a method and apparatus for updating a certificate list and relate to the field of intelligent and connected vehicle technology. A certificate list stored in a first vehicle is updated based on an acquired certificate record, thereby reducing the certificate record that needs to be stored in a vehicle-mounted device of the first vehicle and ensuring the integrity of the certificate list stored in the vehicle-mounted device of the first vehicle. The method comprises the steps of: acquiring a certificate record — the certificate record is transmitted to the first vehicle by a network-side device, and the certificate record includes at least one revoked certificate or at least one valid certificate — and updating a certificate list stored in the first vehicle based on the certificate record — the certificate list is used to record a revoked certificate or a valid certificate of a device belonging to the first vehicle, or is used to record a revoked certificate or a valid certificate of a device belonging to a first vehicle group, and the first vehicle group includes the first vehicle —.

Description

Technology Field

[0001] This application relates to the field of intelligent connected vehicle technology, and in particular to a method and apparatus for updating a certificate list. Background Technology

[0002] With the advancement of intelligence and networking, network-side devices (e.g., servers) or vehicle-mounted devices can use Internet of Vehicles (IVV) technology to track and learn vehicle status, and vehicle functions continue to expand, bringing convenience to users' lives. In an IVV system, unauthorized devices can disrupt the implementation of vehicle functions and threaten vehicle security by using the system to transmit interfering data to the vehicle or to control the vehicle by monitoring vehicle information. To ensure vehicle security, authentication is performed on the relevant IVV after the IVV is activated or before vehicle functions (e.g., autonomous driving) are used, based on a digital certificate—specifically, the device certificate of the IVV—to verify the identity of the IVV and guarantee its validity. The validity of the digital certificate can be guaranteed using a private key stored in the IVV. If a digital certificate becomes invalid due to reasons such as the leakage of a private key, the Certificate Authority (CA) revokes the digital certificate and places it on the Certificate Revocation List (CRL), which is publicly announced by the CA, so that vehicles can be aware of the CRL.

[0003] In conventional technology, a consortium blockchain system comprising supervisory nodes (e.g., CAs) and operational nodes (e.g., on-board vehicle devices) is commonly used to maintain publicly published CRLs. Each operational node stores the same revocation blockchain, which contains the certificate revocation records of all operational nodes. If a large volume of certificate revocation records is stored in the revocation blockchain, the operational node may be unable to store all of them due to the limited storage space of the node storing the revocation blockchain. As a result, some certificate revocation records are lost, and vehicle security is compromised.

[0004] The present application provides a method and apparatus for updating a certificate list. A certificate list stored in a first vehicle is updated based on a certificate record transmitted to a first vehicle by a network-side device, thereby reducing the certificate record that needs to be stored in the first vehicle and ensuring the integrity of the certificate list stored in the vehicle-mounted device of the first vehicle.

[0005] To achieve the aforementioned objectives, the following technical solutions are used in this application.

[0006] According to a first aspect, embodiments of the present application provide a method for updating a certificate list and relate to the field of communication technology. The method comprises the steps of: obtaining a certificate record—the certificate record is transmitted to a first vehicle by a network-side device, and the certificate record includes at least one revoked certificate or at least one valid certificate—and updating a certificate list stored in the first vehicle based on the certificate record—the certificate list is used to record a revoked certificate or a valid certificate of a device belonging to the first vehicle for the first vehicle, or to record a revoked certificate or a valid certificate of a device belonging to the first vehicle group for the first vehicle group, wherein the first vehicle group includes the first vehicle. The certificate list is used to record a revoked certificate or a valid certificate of a device belonging to the first vehicle for the first vehicle and does not include a revoked certificate or a valid certificate of a device not belonging to the first vehicle. Alternatively, the certificate list is used to record revoked or valid certificates of devices belonging to the first vehicle group for the first vehicle group, and does not include revoked or valid certificates of devices not belonging to the first vehicle group.

[0007] According to the process described above, in the present application, a certificate list stored in a first vehicle may be updated based on a certificate record containing at least one revoked certificate or at least one valid certificate. Since the certificate list records the revoked certificate or valid certificate of a device belonging to the first vehicle or the first vehicle group for the first vehicle or the first vehicle group, the certificate record that must be stored in the vehicle-mounted device of the first vehicle may be reduced. When the storage space of the vehicle-mounted device is limited, vehicle security is ensured by ensuring the integrity of the certificate list stored in the device to the maximum extent.

[0008] In a possible implementation, a certificate record is generated by a network-side device for a first vehicle or a first vehicle group, and each revoked certificate or each valid certificate within the certificate record is a certificate of a device belonging to the first vehicle or the first vehicle group.

[0009] In a possible implementation, a certificate record is generated by a network-side device for a first vehicle or a first vehicle group, and each revoked certificate or each valid certificate in the certificate record is a certificate of a device belonging to the first vehicle or the first vehicle group. The step of updating a list of certificates stored in the first vehicle based on the certificate record includes the step of adding each revoked certificate or each valid certificate in the certificate record to the list of certificates.

[0010] According to the aforementioned process, the network-side device generates a certificate record for the first vehicle or the first vehicle group, and then the first vehicle receives the certificate record transmitted by the network-side device, updates the certificate record, and stores the certificate record in the certificate list of the first vehicle. The certificate list of the first vehicle is used to store the certificate records of the first vehicle or the first vehicle group. The certificate list does not store the certificate records of all vehicles, but rather stores fewer contents. Therefore, if the storage space of the vehicle-mounted device is limited, vehicle security can be ensured by guaranteeing the integrity of the certificate records stored in the first vehicle to the maximum extent.

[0011] In a possible implementation, the step of updating a list of certificates stored in a first vehicle based on a certificate record includes determining at least one revoked certificate or at least one valid certificate of a device belonging to the first vehicle or first vehicle group in the certificate record, and adding at least one revoked certificate or at least one valid certificate of a device belonging to the first vehicle or first vehicle group to the list of certificates.

[0012] According to the aforementioned process, after acquiring the certificate record, the network-side device directly transmits the certificate record to the first vehicle, and the first vehicle determines the revoked certificate or valid certificate belonging to the first vehicle or the first vehicle group, renews the revoked certificate or valid certificate belonging to the first vehicle or the first vehicle group, and stores the revoked certificate or valid certificate belonging to the first vehicle or the first vehicle group in the certificate list. The certificate list does not store the certificate records of all vehicles, but rather stores fewer contents. Therefore, if the storage space of the vehicle-mounted device is limited, vehicle security can be guaranteed by ensuring the integrity of the certificate record stored in the first vehicle to the maximum extent.

[0013] In a possible implementation, the certificate list further includes a revoked certificate or a valid certificate of a device belonging to a second vehicle, and the second vehicle is a vehicle other than the first vehicle in the first vehicle group. The revoked certificate or a valid certificate of a device belonging to the second vehicle is used to attempt to authenticate the second vehicle by the first vehicle.

[0014] According to the process described above, the certificate list further includes a certificate record of a second vehicle belonging to the same vehicle group as the first vehicle, thereby enabling the first vehicle to attempt to authenticate the second vehicle based on the certificate list, thereby ensuring communication security between the vehicles of the first vehicle group.

[0015] In a possible implementation, the step of updating a certificate list stored in a first vehicle based on a certificate record comprises: obtaining an identifier of a first certificate list data block — the first certificate list data block is a data block corresponding to a certificate list prior to the update — and generating an updated certificate list data block based on the identifier of the first certificate list data block and the certificate record — the updated certificate list data block includes a block header and a block body, the block header of the updated certificate list data block includes the identifier of the first certificate list data block, and the block body of the updated certificate list data block includes the certificate record —.

[0016] According to the process described above, vehicle security can be enhanced by storing the certificate records of the certificate list in the form of a blockchain, thereby ensuring the security of the certificate records stored in the certificate list. Additionally, the updated certificate list data block includes a block header and a block body; the block header includes an identifier of the first certificate list data block, and the block body includes the certificate records. That is, the updated certificate list data block includes only the newly added certificate records and the identifier of the first certificate list data block, and does not repeatedly store previous certificate records. Therefore, the volume of the updated certificate list data block is relatively small. When the storage space of the in-vehicle device is limited, vehicle security can be ensured by maximally guaranteeing the integrity of the certificate records stored in the first vehicle.

[0017] In a possible implementation, the block header of the updated certificate list data block further includes the identifier of the certificate record.

[0018] In a possible implementation, the block body of the updated certificate list data block further includes a first certificate list data block.

[0019] In a possible implementation, the identifier of the first certificate list data block is a hash value generated based on the first certificate list data block, and the identifier of the certificate record is a hash value generated based on the certificate record.

[0020] In a possible implementation, before updating a list of certificates stored in a first vehicle based on a certificate record, the method includes the step of attempting to verify a certificate record based on signature information within the certificate record, and, if the verification is successful, the step of updating a list of certificates stored in the first vehicle based on the certificate record.

[0021] In possible implementations, a revoked certificate includes one or more of a vehicle identifier, a device identifier, or a device type. A valid certificate includes one or more of a vehicle identifier, a device identifier, or a device type. Device types include network-connected devices and non-network-connected devices. A network-connected device is a vehicle-mounted device located within a vehicle that communicates with an external device (e.g., a vehicle-mounted device in another vehicle or a network-side device). A non-network-connected device is a vehicle-mounted device located within a vehicle that communicates with an external device using a network-connected device.

[0022] In possible implementations, the device identifier includes the vehicle identifier.

[0023] Compared to the prior art of searching a database for the identifier of the vehicle where the vehicle-mounted device is located, based on the device identifier of the vehicle-mounted device, the present application includes the identifier of the vehicle where the vehicle-mounted device is located in the device identifier of the vehicle-mounted device, and binding between the vehicle-mounted device and the vehicle can be implemented. In this way, when transmitting a certificate record, the network-side device directly determines the vehicle where the vehicle-mounted device is located based on the identifier of the vehicle-mounted device, thereby improving the efficiency of transmitting the certificate record by the network-side device.

[0024] According to a second aspect, an embodiment of the present application provides a method for updating a certificate list and relates to the field of communication technology. The method comprises the step of transmitting a certificate record to a first vehicle, wherein the certificate record comprises at least one revoked certificate or at least one valid certificate, and the certificate record is used by the first vehicle to update a certificate list stored in the first vehicle. The certificate list is used to record a revoked certificate or a valid certificate of a device belonging to the first vehicle for the first vehicle, and does not include a revoked certificate or a valid certificate of a device not belonging to the first vehicle. Alternatively, the certificate list is used to record a revoked certificate or a valid certificate of a device belonging to the first vehicle group for the first vehicle group, and does not include a revoked certificate or a valid certificate of a device not belonging to the first vehicle group. The first vehicle group includes the first vehicle.

[0025] In a possible implementation, at least one revoked certificate or at least one valid certificate is a certificate of a device belonging to a first vehicle or a first vehicle group, and before transmitting a certificate record to the first vehicle, the method comprises the steps of determining at least one revoked certificate or at least one valid certificate of a device belonging to a first vehicle or a first vehicle group, and generating a certificate record of the first vehicle or a first vehicle group based on at least one revoked certificate or at least one valid certificate of a device belonging to a first vehicle or a first vehicle group.

[0026] In a possible implementation, the step of determining at least one revoked certificate or at least one valid certificate of a device belonging to a first vehicle or a first vehicle group includes determining at least one revoked certificate or at least one valid certificate of a device belonging to a first vehicle or a first vehicle group based on a device identifier or vehicle identifier within the revoked certificate or the valid certificate.

[0027] In a possible implementation, the step of determining at least one revoked certificate or at least one valid certificate of a device belonging to a first vehicle or a first vehicle group includes the step of determining at least one revoked certificate or at least one valid certificate of a device belonging to a first vehicle or a first vehicle group by querying a vehicle certificate management system.

[0028] In a possible implementation, before generating a certificate record, the method further comprises the step of determining by a network-side device that a device corresponding to at least one revoked certificate does not include a network-connected device — the network-connected device is a network-connected device of the first vehicle — and the step of transmitting the certificate record to the first vehicle by the network-side device comprises the step of transmitting the certificate record to a network-connected device of the first vehicle. The network-connected device of the first vehicle is a vehicle-mounted device located in the first vehicle and configured to communicate with an external device (e.g., a vehicle-mounted device or a network-side device in another vehicle).

[0029] In a possible implementation, before generating a certificate record, the method further comprises the steps of: determining that a device corresponding to at least one revoked certificate includes a network-connected device—the network-connected device is a network-connected device of the first vehicle—notifying a user of the first vehicle to re-register the network-connected device, and, if it is determined that the user has re-registered the network-connected device, transmitting the certificate record to the first vehicle. The step of transmitting the certificate record to the first vehicle includes transmitting the certificate record to a network-connected device within the first vehicle.

[0030] In a possible implementation, a revoked certificate includes one or more of a vehicle identifier, a device identifier, or a device type. A valid certificate includes one or more of a vehicle identifier, a device identifier, or a device type. Device types include network-connected devices and network-non-connected devices. A network-connected device is a vehicle-mounted device located within a vehicle that communicates with an external device (e.g., a vehicle-mounted device in another vehicle or a network-side device). A network-non-connected device is a vehicle-mounted device located within a vehicle that communicates with an external device using a network-connected device.

[0031] In possible implementations, the device identifier includes the vehicle identifier.

[0032] In a possible implementation, the certificate list includes a revoked certificate or a valid certificate of a device belonging to a second vehicle, and the second vehicle is a vehicle other than the first vehicle within the first vehicle group. The revoked certificate or a valid certificate of a device belonging to the second vehicle is used to attempt to authenticate the second vehicle by the first vehicle.

[0033] According to a third aspect, an embodiment of the present application provides a certificate list updating device. The device is applied to a first vehicle and includes an acquisition unit and an update unit. The acquisition unit is configured to acquire a certificate record. The certificate record is transmitted to the first vehicle by a network-side device, and the certificate record includes at least one revoked certificate or at least one valid certificate. The update unit is configured to update a certificate list stored in the first vehicle based on the certificate record, wherein the certificate list is used to record a revoked certificate or a valid certificate of a device belonging to the first vehicle for the first vehicle, and does not include a revoked certificate or a valid certificate of a device not belonging to the first vehicle. Alternatively, the certificate list is used to record a revoked certificate or a valid certificate of a device belonging to the first vehicle group for the first vehicle group, and does not include a revoked certificate or a valid certificate of a device not belonging to the first vehicle group. The first vehicle group includes the first vehicle.

[0034] In a possible implementation, a certificate record is generated by a network-side device for a first vehicle or a first vehicle group, and each revoked certificate or each valid certificate within the certificate record is a certificate of a device belonging to the first vehicle or the first vehicle group.

[0035] In a possible implementation, the renewal unit is configured to update the list of certificates stored in the first vehicle based on the certificate record, which includes adding each revoked certificate or each valid certificate in the certificate record to the list of certificates.

[0036] In a possible implementation, the renewal unit is configured to update a list of certificates stored in a first vehicle based on a certificate record, which includes determining at least one revoked certificate or at least one valid certificate of a device belonging to the first vehicle or the first vehicle group within the certificate record, and adding at least one revoked certificate or at least one valid certificate of a device belonging to the first vehicle or the first vehicle group to the list of certificates.

[0037] In a possible implementation, the certificate list further includes a revoked certificate or a valid certificate of a device belonging to a second vehicle, and the second vehicle is a vehicle other than the first vehicle within the first vehicle group. The revoked certificate or a valid certificate of a device belonging to the second vehicle is used to attempt to authenticate the second vehicle by the first vehicle.

[0038] In a possible implementation, the renewal unit is configured to update a certificate list stored in a first vehicle based on a certificate record, comprising obtaining an identifier of a first certificate list data block — the first certificate list data block is a data block corresponding to a certificate list prior to renewal — and generating a renewed certificate list data block based on the identifier of the first certificate list data block and the certificate record — the renewed certificate list data block comprises a block header and a block body, the block header of the renewed certificate list data block comprises the identifier of the first certificate list data block, and the block body of the renewed certificate list data block comprises the certificate record —.

[0039] In a possible implementation, the block header of the updated certificate list data block further includes the identifier of the certificate record.

[0040] In a possible implementation, the block body of the updated certificate list data block further includes a first certificate list data block.

[0041] In a possible implementation, the identifier of the first certificate list data block is a hash value generated based on the first certificate list data block, and the identifier of the certificate record is a hash value generated based on the certificate record.

[0042] In a possible implementation, before the renewal unit is configured to update the certificate list of the first vehicle or the first group of vehicles based on the certificate record, the device further includes a verification unit configured to attempt to verify the certificate record based on signature information within the certificate record. The renewal unit is also configured to update the certificate list stored in the first vehicle based on the certificate record if the verification is successful.

[0043] In possible implementations, a revoked certificate includes one or more of a vehicle identifier, a device identifier, or a device type. A valid certificate includes one or more of a vehicle identifier, a device identifier, or a device type.

[0044] In possible implementations, the device identifier includes the vehicle identifier.

[0045] According to a fourth aspect, the present application provides a certificate renewal device. The device is applied to a network-side device and includes a transmission unit configured to transmit a certificate record to a first vehicle. The certificate record includes at least one revoked certificate or at least one valid certificate, and the certificate record is used by the first vehicle to update a certificate list stored in the first vehicle. The certificate list is used to record a revoked certificate or a valid certificate of a device belonging to the first vehicle for the first vehicle, and does not include a revoked certificate or a valid certificate of a device not belonging to the first vehicle. Alternatively, the certificate list is used to record a revoked certificate or a valid certificate of a device belonging to the first vehicle group for the first vehicle group, and does not include a revoked certificate or a valid certificate of a device not belonging to the first vehicle group. The first vehicle group includes the first vehicle.

[0046] In a possible implementation, at least one revoked certificate or at least one valid certificate is a certificate of a device belonging to a first vehicle or a first vehicle group, and before the transmission unit is configured to transmit a certificate record to the first vehicle, the device includes a determination unit configured to determine at least one revoked certificate or at least one valid certificate of a device belonging to the first vehicle or a first vehicle group, and a generation unit configured to generate a certificate record of the first vehicle or a first vehicle group based on at least one revoked certificate or at least one valid certificate of a device belonging to the first vehicle or a first vehicle group.

[0047] In a possible implementation, the determination unit is configured to determine at least one revoked certificate or at least one valid certificate of a device belonging to a first vehicle or a first vehicle group, based on a device identifier or vehicle identifier within the revoked certificate or at least one valid certificate of a device belonging to a first vehicle or a first vehicle group.

[0048] In a possible implementation, the determination unit is configured to determine at least one revoked certificate or at least one valid certificate of a device belonging to a first vehicle or a first vehicle group by querying a vehicle certificate management system.

[0049] In a possible implementation, before a generating unit is configured to generate a certificate record of the first vehicle or the first vehicle group based on a revoked certificate or a valid certificate of a device belonging to the first vehicle or the first vehicle group, the device comprises a determination unit configured to determine that a device corresponding to at least one revoked certificate does not include a network-connected device, wherein the network-connected device is a network-connected device of the first vehicle. A transmission unit configured to transmit a certificate record to the first vehicle comprises transmitting the certificate record to a network-connected device within the first vehicle. A network-connected device of the first vehicle is a vehicle-mounted device located within the first vehicle and configured to communicate with an external device (e.g., a vehicle-mounted device or a network-side device within another vehicle).

[0050] In a possible implementation, before the generating unit is configured to generate a certificate record based on a revoked certificate or a valid certificate of a device belonging to the first vehicle or the first vehicle group, the device comprises a determination unit configured to determine that a device corresponding to at least one revoked certificate includes a network-connected device, wherein the network-connected device is a network-connected device of the first vehicle. A notification unit is configured to notify a user of the first vehicle to re-register the network-connected device. The determination unit is also configured to determine that the user has re-registered the network-connected device. A transmission unit configured to transmit the certificate record to the first vehicle comprises transmitting the certificate record to a network-connected device within the first vehicle.

[0051] In possible implementations, a revoked certificate includes one or more of a vehicle identifier, a device identifier, or a device type. A valid certificate includes one or more of a vehicle identifier, a device identifier, or a device type. Device types include network-connected devices and network-non-connected devices. A network-connected device is a vehicle-mounted device located within a vehicle that communicates with an external device (e.g., a vehicle-mounted device in another vehicle or a network-side device). A network-non-connected device is a vehicle-mounted device located within a vehicle that communicates with an external device using a network-connected device.

[0052] In possible implementations, the device identifier includes the vehicle identifier.

[0053] In a possible implementation, the certificate list further includes a revoked certificate or a valid certificate of a device belonging to a second vehicle, and the second vehicle is a vehicle other than the first vehicle in the first vehicle group. The revoked certificate or a valid certificate of a device belonging to the second vehicle is used to attempt to authenticate the second vehicle by the first vehicle.

[0054] According to a fifth aspect, the present application further provides a certificate list updating device comprising a processor and a memory. The memory is configured to store computer program instructions, and the processor is configured to execute computer program instructions so that the certificate list updating device performs a certificate list updating method according to a first aspect.

[0055] According to a sixth aspect, the present application further provides a certificate list updating device comprising a processor and a memory. The memory is configured to store computer program instructions, and the processor is configured to execute computer program instructions so that the certificate list updating device performs a certificate list updating method according to a second aspect.

[0056] According to a seventh aspect, the present application further provides a computer-readable storage medium comprising computer instructions. When the computer instructions are executed by a processor, the certificate list updating device is able to perform a certificate list updating method according to a first aspect or a second aspect.

[0057] According to the eighth aspect, the present application further provides a computer program product. When the computer program product is executed on a processor, the certificate list updating device is able to perform a certificate list updating method according to the first aspect or the second aspect.

[0058] According to the ninth aspect, the present application further provides a certificate list renewal system. The system includes a certificate list renewal device according to the third aspect and a certificate list renewal device according to the fourth aspect.

[0059] According to the tenth aspect, the present application further provides a certificate list renewal system. The system includes a certificate list renewal device according to the fifth aspect and a certificate list renewal device according to the sixth aspect. Brief explanation of the drawing

[0060] To more clearly explain the embodiments of the present application or technical solutions in the prior art, the following is a brief description of the accompanying drawings illustrating the embodiments or prior art. FIG. 1(a) is a schematic diagram of a vehicle digital authentication scenario according to an embodiment of the present application. FIG. 1(b) is a schematic diagram of another vehicle digital authentication scenario according to an embodiment of the present application. FIG. 2 is a flowchart of a method for updating a certificate list according to an embodiment of the present application. FIG. 3 is a flowchart of a method for updating a certificate list according to an embodiment of the present application. FIG. 4 is a flowchart for obtaining a revoked certificate or a valid certificate by a network-side device according to an embodiment of the present application. FIG. 5 is a flowchart of a method for performing device registration with an OEM (original equipment manufacturer) according to an embodiment of the present application. FIG. 6 is a flowchart of a method for updating a certificate list according to an embodiment of the present application. FIG. 7 is a flowchart of a method for updating a certificate list according to an embodiment of the present application. FIG. 8 is a structural block diagram of a certificate list renewal device according to an embodiment of the present application. FIG. 9 is a structural block diagram of a certificate list renewal device according to an embodiment of the present application. FIG. 10 is a structural block diagram of a certificate list renewal device according to an embodiment of the present application. Specific details for implementing the invention

[0061] To clarify the purpose, technical solution, and advantages of the embodiments of the present application, the technical solution of the embodiments of the present application is described below with reference to the accompanying drawings. It is evident that the described embodiments are only a part, not all, of the embodiments of the present application. All other embodiments obtained by a person skilled in the art without original effort based on the embodiments of the present invention will fall within the scope of protection of the present application.

[0062] To address the problem of the prior art, where the loss of some certificate records poses a threat to vehicle security when the vehicle-mounted device needs to store a relatively large amount of certificate records due to the limited storage space of the vehicle-mounted device, the present application provides a method for updating a certificate list. This method is applied to a digital authentication scenario of a vehicle, which includes a network-side device, a vehicle, etc., as illustrated in FIG. 1(a). In the digital authentication scenario, the number of vehicles is n (n≥1), and the n vehicles may belong to the same vehicle group or different vehicle groups. For a description of vehicle groups, see the following. Details are not described again herein.

[0063] The network-side device may be one or more cloud servers (not shown in the drawing).

[0064] The network-side device is configured to acquire at least one revoked certificate after the certificate of at least one device within the vehicle (the certificate may be a digital certificate) is revoked. The at least one revoked certificate may be a certificate of devices belonging to the same vehicle or a certificate of devices belonging to different vehicles. Subsequently, the network-side device generates a relevant certificate record based on the acquired at least one revoked certificate and transmits the generated certificate record to the vehicle. The network-side device is also configured to acquire at least one valid certificate after the certificate of at least one device within the vehicle is renewed. The at least one valid certificate may be a certificate of devices belonging to the same vehicle or a certificate of devices belonging to different vehicles. Subsequently, the network-side device generates a relevant certificate record based on the acquired at least one valid certificate and transmits the generated certificate record to the vehicle. Optionally, the network-side device is also configured to attempt to verify the revoked certificate or valid certificate received by the network-side device after receiving the revoked certificate or valid certificate in order to ensure security attributes such as the authenticity and validity of the revoked certificate or valid certificate. If verification is successful, the network-side device is configured to generate a certificate record based on the acquired revoked or valid certificate, and the certificate record includes signature information written to the certificate record by the CA using a private key.

[0065] The vehicle is configured to receive a certificate record transmitted by a network-side device and to update the list of certificates stored in the vehicle based on the certificate record. Optionally, the vehicle is also configured to attempt to verify signature information, etc., within the certificate record after receiving it, in order to ensure security attributes such as the authenticity and validity of the certificate record. If the verification is successful, the vehicle updates the list of certificates stored in the vehicle based on the certificate record.

[0066] Vehicle 1 illustrated in FIG. 1(a) is used as an example. Vehicle-mounted devices within the vehicle include a telematics box (T-Box), a gateway (GW), on-board diagnostics (OBD), a body control module (BCM), a human machine interface (HMI), a vehicle control unit (VCU), a mobile data center (MDC), passive entry passive start (PEPS), electronic control units (ECU) 1, ECU 2, ECU 3, ECU 4, wireless power transmission (WPT), a battery management system (BMS), ECU 5, sensor 1, sensor 2, etc.

[0067] Optionally, in an embodiment of the present application, the device in the vehicle is a vehicle-mounted device and may be classified into a network-connected device and a network-non-connected device. A network-connected device is a vehicle-mounted device configured to communicate with an external device (e.g., a vehicle-mounted device or a network-side device in another vehicle) within the vehicle where the network-connected device is located. A network-non-connected device is a device configured to communicate with a vehicle-mounted device or a network-side device in another vehicle using a network-connected device within the vehicle where the network-non-connected device is located. Vehicle 1 illustrated in FIG. 1(a) is used as an example. The device type of the T-Box device in Vehicle 1 is a network-connected device, and the device type of the vehicle-mounted devices other than the network-connected device (T-Box device) in Vehicle 1, such as BCM, MDC, and ECU 1, is a network-non-connected device. Optionally, the network-connected device in the vehicle may alternatively be an in-vehicle infotainment (IVI) system, etc.

[0068] The T-Box is a network-connected device and is configured to communicate with external devices, namely, vehicle-mounted devices or network-side devices within vehicles other than the vehicle in which the T-Box is located. For example, in an embodiment of the present application, the T-Box receives a certificate record from a network-side device of a vehicle-mounted device belonging to the vehicle (or vehicle group) in which the T-Box is located. The certificate record includes a revoked certificate or a valid certificate of a vehicle-mounted device belonging to the vehicle (or vehicle group) in which the T-Box is located. Additionally, the T-Box is configured to attempt to verify the certificate record based on signature information, etc., within the received certificate record to ensure security attributes such as the authenticity and validity of the certificate record. Furthermore, the T-Box is configured to transmit the certificate record to another vehicle-mounted device, i.e., a network-nonconnected device, for verification after the certificate record received by the T-Box has been verified by the T-Box, or to discard the certificate record if the certificate record has not been verified by the T-Box. Additionally, the T-Box is configured to update the list of certificates stored in the vehicle where the T-Box is located based on the certificate record after the certificate record received by the T-Box is verified by a network-nonconnected device. Additionally, the T-Box is configured to discard the certificate record received by the T-Box if the certificate record received by the T-Box cannot be verified by another vehicle-mounted device. Furthermore, the T-Box is configured to communicate with a network-nonconnected device within the vehicle where the T-Box is located using a gateway (GW) or the like within the vehicle. For example, in the present application, the T-Box transmits the updated list of certificates to another vehicle-mounted device within the vehicle where the T-Box is located using the GW or the like.

[0069] The GW is a network-nonconnected device and is configured to implement communication between other network-nonconnected devices within the vehicle where the GW is located and a network-connected device (T-Box), or communication between network-nonconnected devices. For example, the GW receives a certificate record from the T-Box and attempts to verify the signature information within the received certificate record to ensure security attributes such as the authenticity and validity of the certificate record. If the certificate record received by the GW can be verified by the GW, the GW transmits the received certificate record to a network-nonconnected device within the vehicle where the GW is located, such as the OBD. If the certificate record received by the GW cannot be verified by the GW—that is, if verification fails—the GW notifies the network-connected device (T-Box) that the certificate record cannot be verified by the GW, causing the T-Box to discard the certificate record.

[0070] The OBD is a non-networked device used to detect failures in systems or components related to the control system and to warn the driver and others if a failure occurs. Additionally, the OBD is configured to communicate with other onboard devices (including networked and non-networked devices) in the vehicle where the OBD is located using a Gateway (GW), or to communicate with network-side devices using a Gateway and a T-Box. Furthermore, the OBD is configured to verify signature information, etc., within certificate records received from the Gateway to ensure security attributes such as the authenticity and validity of certificate records. If verification is successful, the OBD notifies the networked device (T-Box) that the certificate record can be verified by the OBD. If verification fails, the OBD discards the received certificate record and notifies the T-Box that the certificate record cannot be verified by the OBD. Optionally, the OBD is also configured to receive an updated certificate list generated by the T-Box.

[0071] In this embodiment of the present application, network-agnostic devices within a vehicle, such as a BCM, HMI, VCU, and MDC, are domain controllers, and these four domain controllers correspond to Domain 1, Domain 2, Domain 3, and Domain 4. The BCM is a key controller of the vehicle and is configured to control electrical components of the vehicle body, such as rain wipers, power windows, door locks, or lamps. Domain 1, corresponding to the BCM, includes devices such as PEPS, ECU 1, and ECU 2. PEPS is configured to enable a driver to enter the vehicle or start the vehicle in the absence of a key. ECU 1 and ECU 2 are microcontrollers within the vehicle and are configured to control the vehicle. Domain 2, corresponding to the HMI, includes devices such as ECU 3 and ECU 4. The HMI is configured to establish a connection between a person and a computer and is also configured to implement information transmission by exchanging information. ECU 3 and ECU 4 are microcontrollers within the vehicle and are configured to control the vehicle. Domain 3, corresponding to the VCU, includes devices such as WPT, BMS, and ECU 5. The VCU is configured to acquire driver control information, vehicle driving information, etc., transmit control commands to other devices, and control and drive the vehicle in various operating states in conjunction with the motor, battery, engine, etc. WPT is a technology that transmits energy using electromagnetic fields or electromagnetic waves. The BMS is configured to establish a connection between the battery and the user to improve battery utilization and reduce battery overcharging and over-discharging. ECU 5, etc., are microcontrollers within the vehicle and are configured to control the vehicle. Domain 4, corresponding to the MDC, includes Sensor 1, Sensor 2, etc. The MDC is configured to collect data acquired by sensors such as Sensor 1 and Sensor 2—data used for autonomous driving—and to transmit the data to other devices using the GW.In addition to the OBD, other vehicle-mounted devices within the vehicle, such as a domain controller and an intra-domain device, are also configured to receive a certificate record transmitted by a network-connected device and to attempt to verify the signature information within the certificate record to ensure security attributes such as the authenticity and validity of the certificate record. Other vehicle-mounted devices within the vehicle, such as a domain controller and an intra-domain device, are also configured to transmit the verification results to a network-connected device (T-Box) so that the T-Box revokes the certificate record based on the verification results for the certificate record, or updates the list of certificates stored in the vehicle where the network device is located based on the verification results for the certificate record and the certificate record.

[0072] Additionally, the domain controller is configured to attempt to verify the device certificates of domain-internal devices within the domain to which the domain controller belongs, in order to ensure security attributes such as the authenticity and validity of the device certificates (digital certificates). If verification is successful, the domain-internal devices can communicate with other devices using the domain controller and gateway. Devices in different domains communicate with each other using the domain controller of the domain to which they belong. Devices in the same domain can communicate directly with each other. Optionally, if devices in different domains are directly connected, for example, if devices in different domains are directly connected using Bluetooth, devices in different domains can communicate directly with each other. That is, the T-Box, OBD, BCM, HMI, VCU, and MDC within Vehicle 1 communicate with each other using the gateway, or alternatively, the T-Box, OBD, BCM, HMI, VCU, and MDC can communicate directly with each other. The domain controller and domain-internal devices are network-agnostic devices.

[0073] For example, if ECU 5 of Domain 3 needs to communicate with ECU 2 of Domain 1 and ECU 5 is not directly connected to ECU 2, ECU 2 and ECU 5 communicate with each other using BCM, VCU, and GW. If ECU 5 of Domain 3 needs to communicate with ECU 2 of Domain 1 and ECU 5 is directly connected to ECU 2 using Bluetooth, ECU 2 and ECU 5 can communicate with each other using BCM, VCU, and GW, or they can communicate directly with each other using Bluetooth.

[0074] Optionally, after a domain internal device, i.e., a device in Domains 1 through 4, is activated, the domain controller is also configured to attempt to verify the identity of the activated domain internal device—that is, to verify the device certificate of the domain internal device—in order to ensure security attributes such as the authenticity, validity, and validity of the device certificate. If the verification of the device certificate is successful, the identity of the device in the domain is determined to be valid, and the activated domain internal device can be executed normally. Alternatively, before a vehicle function is used, the domain controller and the domain internal device associated with that function are determined, and then the network-connected device attempts to verify the device certificate of the device associated with that function to determine the validity of the device's identity. If the verification of the device certificate of the device associated with this function is successful, the identity of the device can be determined to be valid, and the device can be used normally. If the verification fails, the unverified device is disabled, or the corresponding function is disabled.

[0075] In a possible implementation, the valid certificate of the device is a device certificate capable of guaranteeing the validity of the device's identity, and the device certificate may be a digital certificate. Generally, the device certificate of the device is valid for a specific period, and that specific period is the validity period of the device certificate of the device. When verification of the device's identity is performed, the device identifier of the device is determined. If the device identifier within the device certificate of the device is identical to this device identifier and the device certificate has not expired or has not been revoked, the device certificate can be verified. That is, the validity of the device corresponding to the device certificate is verified. If the device identifier within the device certificate of the device is different from this device identifier, or if the device certificate is an expired or revoked certificate, the device certificate cannot be verified. That is, the identity of the device corresponding to the device certificate is invalid.

[0076] In a possible implementation, the validity of the device certificate is further guaranteed by using the private key stored in the device corresponding to the digital certificate and the validity period of the digital certificate. The network-side device signs the device certificate using the private key (i.e., obtains encrypted information by encrypting the public key and device identifier). In this case, the network-connected device and the vehicle-mounted device may attempt to verify the signature information of the device certificate using the private key stored in the network-connected device and the vehicle-mounted device (i.e., obtains the public key and device identifier by decrypting the encrypted information using the private key). If the verification is successful (i.e., if the obtained public key and device identifier are identical to the encrypted information), and the device certificate has not expired and has not been revoked, the device certificate is verified and the device corresponding to the device certificate is valid.

[0077] For example, to enable the autonomous driving function, the VCU must attempt to verify the MDC's device certificate to determine the validity of the MDC's identity. The HMI and MDC must attempt to verify each other's device certificates to determine the validity of their identities. After successful verification, the identities of the VCU, HMI, and MDC are valid, and the autonomous driving function can be activated normally. Optionally, the autonomous driving function associated with the VCU, HMI, and MDC can be used normally.

[0078] According to the process described above, first, in this embodiment of the present application, the validity of the device identity can be guaranteed by using the device's digital certificate. Before the device is used, verification of the digital certificate corresponding to the device is performed to ensure the security of the vehicle by preventing unauthorized devices from monitoring the vehicle or transmitting commands that interfere with the vehicle. Second, in this embodiment of the present application, verification of a certificate record including a revoked certificate or a valid certificate is performed to ensure the authenticity and validity of the certificate record, thereby ensuring the security of the vehicle. Third, in this embodiment of the present application, the certificate record is generated by the network-side device based on the revoked certificate or the valid certificate received by the network-side device. Therefore, when the certificate list is updated, only the newly added certificate record is updated. When the storage space of the vehicle-mounted device is limited, the certificate record related to the vehicle is stored to the maximum extent possible, thereby reducing the loss of certificate records and ensuring the security of the vehicle.

[0079] In addition to the application scenario illustrated in FIG. 1(a), this embodiment of the present application may also be applied to device authentication within a vehicle based on a central computing architecture (CCA). Refer to FIG. 1(b). The central computing architecture includes a plurality of vehicle integrated / integration units (VIUs) and a plurality of automotive components. The plurality of VIUs form a ring network to achieve high bandwidth, low latency, and high reliability processing capabilities. This simplifies the configuration of the vehicle-mounted network and improves upgrade and maintenance efficiency. The plurality of automotive components may be connected to the VIUs and may be connected to a domain controller (DC), for example, a cockpit domain controller (CDC), a mobile data center (MDC) (or referred to as an intelligent computing center), or a vehicle domain control (VDC) using the VIUs. This helps reduce the harness length in a system for implementing electronic control functions of an automobile by avoiding the requirement that each automobile component must be connected to a domain controller (DC) through its own harness in a conventional system for implementing electronic control functions of an automobile.

[0080] For the specific operation processes of the aforementioned network-side device and vehicle, refer to the corresponding processes of the following method embodiments. Details are not described again herein.

[0081] Before the method embodiments of the present application are described in detail, first, the vehicle group of the present application is described as follows:

[0082] In possible implementations, vehicle groups may be classified based on the brand of the vehicle, the model of the vehicle, or the location of the vehicle. Of course, alternatively, vehicle groups may be classified according to other conditions, such as vehicle color, and this is not limited to the aforementioned classification methods.

[0083] For example, 20 vehicles currently parked in a parking lot are used as an example. The parking lot includes zones A and B. There are 15 vehicles in zone A and 5 vehicles in zone B. Among the 15 vehicles in zone A, 5 vehicles belong to brand a and 10 vehicles belong to brand b. Among the 5 vehicles in zone B, 3 vehicles belong to brand c and 2 vehicles belong to brand b. Among the vehicles belonging to brand a, 2 vehicles belong to series d and 3 vehicles belong to series e. Among the vehicles belonging to brand b, 8 vehicles belong to series f and 4 vehicles belong to series g. Among the vehicles belonging to brand c, 2 vehicles belong to series h and 1 vehicle belongs to series i. If the 20 vehicles are classified into vehicle groups based on zones A and B where the vehicles are located, two vehicle groups, vehicle group 1 and vehicle group 2, can be obtained. Fifteen vehicles in Zone A belong to Vehicle Group 1, and five vehicles in Zone B belong to Vehicle Group 2. If the 20 vehicles in the parking lot are classified into vehicle groups based on vehicle brand, three vehicle groups—Vehicle Group 1, Vehicle Group 2, and Vehicle Group 3—can be obtained. Vehicles of Brand a belong to Vehicle Group 1, vehicles of Brand b belong to Vehicle Group 2, and vehicles of Brand c belong to Vehicle Group 3. If the vehicle groups are classified based on vehicle model, six vehicle groups—Vehicle Group 1, Vehicle Group 2, Vehicle Group 3, Vehicle Group 4, Vehicle Group 5, and Vehicle Group 6—can be obtained. Vehicles of Series d belong to Vehicle Group 1, vehicles of Series e belong to Vehicle Group 2, vehicles of Series f belong to Vehicle Group 3, vehicles of Series g belong to Vehicle Group 4, vehicles of Series h belong to Vehicle Group 5, and vehicles of Series i belong to Vehicle Group 6.

[0084] To reduce the certificate records that need to be stored in a first vehicle or a first vehicle group and to ensure the integrity of the vehicle-mounted certificate list stored in a vehicle-mounted device, the present application provides a method for updating a certificate list. After acquiring a revoked certificate or a valid certificate, a network-side device generates a certificate record for the first vehicle or a first vehicle group based on the acquired revoked certificate or the acquired valid certificate. Then, the network-side device transmits the certificate record to the first vehicle. In response, the first vehicle acquires the certificate record for the first vehicle or the first vehicle group transmitted by the network-side device. Finally, the first vehicle updates the certificate list stored in the first vehicle based on the received certificate record. As illustrated in FIG. 2, the certificate list updating method mainly comprises the following steps S201 to S203.

[0085] S201: The network-side device generates a certificate record for the first vehicle or the first vehicle group based on the acquired revoked certificate or the acquired valid certificate.

[0086] The first vehicle group is any vehicle group among multiple vehicle groups, and the first vehicle is any vehicle within the first vehicle group. A certificate record generated by a network-side device is used by the first vehicle to update the list of certificates stored in the first vehicle. One or more certificate records may exist, and certificate records are generated by the network-side device for the first vehicle or the first vehicle group. Each revoked certificate or each valid certificate within the certificate record is a certificate of a device belonging to the first vehicle or the first vehicle group. The certificate list of the first vehicle is used to record the revoked certificates or valid certificates of devices belonging to the first vehicle for the first vehicle, and does not include the revoked certificates or valid certificates of devices not belonging to the first vehicle. Alternatively, the certificate list of the first vehicle is used to record the revoked certificates or valid certificates of devices belonging to the first vehicle group for the first vehicle group, and does not include the revoked certificates or valid certificates of devices not belonging to the first vehicle group.

[0087] Optionally, after the certificate of at least one device is revoked, the network-side device acquires at least one revoked certificate. After at least one device performs registration, the network-side device acquires at least one valid certificate. After acquiring the revoked certificate or the valid certificate, the network-side device generates a certificate record for a first vehicle or a first vehicle group based on the vehicle where the device corresponding to the revoked certificate or the valid certificate is located. The certificate record includes one or more revoked certificates or one or more valid certificates.

[0088] In a possible implementation, the network-side device obtains the number of a revoked certificate or a valid certificate and queries the vehicle certificate management system based on the number to obtain the revoked certificate or valid certificate corresponding to the number. The vehicle certificate management system may be located at the network-side device or at another device. The vehicle certificate management system is configured to manage device certificates of a vehicle, including revoked certificates of devices belonging to the vehicle and valid certificates of devices belonging to the vehicle. After the validity period of a device's valid certificate expires, the vehicle certificate management system may determine the valid certificate to be an invalid certificate, i.e., a revoked certificate. Alternatively, the vehicle certificate management system may determine the device's valid certificate to be a revoked certificate according to a command received by the vehicle certificate management system. The vehicle certificate management system stores the number of the revoked certificate and the number of the valid certificate, and also stores the certificate corresponding to the number of the revoked certificate or the number of the valid certificate, the identifier of the vehicle where the vehicle-mounted device corresponding to the revoked certificate or the valid certificate is located, the identifier of the vehicle-mounted device, the identifier of the vehicle within the vehicle group where the vehicle is located, and the device identifier of the network-connected device of the vehicle corresponding to each vehicle identifier.

[0089] It should be noted that the certificate records generated by the network-side device for the first vehicle or first vehicle group are generated based on newly added revoked certificates or newly added valid certificates. Therefore, the quantity of certificate records is relatively small. Compared to transmitting both existing certificate records and newly added certificate records to the device of the first vehicle for storage, transmitting only the newly added certificate records to the vehicle-mounted device of the first vehicle for storage minimizes the space required to store the currently received certificate list when the storage space of the vehicle-mounted device is limited, thereby reducing the loss of certificate records stored in the vehicle-mounted device, guaranteeing the integrity of the certificate list stored in the vehicle-mounted device, and ensuring vehicle security.

[0090] S202: The network-side device transmits the certificate record of the first vehicle or the first vehicle group to the first vehicle.

[0091] The network-side device transmits a certificate record generated by the network-side device for the first vehicle or the first vehicle group, based on the vehicle identifier of the first vehicle, to the network-connected device of the first vehicle. In response, the network-connected device of the first vehicle receives the certificate record of the first vehicle or the first vehicle group transmitted by the network-side device.

[0092] In a possible implementation, if the certificate record generated by the network-side device is the certificate record of the first vehicle, the certificate record includes the revoked certificate or valid certificate of the device belonging to the first vehicle. If the certificate record generated by the network-side device is the certificate record of the first vehicle group, the certificate record includes the revoked certificate or valid certificate of the device belonging to the first vehicle group.

[0093] It should be noted that, according to the process described above, in this application, the certificate records of the first vehicle or the first vehicle group are transmitted to the network-connected device of the first vehicle. Compared to the storage space in which the first vehicle stores the certificate records of all vehicles transmitted by the network-side device, the storage space in which the first vehicle stores the certificate records of the first vehicle or the first vehicle group is relatively small. Therefore, when the storage space of the vehicle-mounted device is relatively small, in this embodiment of the application, the loss of certificate records stored in the vehicle-mounted device of the first vehicle is reduced, thereby ensuring the integrity of the certificate records stored in the first vehicle and improving vehicle security.

[0094] S203: The first vehicle updates the list of certificates stored in the first vehicle based on the certificate records received by the first vehicle.

[0095] The network-connected device of the first vehicle adds each revoked certificate or each valid certificate within the certificate record received by the network-connected device of the first vehicle to the certificate list of the first vehicle, and transmits the certificate list to the network-non-connected device of the first vehicle to update the certificate list of the first vehicle. The certificate list includes the previously revoked certificate record or valid certificate and the newly added revoked certificate or newly added valid certificate.

[0096] In another possible implementation, a new certificate list is generated based on each revoked certificate or each valid certificate in a certificate record received by a network-connected device of the first vehicle, and the new certificate list is transmitted to a network-unconnected device in the first vehicle. The new certificate list includes only newly added revoked certificates or newly added valid certificates.

[0097] It should be noted that according to the process described above, the network-side device generates a certificate record for a first vehicle or a first vehicle group based on the vehicle in which the device corresponding to the revoked certificate or valid certificate obtained by the network-side device is located, transmits the certificate record to the first vehicle, and then the first vehicle updates the list of certificates stored in the first vehicle based on the received certificate record. The certificate record generated by the network-side device is a certificate record of a newly added revoked certificate or a newly added valid certificate, and this certificate record is for the first vehicle or a first vehicle group. The first vehicle receives a relatively small number of certificate records to be stored, and the storage space for storing the list of certificates obtained based on the certificate record is relatively small. Therefore, when the storage space of the vehicle-mounted device is limited, in this embodiment of the present application, the loss of certificate records to be stored in the vehicle-mounted device within the vehicle is reduced, thereby maximally ensuring the integrity of the list of certificates stored in the vehicle-mounted device within the vehicle and ensuring the security of the vehicle.

[0098] To reduce the certificate records that need to be stored in a vehicle-mounted device within a first vehicle and to ensure the integrity of the certificate list stored in the vehicle-mounted device, the present application further provides a method for updating a certificate list. As illustrated in FIG. 3, the method comprises steps S301 to S306.

[0099] S301: The network-side device obtains the revoked certificate or the valid certificate.

[0100] For a description of revoked or valid certificates, please refer to the following. Details are not described again here.

[0101] Optionally, after the certificate of at least one vehicle-mounted device is revoked, the network-side device obtains at least one revoked certificate. After at least one vehicle-mounted device performs registration or renewal, the network-side device obtains at least one valid certificate.

[0102] Optionally, after obtaining a revoked certificate or a valid certificate, the network-side device determines whether the vehicle-mounted device corresponding to the revoked certificate obtained by the network-side device includes a network-connected device. If the device corresponding to the revoked certificate obtained by the network-side device includes a network-connected device, the network-side device notifies the user of the first vehicle to re-register the network-connected device. After the user re-registers the network-connected device, the network-side device obtains a valid certificate for the network-connected device. In this case, the network-side device generates a certificate record based on the revoked certificate or valid certificate received before the re-registration of the network-connected device is completed, and the valid certificate for the network-connected device obtained after the re-registration of the network-connected device. If the vehicle-mounted device corresponding to the revoked certificate obtained by the network-side device does not include a network-connected device, the network-side device generates a certificate record based on the revoked certificate or valid certificate obtained by the network-side device.

[0103] In a possible implementation, as illustrated in FIG. 4, after acquiring a revoked certificate or a valid certificate, the network-side device determines whether the vehicle-mounted device corresponding to the revoked certificate acquired by the network-side device includes a network-connected device. If the vehicle-mounted device corresponding to the revoked certificate acquired by the network-side device includes a network-connected device, the network-side device determines whether the network-side device receives a valid certificate of the network-connected device, that is, whether the device certificate of the network-connected device is renewed. If the vehicle-mounted device corresponding to the revoked certificate acquired by the network-side device includes a network-connected device, and the network-side device further acquires a valid certificate of the network-connected device, that is, if the device certificate of the network-connected device is renewed, the network-side device no longer notifies the user to re-register the network-connected device and creates a certificate record based on the revoked certificate and the valid certificate received by the network-side device. If the device corresponding to the revoked certificate obtained by the network-side device includes a network-connected device, and the network-side device does not obtain a valid certificate for the network-connected device—that is, if the device certificate of the network-connected device is not renewed—the network-side device notifies the user to re-register the network-connected device and obtains a valid certificate for the network-connected device. Subsequently, the network-side device generates a certificate record based on the revoked certificate and the valid certificate obtained by the network-side device.If the vehicle-mounted device corresponding to the revoked certificate obtained by the network-side device does not include a network-connected device, that is, if it includes only network-non-connected devices, the network-side device generates a certificate record based on the revoked certificate or valid certificate obtained by the network-side device.

[0104] In a possible implementation, the network-side device obtains the number of a revoked certificate or a valid certificate and queries the vehicle certificate management system based on that number to obtain the revoked certificate or valid certificate corresponding to that number. The vehicle certificate management system may be located at the network-side device or at another device. The vehicle certificate management system is configured to manage device certificates of a vehicle, including revoked certificates of devices belonging to the vehicle and valid certificates of devices belonging to the vehicle. After the validity period of a device's valid certificate expires, the vehicle certificate management system may determine the valid certificate to be an invalid certificate, i.e., a revoked certificate. Alternatively, the vehicle certificate management system may determine a device's valid certificate to be a revoked certificate according to a command received by the vehicle certificate management system. The vehicle certificate management system stores the number of the revoked certificate and the number of the valid certificate, and additionally stores the identifier of the vehicle where the device corresponding to the revoked certificate or the valid certificate is located, the identifier of that device, the identifier of the vehicle within the vehicle group where the vehicle is located, and the device identifier of the network-connected device of the vehicle corresponding to each vehicle identifier.

[0105] S302: The network-side device determines at least one revoked certificate or at least one valid certificate belonging to the first vehicle or the first vehicle group.

[0106] Optionally, after obtaining a revoked certificate or a valid certificate in step S301, the network-side device determines at least one revoked certificate or at least one valid certificate of a device belonging to a first vehicle or a first vehicle group based on a device identifier or vehicle identifier (device identifier of a network-connected device or device identifier of a network-unconnected device) within the revoked certificate or the valid certificate.

[0107] In another possible implementation, after obtaining a revoked certificate or a valid certificate in step S301, the network-side device determines at least one revoked certificate or at least one valid certificate of a device belonging to the first vehicle or first vehicle group within the certificates obtained by the network-side device by querying the vehicle certificate management system.

[0108] In another possible implementation, a network-side device obtains the number of a revoked certificate or a valid certificate, and a user queries a vehicle certificate management system based on the number to determine the revoked certificate or valid certificate corresponding to the number, the vehicle in which the device corresponding to the revoked certificate or valid certificate is located, the vehicle group in which the vehicle is located, etc. Then, the network-side device determines at least one revoked certificate or at least one valid certificate of a device belonging to a first vehicle or first vehicle group based on the revoked certificate or valid certificate found in the vehicle certificate management system and the vehicle or vehicle group in which the device corresponding to the revoked certificate or valid certificate is located.

[0109] S303: The network-side device generates a certificate record of the first vehicle or the first vehicle group based on at least one revoked certificate or at least one valid certificate belonging to the first vehicle or the first vehicle group.

[0110] Optionally, the network-side device generates a certificate record of the first vehicle or the first vehicle group based on at least one revoked certificate or at least one valid certificate of a device belonging to the first vehicle or the first vehicle group.

[0111] In another possible implementation, a network-side device obtains the number of a revoked certificate or a valid certificate, and a user queries a vehicle certificate management system based on the number to determine the revoked certificate or valid certificate corresponding to the number, and determines the identifier of the vehicle where the device corresponding to the revoked certificate or valid certificate is located, the identifier of the vehicle group where the vehicle is located, and the identifiers of all vehicles within that vehicle group. Subsequently, the network-side device generates a certificate record for a first vehicle or a first vehicle group from the vehicle certificate management system based on the information obtained by the network-side device. The certificate record for the first vehicle includes the number of the revoked certificate or valid certificate of a device belonging to the first vehicle, the vehicle identifier of the first vehicle, the device identifier of the network-connected device of the first vehicle, and the device identifier of the device corresponding to the revoked certificate or valid certificate. The certificate record for the first vehicle group includes the number of the revoked certificate or valid certificate of a device belonging to the first vehicle group, the identifiers of all vehicles within the first vehicle group, the device identifiers of the network-connected devices of all vehicles within the first vehicle group, and the device identifiers of the device corresponding to the revoked certificate or valid certificate.

[0112] In a possible implementation, the CA performs steps S301 through S303. The CA and the vehicle certificate management system may be located on the same server of the network-side device or on different servers of the network-side device.

[0113] S304: The network-side device transmits the certificate record of the first vehicle or the first vehicle group to the first vehicle.

[0114] The network-side device transmits a certificate record of the first vehicle or the first vehicle group to the network-connected device of the first vehicle based on the vehicle identifier of the first vehicle. In response, the network-connected device of the first vehicle receives the certificate record of the first vehicle or the first vehicle group transmitted by the network-side device.

[0115] In another possible implementation, the network-side device transmits a certificate record of the first vehicle or the first vehicle group to all vehicles in the first vehicle group based on the identifiers of all vehicles in the first vehicle group. The first vehicle is located within the first vehicle group.

[0116] S305: The first vehicle attempts to verify the certificate record received by the first vehicle.

[0117] Optionally, after generating a certificate record, the network-side device uses a private key to write signature information to the certificate record. After receiving the certificate record of the first vehicle or the first vehicle group, the network-connected device of the first vehicle attempts to verify the signature information within the certificate record received by the network-connected device based on the private key stored in the network-connected device of the first vehicle. If verification is successful, for example, if the information obtained by the network-connected device of the first vehicle by decoding the signature information within the certificate record using the private key stored in the network-connected device is identical to the information written to the certificate record by the network-side device, the network-connected device of the first vehicle updates the certificate list stored in the first vehicle based on the certificate record received by the network-connected device of the first vehicle. If verification fails, the network-connected device of the first vehicle determines that the certificate record received by the network-connected device of the first vehicle is invalid or incorrect and discards the certificate record.

[0118] For example, the configuration of Vehicle 1 shown in FIG. 1(a) is used as an example. The T-Box attempts to verify the signature information within the certificate record received by the T-Box. If the verification is successful, the T-Box updates the list of certificates stored in the first vehicle based on the certificate record received by the T-Box. If the verification fails, the T-Box discards the received certificate record.

[0119] Optionally, the network-connected device of the first vehicle attempts to verify the certificate record received by the first vehicle, and if the verification is successful, the network-connected device transmits the certificate record to the vehicle-mounted device for verification. If the certificate record can be verified by a preset number of vehicle-mounted devices, the network-connected device of the first vehicle updates the list of certificates stored in the first vehicle based on the certificate record received by the network-connected device of the first vehicle. If the certificate record cannot be verified by the network-connected device, or at least cannot be verified by a preset number of vehicle-mounted devices, the network-connected device determines that the certificate record received by the network-connected device is invalid or incorrect and discards the certificate record.

[0120] For example, in the configuration of Vehicle 1 shown in FIG. 1(a), the preset quantity is 4. The T-Box is a network-connected device, and other vehicle-mounted devices within the vehicle are network-non-connected devices. The T-Box attempts to verify signature information in a certificate record received by the T-Box, and if the verification is successful, the T-Box transmits the certificate record received by the T-Box to the GW for verification. If the verification fails, the T-Box determines that the certificate record received by the T-Box is invalid or incorrect and discards the certificate record. For example, a certificate record received by the T-Box can be verified by the T-Box. The GW receives the certificate record transmitted by the T-Box and attempts to verify the signature information within the certificate record. If verification is successful, the certificate record is verified by two on-board devices, the GW and the T-Box, and the GW transmits the certificate record to domain controllers (e.g., BCM, HMI, VCU, and MDC) and other on-board devices communicating directly with the GW (e.g., OBD system) for verification. If verification fails, the GW notifies the T-Box that the certificate record is invalid, causing the T-Box to discard the certificate record. For example, the certificate record can be verified by the GW. The domain controllers and other on-board devices communicating directly with the GW attempt to verify the certificate record transmitted and received by the GW. If the certificate record can be verified by two of these on-board devices, the certificate record is verified by four on-board devices, the T-Box determines that the certificate record is valid, and updates the certificate list stored in the first vehicle based on the certificate record received by the T-Box. If the certificate record can be verified by only one domain controller, that one domain controller transmits the certificate record to the domain controller's internal domain devices.If the certificate record can be verified by at least one domain internal device, the certificate record has been verified by four vehicle-mounted devices, and the T-Box determines that the certificate record is valid and updates the certificate list stored in the first vehicle based on the certificate record received by the T-Box. If the certificate record cannot be verified by at least two vehicle-mounted devices within a vehicle-mounted device that communicates directly with the aforementioned domain controllers and the GW, the T-Box determines that the certificate record is invalid and discards the certificate record.

[0121] It should be noted that one or more certificate records received by the first vehicle may exist, and each certificate record includes signature information written by a network-side device. The vehicle-mounted device of the first vehicle attempts to verify the certificate records received by the vehicle-mounted device one by one, and can update the list of certificates stored in the first vehicle using the certificate records verified by the network-connected device and the network-connected device.

[0122] S306: The first vehicle updates the list of certificates stored in the first vehicle based on the received certificate record.

[0123] Optionally, the network-connected device of the first vehicle adds each revoked certificate or each valid certificate in the certificate record received by the network-connected device of the first vehicle to the certificate list of the first vehicle, and transmits the certificate list to the network-unconnected device of the first vehicle to update the certificate list of the first vehicle. The certificate list includes the previously revoked certificate record or valid certificate and the newly added revoked certificate or newly added valid certificate.

[0124] In another possible implementation, the network-connected device of the first vehicle generates a new certificate list based on each revoked certificate or each valid certificate in the certificate record received by the network-connected device of the first vehicle, and transmits the new certificate list to the network-unconnected device of the first vehicle. The new certificate list includes only newly added revoked certificates or newly added valid certificates.

[0125] Optionally, the certificate list of the first vehicle may be stored in the form of a certificate record received by a network-connected device of the first vehicle, or in another form, for example, in the form of a blockchain.

[0126] Optionally, the certificate list of the first vehicle is stored in the form of a blockchain on each vehicle-mounted device within the first vehicle. The first vehicle obtains an identifier for the first certificate list data block, which is a data block corresponding to the certificate list prior to renewal, i.e., a certificate list data block generated based on the certificate record last received by the network-connected device. Then, the network-connected device generates an updated certificate list data block based on the identifier of the first certificate list data block and the certificate record. The updated certificate list data block includes a block header, a block body, a block size, and the quantity of certificates (i.e., the quantity of revoked or valid certificates within the certificate record), i.e., the quantity of the certificate record. The block header of the updated certificate list data block includes the identifier of the first certificate list data block, and the block body of the updated certificate list data block includes the certificate record received by the first vehicle. Finally, the network-connected device transmits the generated updated certificate list data block to the network-unconnected device of the vehicle where the network-connected device is located.

[0127] In a possible implementation, the block header of the updated certificate list data block further includes the identifier of the certificate record received by the network-connected device, i.e., the identifier of the updated certificate list data block.

[0128] For example, the configuration of a renewed certificate list data block generated by a network-connected device is shown in Table 1 and includes a block size, a block header, a block body, and a quantity of certificates. The block size is 2 bytes. The block header includes the identifier of the previous block, i.e., the identifier of the first certificate list data block, and the identifier may be the hash value of the first certificate list data block and the Merkle root. The Merkle root is obtained by calculating based on the hash value of the previous block and the certificate record, i.e., the identifier of the renewed certificate list data block, i.e., the identifier of the certificate record. The size of the Merkle root is 32 bytes, and the hash value (identifier) ​​of the previous block is 32 bytes. The quantity of certificates, i.e., the quantity of revoked certificates and valid certificates within the certificate record, is 1 byte. The block body contains the certificate record.

[0129] Data items length Block size 2 bytes Block header Identifier of the previous block 32 bytes Merkle Root 32 bytes Certificate quantity 1 byte Block body Certificate records

[0130] In a possible implementation, the block body of the updated certificate list data block further includes a first certificate list data block. It should be noted that the certificate list of the first vehicle is stored in the form of a blockchain, and the updated certificate list data block and the first certificate list data block are connected using the identifiers of the two data blocks, so that the stored certificate records can be prevented from being tampered with, and the loss of certificate records is reduced by reducing the storage space used to store the certificate list, and the integrity and security of the certificate list stored in the network-connected device and the vehicle-mounted device are ensured.

[0131] Additionally, the list of certificates stored in the first vehicle includes revoked certificates or valid certificates belonging to the first vehicle, and further includes revoked certificates or valid certificates belonging to the second vehicle. The second vehicle is a vehicle other than the first vehicle within the first vehicle group. When the first vehicle within the first vehicle group communicates with the second vehicle within the first vehicle group, the first vehicle may attempt to verify the identity of the second vehicle based on signature information within the revoked certificate or valid certificate of the second vehicle in order to determine the validity of the identity of the second vehicle and to ensure the security of communication between the first vehicle and the second vehicle.

[0132] According to the aforementioned process, the certificate records transmitted to the first vehicle by the network-side device are certificate records of the first vehicle or the first vehicle group, and the quantity of certificate records is relatively small. The fewer certificate records the first vehicle has to store, the smaller the storage space used by the first vehicle to store the certificate list becomes. When the storage space of the in-vehicle device is limited, the loss of certificate records can be reduced, and the integrity and security of the certificate list stored in the network-connected device and the vehicle-mounted device can be guaranteed to the maximum extent.

[0133] The revoked or valid certificates mentioned in the previous content are explained as follows:

[0134] Optionally, the revoked certificate includes one or more of a vehicle identifier, a device identifier, or a device type, wherein the vehicle identifier is the identifier of the vehicle where the device corresponding to the revoked certificate is located, the device identifier is the device identifier of the vehicle-mounted device corresponding to the revoked certificate, and the device type includes a network-connected device or a network-non-connected device. Refer to the foregoing for the distinction between network-connected devices and network-non-connected devices. Details are not described again herein. The valid certificate includes one or more of a vehicle identifier, a device identifier, or a device type, wherein the vehicle identifier is the identifier of the vehicle where the device corresponding to the valid certificate is located, the device identifier is the device identifier of the vehicle-mounted device corresponding to the valid certificate, and the device type is a network-connected device or a network-non-connected device.

[0135] In a possible implementation, the device identifier includes a vehicle identifier, and the vehicle identifier is the vehicle identifier of the vehicle where the vehicle-mounted device corresponding to the device identifier is located. In this case, the device corresponding to the revoked certificate or the valid certificate is strongly bound to the vehicle where the device is located. When the identifier of the device corresponding to the revoked certificate or the valid certificate is determined, the identifier of the vehicle to which the device corresponding to the revoked certificate or the valid certificate belongs can be determined. Therefore, when transmitting a certificate record, the efficiency of transmitting the certificate record by the network-side device is improved by the network-side device directly determining the vehicle where the vehicle-mounted device is located based on the device identifier of the vehicle-mounted device.

[0136] In a possible implementation, the device identifier includes the device type of the vehicle-mounted device corresponding to the device identifier.

[0137] In possible implementations, the device identifier includes additional information such as the device production time and the device manufacturer.

[0138] Generally, the device manufacturer installs a root certificate on the device, which may be a root certificate from a CA. Then, when the device is assembled in a vehicle, the device assembled in the vehicle is registered with the Original Equipment Manufacturer (OEM), and the device certificate for that device is determined. If the vehicle is replaced with a different vehicle or the device certificate for the device expires, the device must be re-registered with the OEM. If the device identifier of the device corresponding to the device certificate is strongly bound to the vehicle identifier of the vehicle where the device certificate is located, the device identifier will be determined and renewed again when the device certificate for the device is determined or renewed.

[0139] For example, the identifier of a device ECU includes the device type and the vehicle identifier of the vehicle in which the device ECU is located. As illustrated in FIG. 5, the ECU first determines the device identifier of the ECU based on the device information and the coding form of the device identifier of the ECU, where the device information includes information such as the device type, the time of production of the device, and the device manufacturer. Then, the ECU randomly generates a pair of public and private keys, writes the private key to a Hardware Security Module (HSM), and transmits the device identifier and public key of the ECU to the OEM using a network-connected device. The OEM attempts to verify the device identifier based on the received public key to determine whether the device is valid. If the verification is successful, the OEM determines that the device is valid and adds the vehicle identification number (VIN) to the device identifier of the ECU. Then, the OEM generates a device certificate for the ECU based on information such as the device identifier of the ECU and the received public key. The OEM transmits the device certificate and device identifier of the ECU, generated by the OEM, to the ECU using a network-connected device. In response, the ECU receives the device certificate and device identifier transmitted by the OEM using a network-connected device and attempts to verify the received device certificate to determine its accuracy. After determining that the device certificate is valid, the ECU writes the device certificate to the HSM, stores the device certificate, and updates the device identifier. Finally, the OEM receives a message indicating that the device has been successfully registered and determines that the ECU has been successfully registered. Optionally, the OEM further transmits the ECU's device certificate to the Vehicle Device Certificate Management System, CA, etc.Optionally, the OEM may additionally determine the validity period of the device certificate.

[0140] Optionally, in other possible implementations, the device manufacturer installs a root certificate on the device, which may be the root certificate of the CA. Subsequently, if the device type is a network-offline device, the device randomly generates a public key and a private key, performs re-registration by actively transmitting the device identifier and public key of the network-offline device to the CA using a network-offline device located in the vehicle, and determines a valid certificate for the network-offline device—that is, a new device certificate—to ensure the security of the device.

[0141] For example, Device 1 is installed in Vehicle 1, and Device 1 is a network-agnostic device. In this case, the device certificate of Device 1 is Device Certificate 1, and Device Certificate 1 includes the identifier of Vehicle 1. When Device 1 is transferred from Vehicle 1 to Vehicle 2, Device Certificate 1 becomes invalid, and the network-side device obtains the revoked certificate for Device 1 and creates a certificate record based on the revoked certificate. Optionally, the certificate record includes the revoked Device Certificate 1 of Device 1. Additionally, Device 1 uses a network-agnostic device to renew the device certificate of Device 1 to Device Certificate 2, which includes the identifier of Vehicle 2.

[0142] According to the aforementioned process, the network-side device generates a certificate record for the first vehicle or the first vehicle group based on an acquired revoked certificate or an acquired valid certificate, and the certificate record is a newly added certificate record. Therefore, when the storage space of the device within the first vehicle is limited, the number of certificate records to be stored in the first vehicle is relatively small, and thus the loss of certificate records to be stored in the vehicle-mounted device within the first vehicle is reduced, thereby ensuring the integrity of the certificate list of the first vehicle and ensuring vehicle security.

[0143] To reduce the certificate records that must be stored in the first vehicle and to ensure the integrity of the certificate list stored in the vehicle-mounted device, the present application further provides a method for updating a certificate list. After acquiring a revoked certificate or a valid certificate, the network-side device acquires the revoked certificate or the valid certificate based on the acquired revoked certificate or the acquired valid certificate and creates a certificate record. Then, the network-side device transmits the acquired certificate record to the first vehicle. In response, after acquiring the certificate record transmitted by the network-side device, the first vehicle determines the certificate record belonging to the first vehicle or the first vehicle group and updates the certificate list stored in the first vehicle based on the certificate record belonging to the first vehicle or the first vehicle group. As illustrated in FIG. 6, the method for updating a certificate list mainly comprises the following steps S601 to S603.

[0144] S601: The network-side device creates a certificate record based on the acquired revoked certificate or the acquired valid certificate.

[0145] The first vehicle group is any vehicle group within a plurality of vehicle groups, and the first vehicle is any vehicle within the first vehicle group. A certificate record generated by a network-side device is used by the first vehicle to update the certificate list stored in the first vehicle. One or more certificate records may exist. The certificate list of the first vehicle is used to record a revoked certificate or a valid certificate of a device belonging to the first vehicle for the first vehicle, or to record a revoked certificate or a valid certificate of a device belonging to the first vehicle group for the first vehicle group. For a description of the vehicle group, refer to the foregoing.

[0146] Optionally, after the certificate of at least one device is revoked, the network-side device acquires at least one revoked certificate. After at least one device performs registration, the network-side device acquires at least one valid certificate. After acquiring the revoked certificate or the valid certificate, the network-side device creates a certificate record based on the vehicle where the device corresponding to the revoked certificate or the valid certificate is located. The certificate record includes one or more revoked certificates or one or more valid certificates.

[0147] It should be noted that the certificate record generated by the network-side device is a newly added certificate record. Compared to transmitting both the existing certificate record and the newly added certificate record to the device of the first vehicle for storage, transmitting the newly added certificate record to the device of the first vehicle for storage reduces the space used by the device to store the currently received certificate record when the device's storage space is limited, thereby reducing the loss of certificate records stored in the device, guaranteeing the integrity of the certificate list stored in the vehicle-mounted device, and ensuring vehicle security.

[0148] S602: The network-side device transmits the certificate record to the first vehicle.

[0149] The network-side device transmits the certificate record generated by the network-side device to the network-connected device of the first vehicle. In response, the network-connected device of the first vehicle receives the certificate record transmitted by the network-side device.

[0150] S603: The first vehicle updates the list of certificates stored in the first vehicle based on the certificate records received by the first vehicle.

[0151] A network-connected device of the first vehicle determines, based on the device identifier of the device corresponding to the revoked certificate or valid certificate in the certificate record received by the network-connected device of the first vehicle and the vehicle identifier of the vehicle in which the device is located, at least one revoked certificate or at least one valid certificate of a device belonging to the first vehicle or the first vehicle group in the received certificate record. Then, at least one revoked certificate or at least one valid certificate belonging to the first vehicle or the first vehicle group is added to the certificate list of the first vehicle, and the certificate list is transmitted to a network-unconnected device in the first vehicle to update the certificate list of the first vehicle. The certificate list includes the previously revoked certificate record or valid certificate and the newly added revoked certificate or newly added valid certificate.

[0152] In another possible implementation, a network-connected device of the first vehicle determines, based on the device identifier of the device corresponding to the revoked certificate or valid certificate in the certificate record received by the network-connected device of the first vehicle and the vehicle identifier of the vehicle in which the device is located, at least one revoked certificate or at least one valid certificate of a device belonging to the first vehicle or the first vehicle group in the received certificate record. Then, the network-connected device of the first vehicle generates a new certificate list based on at least one revoked certificate or at least one valid certificate of a device belonging to the first vehicle or the first vehicle group in the certificate record received by the network-connected device of the first vehicle, and transmits the new certificate list to a network-unconnected device in the first vehicle. The new certificate list includes only newly added revoked certificates or newly added valid certificates belonging to the first vehicle or the first vehicle group.

[0153] In the aforementioned process, it should be noted that the network-side device generates a newly added certificate record based on the revoked certificate or valid certificate obtained by the network-side device and the vehicle where the device corresponding to the revoked certificate or valid certificate is located, and transmits the newly added certificate record to the first vehicle. Then, the first vehicle determines the revoked certificate or valid certificate belonging to the first vehicle or the first vehicle group within the certificate record based on the received certificate record, and updates the list of certificates stored in the first vehicle based on the revoked certificate or valid certificate belonging to the first vehicle or the first vehicle group. In conclusion, the certificate record generated by the network-side device is a certificate record of the newly added revoked certificate or the newly added valid certificate, and the first vehicle stores only the certificate record of the first vehicle or the first vehicle group. Therefore, the first vehicle receives a relatively small number of certificate records to be stored, and the storage space for storing the list of certificates obtained based on the certificate record is relatively small. In this case, when the storage space of the in-vehicle device is limited, the loss of certificate records that must be stored in the vehicle is reduced, thereby maximally ensuring the integrity of the certificate list stored in the vehicle and guaranteeing vehicle security.

[0154] To reduce the certificate records that need to be stored in the first vehicle and to ensure the integrity of the vehicle-mounted certificate list stored in the vehicle-mounted device, the present application further provides a method for updating a certificate list. As illustrated in FIG. 7, the method comprises steps S701 to S706.

[0155] S701: The network-side device obtains the revoked certificate or the valid certificate.

[0156] For a description of revoked or valid certificates, refer to the foregoing.

[0157] Optionally, for a specific implementation of this step, refer to Step S301. Details are not described again herein.

[0158] S702: The network-side device obtains the revoked certificate or the valid certificate and creates a certificate record.

[0159] Optionally, the network-side device generates a certificate record based on at least one acquired revoked certificate or at least one acquired valid certificate. This certificate record is the certificate record of the newly added revoked certificate or newly added valid certificate of all vehicles.

[0160] In another possible implementation, a network-side device obtains the number of a revoked certificate or a valid certificate, and a user queries a vehicle certificate management system based on the number to determine the revoked certificate or valid certificate corresponding to the number, and determines the identifier of the vehicle where the device corresponding to the revoked certificate or valid certificate is located, the identifier of the vehicle group where the vehicle is located, and the identifiers of all vehicles in that vehicle group. Subsequently, the network-side device generates a certificate record from the vehicle certificate management system based on the information obtained by the network-side device. The certificate record includes the number of the revoked certificate or a valid certificate, the identifier of the vehicle, the identifier of the network-connected device of the vehicle, and the identifier of the device corresponding to the revoked certificate or a valid certificate.

[0161] In a possible implementation, the CA performs steps S701 and S702. The CA and the vehicle certificate management system may be located on the same server of the network-side device or on different servers of the network-side device.

[0162] S703: The network-side device transmits the certificate record to the first vehicle.

[0163] The network-side device transmits all certificate records generated by the network-side device to the network-connected device of the first vehicle. In response, the network-connected device of the first vehicle receives the certificate records transmitted by the network-side device.

[0164] S704: The first vehicle attempts to verify the certificate record received by the first vehicle.

[0165] Optionally, refer to step S305 for a specific implementation of step S704. Details are not described again herein.

[0166] One or more certificate records received by the first vehicle may exist, and each certificate record includes signature information written by a network-side device. The vehicle-mounted device of the first vehicle may attempt to verify the certificate records received by the vehicle-mounted device one by one, and may update the list of certificates stored in the first vehicle using the certificate records verified by the network-connected device and the network-connected device.

[0167] S705: The first vehicle determines whether a device belonging to the first vehicle or the first vehicle group has a revoked certificate or a valid certificate within the certificate record based on the received certificate record.

[0168] A network-connected device of the first vehicle determines a revoked certificate or a valid certificate of a device belonging to the first vehicle or the first vehicle group based on the device identifier of the device corresponding to the revoked certificate or a valid certificate in the certificate record received by the network-connected device of the first vehicle or the vehicle identifier of the vehicle where the device is located.

[0169] Optionally, step S705 may be performed prior to step S704.

[0170] S706: The first vehicle updates the list of certificates stored in the first vehicle based on a revoked certificate or a valid certificate of a device belonging to the first vehicle or the first vehicle group.

[0171] Optionally, a network-connected device of the first vehicle adds a revoked certificate or a valid certificate of a device belonging to the first vehicle or the first vehicle group to the certificate list of the first vehicle, and transmits the certificate list to a network-unconnected device within the first vehicle to update the certificate list of the first vehicle. The certificate list includes a record of previously revoked certificates or valid certificates, and newly added revoked certificates or newly added valid certificates.

[0172] In another possible implementation, a network-connected device of the first vehicle generates a new certificate list based on each revoked certificate or each valid certificate belonging to the first vehicle or first vehicle group in the certificate record, and transmits the certificate list to a network-unconnected device in the first vehicle. The new certificate list includes only newly added revoked certificates or newly added valid certificates.

[0173] Optionally, the certificate list of the first vehicle is stored in the form of a blockchain on each device of the first vehicle. The certificate list is used to record revoked or valid certificates of devices belonging to the first vehicle or the first vehicle group for the first vehicle or the first vehicle group. For a specific implementation in which the certificate list of the first vehicle is stored in the form of a blockchain, refer to the description in step S306. Details are not described again herein.

[0174] It should be noted that the certificate list of the first vehicle is stored in the form of a blockchain, and since the updated certificate list data block and the first certificate list data block are connected using the identifiers of the two data blocks, the stored certificate records can be prevented from being tampered with, the loss of certificate records can be reduced by reducing the storage space used to store the certificate list, and the integrity and security of the certificate list stored in network-connected devices and network-non-connected devices can be ensured.

[0175] Additionally, the list of certificates stored in the first vehicle includes revoked certificates or valid certificates belonging to the first vehicle, and further includes revoked certificates or valid certificates belonging to the second vehicle. The second vehicle is a vehicle other than the first vehicle within the first vehicle group. When the first vehicle within the first vehicle group communicates with the second vehicle within the first vehicle group, the first vehicle may attempt to verify the identity of the second vehicle based on signature information within the revoked certificate or valid certificate of the second vehicle in order to determine the validity of the identity of the second vehicle and to ensure the security of communication between the first vehicle and the second vehicle.

[0176] According to the process described above, the certificate records transmitted to the first vehicle by the network-side device are newly added certificate records of all vehicles, and the certificate records to be stored in the first vehicle are certificate records corresponding to revoked or valid certificates of the first vehicle or the first vehicle group. Accordingly, the first vehicle must store a relatively small number of certificate records, and the storage space for storing the certificate list by the first vehicle is smaller. In cases where the storage space of the device within the vehicle is limited, in this embodiment of the present application, the loss of certificate records can be reduced, and the integrity and security of the certificate list stored in the network-connected device and the network-non-connected device can be guaranteed to the maximum extent.

[0177] The present application further provides a certificate list updating device. The device is applied to a first vehicle, and the device is configured to perform the operation performed by the first vehicle in the method embodiment illustrated in FIGS. 2 and 3. Alternatively, the device may be a road side unit (RSU). As illustrated in FIG. 8, the device includes an acquisition unit (801), an update unit (802), and a verification unit (803).

[0178] The acquisition unit (801) is configured to acquire a certificate record.

[0179] The certificate record is transmitted to the first vehicle by a network-side device, and the certificate record includes at least one revoked certificate or at least one valid certificate.

[0180] In possible implementations, the revoked certificate includes one or more of a vehicle identifier, a device identifier, or a device type. The valid certificate includes one or more of a vehicle identifier, a device identifier, or a device type. The device type is a network-connected device or a network-non-connected device.

[0181] In a possible implementation, the device identifier includes a vehicle identifier, and the vehicle identifier is an identifier of the vehicle where the vehicle-mounted device corresponding to the device identifier is located.

[0182] The update unit (802) is configured to update the list of certificates stored in the first vehicle based on the certificate records.

[0183] The certificate list is used to record revoked certificates or valid certificates of devices belonging to the first vehicle for the first vehicle, or to record revoked certificates or valid certificates of devices belonging to the first vehicle group for the first vehicle group. The first vehicle group includes the first vehicle.

[0184] Optionally, the certificate record acquired by the acquisition unit (801) is generated by a network-side device for the first vehicle or the first vehicle group, and each revoked certificate or each valid certificate in the certificate record is a certificate of a device belonging to the first vehicle or the first vehicle group. In this case, the renewal unit (802) is configured to update the certificate list stored in the first vehicle based on the certificate record, which includes adding each revoked certificate or each valid certificate in the certificate record to the certificate list of the first vehicle.

[0185] In a possible implementation, the renewal unit (802) is configured to update a certificate list stored in a first vehicle based on a certificate record, comprising obtaining an identifier of a first certificate list data block — the first certificate list data block is a data block corresponding to a certificate list prior to renewal — and generating a renewed certificate list data block based on the identifier of the first certificate list data block and the certificate record obtained by the acquisition unit (801) — the renewed certificate list data block comprises a block header and a block body, the block header of the renewed certificate list data block comprises an identifier of the first certificate list data block, and the block body of the renewed certificate list data block comprises a certificate record —.

[0186] In a possible implementation, the block header of the updated certificate list data block further includes the identifier of the certificate record obtained by the acquisition unit (801).

[0187] In a possible implementation, the block body of the updated certificate list data block further includes a first certificate list data block.

[0188] In a possible implementation, the identifier of the first certificate list data block is a hash value generated based on the first certificate list data block, and the identifier of the certificate record is a hash value generated based on the certificate record.

[0189] Optionally, before the update unit (802) is configured to update the list of certificates stored in the first vehicle based on the certificate record, the device further includes a verification unit (803). The verification unit (803) is configured to attempt to verify the certificate record based on the signature information within the certificate record obtained by the acquisition unit (801). If the verification is successful, the update unit (802) is also configured to update the list of certificates stored in the first vehicle based on the certificate record.

[0190] Optionally, the certificate list of the first vehicle further includes a revoked certificate or a valid certificate of a device belonging to the second vehicle, and the second vehicle is a vehicle other than the first vehicle within the first vehicle group. The revoked certificate or a valid certificate of a device of the second vehicle is used by the first vehicle to attempt authentication of the second vehicle.

[0191] The present application further provides a certificate list renewal device. The device is applied to a network-side device and is configured to perform an operation performed by the network-side device in the method embodiment illustrated in FIG. 2 and FIG. 3. As illustrated in FIG. 9, the device includes a transmission unit (901), a determination unit (902), a generation unit (903), and a notification unit (904).

[0192] The transmission unit (901) is configured to transmit the certificate record to the first vehicle.

[0193] The certificate record includes at least one revoked certificate or at least one valid certificate, and the certificate record is used by the first vehicle to update the certificate list stored in the first vehicle. The certificate list is used to record the revoked certificate or valid certificate of a device belonging to the first vehicle for the first vehicle, or to record the revoked certificate or valid certificate of a device belonging to the first vehicle group for the first vehicle group. The first vehicle group includes at least the first vehicle.

[0194] In possible implementations, the revoked certificate includes one or more of a vehicle identifier, a device identifier, or a device type. The valid certificate includes one or more of a vehicle identifier, a device identifier, or a device type. The device type is a network-connected device or a network-non-connected device.

[0195] In a possible implementation, the device identifier includes a vehicle identifier, and the vehicle identifier is an identifier of the vehicle where the vehicle-mounted device corresponding to the device identifier is located.

[0196] Optionally, before the transmission unit (901) transmits the certificate record to the first vehicle, the device further includes a determination unit (902) and a generation unit (903). The determination unit (902) is configured to determine at least one revoked certificate or at least one valid certificate of at least one device belonging to at least one first vehicle or first vehicle group. The generation unit (903) is configured to generate a certificate record of the first vehicle or first vehicle group based on at least one revoked certificate or at least one valid certificate of the device belonging to the first vehicle or first vehicle group.

[0197] In a possible implementation, the determination unit (902) is configured to determine at least one revoked certificate or at least one valid certificate of a device belonging to a first vehicle or a first vehicle group, based on a device identifier or vehicle identifier within the revoked certificate or valid certificate, and includes determining one or more revoked certificates or one or more valid certificates of a device belonging to a first vehicle or a first vehicle group.

[0198] In a possible implementation, the determination unit (902) is configured to determine at least one revoked certificate or at least one valid certificate of a device belonging to a first vehicle or a first vehicle group by querying a vehicle certificate management system to determine at least one revoked certificate or at least one valid certificate of a device belonging to a first vehicle or a first vehicle group.

[0199] In a possible implementation, before the generating unit (903) is configured to generate a certificate record of the first vehicle or the first vehicle group based on at least one revoked certificate or at least one valid certificate of a device belonging to the first vehicle or the first vehicle group, the determining unit (902) is also configured to determine that the device corresponding to at least one revoked certificate does not include a network-connected device. In this case, the transmission unit (901) being configured to transmit the certificate record to the first vehicle includes transmitting the certificate record to a network-connected device within the first vehicle.

[0200] In a possible implementation, before the generating unit (903) is configured to generate a certificate record of the first vehicle or the first vehicle group based on at least one revoked certificate or at least one valid certificate of a device belonging to the first vehicle or the first vehicle group, the determining unit (902) is also configured to determine that the device corresponding to at least one revoked certificate includes a network-connected device, and then the notification unit (904) notifies the user of the first vehicle to re-register the network-connected device. Finally, the determining unit (902) determines that the user has re-registered the network-connected device. In this case, the transmission unit (901) being configured to transmit the certificate record to the first vehicle includes transmitting the certificate record to a network-connected device within the first vehicle.

[0201] The present application further provides a certificate list renewal device. The device is applied to a first vehicle, and the device is configured to perform the operation performed by the first vehicle in the method embodiment illustrated in FIG. 6 and 7. As illustrated in FIG. 8, the device includes an acquisition unit (801), a renewal unit (802), and a verification unit (803).

[0202] The acquisition unit (801) is configured to acquire a certificate record.

[0203] The certificate record is transmitted to the first vehicle by a network-side device, and the certificate record includes at least one revoked certificate or at least one valid certificate.

[0204] In possible implementations, the revoked certificate includes one or more of a vehicle identifier, a device identifier, or a device type. The valid certificate includes one or more of a vehicle identifier, a device identifier, or a device type. The device type is a network-connected device or a network-non-connected device.

[0205] In a possible implementation, the device identifier includes a vehicle identifier, and the vehicle identifier is an identifier of the vehicle where the vehicle-mounted device corresponding to the device identifier is located.

[0206] The update unit (802) is configured to update the list of certificates stored in the first vehicle based on the certificate records.

[0207] The certificate list is used to record revoked certificates or valid certificates of devices belonging to the first vehicle for the first vehicle, or to record revoked certificates or valid certificates of devices belonging to the first vehicle group for the first vehicle group. The first vehicle group includes the first vehicle.

[0208] Optionally, the update unit (802) is configured to update the certificate list stored in the first vehicle based on the certificate record, which includes determining at least one revoked certificate or at least one valid certificate of a device belonging to the first vehicle or the first vehicle group in the certificate record, and adding at least one revoked certificate or at least one valid certificate of a device belonging to the first vehicle or the first vehicle group to the certificate list of the first vehicle.

[0209] In a possible implementation, the renewal unit (802) is configured to update a certificate list stored in a first vehicle based on a certificate record, comprising obtaining an identifier of a first certificate list data block — the first certificate list data block is a data block corresponding to a certificate list prior to renewal — and generating a renewed certificate list data block based on the identifier of the first certificate list data block and the certificate record obtained by the acquisition unit (801) — the renewed certificate list data block comprises a block header and a block body, the block header of the renewed certificate list data block comprises an identifier of the first certificate list data block, and the block body of the renewed certificate list data block comprises a certificate record —.

[0210] In a possible implementation, the block header of the updated certificate list data block further includes the identifier of the certificate record obtained by the acquisition unit (801).

[0211] In a possible implementation, the block body of the updated certificate list data block further includes a first certificate list data block.

[0212] In a possible implementation, the identifier of the first certificate list data block is a hash value generated based on the first certificate list data block, and the identifier of the certificate record is a hash value generated based on the certificate record.

[0213] Optionally, before the update unit (802) is configured to update the list of certificates stored in the first vehicle based on the certificate record, the device further includes a verification unit (803). The verification unit (803) is configured to attempt to verify the certificate record based on the signature information within the certificate record obtained by the acquisition unit (801). If the verification is successful, the update unit (802) is also configured to update the list of certificates stored in the first vehicle based on the certificate record.

[0214] Optionally, the certificate list of the first vehicle further includes a revoked certificate or a valid certificate of a device belonging to the second vehicle, and the second vehicle is a vehicle other than the first vehicle within the first vehicle group. The revoked certificate or a valid certificate of a device of the second vehicle is used by the first vehicle to attempt authentication of the second vehicle.

[0215] The present application further provides a certificate list renewal device. The device is applied to a network-side device and is configured to perform an operation performed by the network-side device in the method embodiment illustrated in FIG. 6 and 7. As illustrated in FIG. 9, the device includes a transmission unit (901), a determination unit (902), a generation unit (903), and a notification unit (904).

[0216] The transmission unit (901) is configured to transmit the certificate record to the first vehicle.

[0217] The certificate record includes at least one revoked certificate or at least one valid certificate, and the certificate record is used by the first vehicle to update the certificate list stored in the first vehicle. The certificate list is used to record the revoked certificate or valid certificate of a device belonging to the first vehicle for the first vehicle, or to record the revoked certificate or valid certificate of a device belonging to the first vehicle group for the first vehicle group. The first vehicle group includes at least the first vehicle.

[0218] In possible implementations, the revoked certificate includes one or more of a vehicle identifier, a device identifier, or a device type. The valid certificate includes one or more of a vehicle identifier, a device identifier, or a device type. The device type is a network-connected device or a network-non-connected device.

[0219] In a possible implementation, the device identifier includes a vehicle identifier, and the vehicle identifier is an identifier of the vehicle where the vehicle-mounted device corresponding to the device identifier is located.

[0220] Optionally, before the transmission unit (901) transmits the certificate record to the first vehicle, the device further includes a generating unit (903). The generating unit (903) is configured to generate a certificate record based on at least one revoked certificate or at least one valid certificate.

[0221] In a possible implementation, before the generating unit (903) is configured to generate a certificate record based on at least one revoked certificate or at least one valid certificate, the determination unit (902) is configured to determine that the device corresponding to at least one revoked certificate does not include a network-connected device. In this case, the transmission unit (901) being configured to transmit the certificate record to the first vehicle includes transmitting the certificate record to a network-connected device within the first vehicle.

[0222] In a possible implementation, before the generating unit (903) is configured to generate a certificate record based on at least one revoked certificate or at least one valid certificate, the determination unit (902) is also configured to determine that the device corresponding to at least one revoked certificate includes a network-connected device, and then the notification unit (904) notifies the user of the first vehicle to re-register the network-connected device. Finally, the determination unit (902) determines that the user has re-registered the network-connected device. In this case, the transmission unit (901) is configured to transmit the certificate record to the first vehicle, which includes transmitting the certificate record to a network-connected device within the first vehicle.

[0223] One or more of the units of FIGS. 8 and FIGS. 9 may be implemented by software, hardware, firmware, or a combination thereof. Software or firmware may include, but is not limited to, computer program instructions or code and may be executed by a hardware processor. Hardware may include, but is not limited to, various integrated circuits, such as a CPU (central processing unit), DSP (digital signal processor), FPGA (field programmable gate array), or ASIC (application-specific integrated circuit).

[0224] Referring to FIG. 10, the present application further provides a certificate list updating device. This device is applied to a first vehicle and may be configured to perform the operation performed by the first vehicle in the method embodiments illustrated in FIG. 2, FIG. 3, FIG. 6, and FIG. 7. The device includes a memory (1001), a processor (1002), a communication interface (1003), and a bus (1004). The processor (1002) is configured to execute computer program instructions so that the certificate list updating device performs the operation performed by the first vehicle in the certificate list updating method illustrated in FIG. 2, FIG. 3, FIG. 6, and FIG. 7. The communication interface (1003) is configured to support communication between the device and other network entities. The memory (1001) is configured to store program code and data of the device.

[0225] The present application further provides a certificate list updating device. This device is applied to a network-side device and may be configured to perform operations performed by the network-side device in the method embodiments illustrated in FIGS. 2, FIGS. 3, FIGS. 6, and FIGS. 7. For the structure of the device, refer to FIG. 10, and the device includes a memory (1001), a processor (1002), a communication interface (1003), and a bus (1004). The processor (1002) is configured to execute computer program instructions so that the certificate list updating device performs operations performed by the network-side device in the certificate list updating method illustrated in FIGS. 2, FIGS. 3, FIGS. 6, and FIGS. 7. The communication interface (1003) is configured to support communication between the device and another network entity. The memory (1001) is configured to store program code and data of the device.

[0226] A processor (1002) (or described as a controller) may implement or execute various exemplary logic blocks, units, unit modules, and circuits described with reference to the contents disclosed in this application. The processor or controller may be a central processing unit, a general-purpose processor, a digital signal processor, an application-specific integrated circuit, a field-programmable gate array or other programmable logic device, a transistor logic device, a hardware component, or any combination thereof. The processor or controller may implement or execute various exemplary logic blocks, unit modules, and circuits described with reference to the contents disclosed in this application. Alternatively, the processor (1002) may be a combination of processors that alternatively implement computing functions, for example, a combination of one or more microprocessors or a combination of a DSP and a microprocessor.

[0227] The communication interface (1003) may be a transceiver circuit.

[0228] The memory (1001) may include volatile memory, for example, random access memory. Alternatively, the memory may include non-volatile memory, for example, read-only memory, flash memory, hard disk, or solid-state drive. Alternatively, the memory may include a combination of the aforementioned types of memory.

[0229] The bus (1004) may be an extended industry standard architecture (EISA) bus, etc. The bus (1004) may be classified as an address bus, a data bus, a control bus, etc. For ease of representation, only one thick line is used to represent the bus in FIG. 10, but this does not mean that there is only one bus or only one type of bus.

[0230] Embodiments of the present application provide a computer-readable storage medium comprising computer instructions. When the computer instructions are executed by a processor, the certificate list updating device may perform an operation performed by a first vehicle or network-side device in the certificate list updating method provided in FIG. 2, FIG. 3, FIG. 6, and FIG. 7.

[0231] Embodiments of the present application further provide a computer program product comprising instructions. When the instructions are executed on a computer, the computer may perform an operation performed by a first vehicle or network-side device in the certificate list update method illustrated in FIGS. 2, FIGS. 3, FIGS. 6, and FIGS. 7.

[0232] This application further provides a certificate list renewal system. The system includes a network-side certificate list renewal device and a vehicle-side certificate list renewal device.

[0233] For convenience and brevity, regarding the detailed operation processes of the aforementioned systems, devices, and units, refer to the corresponding processes of the aforementioned method embodiments, and details are not described again herein.

[0234] Those skilled in the art will clearly recognize that the descriptions of the embodiments provided in this application may refer to one another. For convenience and brevity, for example, regarding the functions of the apparatus and devices and the steps performed provided in the embodiments of this application, reference is made to the relevant descriptions of the method embodiments of this application. The method embodiments and apparatus embodiments may also refer to one another.

[0235] All or part of the foregoing embodiments may be implemented using software, hardware, firmware, or any combination thereof. Where all or part of the foregoing embodiments are implemented using a software program, all or part of the foregoing embodiments may appear in the form of a computer program product, and the computer program product comprises one or more computer instructions. When the computer program instructions are loaded into and executed on a computer, a procedure or function according to an embodiment of the present application is created wholly or partially.

[0236] A computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. Computer instructions may be stored on a computer-readable storage medium or transferred from one computer-readable storage medium to another computer-readable storage medium. For example, computer instructions may be transferred from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, or digital subscriber line (DSL)) or wireless (e.g., infrared, radio, and microwave). A computer-readable storage medium may be any available medium accessible by a computer, or a data storage device such as a server or data center that incorporates one or more available media. Available media may be magnetic media (e.g., floppy disk, hard disk, magnetic tape), optical media (e.g., DVD), semiconductor media (e.g., solid-state disk (SSD)), etc.

[0237] The foregoing description of the implementation makes it clear to those skilled in the art that, for the sake of convenience and brevity, the division into only the aforementioned functional modules is used as an example for explanation. In actual application, the aforementioned functions may be assigned to other functional modules for implementation. That is, the internal structure of the device is divided into different functional modules to implement all or part of the aforementioned functions.

[0238] It should be understood that in the various embodiments provided in this application, the disclosed devices and methods may be implemented in different ways. For example, the described device embodiments are merely examples. For example, the division into modules or units is merely a logical functional division and may be different in actual implementation. For example, multiple units or components may be combined or integrated into different devices, or some features may be ignored or not performed. Additionally, the mutual coupling, direct coupling, or communication connection shown or discussed may be implemented through some interfaces. Indirect coupling or communication connection between devices or units may be implemented in electronic, mechanical, or other forms.

[0239] Units described as separate parts may or may not be physically separated, and parts indicated as units may be one or more physical units, may be located in one place, or may be distributed in different places. In the application process, some or all of the units may be selected based on actual requirements to achieve the purpose of the solution of the embodiment.

[0240] Additionally, in embodiments of the present application, functional units may be integrated into a single processing unit, each unit may exist physically independently, or two or more units may be integrated into a single unit. The integrated unit may be implemented in the form of hardware or in the form of a software functional unit.

[0241] Where the integration unit is implemented in the form of a software functional unit and sold or used as an independent product, the integration unit may be stored on a computer-readable storage medium. Based on this understanding, the essential technical solution of the embodiments of the present application, or parts contributing to the prior art, or all or part of the technical solution may be implemented in the form of a software product. The computer software product is stored on a storage medium and includes various instructions that instruct a device (which may be a personal computer, a server, a network device, etc.) or a processor to perform all or part of the steps of the method in the embodiments of the present application. The aforementioned storage medium includes any medium capable of storing program code, such as a USB flash drive, a removable hard disk, read-only memory (ROM), random access memory (RAM), a magnetic disk, or an optical disk.

[0242] The foregoing description is merely a specific embodiment of the present application and is not intended to limit the scope of protection of the present application. Any modification or substitution of the technical solution disclosed in the present application falls within the scope of protection of the present application.

Claims

Claim 1 A method for updating a certificate list applicable to a first vehicle, comprising: a step of obtaining a certificate record — said certificate record is transmitted to the first vehicle by a network-side device, said certificate record includes at least one revoked certificate or at least one valid certificate — a step of determining at least one revoked certificate or at least one valid certificate of a device belonging to the first vehicle or the first vehicle group within said certificate record; and a step of adding said at least one revoked certificate or said at least one valid certificate of a device belonging to the first vehicle or the first vehicle group to a certificate list stored in the first vehicle, wherein the certificate list is used to record the revoked certificate or valid certificate of the device belonging to the first vehicle or to record the revoked certificate or valid certificate of the device belonging to the first vehicle group, and said first vehicle group includes the first vehicle. Claim 2 delete Claim 3 delete Claim 4 delete Claim 5 A method for updating a certificate list according to claim 1, wherein the first vehicle group further includes a second vehicle, the certificate list further includes a revoked certificate or a valid certificate of a device belonging to the second vehicle, and the revoked certificate or a valid certificate of a device belonging to the second vehicle is used to attempt to authenticate the second vehicle by the first vehicle. Claim 6 A method for updating a certificate list according to claim 1, further comprising the step of obtaining an identifier of a first certificate list data block — the first certificate list data block is a data block corresponding to the certificate list prior to renewal — and the step of generating an updated certificate list data block based on the identifier of the first certificate list data block and the certificate record — the updated certificate list data block comprises a block header and a block body, the block header of the updated certificate list data block comprises an identifier of the first certificate list data block, and the block body of the updated certificate list data block comprises a revoked certificate or a valid certificate of the device belonging to the first vehicle or the first vehicle group, which is contained in the certificate record. Claim 7 A method for updating a certificate list according to claim 6, wherein the block header of the updated certificate list data block further includes an identifier of the certificate record. Claim 8 A method for updating a certificate list according to claim 6, wherein the block body of the updated certificate list data block further includes the first certificate list data block. Claim 9 A method for updating a certificate list according to claim 1, wherein, prior to the step of adding the at least one revoked certificate or the at least one valid certificate of the device belonging to the first vehicle or the first vehicle group to the certificate list stored in the first vehicle, the method further comprises the step of attempting to verify the certificate record based on signature information within the certificate record, and, if the verification is successful, adding the at least one revoked certificate or the at least one valid certificate of the device belonging to the first vehicle or the first vehicle group to the certificate list stored in the first vehicle. Claim 10 A method for updating a certificate list according to claim 1, wherein the withdrawn certificate includes one or more of a vehicle identifier, a device identifier, or a device type, and the valid certificate includes one or more of a vehicle identifier, a device identifier, or a device type. Claim 11 delete Claim 12 delete Claim 13 delete Claim 14 delete Claim 15 delete Claim 16 delete Claim 17 delete Claim 18 A certificate list updating device applied to a first vehicle, comprising: an acquisition unit configured to acquire a certificate record — said certificate record is transmitted to the first vehicle by a network-side device, said certificate record includes at least one revoked certificate or at least one valid certificate — and an updating unit configured to determine at least one revoked certificate or at least one valid certificate of a device belonging to the first vehicle or the first vehicle group within said certificate record, and to add said at least one revoked certificate or said at least one valid certificate of a device belonging to the first vehicle or the first vehicle group to a certificate list stored in the first vehicle — said certificate list is used to record a revoked certificate or a valid certificate of a device belonging to the first vehicle or to record a revoked certificate or a valid certificate of a device belonging to the first vehicle group, said first vehicle group includes the first vehicle — Claim 19 delete Claim 20 delete Claim 21 delete Claim 22 In paragraph 18, the first vehicle group further includes a second vehicle, the certificate list further includes a revoked certificate or a valid certificate of a device belonging to the second vehicle, and the revoked certificate or a valid certificate of a device belonging to the second vehicle is used by the first vehicle to attempt to certify the second vehicle, a certificate list updating device. Claim 23 A certificate list update device according to claim 18, wherein the update unit is configured to acquire an identifier of a first certificate list data block — the first certificate list data block is a data block corresponding to the certificate list prior to the update — and, based on the identifier of the first certificate list data block and the certificate record, generate an updated certificate list data block — the updated certificate list data block comprises a block header and a block body, the block header of the updated certificate list data block comprises an identifier of the first certificate list data block, and the block body of the updated certificate list data block comprises a revoked certificate or a valid certificate of the device belonging to the first vehicle or the first vehicle group, which is contained in the certificate record. Claim 24 A certificate list updating device according to paragraph 23, wherein the block header of the updated certificate list data block further includes an identifier of the certificate record. Claim 25 A certificate list renewal device according to claim 23, wherein the block body of the above-mentioned renewed certificate list data block further comprises the above-mentioned first certificate list data block. Claim 26 A certificate list update device according to claim 18, wherein the device further comprises a verification unit configured to attempt to verify a certificate record based on signature information within the certificate record before the update unit adds the at least one revoked certificate or the at least one valid certificate of the device belonging to the first vehicle or the first vehicle group to the certificate list stored in the first vehicle, and the update unit is also configured to add the at least one revoked certificate or the at least one valid certificate of the device belonging to the first vehicle or the first vehicle group to the certificate list stored in the first vehicle if the verification is successful. Claim 27 A certificate list updating device according to paragraph 18, wherein the revoked certificate comprises one or more of a vehicle identifier, a device identifier, or a device type, and the valid certificate comprises one or more of a vehicle identifier, a device identifier, or a device type. Claim 28 delete Claim 29 delete Claim 30 delete Claim 31 delete Claim 32 delete Claim 33 delete Claim 34 delete Claim 35 A certificate list updating device comprising a processor and a memory, wherein the memory is configured to store computer program instructions, and the processor executes the computer program instructions to enable the certificate list updating device to perform a certificate list updating method according to any one of claims 1 and 5 to 10. Claim 36 delete Claim 37 A computer-readable storage medium storing computer instructions, wherein when said computer instructions are executed by a processor, a certificate list updating device is enabled to perform a certificate list updating method according to any one of claims 1 and 5 through 10. Claim 38 delete

Images