Key derivation method, apparatus and means of transport

Abstract

The present application provides a key derivation method, an apparatus, and a means of transport. The method can be applied to the field of key management, and comprises: acquiring a master key and identification information of a first component in a means of transport; according to the master key and the identification information of the first component, determining a first key corresponding to the first component; and sending the first key to the first component. The method can carry out key injection and derivation processes in means of transport, and ensure that one component corresponds to one key, reducing the risk of leakage during key injection and derivation.

Description

Key derivation method, device and delivery vehicle

[0001] This application claims priority to the Chinese patent application filed with the State Intellectual Property Office of China on August 30, 2023, with application number 202311114510.7 and application name “Key derivation method, device and carrier”, the entire contents of which are incorporated by reference into this application. Technical Field

[0002] The present application relates to the field of key management, and more particularly, to a key derivation method, device and delivery vehicle. Background Art

[0003] The in-vehicle network is a distributed network, with in-vehicle communication primarily implemented via Ethernet and the Controller Area Network (CAN) bus. In-vehicle communication security is a crucial component of smart cars, and related security features such as device authentication, secure access to the Unified Diagnostic Service (UDS), and secure onboard communication (SecOC) are finding increasing use cases. These security features typically require cryptographic keys to implement.

[0004] However, with the changes in vehicle architecture and business, more and more keys need to be stored in the components of the vehicle. These keys need to be derived through the key management system outside the vehicle based on the key derivation algorithm and uniformly loaded into each component on the production line. This processing method will result in the keys of all components on the production line needing to be loaded, increasing the risk of key leakage.

[0005] Summary of the Invention

[0006] The present application provides a key derivation method, device and carrier, which can enable the key filling and derivation process to be carried out inside the carrier, and ensure that one component corresponds to one key, which can reduce the risk of leakage during key filling and derivation.

[0007] In a first aspect, a key derivation method is provided, the method comprising: obtaining a master key and identification information of a first component in a vehicle; determining a first key corresponding to the first component based on the master key and the identification information of the first component; and sending the first key to the first component.

[0008] Optionally, the identification information of the first component may include: one or more of a component serial number, a component ID, or a component IP address of the domain controller or the electronic control unit.

[0009] Optionally, the master key may be generated by a third-party key management system and then transferred to the key management module inside the vehicle by the third key management system, or may be randomly generated by the key management module inside the vehicle.

[0010] Optionally, the method may be executed by a key management module, which may be deployed in any controller inside the vehicle, or the key management module may be an independent component inside the vehicle.

[0011] In an embodiment of the present application, the first key corresponding to the first component can be determined based on the master key and the identification information of the first component. In this way, the process of key derivation and filling is carried out inside the vehicle, and it is ensured that one component corresponds to one key, which can reduce the risk of leakage during key filling and derivation.

[0012] In combination with the first aspect, in certain implementations of the first aspect, determining the first key corresponding to the first component based on the master key and the identification information of the first component includes: obtaining a salt value, the salt value including at least one of the following: a salt value corresponding to the vehicle, a salt value corresponding to the first component, or a salt value corresponding to the functional domain to which the first component belongs; determining the first key based on the master key, the identification information of the first component, and the salt value.

[0013] The salt value may be a random, unique random number, and the use of the salt value may increase the security of the use of the first key.

[0014] Optionally, when the salt value includes: a salt value corresponding to the first component and / or a salt value of the functional domain of the first component, it can be determined according to identification information of the first component.

[0015] In the embodiment of the present application, during the process of generating the first key, the use of a salt value can increase the security of the use of the first key, thereby more effectively preventing the first key from being stolen by an attacker.

[0016] In combination with the first aspect, in some implementations of the first aspect, the method further includes: deleting the first key.

[0017] Optionally, the process of deleting the first key may be performed after sending the first key to the first component.

[0018] In an embodiment of the present application, after the first key is derived and distributed, the key management module can delete the first key, and subsequent keys can be derived again by the key management module when used. In this way, the storage space of the first key can be saved, thereby improving the utilization efficiency of the first key.

[0019] In combination with the first aspect, in some implementations of the first aspect, the method also includes: obtaining first information, the first information is associated with first authentication request information sent by the first device, the first authentication request information is used to request authentication of the diagnostic authority or communication authority of the first device, the first authentication request information includes identification information of the second component; determining a second key based on the master key and the identification information of the second component, the second key is used to generate second information, and the second information is used to request the first component to authenticate the diagnostic authority or communication authority of the first device.

[0020] Alternatively, the first device may be an external device connected to the vehicle, or the first device may be an internal device or component in the vehicle requesting authentication of a diagnostic or communication function.

[0021] In this embodiment of the present application, the key management module can instantly derive a second key based on the identification information of the second component, allowing the first component to verify the authority of the first device based on the second key. This instant derivation of the second key not only saves storage space in the key management system but also ensures that each component corresponds to a key, thereby increasing the security of the second key.

[0022] In combination with the first aspect, in some implementations of the first aspect, the method further includes: sending the second key to the first component, or sending the second information to the first component, where the second information includes the second key.

[0023] In combination with the first aspect, in some implementations of the first aspect, the first component is a domain controller or an electronic control unit.

[0024] In a second aspect, a key derivation method is provided, which is applied to a first component, where the first component is a domain controller. The method includes: receiving a first key corresponding to the domain controller, where the first key is associated with a master key and identification information of the domain controller; and storing the first key.

[0025] In this embodiment of the present application, after receiving the first key, the domain controller can store the first key so that the domain controller can subsequently derive the key corresponding to the electronic control unit based on the first key. This multi-level key derivation method can further reduce the risk of key leakage and enhance the security of key use.

[0026] In combination with the second aspect, in certain implementations of the second aspect, the method further includes: obtaining identification information of the electronic control unit corresponding to the domain controller; determining a third key corresponding to the electronic control unit based on the first key and the identification information of the electronic control unit; and sending the third key to the electronic control unit.

[0027] In an embodiment of the present application, the domain controller can derive a third key corresponding to the electronic control unit based on the first key and send the third key to the electronic control unit so that the electronic control unit can perform permission verification based on the third key. In this way, each derivation of the key depends on the key of the previous level. The leakage of the key at any level may render the key corresponding to the electronic control unit unusable. Therefore, this multi-level key derivation method can further reduce the risk of key leakage and enhance the security of key use.

[0028] In combination with the second aspect, in certain implementations of the second aspect, determining the third key corresponding to the electronic control unit based on the first key and the identification information of the electronic control unit includes: obtaining a salt value, the salt value including: a salt value corresponding to the vehicle, a salt value corresponding to the domain controller, or a salt value corresponding to the electronic control unit; determining the third key based on the first key, the identification information of the electronic control unit, and the salt value.

[0029] In the embodiment of the present application, during the process of generating the third key, the use of a salt value can further increase the security of the use of the third key, thereby more effectively preventing the third key from being stolen by an attacker.

[0030] In combination with the second aspect, in some implementations of the second aspect, the method further includes: deleting the third key.

[0031] In an embodiment of the present application, after the third key is derived and distributed, the domain controller can delete the third key, and subsequent keys can be derived again by the domain controller when used. In this way, the space for storing keys in the domain controller can be saved, thereby improving the utilization efficiency of the third key.

[0032] In combination with the second aspect, in certain implementations of the second aspect, the method further includes: receiving a second key, or receiving second information, the second information including the second key; determining a fourth key corresponding to the electronic control unit based on the second key and the identification information of the electronic control unit; and sending third information to the electronic control unit, the third information being used to request the electronic control unit to authenticate the diagnostic authority or communication authority of the first device, the third information including the fourth key.

[0033] In an embodiment of the present application, after receiving the second key, the domain controller can instantly derive a fourth key based on the second key and the identification information of the electronic control unit, and send the fourth key to the electronic control unit so that the electronic control unit can verify the authority of the first device based on the fourth key. This instant key derivation method can not only save the storage space of the domain controller, but also ensure that one electronic control unit corresponds to one key, thereby increasing the security of key use.

[0034] In a third aspect, a key derivation method is provided, which is applied to a first component, which is an electronic control unit. The method includes: receiving a first key corresponding to the electronic control unit, the first key being associated with a master key and identification information of the electronic control unit; and storing the first key.

[0035] In an embodiment of the present application, after receiving the first key, the electronic control unit can store the first key to facilitate subsequent authority verification based on the first key. In this way, the key derivation process can be completed conveniently and quickly, thereby improving the derivation efficiency of the first key.

[0036] In combination with the third aspect, in certain implementations of the third aspect, the method further includes: receiving second information, the second information being used to request the electronic control unit to authenticate the diagnostic authority or communication authority of the first device, the second information including a second key, the second key being associated with the master key and the identification information of the second component; and in a case where the first key and the second key match, sending a first response information, the first response information being used to indicate that the first device has the authority to diagnose the electronic control unit, or that the first device has the authority to communicate with the electronic control unit.

[0037] Optionally, the matching of the first key and the second key may be understood as the first key and the second key being completely identical, or the sequence parts of the first key and the second key being identical.

[0038] In an embodiment of the present application, the electronic control unit can verify whether the first device has the authority to diagnose or communicate based on the first key and the second key, so that the legitimate first device can perform the corresponding function as soon as possible to meet the reasonable needs of the user.

[0039] In a fourth aspect, a key derivation method is provided, which is applied to an electronic control unit, and the method includes: receiving a third key corresponding to the electronic control unit, the third key being associated with a master key, identification information of a domain controller, and identification information of the electronic control unit; and storing the third key.

[0040] In an embodiment of the present application, after receiving the third key, the electronic control unit can store the third key to facilitate subsequent authority verification based on the third key. Since the third key is generated through multi-level derivation, the third key has higher security in use.

[0041] In combination with the fourth aspect, in certain implementations of the fourth aspect, the method further includes: receiving third information, the third information being used to request the electronic control unit to authenticate the diagnostic authority or communication authority of the first device, the third information including a fourth key, the fourth key being associated with the master key, the identification information of the second component, and the identification information of the electronic control unit; and sending a second response information when the third key and the fourth key match, the second response information being used to indicate that the first device has the authority to diagnose the electronic control unit, or that the first device has the authority to communicate with the electronic control unit.

[0042] Optionally, the matching of the third key and the fourth key may be understood as the third key and the fourth key being completely identical, or the sequence portion of the third key and the fourth key being identical.

[0043] In an embodiment of the present application, the electronic control unit can verify whether the first device has the authority to diagnose or communicate based on the third key and the fourth key. Since the third key and the fourth key are generated through multi-level derivation, the result of the key verification can be more reliable.

[0044] In a fifth aspect, a key derivation device is provided, which includes: an acquisition unit for acquiring a master key and identification information of a first component in a vehicle; a processing unit for determining a first key corresponding to the first component based on the master key and the identification information of the first component; and a transceiver unit for sending the first key to the first component.

[0045] In combination with the fifth aspect, in certain implementations of the fifth aspect, the acquisition unit is further used to obtain a salt value, and the salt value includes at least one of the following: a salt value corresponding to the vehicle, a salt value corresponding to the first component, or a salt value corresponding to the functional domain to which the first component belongs; the processing unit is specifically used to determine the first key based on the master key, the identification information of the first component and the salt value.

[0046] In combination with the fifth aspect, in some implementations of the fifth aspect, the processing unit is further used to delete the first key.

[0047] In combination with the fifth aspect, in certain implementations of the fifth aspect, the acquisition unit is further used to acquire first information, where the first information is associated with first authentication request information sent by the first device, where the first authentication request information is used to request authentication of the diagnostic authority or communication authority of the first device, and where the first authentication request information includes identification information of the second component; the processing unit is further used to determine a second key based on the master key and the identification information of the second component, where the second key is used to generate second information, and where the second information is used to request the first component to authenticate the diagnostic authority or communication authority of the first device.

[0048] In combination with the fifth aspect, in some implementations of the fifth aspect, the transceiver unit is further used to send the second key to the first component, or send the second information to the first component, where the second information includes the second key.

[0049] In combination with the fifth aspect, in some implementations of the fifth aspect, the first component is a domain controller or an electronic control unit.

[0050] In a sixth aspect, a key derivation device is provided, characterized in that the key derivation device is applied to a first component, the first component is a domain controller, and the device includes: a transceiver unit for receiving a first key corresponding to the domain controller, the first key being associated with a master key and identification information of the domain controller; and a processing unit for storing the first key.

[0051] In combination with the sixth aspect, in certain implementations of the sixth aspect, the device further includes: an acquisition unit, which is used to obtain identification information of the electronic control unit corresponding to the domain controller; the processing unit is also used to determine the third key corresponding to the electronic control unit based on the first key and the identification information of the electronic control unit; the transceiver unit is also used to send the third key to the electronic control unit.

[0052] In combination with the sixth aspect, in certain implementations of the sixth aspect, the acquisition unit is further used to obtain a salt value, wherein the salt value includes: a salt value corresponding to the vehicle, a salt value corresponding to the domain controller, or a salt value corresponding to the electronic control unit; the processing unit is specifically used to determine the third key based on the first key, the identification information of the electronic control unit, and the salt value.

[0053] In combination with the sixth aspect, in some implementations of the sixth aspect, the processing unit is further used to delete the third key.

[0054] In combination with the sixth aspect, in certain implementations of the sixth aspect, the transceiver unit is further used to receive a second key, or receive second information, wherein the second information includes the second key; the processing unit is further used to determine the fourth key corresponding to the electronic control unit based on the second key and the identification information of the electronic control unit; the transceiver unit is further used to send third information to the electronic control unit, wherein the third information is used to request the electronic control unit to authenticate the diagnostic authority or communication authority of the first device, and the third information includes the fourth key.

[0055] In the seventh aspect, a key derivation device is provided, characterized in that the device is applied to a first component, the first component is an electronic control unit, and the device includes: a transceiver unit for receiving a first key corresponding to the electronic control unit, the first key being associated with a master key and identification information of the electronic control unit; and a processing unit for storing the first key.

[0056] In combination with the seventh aspect, in certain implementations of the seventh aspect, the transceiver unit is further used to: receive second information, the second information is used to request the electronic control unit to authenticate the diagnostic authority or communication authority of the first device, the second information includes a second key, and the second key is associated with the master key and the identification information of the second component; when the first key and the second key match, send a first response message, the first response message is used to indicate that the first device has the authority to diagnose the electronic control unit, or the first device has the authority to communicate with the electronic control unit.

[0057] In an eighth aspect, a key derivation device is provided, characterized in that the device is applied to an electronic control unit, and the device includes: a transceiver unit for receiving a third key corresponding to the electronic control unit, the third key being associated with a master key, identification information of a domain controller and identification information of the electronic control unit; and a processing unit for storing the third key.

[0058] In combination with the eighth aspect, in certain implementations of the eighth aspect, the transceiver unit is further used to: receive third information, the third information is used to request the electronic control unit to authenticate the diagnostic authority or communication authority of the first device, the third information includes a fourth key, and the fourth key is associated with the master key, the identification information of the second component and the identification information of the electronic control unit; when the third key and the fourth key match, send a second response information, the second response information is used to indicate that the first device has the authority to diagnose the electronic control unit, or the first device has the authority to communicate with the electronic control unit.

[0059] In the ninth aspect, a key derivation device is provided, comprising: at least one processor and a memory, wherein the at least one processor is coupled to the memory and is configured to read and execute instructions in the memory, so that the device implements the method in any one of the implementation methods of the first to fourth aspects above.

[0060] In the tenth aspect, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores a program code. When the computer program code is run on a computer, the computer executes the method in any one of the implementation methods of the first to fourth aspects above.

[0061] In an eleventh aspect, a chip is provided, which includes a circuit for executing the method in any one of the implementations of the first to fourth aspects above.

[0062] In a twelfth aspect, a computer program product is provided, which includes a computer program. When the computer program is run, the computer executes the method in any one of the implementation modes of the first to fourth aspects above.

[0063] In the thirteenth aspect, a vehicle is provided, comprising: a device according to any one of the implementation methods of the fifth or eighth aspect above. BRIEF DESCRIPTION OF THE DRAWINGS

[0064] FIG1 is a functional schematic diagram of a vehicle provided in an embodiment of the present application;

[0065] FIG2 is a schematic diagram of a unified off-vehicle key derivation and filling method provided by an embodiment of the present application;

[0066] FIG3 is a system architecture used in a key derivation method provided in an embodiment of the present application;

[0067] FIG4 is a schematic diagram of a single-level derivation of a key provided in an embodiment of the present application;

[0068] FIG5 is a schematic diagram of multi-level derivation of a key provided in an embodiment of the present application;

[0069] FIG6 is a schematic diagram of a key derivation method provided in an embodiment of the present application;

[0070] FIG7 is a schematic diagram of another key derivation method provided in an embodiment of the present application;

[0071] FIG8 is a schematic diagram of a master key generation method provided in an embodiment of the present application;

[0072] FIG9 is a schematic diagram of another master key generation method provided in an embodiment of the present application;

[0073] FIG10 is a schematic flowchart of a key usage process provided in an embodiment of the present application;

[0074] FIG11 is a schematic flowchart of another key usage process provided in an embodiment of the present application;

[0075] FIG12 is a schematic diagram of a key derivation device provided in an embodiment of the present application;

[0076] FIG13 is a schematic diagram of another key derivation device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0077] The technical solution in this application will be described below with reference to the accompanying drawings.

[0078] In the description of the embodiments of the present application, unless otherwise specified, " / " means or, for example, A / B can mean A or B; "and / or" in this article is only a description of the association relationship of associated objects, indicating that there can be three relationships, for example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. In this application, "at least one" refers to one or more, and "more than one" refers to two or more. "At least one of the following items" or similar expressions refers to any combination of these items, including any combination of single items or plural items. For example, at least one of a, b, or c can mean: a, b, c, ab, ac, bc, or abc, where a, b, c can be single or multiple.

[0079] In the embodiments of this application, prefixes such as "first" and "second" are used only to distinguish different description objects and have no limiting effect on the position, order, priority, quantity, or content of the described objects. The use of prefixes such as ordinal numbers in the embodiments of this application to distinguish description objects does not constitute a limitation on the described objects. For a statement of the described objects, please refer to the description in the context of the claims or embodiments, and the use of such prefixes should not constitute an unnecessary limitation.

[0080] The technical solutions in the embodiments of the present application will be described below with reference to the accompanying drawings.

[0081] FIG1 is a functional schematic diagram of a vehicle 100 provided in an embodiment of the present application.

[0082] Vehicle 100 may include various subsystems, such as a sensing system 120, a computing platform 130, and a key management system 140. Alternatively, vehicle 100 may include more or fewer subsystems, and each subsystem may include one or more components. Furthermore, each subsystem and component of vehicle 100 may be interconnected via wired or wireless means.

[0083] The perception system 120 may include several sensors for sensing information about the environment surrounding the vehicle 100. For example, the perception system 120 may include a positioning system, which may be a global positioning system (GPS), a Beidou system, or other positioning systems. The perception system 120 may include one or more of an inertial measurement unit (IMU), a laser radar, a millimeter-wave radar, an ultrasonic radar, and a camera.

[0084] Some or all functions of the vehicle 100 can be controlled by a computing platform 130. The computing platform 130 may include processors 131 to 13n (n is a positive integer). A processor is a circuit with signal processing capabilities. In one implementation, the processor can be a circuit with instruction reading and execution capabilities, such as a central processing unit (CPU), a microprocessor, a graphics processing unit (GPU) (which can be understood as a microprocessor), or a digital signal processor (DSP). In another implementation, the processor can implement certain functions through the logical relationship of a hardware circuit. The logical relationship of the hardware circuit is fixed or reconfigurable. For example, the processor is a hardware circuit implemented by an application-specific integrated circuit (ASIC) or a programmable logic device (PLD), such as an FPGA. In a reconfigurable hardware circuit, the process of the processor loading a configuration file to implement the hardware circuit configuration can be understood as the process of the processor loading instructions to implement the functions of some or all of the above units. In addition, the processor may also be a hardware circuit designed for artificial intelligence, which can be understood as an ASIC, such as a neural network processing unit (NPU), a tensor processing unit (TPU), a deep learning processing unit (DPU), etc. In addition, the computing platform 130 may also include a memory for storing instructions, and some or all of the processors 131 to 13n may call the instructions in the memory to implement corresponding functions.

[0085] Computing platform 130 may control functions of vehicle 100 based on input received from various subsystems, such as perception system 120. In some embodiments, computing platform 130 may be used to provide control over many aspects of vehicle 100 and its subsystems.

[0086] Key management system 140 may be used to generate, store, distribute, rotate, and revoke keys to ensure secure communications and data protection.

[0087] Optionally, the key management system 140 may be located in the computing platform 130 or outside the computing platform 130 .

[0088] Optionally, the above components are just an example. In actual applications, the components in the above modules may be added or deleted according to actual needs.

[0089] The vehicle 100 in this application may include: road vehicles, water vehicles, air vehicles, industrial equipment, agricultural equipment, or entertainment equipment, etc. For example, the vehicle 100 can be a vehicle, which is a vehicle in the broad sense, and can be a transportation vehicle (such as a commercial vehicle, a passenger car, a motorcycle, a flying car, a train, etc.), an industrial vehicle (such as a forklift, a trailer, a tractor, etc.), an engineering vehicle (such as an excavator, a bulldozer, a crane, etc.), agricultural equipment (such as a lawn mower, a harvester, etc.), amusement equipment, a toy vehicle, etc. The embodiments of this application do not specifically limit the type of vehicle. For another example, the vehicle 100 can be a vehicle such as an airplane or a ship.

[0090] The following takes the vehicle 100 as an example to illustrate the technical problems to be solved by this application and the technical solutions adopted.

[0091] The in-vehicle network is a distributed network, with in-vehicle communication primarily implemented via Ethernet and the CAN bus. In-vehicle communication security is a crucial component of smart cars, and its related security features, such as device authentication, UDS secure access, and SecOC, are increasingly being used. These security features typically require key-based implementation.

[0092] However, as vehicle architecture and business evolve, the number of keys required to be stored in vehicle components is increasing. These keys need to be derived from an external key management system based on a key derivation algorithm and uniformly installed into each component on the production line. This approach results in the need to install keys for all components on the production line, increasing the risk of key leakage. Furthermore, the current method of in-vehicle key distribution is for specific electronic control units (ECUs) in the same type of vehicle to hold the same key, or for all ECUs within the vehicle to hold a unified key. This key holding method also increases the risk of key leakage.

[0093] For example, as shown in Figure 2, to achieve secure communications and data protection in a vehicle, an off-board key management system must utilize a key derivation algorithm to generate the keys required for each component within the vehicle and uniformly install these keys into each component. Once successfully installed, these keys can be securely stored within the vehicle and used for security operations such as encryption, decryption, and authentication. However, the need to install keys for all components on the production line increases the risk of key leakage, increasing the likelihood that insiders or external attackers will be able to obtain the keys. Once a key is leaked, it could allow unauthorized entities to access sensitive vehicle information, perform malicious operations, or compromise vehicle security.

[0094] The embodiments of the present application provide a key derivation method, device, and vehicle, which can perform the key derivation process in the vehicle and ensure that one component corresponds to one key, thereby reducing the risk of leakage during key filling.

[0095] FIG3 is a system architecture used in the key derivation method provided in an embodiment of the present application.

[0096] As shown in Figure 3, the system architecture can include a key management module and a domain controller. The key management module can be used to obtain the master key and, after the vehicle is assembled and powered on, generate the key for the target ECU using a key derivation algorithm. The domain controller can include: a vehicle interface unit (VIU), a mobile data center (MDC), and a cockpit domain controller (CDC). After generating the key, the key management module can distribute the key to each target ECU through each domain controller via a secure transmission channel. Each target ECU can securely store the received key, and when the key is used, the key management module can derive the key for the corresponding component again. The key management module can be deployed in any domain controller (i.e., the XDC in the figure), or it can be an independent component within the vehicle.

[0097] Among them, when deriving the key, it can be implemented in the following two ways.

[0098] In one possible implementation, as shown in Figure 4, the key management module can obtain the identification information ID_ECUx of all components in the vehicle and generate and store salt values ​​Salt_ECUx based on the identification information of all components. The key management module can then calculate the key of each component by hashing the key derivation function KDF of the message authentication code, that is, using the following formula:

[0099] ECUx_KEY=KDF(MK,ID_ECUx||Salt_ECUx)

[0100] Among them, MK is the master key, x is the ECU number, and ECUx_KEY can contain the vehicle key such as DECUx_KEY or ecux_KEY. This key derivation method can also be called single-level derivation.

[0101] In one possible implementation, as shown in Figure 5, the key management module can obtain the identification information ID_ECUx of all components in the vehicle and generate and store a salt value Salt_ECUx based on the identification information of all components. The key management module can then calculate the domain controller's key by hashing the key derivation function KDF of the message authentication code, that is, using the following formula:

[0102] DECUx_KEY=KDF(MK,ID_DECUx||Salt_DECUx);

[0103] After obtaining DECUx_KEY, the key management module can send DECUx_KEY to each domain controller. After receiving DECUx_KEY, each domain controller can obtain the characteristic information ID_ecux of the ECU connected to the domain controller, and each domain controller can generate a salt value Salt_ecux based on ID_ecux for storage. Finally, each domain controller can calculate the key of the connected ECU based on DECUx_KEY using the key derivation function KDF, that is, using the following formula:

[0104] ecux_KEY=KDF(DECU_KEY,ID_ecux||Salt_ecux)

[0105] Among them, x is the number of the downstream ECU. This key derivation method can also be called multi-level derivation. The ECUs under the domain controller can be understood as the domain controller as the main control unit to establish connections and communicate with multiple downstream ECUs. The domain controller is responsible for coordinating and managing these downstream ECUs, and realizes the overall function and collaborative operation of the vehicle electronic system through communication and data exchange with them.

[0106] FIG6 is a flowchart of a key derivation method provided in an embodiment of the present application. Method 600 can be applied to the system architecture shown in FIG3 . Method 600 can include steps S601 to S603 .

[0107] S601: The key management module obtains a master key and identification information of a first component in a vehicle.

[0108] Optionally, the master key may be generated by a third-party key management system and then transferred to the key management module inside the vehicle by the third key management system, or may be randomly generated by the key management module inside the vehicle.

[0109] Optionally, the identification information of the first component may include: one or more of a component serial number, a component ID, or a component IP address of the domain controller or the electronic control unit.

[0110] Optionally, the key management module may be deployed in any controller inside the vehicle, or the key management module may be an independent component inside the vehicle.

[0111] S602: The key management module determines the key corresponding to the first component according to the master key and the identification information of the first component.

[0112] Optionally, the first component may be a domain controller or an electronic control unit.

[0113] In one embodiment, in step S602, the key management module may obtain a salt value, which may include at least one of the following: a salt value corresponding to the vehicle, a salt value corresponding to the first component, or a salt value corresponding to the functional domain to which the first component belongs. The key management module may determine the first key based on the master key, the identification information of the first component, and the salt value. The salt value may be a random, unique number. The use of the salt value may increase the security of the first key, thereby more effectively preventing the first key from being stolen by an attacker.

[0114] Optionally, when the salt value includes: a salt value corresponding to the first component and / or a salt value of a functional domain of the first component, it can be determined according to identification information of the first component.

[0115] S603: The key management module sends the first key to the first component.

[0116] In one embodiment, after step S603, the key management module may delete the first key, and subsequent keys may be derived again by the key management module when used. In this way, the storage space of the first key can be saved, thereby improving the utilization efficiency of the first key.

[0117] In one embodiment, after step S603, the key management module may obtain first information, which is associated with first authentication request information sent by the first device, requesting authentication of the first device's diagnostic or communication permissions, and including identification information of the second component. The key management module may then determine a second key based on the master key and the identification information of the second component. This second key is used to generate second information, which is used to request the first component to authenticate the first device's diagnostic or communication permissions. In this way, the key management module's instant derivation of the second key not only saves storage space in the key management system but also ensures that each component corresponds to a single key, thereby increasing the security of key usage.

[0118] Alternatively, the first device may be an external device connected to the vehicle, or the first device may be an internal device or component in the vehicle requesting authentication of a diagnostic or communication function.

[0119] Optionally, after the key management module determines the second key, the key management module may send the second key to the first component, or send second information to the first component, where the second information includes the second key.

[0120] In an embodiment of the present application, the first key corresponding to the first component can be determined based on the master key and the identification information of the first component. In this way, the process of key derivation and filling is carried out inside the vehicle, and it is ensured that one component corresponds to one key, which can reduce the risk of leakage during key filling and derivation.

[0121] After the first component receives the first key, different types of first components may perform different processing.

[0122] Method 1: The first component is an electronic control unit.

[0123] In one embodiment, when the first component is an electronic control unit, after receiving the first key from the key management module, the electronic control unit can store the first key so that it can be used for subsequent authorization verification. This allows the legitimate first device to function as quickly as possible, meeting the user's reasonable needs.

[0124] In one embodiment, after the electronic control unit receives the second information or the second key from the key management module, it can verify whether the first key and the second key match. If the first key and the second key match, the electronic control unit can send a first response message to the key management module to indicate that the first device has the authority to diagnose the electronic control unit, or the first device has the authority to communicate with the electronic control unit.

[0125] Optionally, the matching of the first key and the second key may be understood as the first key and the second key being completely identical, or partial sequences of the first key and the second key being partially identical.

[0126] Method 2: The first component is the domain controller.

[0127] In one embodiment, when the first component is a domain controller, after receiving the first key, the domain controller can store the first key. After obtaining identification information corresponding to the electronic control unit, the domain controller can determine a third key based on the first key and the identification information of the electronic control unit and send the third key to the electronic control unit. After receiving the third key, the electronic control unit can store the third key so that the electronic control unit can perform permission verification based on the third key. In this way, each derivation of the key depends on the key of the previous level. The leakage of the key at any level may render the key corresponding to the electronic control unit unusable. Therefore, this multi-level key derivation method can further reduce the risk of key leakage and enhance the security of key use.

[0128] Alternatively, the domain controller can determine the third key based on the first key, a salt value, and identification information of the electronic control unit. The salt value can include a salt value corresponding to the vehicle, a salt value corresponding to the domain controller, or a salt value corresponding to the electronic control unit. Using the salt value can further enhance the security of the third key, thereby more effectively preventing the third key from being stolen by attackers.

[0129] Optionally, after the domain controller sends the third key to the third electronic control unit, the third key may be deleted to save space for storing keys in the domain controller.

[0130] In one embodiment, when the domain controller receives the second key or second information sent by the key management module, the domain controller may generate a fourth key corresponding to the electronic control unit based on the second key and the identification information of the electronic control unit, and send third information to the electronic control unit, the third information including the fourth key. After receiving the third information, the electronic control unit may verify whether the third key and the fourth key match. If the third key and the fourth key match, the electronic control unit may send a second response message to the domain controller or the key management module, indicating that the first device has permission to diagnose the electronic control unit or that the first device has permission to communicate with the electronic control unit. In this way, because the third key and the fourth key are generated through a multi-level derivation method, the key verification result can be more reliable.

[0131] Optionally, the matching of the third key and the fourth key may be understood as the third key and the fourth key being completely identical, or the sequence portion of the third key and the fourth key being identical.

[0132] In one embodiment, after receiving the first key, the domain controller may store the first key and directly forward the first key to the electronic control unit. In this way, the domain controller can forward the first key without deriving a third key based on the first key.

[0133] It should be understood that in the various embodiments of the present application, unless otherwise specified or there is a logical conflict, the terms and / or descriptions between the various embodiments are consistent and can be referenced by each other, and the technical features in different embodiments can be combined to form new embodiments according to their internal logical relationships.

[0134] FIG7 is a flow chart of another key derivation method provided in an embodiment of the present application. Method 700 may be a specific description of each step in method 600 , and method 700 may include steps S701 to S704 .

[0135] S701, master key generation.

[0136] In one possible implementation, as shown in FIG8 , the master key may be generated by a random number generator (RNG) in a third-party key management system (KMS) and then securely transferred to a key management module within the vehicle.

[0137] In one possible implementation, as shown in FIG9 , the master key may be randomly generated by a key management module in the vehicle.

[0138] S702, key derivation.

[0139] For example, the key management module can generate the target ECU key using the key derivation algorithm KDF(MK, ID_ECUx||Salt_ECUx) shown in FIG4 , where ID_ECUx can be one or more of the target ECU's component serial number, component ID, or component IP address, and ID_ECUx can be identification information corresponding to the electronic control unit in method 600 ; Salt_ECUx can be a 256-bit all-zero number, and the value of Salt_ECUx can be updated to mark the target ECU when the key is subsequently updated. Salt_ECUx can be the salt value corresponding to the electronic control unit in method 600 .

[0140] Exemplarily, the key management module may also derive the keys of each component through a key derivation algorithm as shown in FIG5 .

[0141] S703, key distribution.

[0142] Optionally, a prerequisite for executing step S703 may be that the entire vehicle is uniformly filled with a pre-shared master key (PMK) for each component on the production line, where the PMK can be set to use the same key for all components of the vehicle according to actual needs, or a key can be selected for a type of component, or a key can be selected for one component.

[0143] Optionally, for the domain controller, a secure channel established by transport layer security (TLS) may be used to distribute the key.

[0144] Optionally, for the ECUs under each domain controller, a PMK can be used to encrypt a unified distribution key, that is, the PMK can be broadcast to all ECUs under the same domain controller, or distributed to specific ECUs.

[0145] S704, key storage.

[0146] After receiving the key, the target ECU may securely store the key in a hardware security module (HSM) or a secure hardware extension (SHE). The key may be the first key or the third key in method 600 .

[0147] In an embodiment of the present application, the processes of master key generation, key derivation, key distribution and key storage can be completed in the vehicle. This processing method can avoid the filling of keys outside the vehicle, reduce the risk of key leakage, and improve the security of the keys during use.

[0148] FIG10 is a schematic flowchart of a key usage process provided in an embodiment of the present application. Method 1000 may be executed after step S704 of method 700 . Method 1000 may include steps S1001 to S1003 .

[0149] S1001, the key management module triggers an authentication request.

[0150] Optionally, this step may involve triggering an authentication request to the key management module when the first device is connected to the vehicle. The first device may be an external device or a component inside the vehicle. If authentication is not performed after the first device is connected to the vehicle, the vehicle will be unable to interact with the first device.

[0151] Optionally, the authentication request may carry identification information of the ECU associated with authenticating the first device, for example, ID_ECU, wherein the authentication request may be the first authentication request information in method 600, and the ECU associated with authenticating the first device may be the second component in method 600.

[0152] S1002, the key management module generates ECU_KEY.

[0153] Specifically, the key management module may generate a key ECU_KEY corresponding to the ECU based on identification information of the ECU associated with the first device for authentication. The ECU_KEY may be the second key in method 600 .

[0154] Optionally, the key management module may generate the key ECU_KEY based on the method shown in FIG4 .

[0155] S1003: The key management module and ECU complete UDS27 certification.

[0156] Specifically, the key management module can complete UDS27 authentication with the ECU based on the generated ECU_KEY.

[0157] In one embodiment, the ECU may compare a locally stored key (e.g., the key stored in step S704 of method 700) with the ECU_KEY. If the two match, the ECU may send a response message to the key management module, thereby completing the UDS27 authentication. After completing the UDS27 authentication, the first device may have the authority to diagnose the ECU or the authority to communicate with the ECU.

[0158] In one embodiment, when a domain controller exists in method 1000, after the key management module generates the key ECU_KEY, it can send an authentication request to the domain controller, and the authentication request can include ECU_KEY. After receiving the authentication request, the domain controller can forward the authentication request to the corresponding ECU, and the ECU compares the locally stored key (for example, the key stored in step S704 of method 700) with the key ECU_KEY received in the authentication request information. If the two match, the ECU can send a response message to the key management module, thereby completing the UDS27 authentication. After completing the UDS27 authentication, the first device can have the authority to diagnose the ECU, or have the authority to communicate with the ECU.

[0159] It should be understood that UDS27 certification can refer to the evaluation and verification process conducted by relevant certification bodies or standardization organizations to ensure that the functions and requirements of the UDS27 service mark are implemented in the vehicle. This certification usually involves testing and verifying the vehicle's diagnostic tools, diagnostic equipment or software to verify whether it can correctly perform diagnostic and programming operations under the UDS27 mark.

[0160] In an embodiment of the present application, during the use of the key, the key management module can instantly derive the key when verifying the authority of the first device. This can further reduce the risk of key leakage and improve the security of the key during use.

[0161] Figure 11 is a schematic flowchart of another key derivation method provided in an embodiment of the present application. Method 1100 can be executed after step S704 of method 700. Method 1100 can include steps S1101 to S1106.

[0162] S1101, the key management module triggers an authentication request.

[0163] Optionally, this step may involve triggering an authentication request to the key management module when the first device is connected to the vehicle. The first device may be an external device or a component inside the vehicle. If authentication is not performed after the first device is connected to the vehicle, the vehicle will be unable to interact with the first device.

[0164] Optionally, the authentication request may carry identification information of the ECU associated with authenticating the first device, for example, ID_ECU, wherein the authentication request may be the first authentication request information in method 600, and the ECU associated with authenticating the first device may be the second component in method 600.

[0165] S1102, the key management module generates DECU_KEY.

[0166] Specifically, the key management module may generate the key DECU_KEY of the DECU based on the identification information of the ECU associated with the authentication of the first device.

[0167] Optionally, the key management module may generate the key DECU_KEY based on the method shown in FIG5 .

[0168] S1103, the key management module and the domain controller complete device authentication.

[0169] Exemplarily, the key management module can send an authentication request to the domain controller, which includes the key DECU_KEY. The domain controller compares the locally stored key with the received key DECU_KEY. If the two match, the domain controller sends a response message to the key management module, thereby completing the device authentication.

[0170] S1104, the key management module forwards the authentication request to the domain controller.

[0171] The authentication request may be the same as the authentication request in step S1101.

[0172] S1105: The domain controller generates ecu_KEY.

[0173] Optionally, the domain controller may generate the key ecu_KEY based on the method shown in FIG5 .

[0174] S1106, the domain controller and ECU complete device authentication.

[0175] Among them, ecu can be the ECU hanging under the domain controller.

[0176] For example, the domain controller may send an authentication request message to the ECU, the authentication request message including the key ecu_KEY. The ECU compares the locally stored key (e.g., the key stored in step S704 of method 700) with the ecu_KEY in the received authentication request message. If the two match, the ECU may send a response message to the domain controller, thereby completing device authentication. After device authentication is completed, the first device has permission to diagnose the ECU, or the first device has permission to communicate with the ECU.

[0177] In the embodiments of the present application, during key usage, measures such as instant key derivation and multi-level device authentication are adopted to further reduce the risk of key leakage. Specifically, by instantly deriving keys, a temporary key can be generated each time, which can reduce the storage space required for vehicle key storage and reduce the potential threat of key interception or cracking. The multi-level device authentication process can verify the identity and legitimacy of each component and device involved in the communication, preventing unauthorized devices from accessing and using the key. This comprehensive application approach not only improves the security of key management, but also effectively reduces the potential risks caused by key leakage.

[0178] The above content introduces the specific steps of key generation, derivation, distribution, and use. The key distribution examples of each stage mentioned above can be shown in Table 1 below.

[0179] Table 1

[0180] In Table 1, possible design 1 may be an example of keys stored by various components or devices at different stages in method 1000, and possible design 2 may be an example of keys stored by various components or devices at different stages in method 1100.

[0181] It should be understood that in the various embodiments of the present application, unless otherwise specified or there is a logical conflict, the terms and / or descriptions between the various embodiments are consistent and can be referenced by each other, and the technical features in different embodiments can be combined to form new embodiments according to their internal logical relationships.

[0182] The embodiment of the present application also provides an apparatus for implementing any of the above methods, which includes a unit for implementing each step performed by the vehicle 100 in any of the above methods.

[0183] Figure 12 is a schematic diagram of a key derivation device 1200 provided in an embodiment of the present application. The device 1200 may include an acquisition unit 1210, a transceiver unit 1220, and a processing unit 1230. The acquisition unit 1210 is used to acquire instructions and / or data, and the transceiver unit 1220 is used to send and receive instructions and / or data. The acquisition unit 1210 and the transceiver unit 1220 may also be referred to as communication interfaces or communication units. The processing unit 1230 is used to process data so that the device 1200 implements the aforementioned key derivation method.

[0184] Optionally, the device 1200 further includes a storage unit configured to implement a corresponding storage function and store corresponding instructions and / or data.

[0185] As a design, the device 1200 can execute the steps performed by the key management module in the above embodiment.

[0186] The device 1200 includes: an acquisition unit 1210, used to obtain a master key and identification information of a first component in a vehicle; a processing unit 1230, used to determine a first key corresponding to the first component based on the master key and the identification information of the first component; and a transceiver unit 1220, used to send the first key to the first component.

[0187] In one possible implementation, the acquisition unit 1210 is further used to obtain a salt value, which includes at least one of the following: a salt value corresponding to the vehicle, a salt value corresponding to the first component, or a salt value corresponding to the functional domain to which the first component belongs; the processing unit 1230 is specifically used to determine the first key based on the master key, the identification information of the first component and the salt value.

[0188] In a possible implementation, the processing unit 1230 is further configured to delete the first key.

[0189] In one possible implementation, the acquisition unit 1210 is also used to obtain first information, which is associated with first authentication request information sent by the first device, and the first authentication request information is used to request authentication of the diagnostic authority or communication authority of the first device, and the first authentication request information includes identification information of the second component; the processing unit 1230 is also used to determine the second key based on the master key and the identification information of the second component, and the second key is used to generate second information, and the second information is used to request the first component to authenticate the diagnostic authority or communication authority of the first device.

[0190] In a possible implementation, the transceiver unit 1220 is further configured to send the second key to the first component, or send second information to the first component, where the second information includes the second key.

[0191] In a possible implementation, the first component is a domain controller or an electronic control unit.

[0192] As a design, the device 1200 can execute the steps executed by the domain controller in the above embodiment.

[0193] The device 1200 includes: a transceiver unit 1220, configured to receive a first key corresponding to a domain controller, where the first key is associated with a master key and identification information of the domain controller; and a processing unit 1230, configured to store the first key.

[0194] In one possible implementation, the device also includes: an acquisition unit 1210, used to obtain identification information of the electronic control unit corresponding to the domain controller; a processing unit 1230, further used to determine a third key based on the master key and the identification information of the electronic control unit; and a transceiver unit 1220, further used to send the third key to the electronic control unit.

[0195] In one possible implementation, the acquisition unit 1210 is also used to obtain a salt value, which includes: a salt value corresponding to the vehicle, a salt value corresponding to the domain controller, or a salt value corresponding to the electronic control unit; the processing unit 1230 is specifically used to determine the third key based on the first key, the identification information of the electronic control unit, and the salt value.

[0196] In a possible implementation, the processing unit 1230 is further configured to delete the third key.

[0197] In one possible implementation, the transceiver unit 1220 is also used to receive a second key, or receive second information, where the second information includes the second key; the processing unit 1230 is also used to determine the fourth key corresponding to the electronic control unit based on the second key and the identification information of the electronic control unit; the transceiver unit 1220 is also used to send third information to the electronic control unit, where the third information is used to request the electronic control unit to authenticate the diagnostic authority or communication authority of the first device, and the third information includes the fourth key.

[0198] As a design, the device 1200 is used to execute the steps executed by the electronic control unit in the above embodiment.

[0199] The device 1200 includes: a transceiver unit 1220 for receiving a first key corresponding to an electronic control unit, where the first key is associated with a master key and identification information of the electronic control unit; and a processing unit 1230 for storing the first key.

[0200] In one possible implementation, the transceiver unit 1220 is further used to: receive second information, the second information being used to request the electronic control unit to authenticate the diagnostic authority or communication authority of the first device, the second information including a second key, the second key being associated with the master key and the identification information of the second component; and when the first key and the second key match, send a first response information, the first response information being used to indicate that the first device has the authority to diagnose the electronic control unit, or the first device has the authority to communicate with the electronic control unit.

[0201] The device 1200 includes: a transceiver unit 1220, used to receive a third key corresponding to the electronic control unit, where the third key is associated with the master key, identification information of the domain controller and identification information of the electronic control unit; and a processing unit 1230, further used to store the third key.

[0202] In one possible implementation, the transceiver unit 1220 is further used to: receive third information, which is used to request the electronic control unit to authenticate the diagnostic authority or communication authority of the first device, and the third information includes a fourth key, which is associated with the master key, the identification information of the second component and the identification information of the electronic control unit; when the third key and the fourth key match, send a second response information, which is used to indicate that the first device has the authority to diagnose the electronic control unit, or the first device has the authority to communicate with the electronic control unit.

[0203] Optionally, if the device 1200 is located in the vehicle 100 , the processing unit 1230 may be the processor 131 shown in FIG. 1 .

[0204] FIG13 is a schematic diagram of another key derivation device 1300 provided in an embodiment of the present application. The device 1300 can be applied to the vehicle 100 in FIG1 .

[0205] The device 1300 includes a memory 1310, a processor 1320, and a communication interface 1330. The memory 1310, processor 1320, and communication interface 1330 are connected via an internal connection path. The memory 1310 is used to store instructions, and the processor 1320 is used to execute the instructions stored in the memory 1310 to control the communication interface 1330 to obtain information or enable the device 1300 to implement the aforementioned key derivation method. Optionally, the memory 1310 can be coupled to the processor 1320 via an interface or integrated with the processor 1320.

[0206] It should be noted that the communication interface 1330 may be a transceiver such as, but not limited to, a transceiver. The communication interface 1330 may also include an input / output interface.

[0207] The processor 1320 stores one or more computer programs, which include instructions. When the instructions are executed by the processor 1320, the key derivation apparatus 1300 executes the key derivation method in each of the above embodiments.

[0208] During implementation, each step of the above method can be completed by an integrated logic circuit of the hardware in the processor 1320 or by instructions in the form of software. The method disclosed in conjunction with the embodiments of the present application can be directly embodied as being executed by a hardware processor, or can be executed by a combination of hardware and software modules in the processor. The software module can be located in a mature storage medium in the art, such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory or an electrically erasable programmable memory, a register, etc. The storage medium is located in the memory 1310, and the processor 1320 reads the information in the memory 1310 and completes the steps of the above method in combination with its hardware. To avoid repetition, it will not be described in detail here.

[0209] Optionally, the communication interface 1330 in FIG. 13 may implement the acquisition unit 1210 or the transceiver unit 1220 in FIG. 12 , and the processor 1320 in FIG. 13 may implement the processing unit 1230 in FIG. 12 .

[0210] Optionally, the device 1200 or the device 1300 may be a computing platform, and the computing platform may be a vehicle-mounted computing platform.

[0211] Alternatively, the device 1200 or the device 1300 may be located in the vehicle 100 in FIG. 1 .

[0212] Optionally, the device 1200 or the device 1300 may be the computing platform 130 in the vehicle of FIG. 1 .

[0213] An embodiment of the present application further provides a computer-readable storage medium, wherein the computer-readable storage medium stores a program code. When the computer program code runs on a computer, the computer executes any one of the methods in FIG. 4 to FIG. 11 .

[0214] An embodiment of the present application further provides a computer program product, which includes a computer program. When the computer program is executed, the computer executes any one of the methods in Figures 4 to 11 above.

[0215] An embodiment of the present application further provides a chip, comprising: a circuit, wherein the circuit is used to execute any one of the methods in FIG. 4 to FIG. 11 above.

[0216] An embodiment of the present application also provides a vehicle, comprising any one of the key derivation devices shown in FIG12 or FIG13 .

[0217] Those skilled in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0218] Those skilled in the art will clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0219] In the several embodiments provided in this application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are merely schematic. For example, the division of the units is merely a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0220] The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected to achieve the purpose of this embodiment according to actual needs.

[0221] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0222] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0223] The above description is merely a specific embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this application should be included in the scope of protection of this application. Therefore, the scope of protection of this application should be based on the scope of protection of the claims.

Claims

1. A key derivation method, characterized in that: The method comprises: Obtaining a master key and identification information of a first component in a vehicle; Determining a first key corresponding to the first component according to the master key and the identification information of the first component; The first key is sent to the first component.

2. The method according to claim 1, characterized in that The determining, according to the master key and the identification information of the first component, a first key corresponding to the first component includes: Acquire a salt value, where the salt value includes at least one of the following: a salt value corresponding to the vehicle, a salt value corresponding to the first component, or a salt value corresponding to a functional domain to which the first component belongs; The first key is determined according to the master key, the identification information of the first component and the salt value.

3. The method according to claim 1 or 2, characterized in that The method further comprises: Delete the first key.

4. The method according to any one of claims 1 to 3, characterized in that The method further comprises: Acquire first information, where the first information is associated with first authentication request information sent by the first device, where the first authentication request information is used to request authentication of a diagnostic authority or a communication authority of the first device, and the first authentication request information includes identification information of the second component; A second key is determined according to the master key and identification information of the second component, the second key is used to generate second information, and the second information is used to request the first component to authenticate the diagnosis authority or communication authority of the first device.

5. The method according to claim 4, characterized in that The method further comprises: The second key is sent to the first component, or the second information is sent to the first component, wherein the second information includes the second key.

6. The method according to any one of claims 1 to 5, characterized in that: The first component is a domain controller or an electronic control unit.

7. A key derivation method, characterized in that: The method is applied to a first component, the first component being a domain controller, and the method comprises: receiving a first key corresponding to the domain controller, where the first key is associated with a master key and identification information of the domain controller; The first key is stored.

8. The method according to claim 7, characterized in that The method further comprises: Obtaining identification information of an electronic control unit corresponding to the domain controller; Determining a third key corresponding to the electronic control unit according to the first key and the identification information of the electronic control unit; The third key is sent to the electronic control unit.

9. The method according to claim 8, characterized in that The determining, according to the first key and the identification information of the electronic control unit, a third key corresponding to the electronic control unit includes: Obtaining a salt value, where the salt value includes: a salt value corresponding to the vehicle, a salt value corresponding to the domain controller, or a salt value corresponding to the electronic control unit; The third key is determined according to the first key, identification information of the electronic control unit and the salt value.

10. The method according to claim 8 or 9, characterized in that The method further comprises: The third key is deleted.

11. The method according to any one of claims 7 to 10, characterized in that: The method further comprises: receiving a second key, or receiving second information, wherein the second information includes the second key; Determining a fourth key corresponding to the electronic control unit according to the second key and the identification information of the electronic control unit; Sending third information to the electronic control unit, wherein the third information is used to request the electronic control unit to authenticate the diagnosis authority or communication authority of the first device, and the third information includes the fourth key.

12. A key derivation method, characterized in that: The method is applied to a first component, the first component being an electronic control unit, and the method comprises: receiving a first key corresponding to the electronic control unit, wherein the first key is associated with a master key and identification information of the electronic control unit; The first key is stored.

13. The method according to claim 12, characterized in that The method further comprises: receiving second information, the second information being used to request the electronic control unit to authenticate the diagnostic authority or communication authority of the first device, the second information comprising a second key, the second key being associated with the master key and identification information of the second component; When the first key and the second key match, a first response message is sent, where the first response message is used to indicate that the first device has the authority to diagnose the electronic control unit, or the first device has the authority to communicate with the electronic control unit.

14. A key derivation method, characterized in that: The method is applied to an electronic control unit, and the method comprises: receiving a third key corresponding to the electronic control unit, wherein the third key is associated with a master key, identification information of a domain controller, and identification information of the electronic control unit; The third key is stored.

15. The method according to claim 14, characterized in that The method further comprises: receiving third information, the third information being used to request the electronic control unit to authenticate the diagnostic authority or communication authority of the first device, the third information comprising a fourth key, the fourth key being associated with the master key, the identification information of the second component, and the identification information of the electronic control unit; In the case where the third key and the fourth key match, a second response message is sent, where the second response message is used to indicate that the first device has the authority to diagnose the electronic control unit, or the first device has the authority to communicate with the electronic control unit.

16. A key derivation device, characterized in that: The device comprises: an acquisition unit, used to acquire the master key and identification information of the first component in the vehicle; a processing unit, configured to determine a first key corresponding to the first component according to the master key and the identification information of the first component; A transceiver unit is used to send the first key to the first component.

17. The device according to claim 16, characterized in that The acquisition unit is further used to acquire a salt value, wherein the salt value includes at least one of the following: a salt value corresponding to the vehicle, a salt value corresponding to the first component, or a salt value corresponding to a functional domain to which the first component belongs; The processing unit is specifically configured to determine the first key according to the master key, the identification information of the first component and the salt value.

18. The device according to claim 16 or 17, characterized in that The processing unit is further used to delete the first key.

19. The device according to any one of claims 16 to 18, characterized in that The acquisition unit is further used to acquire first information, where the first information is associated with first authentication request information sent by the first device, where the first authentication request information is used to request authentication of the diagnosis authority or communication authority of the first device, and the first authentication request information includes identification information of the second component; The processing unit is further used to determine a second key based on the master key and the identification information of the second component, wherein the second key is used to generate second information, and the second information is used to request the first component to authenticate the diagnosis authority or communication authority of the first device.

20. The device according to claim 19, characterized in that The transceiver unit is further configured to send the second key to the first component, or send the second information to the first component, where the second information includes the second key.

21. The device according to any one of claims 16 to 20, characterized in that The first component is a domain controller or an electronic control unit.

22. A key derivation device, characterized in that: The device is applied to a first component, the first component is a domain controller, and the device includes: a transceiver unit, configured to receive a first key corresponding to the domain controller, wherein the first key is associated with a master key and identification information of the domain controller; A processing unit is configured to store the first key.

23. The device according to claim 22, characterized in that The device further comprises: an acquisition unit; The acquisition unit is used to acquire identification information of the electronic control unit corresponding to the domain controller; The processing unit is further used to determine a third key corresponding to the electronic control unit according to the first key and the identification information of the electronic control unit; The transceiver unit is further used to send the third key to the electronic control unit.

24. The device according to claim 23, characterized in that The acquisition unit is further used to acquire a salt value, wherein the salt value includes: a salt value corresponding to the vehicle, a salt value corresponding to the domain controller, or a salt value corresponding to the electronic control unit; The processing unit is specifically configured to determine the third key according to the first key, the identification information of the electronic control unit and the salt value.

25. The device according to claim 23 or 24, characterized in that The processing unit is further used to delete the third key.

26. The device according to any one of claims 22 to 25, characterized in that The transceiver unit is further used to receive a second key, or receive second information, where the second information includes the second key; The processing unit is further used to determine a fourth key corresponding to the electronic control unit according to the second key and the identification information of the electronic control unit; The transceiver unit is further used to send third information to the electronic control unit, where the third information is used to request the electronic control unit to authenticate the diagnosis authority or communication authority of the first device, and the third information includes the fourth key.

27. A key derivation device, characterized in that: The device is applied to a first component, the first component is an electronic control unit, and the device comprises: a transceiver unit, configured to receive a first key corresponding to the electronic control unit, wherein the first key is associated with a master key and identification information of the electronic control unit; A processing unit is configured to store the first key.

28. The device according to claim 27, characterized in that The transceiver unit is further used for: receiving second information, the second information being used to request the electronic control unit to authenticate the diagnostic authority or communication authority of the first device, the second information comprising a second key, the second key being determined based on the master key and identification information of the second component; When the first key and the second key match, a first response message is sent, where the first response message is used to indicate that the first device has the authority to diagnose the electronic control unit, or the first device has the authority to communicate with the electronic control unit.

29. A key derivation device, characterized in that: The device is applied to an electronic control unit, and comprises: a transceiver unit, configured to receive a third key corresponding to the electronic control unit, wherein the third key is associated with a master key, identification information of a domain controller, and identification information of the electronic control unit; A processing unit is used to store the third key.

30. The device according to claim 29, characterized in that The transceiver unit is further used for: receiving third information, the third information being used to request the electronic control unit to authenticate the diagnostic authority or communication authority of the first device, the third information comprising a fourth key, the fourth key being associated with the master key, the identification information of the second component, and the identification information of the electronic control unit; In the case where the third key and the fourth key match, a second response message is sent, where the second response message is used to indicate that the first device has the authority to diagnose the electronic control unit, or the first device has the authority to communicate with the electronic control unit.

31. A key derivation device, characterized in that: include: A processor and a memory, wherein the processor is coupled to the memory and is configured to read and execute instructions in the memory to perform the method according to any one of claims 1 to 15.

32. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a program code, and when the computer program code is executed on a computer, the computer is caused to execute the method according to any one of claims 1 to 15.

33. A chip, characterized in that: include: A circuit for executing the method according to any one of claims 1 to 15.

34. A vehicle, characterized in that: include: A key derivation device as claimed in any one of claims 16 to 31.

Images