Vehicle and communication security authentication method and apparatus therefor, and electronic device and storage medium

Abstract

A vehicle and a communication security authentication method and apparatus therefor, and an electronic device and a storage medium. The method comprises: after primary unlocking of a second ECU is successful, receiving a secondary seed request, which is sent by a first ECU (S11); generating a secondary seed on the basis of the secondary seed request, wherein the secondary seed comprises a plurality of data bits, and second data can be written into some of the plurality of data bits by means of the second ECU (S12); sending the secondary seed to the first ECU (S13); receiving a secondary key, which is sent by the first ECU, wherein the secondary key is obtained after first data is written into the other data bits of the plurality of data bits of the secondary seed by means of the first ECU (S14); and matching the secondary key with a preset key, and performing secondary unlocking when the matching is successful (S15).

Description

Vehicle and communication security authentication method, device, electronic device and storage medium thereof

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This disclosure claims priority to Chinese patent application number 202310758795.1 filed on June 26, 2023, entitled “Vehicle and its communication security authentication method, device, electronic device and storage medium,” the entire contents of which are incorporated by reference into this disclosure. Technical Field

[0003] The present disclosure relates to the field of vehicle safety technology, and in particular to a vehicle and its communication security authentication method, device, electronic device, and storage medium. Background Art

[0004] With the continuous development of society, the automotive industry is gradually shifting towards intelligent, connected, and technologically advanced mobility. Vehicles are increasingly equipped with more electronic devices and functions. At the same time, with the introduction of international regulations such as ISO 21434 (an automotive cybersecurity standard), UNECE R155 (an automotive cybersecurity regulation), and R156 (an automotive cybersecurity regulation), vehicle cybersecurity for in-vehicle communications has become increasingly important.

[0005] In related technologies, UDS 27 (Unified Diagnostic Services) is typically used for security verification of communications between in-vehicle ECUs (Electronic Control Units). However, this diagnostic service typically only provides a level one unlocking service, making in-vehicle ECUs vulnerable to cyberattacks and resulting in poor communication security.

[0006] It should be noted that the information disclosed in this background technology section is only for understanding the background technology of the present application concept, and therefore, it may contain information that does not constitute prior art.

[0007] Public content

[0008] The present disclosure aims to address, at least to some extent, one of the technical problems in the related art. To this end, the present disclosure provides a vehicle and its communication security authentication method, apparatus, electronic device, and storage medium. This method involves writing data to multiple data bits of a secondary seed via a first ECU and a second ECU to generate a secondary key, which is then matched with a preset key via the second ECU to perform secondary unlocking on top of primary unlocking. This enhances the authentication strength of secure access to in-vehicle ECUs and improves vehicle communication security.

[0009] To achieve the above-mentioned purpose, an embodiment of the first aspect of the present disclosure proposes a vehicle communication security authentication method, wherein the vehicle includes a first ECU and a second ECU, and the method is applied to the second ECU, and the method includes: after the first-level unlocking of the second ECU is successful, receiving a secondary seed request sent by the first ECU; generating a secondary seed based on the secondary seed request, the secondary seed includes multiple data bits, and a part of the multiple data bits is written by the second ECU into the second data; sending the secondary seed to the first ECU; receiving a secondary key sent by the first ECU, the secondary key is obtained by writing the first data to another part of the multiple data bits of the secondary seed by the first ECU; matching the secondary key with the preset key, and performing secondary unlocking when the match is successful.

[0010] According to the vehicle communication security authentication method of the embodiment of the present disclosure, after the first-level unlocking of the second ECU is successful, the second ECU generates a second-level seed based on the received second-level seed request sent by the first ECU, and a part of the multiple data bits of the second-level seed are written into the second data by the second ECU, and the other part of the data bits are written into the first data by the first ECU, thereby obtaining a second-level key, and the second ECU matches it with the preset key to perform a second-level unlocking based on the first-level unlocking, thereby enhancing the authentication strength of the secure access to the ECU in the vehicle and improving the communication security of the vehicle.

[0011] In some embodiments of the present disclosure, the preset key includes first preset data and second preset data, and the secondary key is matched with the preset key, and when the match is successful, the secondary unlocking is performed, including: matching the first data in the secondary key with the first preset data, and matching the second data in the secondary key with the second preset data; when the first data in the secondary key matches the first preset data, and the second data in the secondary key matches the second preset data, it is determined that the match is successful, and the secondary unlocking is performed.

[0012] In some embodiments of the present disclosure, different second ECUs correspond to different second preset data, and different first ECUs correspond to different first preset data.

[0013] In some embodiments of the present disclosure, the second ECU includes a whitelist, and the identification information of the second ECU, the identification information of the first ECU, and the preset key are correspondingly stored in the whitelist.

[0014] In some embodiments of the present disclosure, the communication security authentication method of a vehicle also includes: receiving a first-level seed request sent by a first ECU; generating a first-level seed based on the first-level seed request, and encrypting the first-level seed to generate a first-level verification key; sending the first-level seed to the first ECU; receiving a first-level key sent by the first ECU, the first-level key being generated by encrypting the first-level seed by the first ECU; matching the first-level key with the first-level verification key, and performing a first-level unlock when the match is successful.

[0015] In some embodiments of the present disclosure, the primary seed includes a random number, and encrypting the primary seed to generate a primary verification key includes: encrypting the random number to generate the primary verification key.

[0016] To achieve the above-mentioned purpose, the second aspect embodiment of the present disclosure also proposes a vehicle communication security authentication method, the vehicle includes a first ECU and a second ECU, the method is applied to the first ECU, and the method includes: after successfully performing the first-level unlocking of the second ECU, sending a secondary seed request to the second ECU; receiving the secondary seed generated by the second ECU based on the secondary seed request, the secondary seed includes multiple data bits, and a part of the multiple data bits is written by the second ECU as the second data; after writing the first data to another part of the multiple data bits of the secondary seed, a secondary key is obtained; and the secondary key is sent to the second ECU, wherein the second ECU matches the secondary key with the preset key, and performs the second unlocking when the match is successful.

[0017] According to the vehicle communication security authentication method of the embodiment of the present disclosure, after the first-level unlocking of the second ECU is successfully performed, the first ECU sends a second-level seed request to the second ECU, so that the second ECU generates a second-level seed based on the second-level seed request, and part of the multiple data bits of the second-level seed are written into the second data by the second ECU, and the other part of the data bits are written into the first data by the first ECU, thereby obtaining a second-level key, and the second ECU matches it with the preset key to perform a second-level unlocking based on the first-level unlocking, thereby enhancing the authentication strength of the secure access to the ECU in the vehicle and improving the communication security of the vehicle.

[0018] In some embodiments of the present disclosure, the vehicle communication security authentication method also includes: sending a first-level seed request to the second ECU; receiving a first-level seed generated by the second ECU based on the first-level seed request; encrypting the first-level seed to generate a first-level key; sending the first-level key to the second ECU, wherein the second ECU matches the first-level key with the first-level verification key, and performs a first-level unlocking when the match is successful, and the first-level verification key is generated by encrypting the first-level seed by the second ECU.

[0019] To achieve the above-mentioned purpose, an embodiment of the third aspect of the present disclosure proposes a computer-readable storage medium on which a program is stored. When the program is executed by a processor, the vehicle communication security authentication method of any of the above-mentioned embodiments is implemented.

[0020] According to the computer-readable storage medium of the embodiment of the present disclosure, based on the aforementioned vehicle communication security authentication method, data is written to multiple data bits of the secondary seed through the first ECU and the second ECU to generate a secondary key, and the second ECU matches it with the preset key to perform secondary unlocking, thereby enhancing the authentication strength of the ECU security access in the vehicle and improving the communication security of the vehicle.

[0021] To achieve the above-mentioned purpose, the fourth embodiment of the present disclosure proposes an electronic device, including: a memory, a processor, and a program stored in the memory and runnable on the processor. When the processor executes the program, the vehicle communication security authentication method of any of the above-mentioned embodiments is implemented.

[0022] According to the electronic device of the embodiment of the present disclosure, based on the aforementioned vehicle communication security authentication method, data is written to multiple data bits of the secondary seed through the first ECU and the second ECU to generate a secondary key, and the second ECU matches it with the preset key to perform secondary unlocking, thereby enhancing the authentication strength of the ECU security access in the vehicle and improving the communication security of the vehicle.

[0023] To achieve the above-mentioned purpose, the fifth aspect embodiment of the present disclosure proposes a vehicle communication security authentication device, the vehicle includes a first ECU and a second ECU, the device is applied to the second ECU, and the device includes: a first receiving module, for receiving a secondary seed request sent by the first ECU after the first-level unlocking of the second ECU is successful; a first generating module, for generating a secondary seed based on the secondary seed request, the secondary seed includes multiple data bits, and a part of the multiple data bits are written into the second data by the second ECU; a first sending module, for sending the secondary seed to the first ECU; the first receiving module, also for receiving a secondary key sent by the first ECU, the secondary key is obtained by writing the first data to another part of the multiple data bits of the secondary seed by the first ECU; a first unlocking module, for matching the secondary key with a preset key, and performing secondary unlocking when the match is successful.

[0024] According to the vehicle communication security authentication device of the embodiment of the present disclosure, after the first-level unlocking of the second ECU is successful, the second ECU generates a second-level seed based on the received second-level seed request sent by the first ECU, and a part of the multiple data bits of the second-level seed are written into the second data by the second ECU, and the other part of the data bits are written into the first data by the first ECU, thereby obtaining a second-level key, and the second ECU matches it with the preset key to perform a second-level unlocking based on the first-level unlocking, thereby enhancing the authentication strength of the secure access to the ECU in the vehicle and improving the communication security of the vehicle.

[0025] To achieve the above-mentioned purpose, the sixth embodiment of the present disclosure also proposes a vehicle communication security authentication device, the vehicle includes a first ECU and a second ECU, the device is applied to the first ECU, and the device includes: a second sending module, used to send a secondary seed request to the second ECU after the first-level unlocking of the second ECU is successful; a second receiving module, used to receive the secondary seed generated by the second ECU based on the secondary seed request, the secondary seed includes multiple data bits, and a part of the multiple data bits is written into the second data by the second ECU; a second generating module, used to write the first data to another part of the multiple data bits of the secondary seed to obtain a secondary key; the second sending module is also used to send the secondary key to the second ECU, wherein the second ECU matches the secondary key with the preset key, and performs secondary unlocking when the match is successful.

[0026] According to the vehicle communication security authentication device of the embodiment of the present disclosure, after the first-level unlocking of the second ECU is successfully performed, the first ECU sends a second-level seed request to the second ECU, so that the second ECU generates a second-level seed based on the second-level seed request, and part of the multiple data bits of the second-level seed are written into the second data by the second ECU, and the other part of the data bits are written into the first data by the first ECU, thereby obtaining a second-level key, and the second ECU matches it with the preset key to perform a second-level unlocking based on the first-level unlocking, thereby enhancing the authentication strength of the secure access to the ECU in the vehicle and improving the communication security of the vehicle.

[0027] To achieve the above-mentioned objectives, a seventh embodiment of the present disclosure proposes a vehicle, comprising the electronic device of the aforementioned embodiment, or the vehicle communication security authentication device of the aforementioned embodiment.

[0028] According to the vehicle of the embodiment of the present disclosure, based on the aforementioned electronic device or vehicle communication security authentication device, data is written to multiple data bits of the secondary seed through the first ECU and the second ECU to generate a secondary key, and the second ECU matches it with the preset key to perform secondary unlocking, thereby enhancing the authentication strength of the ECU security access in the vehicle and improving the communication security of the vehicle.

[0029] Additional aspects and advantages of the present disclosure will be given in part in the description below and in part will be obvious from the description below, or will be learned through practice of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] The above and / or additional aspects and advantages of the present application will become apparent and easily understood from the description of the embodiments in conjunction with the following drawings, in which:

[0031] FIG1 is a flow chart of a vehicle communication security authentication method according to an embodiment of the present disclosure;

[0032] FIG2 is a flow chart of a vehicle communication security authentication method according to another embodiment of the present disclosure;

[0033] FIG3 is a schematic diagram of a key of a vehicle communication security authentication method according to an embodiment of the present disclosure;

[0034] FIG4 is a flow chart of a vehicle communication security authentication method according to yet another embodiment of the present disclosure;

[0035] FIG5 is a structural block diagram of an electronic device according to an embodiment of the present disclosure;

[0036] FIG6 is a structural block diagram of a vehicle communication security authentication device according to an embodiment of the present disclosure;

[0037] 7 is a structural block diagram of a vehicle communication security authentication device according to another embodiment of the present disclosure;

[0038] FIG8 is a structural block diagram of a vehicle according to one embodiment of the present disclosure;

[0039] FIG9 is a structural block diagram of a vehicle according to another embodiment of the present disclosure;

[0040] FIG10 is a structural block diagram of a vehicle according to yet another embodiment of the present disclosure. DETAILED DESCRIPTION

[0041] The following describes in detail embodiments of the present disclosure, examples of which are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are intended to be used to explain the present disclosure, and should not be construed as limiting the present disclosure.

[0042] It should be noted that the UDS 27 diagnostic service provides a method for accessing data or diagnostic services. Its secure unlocking process is based on a Seed-Key mechanism. Only by unlocking with the Seed-Key can specific vehicle services and functions be executed. However, the UDS 27 service seed is typically a 4-byte seed, and some bytes have certain patterns, making it vulnerable to cyberattacks and failing to effectively protect vehicle assets.

[0043] Based on this, the embodiments of the present disclosure provide a vehicle and its communication security authentication method, device, electronic device and storage medium. On the basis of the first-level unlocking, multiple data bits of the second-level seed are written by the first ECU and the second ECU to generate a second-level key, and the second ECU matches it with the preset key to perform second-level unlocking, thereby enhancing the authentication strength of the ECU security access in the vehicle and improving the communication security of the vehicle.

[0044] The following describes in detail the vehicle and its communication security authentication method, device, electronic device, and storage medium according to the embodiments of the present disclosure with reference to the accompanying drawings.

[0045] FIG1 is a flow chart of a vehicle communication security authentication method according to an embodiment of the present disclosure.

[0046] It should be noted that the vehicle includes a first ECU and a second ECU, and the method is applied to the second ECU.

[0047] As shown in FIG1 , the vehicle communication security authentication method may include:

[0048] S11: After the first-level unlocking of the second ECU is successful, a second-level seed request sent by the first ECU is received.

[0049] Specifically, taking the first ECU as the client and the second ECU as the server as an example, when the first ECU needs to access the second ECU, the second ECU needs to be unlocked. The unlocking includes first-level unlocking and second-level unlocking. When unlocking, the first ECU first performs a first-level unlock on the second ECU in a certain way, and after the first-level unlocking is successful, the second-level unlocking is performed. At this time, the first ECU sends a second-level seed request to the second ECU, and the second ECU receives the second-level seed request.

[0050] S12: Generate a secondary seed based on the secondary seed request, wherein the secondary seed includes a plurality of data bits, and a portion of the plurality of data bits is written into the second data by the second ECU.

[0051] Specifically, after the second ECU receives the secondary seed request sent by the first ECU, it generates a secondary seed, Key A. For example, the secondary seed, Key A, can consist of 1 byte, i.e., 8 data bits. The first 3 data bits are automatically written with the second data when the second ECU leaves the factory, and the last 5 data bits are filled with 0xFF by default. The data padding can also be adjusted based on the design of each manufacturer. In this case, the secondary seed includes the 3 data bits automatically written by the second ECU when it leaves the factory and the 5 data bits filled with 0xFF by default.

[0052] S13: Send the secondary seed to the first ECU.

[0053] Furthermore, the second ECU sends the generated secondary seed to the first ECU, and the first ECU writes the first data into another portion of the multiple data bits of the secondary seed to obtain the secondary key. For example, the first three bits of the secondary seed KeyA are the data automatically written by the second ECU when it leaves the factory, and the last five data bits are all 0xFF. The first ECU writes the first data FE F5E4C5D4 into the last five data bits of the secondary seed KeyA to obtain the secondary key KeyB, whose first three bits are the data automatically written by the second ECU when it leaves the factory, and the last five bits are FE F5E4C5D4.

[0054] It should be noted that the first ECU can write the first data to the last 5 of the 8 data bits of the secondary seed, or to the last 3, 4, or 6 of the 8 data bits of the secondary seed. The number of data bits written by the first ECU can be adjusted based on the difficulty of security access. In addition, the secondary seed can also consist of two or more bytes, which can be adjusted based on the difficulty of security access to increase the difficulty of cracking. This method is highly flexible.

[0055] S14: Receive the secondary key sent by the first ECU, wherein the secondary key is obtained by the first ECU writing the first data into another part of the multiple data bits of the secondary seed.

[0056] That is, after the first ECU writes the first data into another part of the multiple data bits of the secondary seed KeyA to obtain the secondary key KeyB, it sends it to the second ECU so that the second ECU determines whether to perform secondary unlocking based on the secondary key.

[0057] S15: Match the secondary key with the preset key, and perform secondary unlocking when the match is successful.

[0058] Specifically, the preset key is a pre-set key segment. The secondary key is matched with the preset key through the second ECU. If the match is successful, the second ECU is unlocked. If the match is not successful, the second ECU is not unlocked and the data security authentication is exited.

[0059] In the above embodiment, after the first-level unlocking of the second ECU is successful, the second ECU generates a second-level seed based on the received second-level seed request sent by the first ECU. Some of the multiple data bits of the second-level seed are written into the second data by the second ECU, and the other data bits are written into the first data by the first ECU, thereby obtaining a second-level key, and the second ECU matches it with the preset key to perform a second-level unlocking based on the first-level unlocking, thereby enhancing the authentication strength of the secure access to the ECU in the vehicle and improving the communication security of the vehicle.

[0060] In some embodiments, referring to FIG2 , the preset key includes first preset data and second preset data, and matching the secondary key with the preset key and performing secondary unlocking when the match is successful includes:

[0061] S151: Match the first data in the secondary key with the first preset data, and match the second data in the secondary key with the second preset data.

[0062] Taking the above example, correspondingly, the second preset data may be the data corresponding to the first 3 data bits of the preset key, and the first preset data may be the data corresponding to the last 5 data bits of the preset key. The preset key composed of the first preset data and the second preset data is pre-stored in the whitelist.

[0063] The second ECU includes a whitelist containing data that can successfully pass. This whitelist is programmed into the second ECU by the manufacturer at the factory. If the data in the secondary key is not on the whitelist, the secondary key will fail to match the preset key. The whitelist also stores the identification information of the second ECU and the identification information of the first ECU. The identification information of the second ECU is used to identify the second ECU, and the identification information of the first ECU is used to identify the first ECU.

[0064] S152: When the first data in the secondary key matches the first preset data, and the second data in the secondary key matches the second preset data, it is determined that the matching is successful, and secondary unlocking is performed.

[0065] Exemplarily, as shown in Figure 3, a preset key including second preset data of 11, 22 and 33 and first preset data of FE, F5, E4, C5 and D4 is stored in the white list of the second ECU. After receiving the secondary key, the second ECU matches the second data in the secondary key with the second preset data 11, 22 and 33. If the second data is also 11, 22, 33, it is determined that the second data matches the second preset data, and matches the first data in the secondary key with the first preset data FE, F5, E4, C5 and D4. If the first data is also FE, F5, E4, C5 and D4, it is determined that the first data matches the first preset data, and then it can be determined that the secondary key matches the preset key successfully, and the second ECU is successfully unlocked.

[0066] In this way, by matching the first data and the second data in the secondary key with the preset key in the whitelist, the strength of data security authentication is enhanced, and the communication security of the vehicle is guaranteed as much as possible.

[0067] In some embodiments, different second ECUs correspond to different second preset data, and different first ECUs correspond to different first preset data.

[0068] Taking the above example as an example, the second preset data corresponds to the first three bits of the preset key, which is written by the second ECU at the factory. Therefore, different second ECUs correspond to different second preset data. The first preset data corresponds to the last five bits of the preset key, which is written by the first ECU. Therefore, different first ECUs correspond to different first preset data. This ensures that when the first and second ECUs change, the preset data written by them also changes accordingly, further improving security.

[0069] In some embodiments, referring to FIG. 4 , the vehicle communication security authentication method further includes:

[0070] S21: Receive a primary seed request sent by the first ECU.

[0071] Specifically, when performing the first level unlocking, the first ECU may send a first level seed request, and the second ECU may receive the first level seed request sent by the first ECU.

[0072] S22: Generate a first-level seed based on the first-level seed request, and encrypt the first-level seed to generate a first-level verification key.

[0073] Specifically, after receiving the primary seed request, the second ECU generates a primary seed. Exemplarily, the primary seed is a random number. The primary seed is encrypted to generate a primary verification key. That is, the random number is encrypted using a security algorithm to generate the primary verification key. The security algorithm may be a commonly used security algorithm, including but not limited to the MD5 (Message Digest Algorithm 5) algorithm, the SHA (Secure Hash Algorithm) algorithm, the DES (Data Encryption Standard) algorithm, the AES (Advanced Encryption Standard) algorithm, and the RSA (Rivest-Shamir-Adleman) algorithm.

[0074] S23: Send the primary seed to the first ECU.

[0075] S24: Receive the primary key sent by the first ECU, where the primary key is generated by encrypting the primary seed by the first ECU.

[0076] Specifically, after the second ECU sends the primary seed to the first ECU, the first ECU encrypts the primary seed using a security algorithm to obtain a primary key, and then sends it to the second ECU. The security algorithm used by the first ECU is the same as the security algorithm used by the second ECU to obtain the primary verification key.

[0077] S25: Match the first-level key with the first-level verification key, and perform first-level unlocking when the match is successful.

[0078] Specifically, after the second ECU obtains the first-level key, it matches the first-level key with the first-level verification key to determine whether the first-level key matches. If the match is successful, it means that the first-level key is legal, and the second ECU performs first-level unlocking. If the match is not successful, the second ECU is in a locked state.

[0079] To sum up, according to the vehicle communication security authentication method of the embodiment of the present disclosure, after the first-level unlocking of the second ECU is successful, the second ECU generates a second-level seed based on the received second-level seed request sent by the first ECU, and a part of the multiple data bits of the second-level seed are written into the second data by the second ECU, and the other part of the data bits are written into the first data by the first ECU, thereby obtaining a second-level key, and the second ECU matches it with the preset key to perform a second-level unlocking based on the first-level unlocking, thereby enhancing the authentication strength of the secure access to the ECU in the vehicle and improving the communication security of the vehicle.

[0080] It should be noted that the specific numerical values ​​mentioned above are only used as examples to illustrate the implementation of the present disclosure in detail and should not be understood as limiting the present disclosure. In other examples, implementation methods, or embodiments, other numerical values ​​can be selected according to the present disclosure and are not specifically limited here.

[0081] Corresponding to the above embodiments, an embodiment of the present disclosure further proposes a computer-readable storage medium on which a program is stored. When the program is executed by a processor, the vehicle communication security authentication method of any of the above embodiments is implemented.

[0082] According to the computer-readable storage medium of the embodiment of the present disclosure, based on the aforementioned vehicle communication security authentication method, data is written to multiple data bits of the secondary seed through the first ECU and the second ECU to generate a secondary key, and the second ECU matches it with the preset key to perform secondary unlocking, thereby enhancing the authentication strength of the ECU security access in the vehicle and improving the communication security of the vehicle.

[0083] For example, when the program is executed by the processor, the following vehicle communication security authentication method is implemented:

[0084] S11: After the first-level unlocking of the second ECU is successful, a second-level seed request sent by the first ECU is received.

[0085] S12: Generate a secondary seed based on the secondary seed request, where the secondary seed includes multiple data bits, and a portion of the multiple data bits is written into the second data by the second ECU.

[0086] S13: Send the secondary seed to the first ECU.

[0087] S14: Receive a secondary key sent by the first ECU, where the secondary key is obtained by the first ECU writing the first data into another part of the multiple data bits of the secondary seed.

[0088] S15: Match the secondary key with the preset key, and perform secondary unlocking when the match is successful.

[0089] It should be pointed out that the above explanation of the embodiments and beneficial effects of the vehicle communication security authentication method is also applicable to the computer-readable storage medium of the embodiment of the present disclosure. To avoid redundancy, it will not be elaborated here.

[0090] Corresponding to the above embodiments, an embodiment of the present disclosure further provides an electronic device.

[0091] Figure 5 is a block diagram of an electronic device according to one embodiment of the present disclosure. As shown in Figure 5 , the electronic device 100 includes a memory 102, a processor 104, and a program 106 stored in the memory 102 and executable by the processor 104. When the processor 104 executes the program 106, it implements the vehicle communication security authentication method according to any of the above embodiments.

[0092] According to the electronic device of the embodiment of the present disclosure, based on the aforementioned vehicle communication security authentication method, data is written to multiple data bits of the secondary seed through the first ECU and the second ECU to generate a secondary key, and the second ECU matches it with the preset key to perform secondary unlocking, thereby enhancing the authentication strength of the ECU security access in the vehicle and improving the communication security of the vehicle.

[0093] For example, when the program 106 is executed by the processor 104, the following vehicle communication security authentication method is implemented:

[0094] S11: After the first-level unlocking of the second ECU is successful, a second-level seed request sent by the first ECU is received.

[0095] S12: Generate a secondary seed based on the secondary seed request, where the secondary seed includes multiple data bits, and a portion of the multiple data bits is written into the second data by the second ECU.

[0096] S13: Send the secondary seed to the first ECU.

[0097] S14: Receive a secondary key sent by the first ECU, where the secondary key is obtained by the first ECU writing the first data into another part of the multiple data bits of the secondary seed.

[0098] S15: Match the secondary key with the preset key, and perform secondary unlocking when the match is successful.

[0099] It should be noted that the above explanation of the embodiment and beneficial effects of the vehicle communication security authentication method is also applicable to the electronic device 100 of the embodiment of the present disclosure. To avoid redundancy, it will not be elaborated here.

[0100] Corresponding to the above embodiments, an embodiment of the present disclosure further proposes a vehicle communication security authentication device.

[0101] FIG6 is a block diagram of a vehicle communication security authentication device according to an embodiment of the present disclosure. As shown in FIG6 , the vehicle communication security authentication device 300 includes: a first receiving module 302, a first generating module 304, a first sending module 306, and a first unlocking module 308. The first receiving module 302 is configured to receive a secondary seed request from the first ECU after the second ECU successfully unlocks the primary ECU; the first generating module 304 is configured to generate a secondary seed based on the secondary seed request. The secondary seed includes multiple data bits, and a portion of the multiple data bits is written by the second ECU as second data; the first sending module 306 is configured to send the secondary seed to the first ECU; the first receiving module 302 is further configured to receive a secondary key from the first ECU. The secondary key is obtained by writing the first data to another portion of the multiple data bits of the secondary seed by the first ECU; and the first unlocking module 308 is configured to match the secondary key with a preset key and, if the match is successful, perform secondary unlocking.

[0102] According to the vehicle communication security authentication device of the embodiment of the present disclosure, after the first-level unlocking of the second ECU is successful, the second ECU generates a second-level seed based on the received second-level seed request sent by the first ECU, and a part of the multiple data bits of the second-level seed are written into the second data by the second ECU, and the other part of the data bits are written into the first data by the first ECU, thereby obtaining a second-level key, and the second ECU matches it with the preset key to perform a second-level unlocking based on the first-level unlocking, thereby enhancing the authentication strength of the secure access to the ECU in the vehicle and improving the communication security of the vehicle.

[0103] In some embodiments of the present disclosure, the preset key includes first preset data and second preset data, and the first unlocking module 308 is specifically used to: match the first data in the secondary key with the first preset data, and match the second data in the secondary key with the second preset data; when the first data in the secondary key matches the first preset data, and the second data in the secondary key matches the second preset data, it is determined that the match is successful and secondary unlocking is performed.

[0104] In some embodiments of the present disclosure, different second ECUs correspond to different second preset data, and different first ECUs correspond to different first preset data.

[0105] In some embodiments of the present disclosure, the second ECU includes a whitelist, and the identification information of the second ECU, the identification information of the first ECU, and the preset key are correspondingly stored in the whitelist.

[0106] In some embodiments of the present disclosure, the vehicle communication security authentication device 300 also includes a third receiving module (not shown in the figure), a third generating module (not shown in the figure), a third sending module (not shown in the figure) and a third unlocking module (not shown in the figure), the third receiving module is used to receive a first-level seed request sent by the first ECU; the third generating module is used to generate a first-level seed based on the first-level seed request, and encrypt the first-level seed to generate a first-level verification key; the third sending module is used to send the first-level seed to the first ECU; the third receiving module is also used to receive a first-level key sent by the first ECU, and the first-level key is generated by encrypting the first-level seed by the first ECU; the third unlocking module is used to match the first-level key with the first-level verification key, and perform first-level unlocking when the match is successful.

[0107] In some embodiments of the present disclosure, the third generation module is specifically used to: encrypt the random number to generate a first-level verification key.

[0108] It should be noted that the above explanation of the embodiment and beneficial effects of the vehicle communication security authentication method is also applicable to the vehicle communication security authentication device 300 of the embodiment of the present disclosure. To avoid redundancy, it will not be elaborated here.

[0109] Corresponding to the above embodiment, an embodiment of the present disclosure further proposes another vehicle communication security authentication device.

[0110] FIG7 is a block diagram of a vehicle communication security authentication device according to another embodiment of the present disclosure. As shown in FIG7 , the vehicle communication security authentication device 400 includes: a second sending module 402, a second receiving module 404, and a second generating module 406. The second sending module 402 is used to send a secondary seed request to the second ECU after the first-level unlocking of the second ECU is successful; the second receiving module 404 is used to receive a secondary seed generated by the second ECU based on the secondary seed request, the secondary seed including multiple data bits, and a portion of the multiple data bits is written by the second ECU as the second data; the second generating module 406 is used to write the first data to another portion of the multiple data bits of the secondary seed to obtain a secondary key; the second sending module 402 is also used to send the secondary key to the second ECU, wherein the second ECU matches the secondary key with the preset key and performs the secondary unlocking when the match is successful.

[0111] According to the vehicle communication security authentication device of the embodiment of the present disclosure, after the first-level unlocking of the second ECU is successfully performed, the first ECU sends a second-level seed request to the second ECU, so that the second ECU generates a second-level seed based on the second-level seed request, and part of the multiple data bits of the second-level seed are written into the second data by the second ECU, and the other part of the data bits are written into the first data by the first ECU, thereby obtaining a second-level key, and the second ECU matches it with the preset key to perform a second-level unlocking based on the first-level unlocking, thereby enhancing the authentication strength of the secure access to the ECU in the vehicle and improving the communication security of the vehicle.

[0112] In some embodiments of the present disclosure, the vehicle communication security authentication device 400 also includes a fourth sending module (not shown in the figure), a fourth receiving module (not shown in the figure) and a fourth generating module (not shown in the figure), the fourth sending module is used to send a first-level seed request to the second ECU; the fourth receiving module is used to receive the first-level seed generated by the second ECU based on the first-level seed request; the fourth generating module is used to encrypt the first-level seed to generate a first-level key; the fourth sending module is also used to send the first-level key to the second ECU, wherein the second ECU matches the first-level key with the first-level verification key, and performs a first-level unlocking when the match is successful, and the first-level verification key is generated by the second ECU encrypting the first-level seed.

[0113] It should be pointed out that the above explanation of the embodiment and beneficial effects of the vehicle communication security authentication method is also applicable to the vehicle communication security authentication device 400 of the embodiment of the present disclosure. To avoid redundancy, it will not be elaborated here.

[0114] Corresponding to the above-mentioned embodiments, the embodiments of the present disclosure further provide a vehicle. FIG8 is a structural block diagram of a vehicle according to one embodiment of the present disclosure, FIG9 is a structural block diagram of a vehicle according to another embodiment of the present disclosure, and FIG10 is a structural block diagram of a vehicle according to yet another embodiment of the present disclosure. As shown in FIG8 , the vehicle 500 includes the electronic device 100 of the aforementioned embodiment. As shown in FIG9 , the vehicle 500 includes the vehicle communication security authentication device 300 of the aforementioned embodiment. As shown in FIG10 , the vehicle 500 includes the vehicle communication security authentication device 400 of the aforementioned embodiment.

[0115] According to the vehicle of the embodiment of the present disclosure, based on the aforementioned vehicle communication security authentication method, data is written to multiple data bits of the secondary seed through the first ECU and the second ECU to generate a secondary key, and the second ECU matches it with the preset key to perform secondary unlocking, thereby enhancing the authentication strength of the ECU security access in the vehicle and improving the communication security of the vehicle.

[0116] It should be pointed out that the above explanation of the embodiment and beneficial effects of the vehicle communication security authentication method is also applicable to the vehicle 500 of the embodiment of the present disclosure. To avoid redundancy, it will not be elaborated here.

[0117] It should be noted that the logic and / or steps represented in the flowcharts or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing the logical functions, and can be embodied in any computer-readable medium for use by an instruction execution system, apparatus, or device (such as a computer-based system, a system including a processor, or other system that can fetch and execute instructions from an instruction execution system, apparatus, or device), or in conjunction with such instruction execution system, apparatus, or device. For the purposes of this specification, a "computer-readable medium" can be any device that can contain, store, communicate, propagate, or transmit a program for use by an instruction execution system, apparatus, or device, or in conjunction with such instruction execution system, apparatus, or device. More specific examples (non-exhaustive list) of computer-readable media include the following: an electrical connection portion having one or more wires (electronic device), a portable computer disk cartridge (magnetic device), random access memory (RAM), read-only memory (ROM), erasable and programmable read-only memory (EPROM or flash memory), fiber optic devices, and portable compact disc read-only memory (CDROM). Furthermore, the computer-readable medium may even be paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium and then editing, interpreting or processing it in another suitable manner if necessary, and then storing it in a computer memory.

[0118] It should be understood that various parts of the present disclosure can be implemented using hardware, software, firmware, or a combination thereof. In the above embodiments, multiple steps or methods can be implemented using software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented using hardware, as in another embodiment, any one of the following technologies known in the art or a combination thereof can be used to implement: a discrete logic circuit having a logic gate circuit for implementing a logic function on a data signal, an application-specific integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0119] Throughout this specification, reference to terms such as "one embodiment," "some embodiments," "examples," "specific examples," or "some examples" means that a specific feature, structure, material, or characteristic described in conjunction with that embodiment or example is included in at least one embodiment or example of the present disclosure. In this specification, schematic representations of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in any one or more embodiments or examples.

[0120] Furthermore, the terms "first," "second," and the like used in the embodiments of the present disclosure are for descriptive purposes only and should not be construed as indicating or implying relative importance, or implicitly specifying the number of technical features indicated in the embodiments. Thus, features defined in the embodiments of the present disclosure with terms such as "first," "second," and the like may explicitly or implicitly indicate that the embodiment includes at least one of such features. In the description of the present disclosure, the word "plurality" means at least two or more, such as two, three, four, and the like, unless otherwise specifically defined in the embodiments. Relational terms such as first and second are used solely to distinguish one entity or operation from another, and do not necessarily require or imply any actual relationship or order between these entities or operations. Furthermore, the terms "comprise," "comprising," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, article, or apparatus comprising a list of elements includes not only those elements but also other elements not explicitly listed, or elements inherent to such process, method, article, or apparatus. Without further qualification, the phrase "comprising a..." does not preclude the presence of additional identical elements in the process, method, article, or apparatus comprising the elements.

[0121] Each embodiment in this specification is described in a related manner. Similar portions between the various embodiments can be referenced to each other. Each embodiment focuses on the differences between the other embodiments. In particular, the device, electronic device, and computer-readable storage medium embodiments are generally similar to the method embodiments, so their descriptions are relatively simple. For related portions, reference can be made to the descriptions of the method embodiments.

[0122] Although the embodiments of the present disclosure have been shown and described above, it is understood that the above embodiments are illustrative and are not to be construed as limitations on the present disclosure. A person skilled in the art may change, modify, replace and vary the above embodiments within the scope of the present disclosure.

Claims

1. A vehicle communication security authentication method, the vehicle comprising a first ECU and a second ECU, the method being applied to the second ECU, the method comprising: After the first level unlocking of the second ECU is successful, receiving a second level seed request sent by the first ECU; generating a secondary seed based on the secondary seed request, the secondary seed comprising a plurality of data bits, and a portion of the plurality of data bits being written into second data by the second ECU; sending the secondary seed to the first ECU; receiving a secondary key sent by the first ECU, wherein the secondary key is obtained by writing the first data into another part of the data bits of the plurality of data bits of the secondary seed by the first ECU; The secondary key is matched with the preset key, and when the match is successful, secondary unlocking is performed.

2. The vehicle communication security authentication method according to claim 1, wherein: The preset key includes first preset data and second preset data, and the matching of the secondary key with the preset key and performing secondary unlocking when the matching is successful includes: Matching the first data in the secondary key with the first preset data, and matching the second data in the secondary key with the second preset data; When the first data in the secondary key matches the first preset data, and the second data in the secondary key matches the second preset data, it is determined that the match is successful, and secondary unlocking is performed.

3. The vehicle communication security authentication method according to claim 2, wherein: Different second ECUs correspond to different second preset data, and different first ECUs correspond to different first preset data.

4. The vehicle communication security authentication method according to claim 3, wherein: The second ECU includes a white list, and the identification information of the second ECU, the identification information of the first ECU and the preset key are correspondingly stored in the white list.

5. The vehicle communication security authentication method according to any one of claims 1 to 4, wherein: The method further comprises: Receiving a primary seed request sent by the first ECU; Generate a primary seed based on the primary seed request, and encrypt the primary seed to generate a primary verification key; sending the primary seed to the first ECU; receiving a primary key sent by the first ECU, where the primary key is generated by encrypting the primary seed by the first ECU; The primary key is matched with the primary verification key, and when the match is successful, a primary unlocking is performed.

6. The vehicle communication security authentication method according to claim 5, wherein: The primary seed includes a random number, and the step of encrypting the primary seed to generate a primary verification key includes: The random number is encrypted to generate the primary verification key.

7. A vehicle communication security authentication method, wherein: The vehicle includes a first ECU and a second ECU, the method is applied to the first ECU, and the method includes: After successfully performing the first-level unlocking on the second ECU, sending a second-level seed request to the second ECU; receiving a secondary seed generated by the second ECU based on the secondary seed request, the secondary seed comprising a plurality of data bits, and a portion of the plurality of data bits being written into second data by the second ECU; After writing the first data into another part of the data bits of the plurality of data bits of the secondary seed, a secondary key is obtained; The secondary key is sent to the second ECU, wherein the second ECU matches the secondary key with a preset key and performs secondary unlocking when the match succeeds.

8. The vehicle communication security authentication method according to claim 7, wherein: The method further comprises: sending a primary seed request to the second ECU; receiving a primary seed generated by the second ECU based on the primary seed request; Encrypting the primary seed to generate a primary key; The first-level key is sent to the second ECU, wherein the second ECU matches the first-level key with a first-level verification key and performs a first-level unlocking when the match is successful. The first-level verification key is generated by encrypting the first-level seed by the second ECU.

9. A computer-readable storage medium having a program stored thereon, wherein when the program is executed by a processor, the vehicle communication security authentication method according to any one of claims 1 to 8 is implemented.

10. An electronic device, comprising: A memory, a processor, and a program stored in the memory and executable on the processor, wherein when the processor executes the program, the vehicle communication security authentication method according to any one of claims 1 to 8 is implemented.

11. A vehicle communication security authentication device, the vehicle comprising a first ECU and a second ECU, the device being applied to the second ECU, the device comprising: A first receiving module, configured to receive a secondary seed request sent by the first ECU after the first level unlocking of the second ECU is successful; A first generating module, configured to generate a secondary seed based on the secondary seed request, wherein the secondary seed includes a plurality of data bits, and a portion of the plurality of data bits is written into second data by the second ECU; A first sending module, used for sending the secondary seed to the first ECU; The first receiving module is further used to receive a secondary key sent by the first ECU, where the secondary key is obtained by the first ECU writing the first data to another part of the multiple data bits of the secondary seed; The first unlocking module is used to match the secondary key with the preset key and perform Second level unlock.

12. A vehicle communication security authentication device, the vehicle comprising a first ECU and a second ECU, the device being applied to the first ECU, the device comprising: A second sending module, configured to send a secondary seed request to the second ECU after the primary unlocking of the second ECU is successful; A second receiving module, configured to receive a secondary seed generated by the second ECU based on the secondary seed request, wherein the secondary seed includes a plurality of data bits, and a portion of the plurality of data bits is written into second data by the second ECU; A second generating module, used for obtaining a secondary key after writing the first data into another part of the plurality of data bits of the secondary seed; The second sending module is further used to send the secondary key to the second ECU, wherein the second ECU matches the secondary key with a preset key and performs secondary unlocking when the match is successful.

13. A vehicle, comprising the electronic device according to claim 10, or the vehicle communication security authentication device according to claim 11 or 12.

Images