Verification method, verification device, and vehicle

Abstract

The present application provides a verification method, a verification device, and a vehicle. The method can be applied to the field of vehicles. The method comprises: obtaining a first event; receiving first request information sent by a second module, wherein the first request information is used for requesting to verify the legitimacy of a first control instruction, and the first control instruction is associated with a first input; determining that the duration between a first moment and a second moment is less than or equal to a first preset duration, wherein the first moment is associated with the moment when the first event occurs, and the second moment is associated with the moment when the first request information is received; and sending first response information to the second module, wherein the first response information is used for indicating that verification of the legitimacy of the first control instruction succeeds. By means of the method, the legitimacy of a first control instruction can be verified on the basis of the moment when a first event occurs and the moment when first request information is received, so that an illegitimate vehicle control instruction can be prevented from being sent to a corresponding module or component for execution.

Description

Verification method, verification device and delivery vehicle

[0001] This application claims priority to the Chinese patent application filed with the State Intellectual Property Office of China on August 30, 2023, with application number 202311109315.5 and application name “Verification Method, Verification Device and Vehicle”, the entire contents of which are incorporated by reference into this application. Technical Field

[0002] The present application relates to the field of vehicles, and more particularly, to a verification method, a verification device, and a vehicle. Background Art

[0003] As smart cars become more widely used in daily life, users expect them to provide a more comfortable user experience. Smart cars allow users to issue vehicle control commands through human-computer interaction. These commands can include vehicle body control commands, such as those for doors, windows, air conditioning, and seats, or they can include control commands for power switches. The deployment of vehicle human-computer interaction systems was initially intended to enrich the entertainment experience for drivers and passengers, leading to their deployment in the vehicle's entertainment domain.

[0004] However, the vehicle's entertainment system, with its rich set of third-party applications and connected services, presents a risk of being hacked. Therefore, ensuring the security of vehicle control commands is an urgent issue to address if the vehicle's entertainment system is compromised or even breached.

[0005] Summary of the Invention

[0006] The present application provides a verification method, a verification device, and a vehicle, which can prevent illegal control instructions from being sent to corresponding modules or components for execution when the entertainment domain system of the vehicle is invaded or even broken by an attacker, thereby improving the system security of the vehicle.

[0007] In a first aspect, a verification method is provided, which is applied to a first module and includes: obtaining a first event; receiving a first request message sent by a second module, wherein the first request message is used to request verification of the legitimacy of a first control instruction, and the first control instruction is associated with a first input; determining that the duration between a first moment and a second moment is less than or equal to a first preset duration, the first moment is associated with a moment when the first event occurs, and the second moment is associated with a moment when the first request message is received; and sending a first response message to the second module, wherein the first response message is used to indicate that the legitimacy verification of the first control instruction has passed.

[0008] Optionally, the first module may be a trusted module or a verification module, and the verification module may include: a vehicle control scenario verification module.

[0009] Optionally, the first event may be a human-computer interaction event. When the first module is a trusted module, the first module may directly obtain the first event. When the first module is a verification module, the first module may obtain the first event from other modules (e.g., trusted modules).

[0010] Optionally, the first control instruction may be a vehicle control instruction, which may include: a vehicle body control instruction, for example, a control instruction for doors, windows, air conditioning and seats, or the control instruction may include a control instruction for a power domain switch.

[0011] Optionally, the second moment may be the moment when the first module receives the first request information. The second moment may also be understood as the moment when the second module sends the first request information, or the second moment may also be understood as the moment when the first control instruction is generated.

[0012] In a possible implementation, obtaining the first event may further include: obtaining the first event and the first moment.

[0013] In one possible implementation, when the first module determines that the duration between the first moment and the second moment is greater than a first preset duration, a second response message may be sent to the second module, where the second response message is used to indicate that the legitimacy verification of the first control instruction has failed.

[0014] In an embodiment of the present application, the legitimacy of the first control instruction can be verified based on the time of occurrence of the first event and the time of receipt of the first request information, thereby preventing illegal control instructions from being sent to the corresponding module or component for execution, and improving the system safety of the vehicle.

[0015] In combination with the first aspect, in some implementations of the first aspect, before determining that the duration between the first moment and the second moment is less than or equal to a first preset duration, the method further includes: verifying that the first request information is associated with the first event.

[0016] Optionally, detecting that the first request information is associated with the first event may be understood as detecting that the first request information is generated based on the first event.

[0017] In an embodiment of the present application, when it is detected that the first request information is associated with the first event, the first module verifies the legitimacy of the first control instruction based on the time of occurrence of the first event and the time of receipt of the first request information. In this way, it can further prevent illegal control instructions from being sent to the corresponding module or component for execution, thereby better ensuring the safe operation of components in the vehicle.

[0018] In combination with the first aspect, in some implementations of the first aspect, the first response information includes a signature result, and the signature result includes a signature for the first moment.

[0019] Optionally, the first module may sign the first moment to obtain a signature result, and carry the signature result in the first response information.

[0020] Optionally, the signature result may include a signature of the first event.

[0021] In an embodiment of the present application, the first module can send a first response message to the second module, and the first response message carries a signature of the first moment. The second module can send the signature result to the module and component that executes the control instruction, so that the module or component that executes the control instruction can determine whether to execute the first control instruction based on the signature result. In this way, it can further avoid the illegal first control instruction from being executed by the corresponding module or component, and prevent the attacker from causing more serious consequences after invading the vehicle.

[0022] In combination with the first aspect, in some implementations of the first aspect, the first event includes: input from a physical key, input from a touch screen, or input from voice interaction.

[0023] In combination with the first aspect, in certain implementations of the first aspect, the first event includes the input of the voice interaction, and obtaining the first event includes: detecting a preset keyword, the preset keyword including: a wake-up word or a preset control instruction; and obtaining the first event according to the preset keyword.

[0024] Optionally, the wake-up word may be a keyword including the name of the voice assistant.

[0025] In an embodiment of the present application, when the first module detects that the user has the intention to interact with the voice assistant, the first module obtains the first event and verifies the legitimacy of the first control instruction based on the time corresponding to the first event. In this way, on the one hand, it can further prevent illegal control instructions from being sent to the corresponding module or component for execution. On the other hand, when the first module does not detect that the user has the intention to interact with the voice assistant, the voice assistant can be put into hibernation to reduce the risk of the user's voice interaction being stolen by attackers.

[0026] In combination with the first aspect, in certain implementations of the first aspect, before detecting the preset keyword, the method further includes: detecting whether the voice interaction includes the preset keyword based on a digital signal processor DSP or a high-fidelity Hi-Fi chip.

[0027] In the second aspect, a verification method is provided, which is applied to the second module, and the method includes: generating a first control instruction, which is associated with a first input; if a first event occurs within a first preset time period, sending the first control instruction to a third module, wherein the first preset time period is associated with a first moment and a second moment, the first moment is associated with a moment when the first event occurs, the second moment is associated with the first control instruction, and the first event is associated with the first input.

[0028] Optionally, the second module may be an instruction generation module, which may include: a vehicle control hardware abstraction layer (HAL) and / or a vehicle control service module.

[0029] Optionally, the first control instruction being associated with the first input may be understood as the first control instruction being generated based on the first input. The first input may be related to the first event, or the first input may be input by an attacker.

[0030] Optionally, the second moment being associated with the first control instruction can be understood as the second moment being the moment when the first control instruction is generated.

[0031] In this embodiment of the present application, after the second module generates a first control instruction, if a first event occurs within a first preset time period, the second module can send the first control instruction to the third module so that the third module can execute the first control instruction. This can prevent illegal control instructions from being sent to the third module for execution, thereby improving the system security of the vehicle.

[0032] In combination with the second aspect, in certain implementations of the second aspect, before sending the first control instruction to the third module, the method also includes: sending a first request message to the first module, the first request message being used to request verification of the legitimacy of the first control instruction; receiving a first response message sent by the first module, the first response message being used to indicate that the legitimacy verification of the first control instruction has passed, and the passing of the legitimacy verification of the first control instruction is included within the first preset time length, and the first event exists.

[0033] Optionally, after the second module receives the second response information sent by the first module, the second module may not send the first control instruction to the third module, where the second response information is used to indicate that the legitimacy verification of the first control instruction has failed.

[0034] In an embodiment of the present application, the second module may request the first module to verify the legality of the first control instruction, and if the first control instruction is legal, send the first control instruction to the third module. In this way, the module that verifies the first control instruction and the module that sends the first control instruction are separated, which can ensure that each module focuses on its own task, helps to more effectively manage and control control instructions, and prevent illegal control instructions from being sent to the third module for execution.

[0035] In combination with the second aspect, in some implementations of the second aspect, before sending the first control instruction to the third module, the method further includes: querying whether the first event exists within the first preset time period.

[0036] Optionally, when the second module finds that the first event exists within the first preset time period, the second module may send the first control instruction to the third module; otherwise, the second module may not send the first control instruction to the third module.

[0037] In the embodiment of the present application, the second module can query whether the first control instruction is legal by itself, so as to prevent illegal control instructions from being sent to the corresponding third module for execution.

[0038] In combination with the second aspect, in some implementations of the second aspect, the method further includes: sending a signature result to the third module, where the signature result includes a signature for the first moment.

[0039] Optionally, the signature result also includes a signature for the first event.

[0040] In an embodiment of the present application, the second module can send a signature result to the third module, and the signature result includes a signature of the first moment, so that the third module can determine whether to execute the first control instruction based on the signature result. In this way, it can further avoid the illegal first control instruction from being executed by the third module, preventing the attacker from causing more serious consequences after invading the vehicle.

[0041] In combination with the second aspect, in some implementations of the second aspect, before sending the signature result to the third module, the method further includes: receiving the signature result sent by the first module.

[0042] Optionally, the first module may send a first response message to the second module, where the first response message includes the signature result.

[0043] In a third aspect, a verification method is provided, which is applied to a third module and includes: receiving a first control instruction sent by a second module; if a first event occurs within a first preset time period, executing the first control instruction, wherein the first preset time period is associated with a first moment and a second moment, the first moment is associated with a moment when the first event occurs, the second moment is associated with the first control instruction, and the first event is associated with the first input.

[0044] Optionally, the third module may be located in a vehicle domain controller (VDC).

[0045] In an embodiment of the present application, after receiving the first control instruction, the third module executes the first control instruction if the first event occurs within the first preset time period. In this way, the third module can be prevented from executing illegal control instructions, thereby ensuring the system safety of the vehicle.

[0046] In combination with the third aspect, in certain implementations of the third aspect, before executing the first control instruction, the method also includes: receiving the signature result sent by the second module, the signature result including the signature of the first moment; determining that the duration between the first moment and the third moment is less than or equal to a second preset duration, wherein the third moment is associated with the moment when the first control instruction is received.

[0047] Optionally, after receiving the signature result, the third module may use the key to decrypt the signature result to obtain the first moment.

[0048] Optionally, when the duration between the first moment and the third moment is greater than a second preset duration, the third module may not execute the first control instruction.

[0049] In an embodiment of the present application, the third module can determine whether to execute the first control instruction based on the first moment included in the signature result and the third moment when the first control instruction is received. In this way, the third module can be further prevented from executing illegal control instructions, thereby causing unnecessary losses to the user.

[0050] In combination with the third aspect, in certain implementations of the third aspect, the first event includes: input from a physical key, input from a touch screen, or input from voice interaction.

[0051] In a fourth aspect, a verification device is provided, which includes: an acquisition unit for acquiring a first event; a transceiver unit for receiving a first request message sent by a second module, wherein the first request message is used to request verification of the legality of a first control instruction, and the first control instruction is associated with a first input; a processing unit for determining that the duration between a first moment and a second moment is less than or equal to a first preset duration, wherein the first moment is associated with a moment when the first event occurs, and the second moment is associated with a moment when the first request message is received; the transceiver unit is also used to send a first response message to the second module, wherein the first response message is used to indicate that the legality verification of the first control instruction has passed.

[0052] In combination with the fourth aspect, in some implementations of the fourth aspect, the processing unit is further used to verify that the first request information is associated with the first event.

[0053] In combination with the fourth aspect, in certain implementations of the fourth aspect, the first response information includes a signature result, and the signature result includes a signature for the first moment.

[0054] In combination with the fourth aspect, in some implementations of the fourth aspect, the first event includes: input from a physical key, input from a touch screen, or input from voice interaction.

[0055] In combination with the fourth aspect, in certain implementations of the fourth aspect, the acquisition unit is specifically used to: detect a preset keyword, where the preset keyword includes: a wake-up word or a preset control instruction; and acquire the first event based on the preset keyword.

[0056] In combination with the fourth aspect, in some implementations of the fourth aspect, the processing unit is further used to detect whether the voice interaction includes the preset keywords based on a digital signal processor DSP or a high-fidelity Hi-Fi chip.

[0057] In the fifth aspect, a verification device is provided, which includes: a processing unit for generating a first control instruction, wherein the first control instruction is associated with a first input; a transceiver unit for sending the first control instruction to a third module if a first event occurs within a first preset time period, wherein the first preset time period is associated with a first moment and a second moment, the first moment is associated with a moment when the first event occurs, the second moment is associated with the first control instruction, and the first event is associated with the first input.

[0058] In combination with the fifth aspect, in certain implementations of the fifth aspect, the transceiver unit is further used to: send a first request message to the first module, the first request message is used to request verification of the legitimacy of the first control instruction; receive a first response message sent by the first module, the first response message is used to indicate that the legitimacy verification of the first control instruction has passed, and the passing of the legitimacy verification of the first control instruction is included in the first preset time length, and the first event exists.

[0059] In combination with the fifth aspect, in some implementations of the fifth aspect, the processing unit is further used to query whether the first event exists within the first preset time period.

[0060] In combination with the fifth aspect, in certain implementations of the fifth aspect, the transceiver unit is further used to send a signature result to the third module, where the signature result includes a signature at a first moment, and the first moment is associated with a moment when the first event occurs.

[0061] In combination with the fifth aspect, in some implementations of the fifth aspect, the transceiver unit is further used to receive the signature result sent by the first module.

[0062] In the sixth aspect, a verification device is provided, which includes: a transceiver unit for receiving a first control instruction sent by a second module; a processing unit for executing the first control instruction if a first event occurs within a first preset time period, wherein the first preset time period is associated with a first moment and a second moment, the first moment is associated with a moment when the first event occurs, the second moment is associated with the first control instruction, and the first event is associated with the first input.

[0063] In combination with the sixth aspect, in certain implementations of the sixth aspect, the transceiver unit is further used to receive a signature result sent by the second module, the signature result including a signature of a first moment, and the first moment is associated with the moment when the first event occurs; the processing unit is further used to determine that the duration between the first moment and the third moment is less than or equal to a second preset duration, wherein the third moment is associated with the moment when the first control instruction is received.

[0064] In combination with the sixth aspect, in certain implementations of the sixth aspect, the first event includes: input from a physical key, input from a touch screen, or input from voice interaction.

[0065] In the seventh aspect, a verification device is provided, comprising: at least one processor and a memory, wherein the at least one processor is coupled to the memory and is configured to read and execute instructions in the memory, so that the device implements the method in any one of the implementation methods of the first to third aspects above.

[0066] In an eighth aspect, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores a program code. When the computer program code is run on a computer, the computer executes the method in any one of the implementation methods of the first to third aspects above.

[0067] In a ninth aspect, a chip is provided, which includes a circuit for executing the method in any one of the implementations of the first to third aspects above.

[0068] In a tenth aspect, a computer program product is provided, which includes a computer program. When the computer program is run, the computer executes the method in any one of the implementation modes of the first to third aspects above.

[0069] In the eleventh aspect, a vehicle is provided, comprising: a device according to any one of the implementations of the fourth or sixth aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0070] FIG1 is a functional schematic diagram of a vehicle provided in an embodiment of the present application;

[0071] FIG2 is a schematic flowchart of automatic parking provided in an embodiment of the present application;

[0072] FIG3 is a system architecture applicable to the verification method provided in an embodiment of the present application;

[0073] FIG4 is a schematic flow chart of a verification method provided in an embodiment of the present application;

[0074] FIG5 is another system architecture applicable to the verification method provided in an embodiment of the present application;

[0075] FIG6 is a schematic flow chart of another verification method provided in an embodiment of the present application;

[0076] FIG7 is another system architecture applicable to the verification method provided in an embodiment of the present application;

[0077] FIG8 is a schematic flow chart of another verification method provided in an embodiment of the present application;

[0078] FIG9 is a schematic flowchart of a smart cockpit voice processing according to an embodiment of the present application;

[0079] FIG10 is a scenario in which the verification method provided in an embodiment of the present application is applicable;

[0080] FIG11 is a verification device provided in an embodiment of the present application;

[0081] FIG12 is another verification device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0082] The technical solution in this application will be described below with reference to the accompanying drawings.

[0083] In the description of the embodiments of the present application, unless otherwise specified, " / " means or, for example, A / B can mean A or B; "and / or" in this article is only a description of the association relationship of associated objects, indicating that there can be three relationships, for example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. In this application, "at least one" refers to one or more, and "more than one" refers to two or more. "At least one of the following items" or similar expressions refers to any combination of these items, including any combination of single items or plural items. For example, at least one of a, b, or c can mean: a, b, c, ab, ac, bc, or abc, where a, b, c can be single or multiple.

[0084] In the embodiments of this application, prefixes such as "first" and "second" are used only to distinguish different description objects and have no limiting effect on the position, order, priority, quantity, or content of the described objects. The use of prefixes such as ordinal numbers in the embodiments of this application to distinguish description objects does not constitute a limitation on the described objects. For a statement of the described objects, please refer to the description in the context of the claims or embodiments, and the use of such prefixes should not constitute an unnecessary limitation.

[0085] The technical solutions in the embodiments of the present application will be described below with reference to the accompanying drawings.

[0086] FIG1 is a functional schematic diagram of a vehicle 100 provided in an embodiment of the present application.

[0087] Vehicle 100 may include various subsystems, such as a sensing system 120, a computing platform 130, and a key management system 140. Optionally, vehicle 100 may include more or fewer subsystems, and each subsystem may include one or more components. Furthermore, each subsystem and component of vehicle 100 may be interconnected via wired or wireless means.

[0088] The perception system 120 may include several sensors for sensing information about the environment surrounding the vehicle 100. For example, the perception system 120 may include a positioning system, which may be a global positioning system (GPS), a Beidou system, or other positioning systems. The perception system 120 may include one or more of an inertial measurement unit (IMU), a laser radar, a millimeter-wave radar, an ultrasonic radar, and a camera.

[0089] Some or all functions of the vehicle 100 can be controlled by a computing platform 130. The computing platform 130 may include processors 131 to 13n (n is a positive integer). A processor is a circuit with signal processing capabilities. In one implementation, the processor can be a circuit with instruction reading and execution capabilities, such as a central processing unit (CPU), a microprocessor, a graphics processing unit (GPU) (which can be understood as a microprocessor), or a digital signal processor (DSP). In another implementation, the processor can implement certain functions through the logical relationship of a hardware circuit. The logical relationship of the hardware circuit is fixed or reconfigurable. For example, the processor is a hardware circuit implemented by an application-specific integrated circuit (ASIC) or a programmable logic device (PLD), such as an FPGA. In a reconfigurable hardware circuit, the process of the processor loading a configuration file to implement the hardware circuit configuration can be understood as the process of the processor loading instructions to implement the functions of some or all of the above units. In addition, the processor may also be a hardware circuit designed for artificial intelligence, which can be understood as an ASIC, such as a neural network processing unit (NPU), a tensor processing unit (TPU), a deep learning processing unit (DPU), etc. In addition, the computing platform 130 may also include a memory for storing instructions, and some or all of the processors 131 to 13n may call the instructions in the memory to implement corresponding functions.

[0090] Computing platform 130 may control functions of vehicle 100 based on input received from various subsystems, such as perception system 120. In some embodiments, computing platform 130 may be used to provide control over many aspects of vehicle 100 and its subsystems.

[0091] The entertainment system 140 can provide entertainment functions and human-computer interaction functions, and provide the driver and passengers with a comfortable, pleasant and interactive riding experience, thereby enhancing the functionality and intelligence level of the vehicle. Optionally, the entertainment system 140 can also be located in the computing platform 130.

[0092] Optionally, the above components are just an example. In actual applications, the components in the above modules may be added or deleted according to actual needs.

[0093] The vehicle 100 in this application may include: road vehicles, water vehicles, air vehicles, industrial equipment, agricultural equipment, or entertainment equipment, etc. For example, the vehicle 100 can be a vehicle, which is a vehicle in the broad sense, and can be a transportation vehicle (such as a commercial vehicle, a passenger car, a motorcycle, a flying car, a train, etc.), an industrial vehicle (such as a forklift, a trailer, a tractor, etc.), an engineering vehicle (such as an excavator, a bulldozer, a crane, etc.), agricultural equipment (such as a lawn mower, a harvester, etc.), amusement equipment, a toy vehicle, etc. The embodiments of this application do not specifically limit the type of vehicle. For another example, the vehicle 100 can be a vehicle such as an airplane or a ship.

[0094] The following takes the vehicle 100 as an example to illustrate the technical problems to be solved by this application and the technical solutions adopted.

[0095] As smart cars become more widely used in daily life, users expect them to provide a more comfortable user experience. Smart cars allow users to issue vehicle control commands through human-computer interaction. These commands can include vehicle body control commands, such as those for doors, windows, air conditioning, and seats, or they can include control commands for power switches. The deployment of vehicle human-computer interaction systems was initially intended to enrich the entertainment experience for drivers and passengers, leading to their deployment in the vehicle's entertainment domain.

[0096] For example, in the automated parking service shown in Figure 2, a user can initiate an automated parking request through the in-cabin human-machine interface (HMI). The vehicle then plans a route and provides feedback to the user. After the user selects a route, the vehicle begins automated parking. During this process, the user can interact with the vehicle through the touchscreen or voice commands.

[0097] However, the initial deployment of a vehicle's human-machine interaction system was to enrich the entertainment experience for drivers and passengers, leading to its deployment in the vehicle's entertainment domain. However, due to its rich set of third-party applications and connected services, the vehicle's entertainment domain system presents a risk of being hacked. Therefore, in the event that the vehicle's entertainment domain system is compromised or even breached, ensuring the security of vehicle control commands is a pressing issue.

[0098] The embodiments of the present application provide a verification method, a verification device, and a vehicle, which can prevent illegal control instructions from being sent to corresponding modules or components for execution when the entertainment domain system of the vehicle is invaded or even broken by an attacker, thereby improving the system security of the vehicle.

[0099] FIG3 is a system architecture applicable to the verification method provided in an embodiment of the present application. This system architecture can be applied to the vehicle 100 of FIG1 .

[0100] As shown in Figure 3, the architecture includes: entertainment domain, management domain and instrumentation domain.

[0101] In the entertainment domain, users can initiate vehicle control requests through physical buttons, touch screens, or voice assistants. These requests are processed by the entertainment domain and converted into vehicle control commands. These commands pass through the vehicle interface unit (VIU) and reach the corresponding VDC or multi-domain controller (MDC). After receiving and verifying the vehicle control commands, the VDC or MDC can send them to the corresponding electronic control unit (ECU) for execution. These vehicle control commands can include vehicle body control commands, such as opening doors and windows, or they can include power domain control commands, such as automatic parking and cruise assist.

[0102] The instrument cluster (IPC) and head-up display (HUD) are included in the instrument domain. The IPC and HUD provide the driver with critical vehicle information, including speed, RPM, mileage, fuel status, warning lights, and audio controls. The IPC and HUD are designed to help the driver understand and control the vehicle's status, improving driving safety and convenience.

[0103] The management domain includes on-board diagnostics (OBD) and over-the-air (OTA) technology, which provide vehicle diagnostics, remote maintenance, software updates, security management, and data analysis. OBD and OTA provide automakers, repair service providers, and car owners with more convenient, efficient, and secure vehicle management and maintenance.

[0104] FIG4 is a schematic flow chart of a verification method provided in an embodiment of the present application. The method 400 may be applied to the architecture 300 . The method 400 may include steps S401 to S405 .

[0105] S401: The second module generates a first control instruction.

[0106] Exemplarily, the second module may be an instruction generation module, which may include: a vehicle control hardware abstraction layer and / or a vehicle control service module; the first control instruction may be associated with the first input.

[0107] Optionally, the first control instruction may be a vehicle control instruction, which may include: a vehicle body control instruction, for example, a control instruction for doors, windows, air conditioning and seats, or the control instruction may include a control instruction for a power domain switch.

[0108] S402: The second module sends first request information to the first module.

[0109] The first request information is used to request verification of the legitimacy of the first control instruction; the first module may be a trusted module or a verification module, and the verification module may include: a vehicle control scenario verification module.

[0110] In one embodiment, before step S402, the first module may obtain the first event, or obtain the first event and the first moment, so that the first module determines the legitimacy of the first control instruction based on the first moment, wherein the first moment is associated with the moment when the first event occurs.

[0111] Optionally, the first event may be a human-computer interaction event. When the first module is a trusted module, the first module may directly obtain the first event. When the first module is a verification module, the first module may obtain the first event from other modules (e.g., trusted modules).

[0112] Optionally, the first event may include: input from a physical key, input from a touch screen, or input from voice interaction.

[0113] In one embodiment, when the first event includes voice interaction input, the first module can detect whether the voice interaction input includes preset keywords before obtaining the first event. If the voice interaction input includes preset keywords, the first module can obtain the first event. This, on the one hand, can further prevent illegal control instructions from being sent to the third module for execution. On the other hand, when the first module detects that the user intends to interact with the voice assistant, it can put the voice assistant into hibernation, reducing the risk of the user's voice interaction being intercepted by an attacker.

[0114] Optionally, the preset keywords include wake-up words or preset control instructions.

[0115] Optionally, the wake-up word may be a keyword including the name of the voice assistant.

[0116] In one embodiment, a digital signal processor (DSP) or a high-fidelity Hi-Fi chip may be used to detect whether the voice interaction includes preset keywords.

[0117] S403: The first module determines whether the duration between the first moment and the second moment is less than or equal to a first preset duration.

[0118] Among them, the first preset duration can be associated with the first moment and the second moment, wherein the first moment can be associated with the first event, for example, the first moment is the moment when the first event occurs; the second moment can be the moment when the first module receives the first request information, and the second moment can also be understood as the moment when the second module sends the first request information, or the second moment can also be understood as the moment when the first control instruction is generated.

[0119] Optionally, the first preset duration can be set to 1 second.

[0120] In one embodiment, before step S403, the first module may verify that the first request information is associated with the first event, thereby further preventing illegal control instructions from being sent to corresponding modules or components for execution, thereby better ensuring the safe operation of components in the vehicle.

[0121] In one embodiment, the second module may also locally query the validity of the first control instruction to determine whether to send the first control instruction to the third module. Specifically, the second module may not execute step S402, and instead execute step S403 by determining that the duration between the first moment and the second moment is less than or equal to a first preset duration.

[0122] S404: The first module sends first response information to the second module.

[0123] The first response information is used to indicate that the legitimacy verification of the first control instruction has passed.

[0124] In one embodiment, the first response includes a signature result, which includes a signature of the first moment. This signature result facilitates the third component to determine whether to execute the first control instruction based on the signature result. This further prevents the execution of illegal first control instructions by the corresponding module or component, preventing an attacker from causing more serious consequences after invading the vehicle.

[0125] Optionally, the first module may sign the first moment to obtain a signature result, and carry the signature result in the first response information.

[0126] Optionally, the signature result also includes a signature for the first event.

[0127] In one embodiment, when step S403 is replaced by the first module determining that the duration between the first moment and the second moment is greater than the first preset duration, then in step S404, the first module may send a second response message to the second module, and the second response message is used to indicate that the legitimacy verification of the first control instruction fails, then the second module may not execute step S405.

[0128] S405: The second module sends a first control instruction to the third module.

[0129] The third module may be located in the VDC of the vehicle.

[0130] In an embodiment of the present application, the first module can verify the legitimacy of the first control instruction based on the time of occurrence of the first event and the time of receipt of the first request information, thereby preventing illegal control instructions from being sent to the corresponding module or component for execution, and improving the system safety of the vehicle.

[0131] The third module may perform different processing after receiving the first control instruction.

[0132] In one embodiment, if the first event occurs within a first preset time period, the third module may execute the first control instruction.

[0133] In one embodiment, after receiving the signature result sent by the second module, the third module can use the key to decrypt the signature result to obtain the first time. After determining that the duration between the first time and the third time is less than or equal to the second preset duration, the third module can execute the first control instruction; otherwise, the third module does not execute the first control instruction. The third time is associated with the time when the third module receives the first control instruction. In this way, the use of the signature result can further prevent the third module from executing illegal control instructions, thereby causing unnecessary losses to the user.

[0134] It should be understood that in the various embodiments of the present application, unless otherwise specified or there is a logical conflict, the terms and / or descriptions between the various embodiments are consistent and can be referenced by each other, and the technical features in different embodiments can be combined to form new embodiments according to their internal logical relationships.

[0135] FIG5 is another system architecture applicable to the verification method provided in an embodiment of the present application. The system architecture 500 may be a specific introduction to the intelligent cockpit domain controller (CDC) in the architecture 200 .

[0136] As shown in FIG5 , the architecture 500 includes a trusted execution environment (TEE), an entertainment domain, a vehicle management domain, a meter domain (RDA), and a trusted module.

[0137] A TEE is a secure computing environment that provides trust and isolation for applications. Applications can run in a trusted environment, isolated from other applications and the operating system. A TEE can include a communication encryption module that stores Transport Layer Security (TLS) session keys and business keys.

[0138] The entertainment domain can provide entertainment functions and human-computer interaction functions, including: entertainment interaction application (APP), upper body control APP, system layer and operating system and driver.

[0139] The vehicle management domain can be used to support remote vehicle updates, fault diagnosis, vehicle health report generation, secure communications, operating system management, and certificate management.

[0140] The instrument cluster can provide the driver with key vehicle information, including speed, RPM, mileage, fuel status, warning lights, audio controls, etc., to improve driving safety and convenience.

[0141] The trusted module may include a vehicle control scenario verification module and an interrupt signal (IRQ) processing module, which are used to verify the execution of vehicle control instructions and correctly process requests from various components or modules to ensure the stability and reliability of the CDC system.

[0142] FIG6 is a schematic flow chart of another verification method provided in an embodiment of the present application. Method 600 can be applied to architecture 500. Method 600 is a specific description of each step in method 400. Method 600 may include steps S601 to S607.

[0143] S601: The trusted module obtains an interrupt signal corresponding to a human-computer interaction event from an external device.

[0144] Specifically, when the user touches the screen, an interrupt signal can be sent to a trusted module at the exception level (EL2). This step can correspond to step ① in the architecture 500, and the human-computer interaction event can be the first event in the method 400.

[0145] Optionally, the external device may include one or more of: physical buttons, a display touch screen, a DSP, and a Hi-Fi.

[0146] In one possible implementation, if the external device includes a physical button, an interrupt signal is sent to the CPU when the physical button is pressed. By configuring the hypervisor configuration register (HCR), the interrupt signal is first sent to the corresponding trusted module in EL2, which is then routed to the corresponding virtual machine, where the driver in the virtual machine interprets the interrupt signal. During this process, the trusted module can update the time corresponding to the key interrupt in the cache after receiving the interrupt signal, and the above process can be transparent to the operating system and upper-layer applications within the virtual machine.

[0147] In one possible implementation, if the external device includes a touchscreen display, a user clicking the touchscreen can send an interrupt signal to the CPU. Similar to the physical button scenario, upon receiving the interrupt signal, the trusted module can refresh the latest touchscreen time in its cache and then inject the interrupt signal into the virtual machine by writing to the Link Register (LR). The driver in the virtual machine then processes the interrupt signal. The LR register can be used to notify the CPU of the ID corresponding to the interrupt signal from the external device. Injecting the interrupt signal into the virtual machine can be understood as writing the interrupt signal ID into the LR register.

[0148] In one possible implementation, in scenarios where the external device includes a DSP or high-fidelity (HiFi), a keyword recognition algorithm can be deployed on the DSP for security and privacy reasons. When the DSP recognizes a keyword, it can instruct the CPU through an interrupt signal to obtain audio data from the audio buffer and perform further semantic analysis and interaction on the audio data. During this process, when the trusted module receives the interrupt signal, it can refresh the latest voice interaction time in the cache.

[0149] S602: The trusted module intercepts the human-computer interaction event and records the time in the cache.

[0150] Specifically, the trusted module may respond to the interrupt signal and record the interrupt type and timestamp in the cache. This step may correspond to step ② in the architecture 500 , and the timestamp may correspond to the first moment in the method 400 .

[0151] S603 , before issuing a vehicle control command, the vehicle control hardware abstraction layer (HAL) queries the vehicle control scene verification module to determine whether the vehicle control command meets legal triggering conditions.

[0152] Specifically, the above steps may correspond to ③ in architecture 500 , the vehicle control instruction may be the first control instruction in method 400 , and the vehicle control scene verification module may be the first module in method 400 .

[0153] Optionally, the vehicle control HAL may send a first request message to the vehicle control scene verification module to query the legitimacy of the vehicle control instruction.

[0154] S604, the vehicle control scene verification module queries the cache. If the vehicle control instruction meets the legal trigger conditions, the vehicle control scene verification module can request TEE to sign the trigger conditions and timestamp.

[0155] Specifically, the above steps may correspond to step ④ in architecture 500 .

[0156] Optionally, the trigger condition for the vehicle control instruction to meet the legality can be understood as: the vehicle control instruction is legal, that is, the vehicle control scene verification module determines that the time between the moment when the human-computer interaction event occurs and the moment when the first control instruction is received is less than or equal to the first preset time.

[0157] Optionally, the signature of the legality trigger condition and the timestamp by the above-mentioned vehicle control scene verification module can be understood as: signing the time when the human-computer interaction event occurs and / or the human-computer interaction event.

[0158] In one embodiment, if the vehicle control scenario verification module determines that at least one valid scenario has occurred within a first preset duration, it can determine that the vehicle control command meets the legal triggering conditions. The specific value of the first preset duration can be determined based on the time cost of the service. For example, the preset threshold can be set to 1 second. The above-mentioned valid scenarios can include physical button, touch screen interaction, or voice interaction scenarios.

[0159] Optionally, for a vehicle control command that can be invoked in multiple scenarios, if one of the scenarios satisfies the legitimacy triggering condition, then the vehicle control command can be determined to have satisfied the legitimacy triggering condition. For example, for a "windows open" command that can be invoked by physical buttons, touchscreen interaction, or voice interaction, if the vehicle control scenario verification module determines that the duration between the occurrence of any human-computer interaction event and the receipt of the first request information in any of the three scenarios is less than or equal to a first preset duration, then the "windows open" command satisfies the legitimacy triggering condition.

[0160] Optionally, for vehicle control commands that can only be invoked in specific scenarios, the duration between the moment of the human-computer interaction event occurring in that specific scenario and the moment the first control command is received is less than or equal to a preset duration for the vehicle control command to be considered as meeting the legal triggering conditions. For example, if the "autopark" command requires the user to click the touchscreen to initiate, a touchscreen event must occur, and the duration between the touchscreen event and the moment the first control command is received is less than or equal to the preset duration for the vehicle control command to be considered as meeting the legal triggering conditions.

[0161] Alternatively, the vehicle control scenario verification module may also use the stored business key to sign the trigger condition and timestamp.

[0162] S605: The vehicle control scene verification module returns the signature to the vehicle control HAL.

[0163] Specifically, the above steps may correspond to step ⑤ in architecture 500 .

[0164] S606, the vehicle control HAL sends the signature and vehicle control command to the corresponding component via TLS.

[0165] Optionally, the corresponding component may be a VDC or an MDC, and the corresponding component may include the third module in method 400 .

[0166] Optionally, the vehicle control HAL may send the signature and vehicle control command to a secure communication (SecCOM) module, which then sends the signature and the vehicle control command to corresponding components.

[0167] S607: After receiving the signature and vehicle control instruction, the corresponding component can verify the integrity of the message and the signature.

[0168] Specifically, the corresponding component uses the key to decrypt the signature to obtain the moment when the human-computer interaction time occurs. When the duration between the moment when the human-computer interaction time occurs and the moment when the vehicle control instruction is received is less than or equal to the second preset threshold, the corresponding component can execute the vehicle control instruction.

[0169] In an embodiment of the present application, the vehicle scenario verification module can verify the legitimacy of the vehicle control command based on the time of occurrence of the human-computer interaction event and the time of receipt of the first request information, thereby preventing illegal vehicle control commands from being sent to the corresponding components for execution, thereby improving the system security of the vehicle. In addition, the corresponding component can decrypt the signature result to obtain the time of occurrence of the human-computer interaction event and determine whether to execute the vehicle control command based on the time of occurrence of the human-computer interaction event and the time of receipt of the vehicle control command. This can further prevent the corresponding component from executing illegal control commands, thereby causing unnecessary losses to the user.

[0170] FIG7 is another system architecture applicable to the verification method provided in an embodiment of the present application. The system architecture 700 may be a specific introduction to the CDC in the architecture 200 .

[0171] The difference between Architecture 700 and Architecture 500 is that the vehicle control service module (SA) and vehicle control HAL can be migrated to a secure virtual machine, such as the instrument cluster domain. All vehicle control commands can be issued by the secure virtual machine. The secure virtual machine includes an independent pre-set key, and other non-secure virtual machines cannot impersonate the secure virtual machine to send vehicle control commands. The vehicle control service module determines whether the vehicle control command meets the legitimacy trigger conditions. If so, the vehicle control command is allowed to be securely issued. Otherwise, the vehicle control command is not issued, and the malicious command is terminated in the CDC, without the need for additional verification by related components.

[0172] The functions of the various components in architecture 700 have been described in detail in architecture 500 and will not be repeated here.

[0173] FIG8 is a schematic flow chart of another verification method provided in an embodiment of the present application. Method 800 may be applied to architecture 700 . Method 800 may be a specific description of each step in method 400 . Method 800 may include steps S801 to S807 .

[0174] S801: The trusted module obtains an interrupt signal corresponding to a human-computer interaction event from an external device.

[0175] Specifically, when the user touches the screen, an interrupt signal can be sent to a trusted module at the exception level (EL2). This step can correspond to step ① in the architecture 700, and the human-computer interaction event can be the first event in the method 400.

[0176] Optionally, the external device may include one or more of: physical buttons, a display touch screen, a DSP, and a Hi-Fi.

[0177] In one possible implementation, if the external device includes a physical button, an interrupt signal is sent to the CPU when the physical button is pressed. By configuring the trusted module control register (HCR), the interrupt signal is first sent to the corresponding trusted module at EL2, which is then routed to the corresponding virtual machine, where the driver within the virtual machine interprets the interrupt signal. During this process, the trusted module updates the time corresponding to the key interrupt in the cache after receiving the interrupt signal. This process is transparent to the operating system and upper-layer applications within the virtual machine.

[0178] In one possible implementation, if the external device includes a touchscreen display, a user clicking the touchscreen display can send an interrupt signal to the CPU. Similar to the physical button scenario, upon receiving the interrupt signal, the trusted module can refresh the latest touchscreen time in its cache and then inject the interrupt signal into the virtual machine by writing to the LR register. The driver in the virtual machine then processes the interrupt signal. The LR register can be used to notify the CPU of the ID corresponding to the interrupt signal from the external device. Injecting the interrupt signal into the virtual machine can be understood as writing the interrupt signal ID into the LR register.

[0179] In one possible implementation, if the external device includes a DSP or HiFi, a keyword recognition algorithm can be deployed on the DSP for security and privacy reasons. When the DSP recognizes a keyword, it can use an interrupt signal to instruct the CPU to retrieve audio data from the audio buffer and perform further semantic analysis and interaction on the audio data. During this process, the trusted module can refresh the latest voice interaction time in the buffer when it receives the interrupt signal.

[0180] S802: The trusted module intercepts the human-computer interaction event and records the timestamp in the vehicle control scene verification cache of the instrument domain.

[0181] Specifically, the trusted module can respond to the interrupt signal and record the interrupt type and timestamp in the cache of the instrument domain vehicle control verification module. This step can correspond to ② in architecture 700, and the timestamp can correspond to the first moment in method 400.

[0182] S803: The trusted module injects an interrupt signal into the operating system of the entertainment domain.

[0183] Specifically, this step may correspond to ③ in architecture 700 .

[0184] S804, the vehicle body control APP in the entertainment domain sends the vehicle control instruction to the vehicle control SA in the instrument domain through the inter-domain secure communication mechanism.

[0185] Specifically, this step may correspond to step ④ in architecture 700 .

[0186] S805, the vehicle control SA calls the vehicle control scene verification module to query the cache and determine whether the vehicle control command meets the legal triggering conditions.

[0187] Specifically, this step may correspond to step ⑤ in architecture 700 .

[0188] In one embodiment, the vehicle control SA may locally call the vehicle control scenario verification module to query and determine whether the vehicle control instruction meets the legality triggering conditions.

[0189] In one embodiment, the vehicle control SA may send a first request message to the vehicle control scenario verification module, requesting the vehicle control scenario verification module to determine whether the vehicle control instruction meets the legitimacy triggering condition.

[0190] Optionally, the trigger condition for the vehicle control instruction to meet the legality can be understood as: the vehicle control instruction is legal, that is, the vehicle control scene verification module determines that the time between the moment when the human-computer interaction event occurs and the moment when the first control instruction is received is less than or equal to the first preset time.

[0191] In one embodiment, if the vehicle control scenario verification module determines that at least one valid scenario has occurred within a first preset duration, it can determine that the vehicle control command meets the legal triggering conditions. The specific value of the first preset duration can be determined based on the time cost of the service. For example, the preset threshold can be set to 1 second. The above-mentioned valid scenarios can include physical button, touch screen interaction, or voice interaction scenarios.

[0192] Optionally, for a vehicle control command that can be invoked in multiple scenarios, if one of the scenarios satisfies the legitimacy triggering condition, then the vehicle control command can be determined to have satisfied the legitimacy triggering condition. For example, for a "windows open" command that can be invoked by physical buttons, touchscreen interaction, or voice interaction, if the vehicle control scenario verification module determines that the duration between the occurrence of any human-computer interaction event and the receipt of the first request information in any of the three scenarios is less than or equal to a first preset duration, then the "windows open" command satisfies the legitimacy triggering condition.

[0193] Optionally, for vehicle control commands that can only be invoked in specific scenarios, the duration between the moment of the human-computer interaction event occurring in that specific scenario and the moment of receipt of the first control command is less than or equal to a first preset duration for the vehicle control command to be considered as meeting the legal triggering conditions. For example, if the "autopark" command requires the user to click the touchscreen to initiate, a touchscreen event must occur, and the duration between the moment of the touchscreen event and the moment of receipt of the first control command is less than or equal to the first preset duration for the vehicle control command to be considered as meeting the legal triggering conditions.

[0194] S806: When the vehicle control instruction meets the legality triggering condition, the vehicle control SA may send the vehicle control instruction to the corresponding component.

[0195] Specifically, this step may correspond to step ⑥ in architecture 700 .

[0196] Optionally, the corresponding component may be a VDC or an MDC.

[0197] S807: After receiving the vehicle control command, the corresponding component can directly execute it.

[0198] In this embodiment of the present application, the vehicle scenario verification module or vehicle control SA verifies the legitimacy of vehicle control commands based on the time of occurrence of the human-machine interaction event and the time of receipt of the first request information, thereby preventing illegal vehicle control commands from being sent to the corresponding components for execution, thereby improving vehicle system security. Furthermore, by migrating the vehicle control SA and vehicle control HAL into the instrument cluster domain, all vehicle control commands are issued from the instrument cluster domain. Because the instrument cluster domain has its own independent key, other virtual machines cannot impersonate it to send vehicle control commands, further improving the security of vehicle control commands.

[0199] FIG9 is a schematic flowchart of a smart cockpit voice processing provided in an embodiment of the present application, which may be a specific description of the voice interaction input method in method 400 . Method 900 may include the following steps.

[0200] S901: A microphone (Mic) obtains user voice interaction information and sends the voice interaction information to a DSP for processing.

[0201] S902 , after the DSP recognizes the wake-up keyword from the voice interaction information, it sends an interrupt signal to the system-on-a-chip (SoC).

[0202] Alternatively, the DSP can identify whether the voice interaction information includes a preset control instruction. When the DSP identifies that the voice interaction information includes a preset control instruction, the DSP can send the interrupt signal to the SoC for processing. The preset control instruction is used to generate a vehicle control instruction.

[0203] Alternatively, in step S902, if the DSP does not recognize the wake-up keyword from the voice interaction information, the voice interaction information can be discarded. At this time, the voice assistant can be in a dormant state and will not parse the voice interaction information of the user in the car, thereby protecting the user's privacy.

[0204] Optionally, the wake-up keyword can be understood as the name of the voice assistant contained in the user's voice interaction information.

[0205] S903: After receiving the interrupt signal, the SoC may wake up the HiVoice.

[0206] Among them, HiVoice can be a voice recognition and voice control platform for realizing voice interaction functions; HiVoice can recognize the user's voice interaction information and convert it into corresponding operation instructions.

[0207] S904 , HiVoice recognizes the voice interaction information, converts the voice interaction information into vehicle control instructions, and sends them to the vehicle control SA.

[0208] S905 , the vehicle control SA performs a validity check on the vehicle control command. If the check passes, the vehicle control SA sends the vehicle control command to SecCOM.

[0209] The legitimacy check performed by the vehicle control SA on the vehicle control command may be the same as the legitimacy check steps of method 600 and method 800 .

[0210] S906, secCOM forwards the vehicle control command to the VIU.

[0211] S907: VIU converts the vehicle control command into a different format and sends it to VDC.

[0212] S908: After receiving the vehicle control command, the VDC can directly execute it.

[0213] Optionally, in this step, after receiving the vehicle control command, the VDC may verify the integrity of the vehicle control command, and execute the vehicle control command if the verification passes.

[0214] In this embodiment of the present application, the user's intention to interact with the voice assistant can be determined by identifying the wake-up keyword in the user's voice interaction information, and then the vehicle control command can be generated based on the user's voice interaction information. This method avoids the voice assistant constantly parsing the user's voice interaction information, reduces the possibility of the voice analysis results being misused by intruders, and thus improves the user's privacy.

[0215] FIG10 is a scenario in which the verification method provided in an embodiment of the present application is applicable, and method 900 can be applied to this scenario.

[0216] As shown in FIG10( a ), the vehicle's central control screen displays: a display interface 1000 and a function bar 1010 . Display interface 1000 includes user account login information 1001 (the vehicle currently has no account logged in), a Bluetooth icon 1002 , a Wi-Fi icon 1003 , a cellular network signal icon 1004 , an in-vehicle map application search box 1005 , a card 1006 that switches to displaying all installed vehicle applications, a card 1007 that switches to displaying in-vehicle music applications, a card 1008 that displays the vehicle's remaining battery life and remaining mileage, and a card 1009 that displays the vehicle's 360-degree surround view function. The in-vehicle map application search box 1005 may include a user-configured home control 10051 and a go-to-work control 10052 . The function bar 1010 includes an icon 1011 for switching to the central control large screen desktop, a vehicle internal circulation icon 1012, a driver's seat heating function icon 1013, a driver's area air-conditioning temperature display icon 1014, a passenger area air-conditioning temperature display icon 1015, a passenger seat heating function icon 1016 and a volume setting icon 1017.

[0217] As shown in (b) of Figure 10, the user issues a voice command "Please open the window" in the car. Since the DSP inside the vehicle does not recognize the wake-up keyword, the DSP will directly discard the voice data and the voice assistant will be in sleep mode.

[0218] As shown in (c) in Figure 10, the user issues a voice command in the car, "Voice assistant, please open the window." Since the DSP inside the vehicle recognizes the wake-up keyword, it can perform subsequent audio processing and semantic analysis to generate a vehicle control command. After the vehicle executes the vehicle control command, the voice assistant 1019 and voice text 1018 can be displayed on the display interface 1000 to prompt the user, "Your command has been received and the window has been opened."

[0219] In this embodiment, by identifying whether the user's voice interaction information contains a wake-up keyword, it is possible to determine whether the user intends to interact with the voice assistant, thereby generating vehicle control instructions based on the user's voice interaction information. This method can prevent the voice assistant from continuously parsing the user's voice interaction information, thereby reducing the risk of the voice analysis results being misused by intruders and improving the user's privacy and security.

[0220] It should be understood that in the various embodiments of the present application, unless otherwise specified or there is a logical conflict, the terms and / or descriptions between the various embodiments are consistent and can be referenced by each other, and the technical features in different embodiments can be combined to form new embodiments according to their internal logical relationships.

[0221] The embodiment of the present application also provides an apparatus for implementing any of the above methods, which includes a unit for implementing each step performed by the vehicle 100 in any of the above methods.

[0222] Figure 11 is a schematic diagram of a verification device 1100 provided in an embodiment of the present application. The device 1100 may include an acquisition unit 1110, a transceiver unit 1120, and a processing unit 1130. The acquisition unit 1110 is used to acquire instructions and / or data, and the transceiver unit 1120 is used to send and receive instructions and / or data. The acquisition unit 1110 and the transceiver unit 1120 may also be referred to as communication interfaces or communication units. The processing unit 1130 is used to process data so that the device 1100 implements the aforementioned verification method.

[0223] Optionally, the device 1100 further includes a storage unit configured to implement a corresponding storage function and store corresponding instructions and / or data.

[0224] As a design, the device 1100 can execute the steps executed by the first module in the above embodiment.

[0225] The device 1100 includes: an acquisition unit 1110, used to acquire a first event; a transceiver unit 1120, used to receive a first request message sent by the second module, the first request message is used to request verification of the legitimacy of a first control instruction, and the first control instruction is associated with a first input; a processing unit 1130, used to determine that the duration between a first moment and a second moment is less than or equal to a first preset duration, the first moment is associated with the moment when the first event occurs, and the second moment is associated with the moment when the first request message is received; the transceiver unit 1120 is also used to send a first response message to the second module, and the first response message is used to indicate that the legitimacy verification of the first control instruction has passed.

[0226] In a possible implementation, the processing unit 1130 is further configured to verify that the first request information is associated with the first event.

[0227] In a possible implementation, the first response information includes a signature result, and the signature result includes a signature for the first moment.

[0228] In a possible implementation, the first event includes: input from a physical key, input from a touch screen, or input from voice interaction.

[0229] In a possible implementation, the acquisition unit 1110 is specifically configured to: detect a preset keyword, where the preset keyword includes a wake-up word or a preset control instruction; and acquire a first event according to the preset keyword.

[0230] In a possible implementation, the processing unit 1130 is further configured to detect whether the voice interaction includes preset keywords based on a digital signal processor DSP or a high-fidelity Hi-Fi chip.

[0231] As a design, the device 1100 can execute the steps executed by the second module in the above embodiment.

[0232] Device 1100 includes: a processing unit 1130, used to generate a first control instruction, which is associated with a first input; a transceiver unit 1120, used to send the first control instruction to a third module if a first event occurs within a first preset time period, wherein the first preset time period is associated with a first moment and a second moment, the first moment is associated with a moment when the first event occurs, the second moment is associated with the first control instruction, and the first event is associated with the first input.

[0233] In one possible implementation, the transceiver unit 1120 is also used to: send a first request message to the first module, where the first request message is used to request verification of the legitimacy of the first control instruction; receive a first response message sent by the first module, where the first response message is used to indicate that the legitimacy verification of the first control instruction has passed, and the passing of the legitimacy verification of the first control instruction is included in a first preset time period, and a first event occurs.

[0234] In a possible implementation, the processing unit 1130 is further configured to query whether a first event occurs within a first preset time period.

[0235] In a possible implementation, the transceiver unit 1120 is further configured to send a signature result to the third module, where the signature result includes the signature at the first moment.

[0236] In a possible implementation, the transceiver unit 1120 is further configured to receive the signature result sent by the first module.

[0237] As a design, the device 1100 can execute the steps executed by the third module in the above embodiment.

[0238] The device 1100 includes: a transceiver unit 1120, used to receive a first control instruction sent by a second module; a processing unit 1130, used to execute the first control instruction if a first event occurs within a first preset time period, wherein the first preset time period is associated with a first moment and a second moment, the first moment is associated with a moment when the first event occurs, the second moment is associated with the first control instruction, and the first event is associated with a first input.

[0239] In one possible implementation, the transceiver unit 1120 is also used to receive the signature result sent by the second module, where the signature result includes the signature of the first moment, where the first moment is associated with the moment when the first event occurs; the processing unit 1130 is also used to determine that the duration between the first moment and the third moment is less than or equal to the second preset duration, where the third moment is associated with the moment when the first control instruction is received.

[0240] In a possible implementation, the first event includes: input from a physical key, input from a touch screen, or input from voice interaction.

[0241] Optionally, if the device 1100 is located in the vehicle 100 , the processing unit 1230 may be the processor 131 shown in FIG. 1 .

[0242] FIG12 is a schematic diagram of another verification device 1200 provided in an embodiment of the present application. The device 1200 can be applied to the vehicle 100 of FIG1 .

[0243] The device 1200 includes a memory 1210, a processor 1220, and a communication interface 1230. The memory 1210, processor 1220, and communication interface 1230 are connected via an internal connection path. The memory 1210 is used to store instructions, and the processor 1220 is used to execute the instructions stored in the memory 1210 to control the communication interface 1230 to obtain information or enable the device 1200 to implement the aforementioned verification method. Optionally, the memory 1210 can be coupled to the processor 1220 via an interface or integrated with the processor 1220.

[0244] It should be noted that the communication interface 1230 may be a transceiver such as, but not limited to, a transceiver. The communication interface 1230 may also include an input / output interface.

[0245] The processor 1220 stores one or more computer programs, which include instructions. When the instructions are executed by the processor 1220, the verification device 1200 executes the verification method in each of the above embodiments.

[0246] During implementation, each step of the above method can be completed by an integrated logic circuit of the hardware in the processor 1220 or by instructions in the form of software. The method disclosed in conjunction with the embodiments of the present application can be directly embodied as being executed by a hardware processor, or can be executed by a combination of hardware and software modules in the processor. The software module can be located in a mature storage medium in the art, such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory or an electrically erasable programmable memory, a register, etc. The storage medium is located in the memory 1210, and the processor 1220 reads the information in the memory 1210 and completes the steps of the above method in combination with its hardware. To avoid repetition, it will not be described in detail here.

[0247] Optionally, the communication interface 1230 in FIG. 12 may implement the acquisition unit 1110 or the transceiver unit 1120 in FIG. 11 , and the processor 1220 in FIG. 12 may implement the processing unit 1130 in FIG. 11 .

[0248] Optionally, the device 1100 or the device 1200 may be a computing platform, and the computing platform may be a vehicle-mounted computing platform.

[0249] Alternatively, the device 1100 or the device 1200 may be located in the vehicle 100 in FIG. 1 .

[0250] Optionally, the device 1100 or the device 1200 may be the computing platform 130 in the vehicle of FIG. 1 .

[0251] An embodiment of the present application further provides a computer-readable storage medium, wherein the computer-readable storage medium stores a program code. When the computer program code runs on a computer, the computer executes any one of the methods in FIG. 4 to FIG. 9 .

[0252] An embodiment of the present application further provides a computer program product, which includes a computer program. When the computer program is executed, the computer executes any one of the methods in Figures 4 to 9 above.

[0253] An embodiment of the present application further provides a chip, comprising: a circuit, wherein the circuit is used to execute any one of the methods in FIG. 4 to FIG. 9 above.

[0254] An embodiment of the present application also provides a vehicle comprising any one of the verification devices shown in FIG11 or FIG12 .

[0255] Those skilled in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0256] Those skilled in the art will clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0257] In the several embodiments provided in this application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are merely schematic. For example, the division of the units is merely a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0258] The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected to achieve the purpose of this embodiment according to actual needs.

[0259] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0260] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0261] The above description is merely a specific embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this application should be included in the scope of protection of this application. Therefore, the scope of protection of this application should be based on the scope of protection of the claims.

Claims

1. A verification method, characterized in that: The method is applied in a first module, and the method comprises: Get the first event; receiving first request information sent by the second module, where the first request information is used to request verification of the legitimacy of a first control instruction, where the first control instruction is associated with a first input; Determine that the duration between a first moment and a second moment is less than or equal to a first preset duration, the first moment is associated with a moment when the first event occurs, and the second moment is associated with a moment when the first request information is received; A first response message is sent to the second module, where the first response message is used to indicate that the legitimacy verification of the first control instruction has passed.

2. The method according to claim 1, characterized in that Before determining that the duration between the first moment and the second moment is less than or equal to the first preset duration, the method further includes: Verify that the first request information is associated with the first event.

3. The method according to claim 1 or 2, characterized in that The first response information includes a signature result, and the signature result includes a signature for the first moment.

4. The method according to any one of claims 1 to 3, characterized in that The first event includes: input from a physical key, input from a touch screen, or input from a voice interaction.

5. The method according to claim 4, characterized in that The first event includes the input of the voice interaction, and the obtaining of the first event includes: Detecting a preset keyword, wherein the preset keyword includes: a wake-up word or a preset control instruction; The first event is obtained according to the preset keyword.

6. The method according to claim 5, characterized in that Before detecting the preset keyword, the method further includes: The digital signal processor DSP or the high-fidelity Hi-Fi chip is used to detect whether the voice interaction includes the preset keyword.

7. A verification method, characterized in that: The method is applied in the second module, and the method comprises: generating a first control instruction, wherein the first control instruction is associated with a first input; If a first event occurs within a first preset duration, the first control instruction is sent to a third module, wherein the first preset duration is associated with a first moment and a second moment, the first moment is associated with a moment when the first event occurs, the second moment is associated with the first control instruction, and the first event is associated with the first input.

8. The method according to claim 7, characterized in that Before sending the first control instruction to the third module, the method further includes: Sending first request information to the first module, where the first request information is used to request verification of the legitimacy of the first control instruction; Receive first response information sent by the first module, where the first response information is used to indicate that the legitimacy verification of the first control instruction has passed, that the legitimacy verification of the first control instruction has passed is included within the first preset time period, and that the first event exists.

9. The method according to claim 7, characterized in that Before sending the first control instruction to the third module, the method further includes: Query whether the first event exists within the first preset time period.

10. The method according to any one of claims 7 to 9, characterized in that: The method further comprises: Sending a signature result to the third module, where the signature result includes a signature for the first moment.

11. The method according to claim 10, characterized in that Before sending the signature result to the third module, the method further includes: Receive the signature result sent by the first module.

12. A verification method, characterized in that: The method is applied in the third module, and the method comprises: receiving a first control instruction sent by the second module; If a first event occurs within a first preset duration, the first control instruction is executed, wherein the first preset duration is associated with a first moment and a second moment, the first moment is associated with a moment when the first event occurs, the second moment is associated with the first control instruction, and the first event is associated with the first input.

13. The method according to claim 12, characterized in that Before executing the first control instruction, the method further includes: receiving a signature result sent by the second module, wherein the signature result includes a signature for the first moment; Determine that the duration between the first moment and a third moment is less than or equal to a second preset duration, wherein the third moment is associated with the moment when the first control instruction is received.

14. The method according to claim 13, characterized in that The first event includes: input from a physical key, input from a touch screen, or input from a voice interaction.

15. A verification device, characterized in that: The device comprises: An acquiring unit, used for acquiring a first event; A transceiver unit, configured to receive first request information sent by the second module, wherein the first request information is used to request verification of the legitimacy of a first control instruction, wherein the first control instruction is associated with a first input; A processing unit, configured to determine that a duration between a first moment and a second moment is less than or equal to a first preset duration, the first moment being associated with a moment when the first event occurs, and the second moment being associated with a moment when the first request information is received; The transceiver unit is further used to send first response information to the second module, where the first response information is used to indicate that the legitimacy verification of the first control instruction has passed.

16. The device according to claim 15, characterized in that The processing unit is further configured to verify that the first request information is associated with the first event.

17. The device according to claim 15 or 16, characterized in that The first response information includes a signature result, and the signature result includes a signature for the first moment.

18. The device according to any one of claims 15 to 17, characterized in that The first event includes: input from a physical key, input from a touch screen, or input from a voice interaction.

19. The device according to claim 18, characterized in that The first event includes the input of the voice interaction; The acquisition unit is specifically used for: Detecting a preset keyword, wherein the preset keyword includes: a wake-up word or a preset control instruction; The first event is obtained according to the preset keyword.

20. The device according to claim 19, characterized in that The processing unit is further used to detect whether the voice interaction includes the preset keyword based on a digital signal processor DSP or a high-fidelity Hi-Fi chip.

21. A verification device, characterized in that: The device comprises: A processing unit, configured to generate a first control instruction, wherein the first control instruction is associated with a first input; A transceiver unit is used to send the first control instruction to a third module if a first event occurs within a first preset time period, wherein the first preset time period is associated with a first moment and a second moment, the first moment is associated with a moment when the first event occurs, the second moment is associated with the first control instruction, and the first event is associated with the first input.

22. The device according to claim 21, characterized in that The transceiver unit is further used for: Sending first request information to the first module, where the first request information is used to request verification of the legitimacy of the first control instruction; Receive first response information sent by the first module, where the first response information is used to indicate that the legitimacy verification of the first control instruction has passed, that the legitimacy verification of the first control instruction has passed is included within the first preset time period, and that the first event exists.

23. The device according to claim 21, characterized in that The processing unit is further used to query whether the first event exists within the first preset time period.

24. The device according to any one of claims 21 to 23, characterized in that The transceiver unit is further used to send a signature result to the third module, where the signature result includes a signature for the first moment.

25. The device according to claim 24, characterized in that The transceiver unit is further used to receive the signature result sent by the first module.

26. A verification device, characterized in that: The device comprises: A transceiver unit, configured to receive a first control instruction sent by the second module; A processing unit, used for executing the first control instruction if a first event occurs within a first preset time period, wherein the first preset time period is associated with a first moment and a second moment, the first moment is associated with a moment when the first event occurs, the second moment is associated with the first control instruction, and the first event is associated with the first input.

27. The device according to claim 26, characterized in that The transceiver unit is further configured to receive a signature result sent by the second module, wherein the signature result includes a signature for the first moment; The processing unit is further used to determine that the duration between the first moment and a third moment is less than or equal to a second preset duration, wherein the third moment is associated with the moment when the first control instruction is received.

28. The device according to claim 27, characterized in that The first event includes: input from a physical key, input from a touch screen, or input from a voice interaction.

29. A verification device, characterized in that: include: A processor and a memory, wherein the processor is coupled to the memory and is configured to read and execute instructions in the memory to perform the method according to any one of claims 1 to 6.

30. The device according to claim 29, characterized in that The apparatus is a device having a trusted execution environment.

31. A verification device, characterized in that: include: A processor and a memory, wherein the processor is coupled to the memory and is configured to read and execute instructions in the memory to perform the method according to any one of claims 7 to 11.

32. A verification device, characterized in that: include: A processor and a memory, wherein the processor is coupled to the memory and is configured to read and execute instructions in the memory to perform the method according to any one of claims 12 to 14.

33. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a program code, and when the computer program code is executed on a computer, the computer is caused to execute the method according to any one of claims 1 to 14.

34. A chip, characterized in that: include: A circuit for executing the method according to any one of claims 1 to 14.

35. A vehicle, characterized in that: include: A device as claimed in any one of claims 15 to 32.

Images