Communication method and apparatus, terminal, and storage medium

Abstract

The present application relates to a communication method and apparatus, a terminal, and a storage medium. The communication method comprises: upon completion of ICCOA protocol authentication between a first terminal and a second terminal, generating a first temporary private key on the basis of random number data during the ICCOA protocol authentication process; generating a shared key on the basis of the first temporary private key and a second temporary public key received from the second terminal, wherein the second temporary public key is generated on the basis of the second temporary private key, and the second temporary private key is generated on the basis of the random number data during the ICCOA protocol authentication process; and performing encrypted communication with the second terminal on the basis of the shared key. The present application can prevent data having undergone ICCOA protocol authentication from being transmitted in plaintext; and when applied to the communication between a vehicle end and a vehicle key end, the present application can effectively prevent vehicle-control data of a vehicle enterprise from being relayed or tampered with, and better avoid the possibility of data leakage or loss of vehicle control, thereby reducing potential safety hazards, and improving the security of ICCOA protocol-based information transmission.

Description

Communication method, device, terminal and storage medium

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This application claims priority to the Chinese patent application filed with the China Patent Office on March 29, 2024, with application number 202410376457.6 and invention name “Communication Method, Device, Terminal and Storage Medium”, the entire contents of which are incorporated by reference into this application. Technical Field

[0003] The present application relates to the field of communication technology, and in particular to a communication method, device, terminal and storage medium. Background Art

[0004] Car keys have evolved through mechanical keys, chip keys, remote control keys, and smart keys, each of which has progressed towards greater convenience and intelligence. Among these, remote control keys, smart start systems, and digital key apps (applications) based on automotive electronics are making vehicle use increasingly convenient and intelligent.

[0005] The development of digital keys has led to the development of several communication protocols, including ICCE, ICCOA, and CCC. Each protocol defines a specific digital key authentication interaction process. The ICCOA protocol, a modified version of the CCC protocol, incorporates some of CCC's encryption algorithms, such as SPAKE2+. This algorithm is difficult to implement and has led to suspicions of plagiarism. Therefore, ICCOA version 2.0 did not adopt this algorithm, instead adopting an authentication process based on temporary key exchange verification.

[0006] However, in version 2.0 of ICCOA, data processing after ICCOA protocol authentication uses plain text transmission, and verification uses signature verification. From an information security perspective, this solution can easily lead to the transfer or modification of vehicle control data of automobile companies, resulting in data leakage or vehicle loss of control, posing a serious security risk. Summary of the Invention

[0007] One of the purposes of this application is to provide a communication method, which can obtain a shared key based on the random number data in the ICCOA protocol authentication process after the ICCOA protocol authentication is completed, and then use the shared key to encrypt subsequent communications to reduce security risks; the second purpose of this application is to provide a communication device; the third purpose of this application is to provide a terminal; the fourth purpose of this application is to provide a storage medium.

[0008] To achieve the above objectives, in a first aspect, the present application provides a communication method, the communication method comprising:

[0009] After the ICCOA protocol authentication between the first terminal and the second terminal is completed, generating a first temporary private key based on random number data in the ICCOA protocol authentication process;

[0010] Generate a shared key based on the first temporary private key and a second temporary public key received from the second terminal; wherein the second temporary public key is generated based on the second temporary private key, and the second temporary private key is generated by the second terminal based on random number data during the ICCOA protocol authentication process;

[0011] Perform encrypted communication with the second terminal based on the shared key.

[0012] Optionally, generating the first temporary private key based on random number data in the ICCOA protocol authentication process includes:

[0013] Decrypting encrypted data received from the second terminal; wherein the encrypted data is data obtained by encrypting target random number data by the second terminal, the target random number data being obtained by concatenating first random number data generated by the first terminal and second random number data generated by the second terminal during the ICCOA protocol authentication process;

[0014] If the decrypted data of the encrypted data is identical to the target random number data of the first terminal, the first temporary private key is generated based on the encrypted data.

[0015] Optionally, generating the first temporary private key based on the encrypted data includes:

[0016] Concatenate the vehicle manufacturer unique identifier of the ICCOA vehicle server certificate extension and / or the vehicle owner key unique identifier of the ICCOA vehicle owner key certificate extension with the encrypted data to obtain private key input data for generating the first temporary private key;

[0017] The first temporary private key is generated based on the private key input data.

[0018] Optionally, before performing encrypted communication with the second terminal based on the shared key, the communication method includes:

[0019] generating a first temporary public key based on the first temporary private key;

[0020] The first temporary public key is transmitted to the second terminal, so that the second terminal generates a shared key based on the second temporary private key and the first temporary public key.

[0021] Optionally, generating a first temporary public key based on the first temporary private key includes:

[0022] The first temporary private key is processed based on the curve equation curve25519 to obtain the first temporary public key.

[0023] Optionally, generating a shared key based on the first temporary private key and a second temporary public key received from the second terminal includes:

[0024] generating shared key coordinates of the shared key based on the first temporary private key and the second temporary public key received from the second terminal;

[0025] The shared key is generated based on a hash function and the shared key coordinates.

[0026] Optionally, generating the shared key based on a hash function and the shared key coordinates includes:

[0027] Concatenate the vehicle manufacturer unique identifier of the ICCOA vehicle server certificate extension and / or the vehicle owner key unique identifier of the ICCOA vehicle owner key certificate extension with the shared key coordinates to obtain key input data of the shared key;

[0028] The key input data is hashed randomly based on a hash function to obtain the shared key.

[0029] Optionally, the performing encrypted communication with the second terminal based on the shared key includes:

[0030] Performing encrypted data verification based on the shared secret key and a second temporary public key corresponding to the shared secret key;

[0031] If it is determined that the encrypted data verification is passed, the shared key is used for encrypted communication.

[0032] Optionally, before generating the first temporary private key based on random number data in the ICCOA protocol authentication process, the communication method includes:

[0033] It is determined that the first terminal does not have a valid shared key.

[0034] To achieve the above objectives, in a second aspect, the present application further provides a communication device, comprising:

[0035] A key generation module, configured to, after ICCOA protocol authentication is completed between a first terminal and a second terminal, generate a first temporary private key based on random number data during the ICCOA protocol authentication process; further configured to generate a shared key based on the first temporary private key and a second temporary public key received from the second terminal; wherein the second temporary public key is generated based on the second temporary private key, which is generated by the second terminal based on random number data during the ICCOA protocol authentication process; and further configured to generate a shared key based on the shared key coordinates;

[0036] An encryption communication module is used to perform encrypted communication with the second terminal based on the shared key.

[0037] To achieve the above objectives, in a third aspect, the present application also provides a terminal, comprising: a processor and a memory, wherein the processor is used to execute a control program stored in the memory to implement the communication method as described in any one of the first aspects.

[0038] To achieve the above-mentioned purpose, in a fourth aspect, the present application also provides a storage medium, which stores one or more programs, and the one or more programs can be executed by one or more processors to implement the communication method as described in any one of the first aspects.

[0039] Beneficial effects of this application:

[0040] In this application, after the ICCOA protocol authentication between the first terminal (such as the vehicle end) and the second terminal (such as the car key end) is completed, a shared key can be generated based on the random number data in the ICCOA protocol authentication process, and then the generated shared key can be used for subsequent encrypted communication, thereby avoiding the data after the ICCOA protocol authentication from being transmitted in plain text. When it is applied to the communication between the vehicle end and the car key end, it can effectively prevent the car company's vehicle control data from being transferred or modified, better avoid the possibility of data leakage or vehicle loss of control, reduce safety hazards, and improve the security of information transmission based on the ICCOA protocol. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] FIG1 is a flow chart showing a communication method according to an embodiment of the present application;

[0042] FIG2 shows a schematic diagram of a communication method according to an embodiment of the present invention;

[0043] FIG3 shows a schematic structural diagram of a communication device provided in an embodiment of the present application;

[0044] FIG4 shows a schematic structural diagram of a terminal provided in an embodiment of the present application.

[0045] Among them: 10, secret key generation module; 20, encryption communication module; 100, terminal; 101, processor; 102, memory; 1021, operating system; 1022, application; 103, user interface; 104, network interface; 105, bus system. DETAILED DESCRIPTION

[0046] The following will describe the embodiments of the present application with reference to the accompanying drawings and preferred embodiments. Those skilled in the art can easily understand the other advantages and effects of the present application from the contents disclosed in this specification. The present application can also be implemented or applied through other different specific embodiments, and the details in this specification can also be modified or changed in various ways based on different viewpoints and applications without departing from the spirit of the present application. It should be understood that the preferred embodiments are only for the purpose of illustrating the present application and are not intended to limit the scope of protection of the present application.

[0047] It should be noted that the illustrations provided in the following embodiments are only schematic illustrations of the basic concept of the present application. Therefore, the illustrations only show components related to the present application and are not drawn according to the number, shape and size of components in actual implementation. In actual implementation, the type, quantity and proportion of each component can be changed at will, and the component layout type may also be more complicated.

[0048] In this application, after the ICCOA protocol authentication between the first terminal (such as the vehicle end) and the second terminal (such as the car key end) is completed, a shared key can be generated based on the random number data in the ICCOA protocol authentication process, and then the generated shared key can be used for subsequent encrypted communication, thereby avoiding the data after the ICCOA protocol authentication from being transmitted in plain text. When it is applied to the communication between the vehicle end and the car key end, it can effectively prevent the car company's vehicle control data from being transferred or modified, better avoid the possibility of data leakage or vehicle loss of control, reduce safety hazards, and improve the security of information transmission based on the ICCOA protocol.

[0049] To facilitate understanding of the embodiments of the present application, further explanation will be given below with reference to specific embodiments in conjunction with the accompanying drawings. The embodiments do not constitute a limitation on the embodiments of the present application.

[0050] This embodiment provides a communication method. Referring to Figures 1 and 2, the method may include:

[0051] S110: After the ICCOA protocol authentication between the first terminal and the second terminal is completed, a first temporary private key is generated based on random number data in the ICCOA protocol authentication process;

[0052] S120, generating a shared key based on the first temporary private key and the second temporary public key received from the second terminal;

[0053] S130: Perform encrypted communication with the second terminal based on the shared key.

[0054] In step S110, in a digital key solution implemented based on the ICCOA protocol, when performing ICCOA protocol authentication between a first terminal and a second terminal, the first terminal may generate random number data (referred to as first random number data), and the second terminal may also generate random number data (referred to as second random number data), and the two may exchange the random number data generated by each terminal. The random number data may be a true random number generated based on a timestamp.

[0055] In this step, after the ICCOA protocol authentication between the first terminal and the second terminal is completed, the first terminal can concatenate the first random number data and the second random number data to obtain the concatenated target random number data. Alternatively, the second terminal can also concatenate the first random number data and the second random number data to obtain the concatenated target random number data.

[0056] After obtaining the target random number data, the second terminal can encrypt the target random number data to obtain encrypted data (which can be recorded as second encrypted data). After obtaining the second encrypted data, the second terminal can transmit the second encrypted data to the first terminal, and the first terminal can receive the second encrypted data sent by the second terminal, so that the first terminal can obtain the second encrypted data from the second terminal.

[0057] After the first terminal obtains the encrypted data, it can decrypt it. If the decrypted data of the second encrypted data is the same as the target random number data of the first terminal, it indicates that the second encrypted data was generated based on the first random number data and the second random number data generated during the ICCOA protocol authentication. A shared key generation flag can be marked to indicate that the first terminal meets the conditions for generating a shared key. The subsequent generation of a temporary secret key, a temporary public key, and a shared key can then proceed. In other words, a first temporary private key can be generated based on the second encrypted data.

[0058] If the decrypted data of the second encrypted data is different from the target random number data of the first terminal, it means that the second encrypted data is not generated based on the first random number data and the second random number data generated in the ICCOA protocol authentication, and the generation process of the temporary secret key, temporary public key and shared secret key will no longer be performed.

[0059] It should be noted that if the first terminal does not detect the shared key generation flag, it means that the first terminal has not determined that the data after decryption of the second encrypted data is the same as the target random number data of the first terminal, or the first terminal has not determined whether the data after decryption of the second encrypted data is the same as the target random number data of the first terminal, then the generation process of the temporary secret key, temporary public key and shared secret key will not be performed.

[0060] Among them, when generating the first temporary private key based on the second encrypted data, the car manufacturer's unique identifier of the ICCOA car server certificate extension and / or the owner key unique identifier of the ICCOA owner key certificate extension can be first spliced ​​with the second encrypted data to obtain the private key input data for generating the temporary private key, and then a temporary private key (recorded as the first temporary private key) is generated based on the private key input data.

[0061] In some embodiments, the first terminal may be a vehicle terminal, and the second terminal may be a vehicle key terminal. During ICCOA protocol authentication between the vehicle terminal and the vehicle key terminal, the vehicle terminal may generate a first random number data, the vehicle key terminal may generate a second random number data, and the vehicle terminal and the vehicle key terminal may exchange their respective random number data.

[0062] After the ICCOA protocol authentication between the vehicle end and the car key end is completed, both the vehicle end and the car key end can splice the first random number data and the second random number data to obtain the spliced ​​target random number data.

[0063] The car key then uses the car key's private key to encrypt its own target random number data, generating the second encrypted data. The car then uses the car key's public key to encrypt its own target random number data, generating the first encrypted data. The car and car key can then exchange their encrypted data.

[0064] In this embodiment, after the vehicle side obtains the second encrypted data from the vehicle key side, it can use the vehicle key public key to decrypt it. If the decrypted data of the second encrypted data is the same as the target random number data of the vehicle side itself, it means that the second encrypted data is generated based on the first random number data and the second random number data generated in the ICCOA protocol authentication, and the shared key generation flag can be marked on the vehicle side to indicate that the vehicle side meets the conditions for generating a shared secret key. Then, the vehicle side can splice the car company unique identifier of the ICCOA car server certificate extension (for example, field 1.3.6.1.4.1.59129.2.5), the owner key unique identifier of the ICCOA owner key certificate extension (for example, field 1.3.6.1.4.1.59129.2.2), and the second encrypted data to obtain the first private key input data for generating a temporary private key, and then generate the first temporary private key based on the first private key input data.

[0065] In this embodiment, after the car key end obtains the first encrypted data from the car end, it can use the car key private key to decrypt it. If the decrypted data of the first encrypted data is the same as the target random number data of the car key end itself, it means that this first encrypted data is generated based on the first random number data and the second random number data generated in the ICCOA protocol authentication, and the shared key generation flag can be marked on the car key end to indicate that the car key end meets the conditions for generating a shared secret key. Then, the car key end can splice the car company unique identifier of the ICCOA car server certificate extension (for example, field 1.3.6.1.4.1.59129.2.5), the ICCOA car owner key certificate extension car owner key unique identifier (for example, field 1.3.6.1.4.1.59129.2.2), and the first encrypted data to obtain the second private key input data for generating a temporary private key, and then generate a second temporary private key based on the second private key input data.

[0066] It should be noted that, in this step, in addition to generating the temporary private key in the above-mentioned manner, the temporary private key may also be generated in other manners, which are not limited thereto.

[0067] In step S120, the first terminal may process the first temporary private key based on the curve equation curve25519 to obtain a first temporary public key. The second terminal may process the second temporary private key based on the curve equation to obtain a second temporary public key. The two terminals may then exchange their temporary public keys. Using the currently more suitable curve25519 curve instead of using curves from the NIST cluster can better prevent the NIST cluster backdoor security risk.

[0068] Of course, the first terminal and the second terminal may also use other methods to obtain the required temporary public key, which is not limited to this.

[0069] In some embodiments, the equation of the curve equation curve25519 can be y 2 =x 3 +48662x 2 +x(mod 2 255 -19). The first temporary private key can be recorded as a, and the first temporary public key generated by the vehicle can be recorded as A. The calculation process of A can be recorded as: A = a × Curve255196_Base_Point.

[0070] The first temporary private key can be recorded as b, the first temporary public key generated by the vehicle side can be recorded as B, and the calculation process of B can be recorded as: B = b × Curve255196_Base_Point.

[0071] Curve255196_Base_Point is the generating point of the curve.

[0072] In this step, after the first and second terminals generate their own temporary public keys, they can exchange these keys to obtain each other's temporary public keys. This can be accomplished by using a 16-byte random number and the corresponding temporary public key as input, then encrypting the data using the vehicle key certificate. The encrypted data can then be exchanged to achieve this exchange. It should be noted that after decrypting the encrypted data, the decrypted random number does not need to be processed.

[0073] In some embodiments, after the vehicle and key generate their own temporary public keys, the vehicle can concatenate its target random number data with the first temporary public key, then encrypt the concatenated data using the vehicle key's public key and transmit the encrypted data to the key. Upon receiving the encrypted data, the key can decrypt it using the vehicle key's private key to obtain the first temporary public key and target random number data, without requiring subsequent processing of the decrypted random number data.

[0074] In this implementation, the vehicle key concatenates its target random number data with the second temporary public key, then encrypts the concatenated data using the vehicle key's private key and transmits the encrypted data to the vehicle. Upon receiving the encrypted data, the vehicle decrypts it using the vehicle key's public key, obtaining the second temporary public key and the target random number data. There's no need to process the decrypted random number data subsequently.

[0075] It should be noted that, in addition to the above-mentioned method for exchanging temporary public keys, the first terminal and the second terminal may also exchange temporary public keys in other ways, which are not limited to this.

[0076] After the first terminal receives the second temporary public key from the second terminal, the first terminal can generate the shared key coordinates of the shared key based on the second temporary public key and the first temporary private key. Then, the first terminal can generate the required shared key based on the hash function and the shared key coordinates. For example, the hash function can be used to randomly hash the contribution key coordinates to obtain the required shared key.

[0077] After the second terminal receives the first temporary public key from the first terminal, it can generate the shared key coordinates of the shared key based on the first temporary public key and the second temporary private key. Then, it can generate the required shared key based on the hash function and the shared key coordinates. For example, the hash function can be used to randomly hash the contribution key coordinates to obtain the required shared key.

[0078] It should be noted that the aforementioned hash function can be the SHA-256 hash function or other hash functions, without limitation. The SHA-256 hash function here can further ensure the randomness of the final shared secret key. Of course, a random algorithm of similar strength can also be used, but the strength cannot be lower than that of the SHA-256 hash function.

[0079] In some embodiments, the first temporary private key can be denoted as a, the first temporary public key can be denoted as A, the second temporary private key can be denoted as b, and the second temporary public key can be denoted as B. In this embodiment, after the vehicle and the car key have exchanged temporary public keys, the vehicle can generate a first shared key coordinate X1 based on the first temporary private key a and the second temporary public key B. This first shared key coordinate X1 = a*B. Similarly, the car key can generate a second shared key coordinate based on the second temporary private key b and the first temporary public key A. This second shared key coordinate X2 = b*A. It should be noted that the first shared key coordinate X1 and the second shared key coordinate X2 can be essentially the same.

[0080] In this embodiment, after the vehicle obtains the first shared key coordinate X1, it can use the SHA-256 hash function to hash the first shared key coordinate X1 to obtain the required shared key. Similarly, the vehicle key can use the SHA-256 hash function to hash the second shared key coordinate X2 to obtain the required shared key.

[0081] In this way, the car end and the car key end can obtain the same shared secret key K=SHA-256 (X1 or X2).

[0082] It should be noted that, in addition to obtaining the shared key through the above-mentioned method, the shared key can also be obtained through other methods, which are not limited to this.

[0083] After the first terminal and the second terminal obtain the shared secret key, the two can perform subsequent communication based on the shared secret key, thereby achieving encrypted communication between the two.

[0084] Before the two parties use the shared key for formal encrypted communication, they can first verify the encrypted data based on the shared key. Once the encrypted data verification passes, the two parties can then continue encrypted communication based on the shared key to better ensure the reliability of the encrypted communication. For example, the first terminal can first verify the encrypted data based on the shared key and the second temporary public key corresponding to the shared key. If the encrypted data verification passes, encrypted communication can then proceed using the shared key.

[0085] In some embodiments, after the vehicle and the vehicle key generate a shared secret key, the vehicle may use the shared secret key to encrypt the second temporary public key, then re-encrypt the encrypted data using the AES-CMAC algorithm (or an encryption method with a strength no less than that of the AES-CMAC algorithm), and then transmit it to the vehicle key. Similarly, the vehicle key may use the shared secret key to encrypt the first temporary public key, then re-encrypt the encrypted data using the AES-CMAC algorithm (or an encryption method with a strength no less than that of the AES-CMAC algorithm), and then transmit it to the vehicle.

[0086] In this embodiment, after the vehicle receives the encrypted data transmitted by the car key, it can first perform AES-CMAC decryption, then use the shared key to decrypt it, and verify whether the decrypted data is the temporary public key generated by itself (i.e., the first temporary public key), thereby determining whether the shared key is valid. If the vehicle determines that the decrypted data is the first temporary public key, then the shared key is valid, and this shared key can be used for subsequent encrypted communication with the car key.

[0087] In this implementation, after the car key receives the encrypted data transmitted from the vehicle, it first performs AES-CMAC decryption, then decrypts it using the shared key. It then verifies whether the decrypted data is the temporary public key it generated (i.e., the second temporary public key), thereby determining whether the shared key is valid. If the car key determines that the decrypted data is the second temporary public key, then the shared key is valid and can subsequently be used for encrypted communication with the vehicle. This avoids the use of complex encryption algorithms such as SPAKE2+ and prevents conflicts with the CCC protocol.

[0088] It should be noted that in addition to the above-mentioned encrypted data verification methods, other methods can also be used for encrypted data verification, and there are no limitations on this. In addition, when the first terminal and the second terminal use a shared key for encrypted communication, they can use a dual encryption method, i.e., shared key encryption and decryption + other encryption and decryption methods, or a single encryption method with shared key encryption and decryption, and there are no limitations on this.

[0089] In this method, after the ICCOA protocol authentication between the first terminal (such as the vehicle end) and the second terminal (such as the car key end) is completed, a shared key can be generated based on the random number data in the ICCOA protocol authentication process, and then the generated shared key can be used for subsequent encrypted communication, thereby avoiding the data after the ICCOA protocol authentication from being transmitted in plain text, which can effectively prevent the car company's vehicle control data from being transferred or modified, better avoid the possibility of data leakage or vehicle loss of control, reduce safety hazards, and improve the security of information transmission based on the ICCOA protocol.

[0090] In addition, this method allows you to configure a usage time limit for the shared key. The shared key is valid within the usage time limit and becomes invalid after the usage time limit has expired. The usage time limit can be set based on actual needs, and its specific duration is not limited.

[0091] To achieve faster communication, a shared key can be generated once and retained for subsequent use until communication between the first and second terminals is disconnected, or the shared key expires. This means that the shared key can be used multiple times for communication within its lifetime without requiring updates. This avoids frequent shared key generation due to signal quality issues, saving time and improving communication efficiency.

[0092] When the shared key reaches its usage limit, it becomes invalid and can be deleted. When communication based on the ICCOA protocol is needed again, a new shared key can be generated.

[0093] Among them, since the usage time limit of the shared secret key is set, before generating the first temporary private key based on the random number data in the ICCOA protocol authentication process, it is possible to first determine whether there is a valid shared secret key in the terminal. If a valid shared secret key exists, there is no need to generate a new shared secret key, and there is no need to generate data such as a temporary secret key and a temporary public key. If there is no valid shared secret key, subsequent generation of temporary secret keys, temporary shared keys, and other data can be performed, that is, the first terminal can first generate the first temporary private key based on the random number data in the ICCOA protocol authentication process.

[0094] For example, when the first terminal detects the shared key and the usage time of the shared key is within the usage time limit, it can be considered that there is a valid shared key, and the shared key can be used directly for subsequent encrypted communication. When the first terminal does not detect the shared key, or the usage time of the detected shared key reaches the usage time limit, it can be considered that there is no valid shared key, and the first temporary private key can be generated based on the random number data in the ICCOA protocol authentication process, and subsequent shared key generation can be carried out.

[0095] In this method, by setting a usage time limit for the shared key, communication security can be better ensured. Furthermore, by first determining whether a valid shared key exists before initiating the shared key generation process, frequent shared key generation can be effectively avoided, thereby improving the efficiency of encrypted communication. In other words, this method can balance the efficiency and security of encrypted communication, further enhancing the user experience.

[0096] In one exemplary embodiment, a communication method is provided. In this method, when generating a shared key based on a hash function and shared key coordinates, the vehicle manufacturer's unique identifier in an ICCOA vehicle server certificate extension and / or the vehicle owner key's unique identifier in an ICCOA vehicle owner key certificate extension are first concatenated with the shared key coordinates to obtain key input data for the shared key. The key input data is then hashed and randomized based on the hash function to obtain the shared key.

[0097] For example, the shared key input data can be obtained by concatenating the vehicle manufacturer's unique identifier from the ICCOA vehicle server certificate extension, the vehicle owner key unique identifier from the ICCOA vehicle owner key certificate extension, and the shared key coordinates generated by the vehicle. A hash function is then used to randomize the key input data to obtain the shared key.

[0098] For another example, the shared key input data can be obtained by concatenating the owner key unique identifier (ID) in the ICCOA owner key certificate extension and the shared key coordinates generated by the vehicle. A hash function is then used to randomize the key input data to obtain the shared key.

[0099] For example, the car manufacturer's unique identifier in the ICCOA car server certificate extension and the shared key coordinates generated by the car can be concatenated to obtain the shared key input data. Then, a hash function is used to hash the key input data to obtain the shared key.

[0100] In this method, when generating a shared secret key, the car manufacturer's unique identifier of the ICCOA car server certificate extension and / or the owner key unique identifier of the ICCOA owner key certificate extension are introduced, which can further improve the security of communications based on the ICCOA protocol.

[0101] In an exemplary embodiment, a communication device is provided. The device can be used to implement the above-mentioned communication method. For example, with reference to Figures 2 and 3, the device may include:

[0102] The key generation module 10 is configured to generate a first temporary private key based on random number data during the ICCOA protocol authentication process after ICCOA protocol authentication is completed between the first terminal and the second terminal; further configured to generate a shared key based on the first temporary private key and a second temporary public key received from the second terminal; wherein the second temporary public key is generated based on the second temporary private key, which is generated by the second terminal based on random number data during the ICCOA protocol authentication process; and further configured to generate a shared key based on the shared key coordinates.

[0103] The encryption communication module 20 is configured to perform encryption communication with the second terminal based on the shared secret key.

[0104] In an exemplary embodiment, a communication device is provided. Referring to FIG. 2 and FIG. 3 , in the device, a key generation module 10 may be used to:

[0105] Decrypting encrypted data received from the second terminal; wherein the encrypted data is data obtained by encrypting target random number data by the second terminal, where the target random number data is obtained by concatenating the first random number data generated by the first terminal and the second random number data generated by the second terminal during the ICCOA protocol authentication process;

[0106] If the decrypted data of the encrypted data is identical to the target random number data of the first terminal, a first temporary private key is generated based on the encrypted data.

[0107] In an exemplary embodiment, a communication device is provided. Referring to FIG. 2 and FIG. 3 , in the device, a key generation module 10 may be used to:

[0108] The vehicle manufacturer unique identifier of the ICCOA vehicle server certificate extension and / or the vehicle owner key unique identifier of the ICCOA vehicle owner key certificate extension are concatenated with the encrypted data to obtain private key input data for generating a first temporary private key;

[0109] A first temporary private key is generated based on the private key input data.

[0110] In an exemplary embodiment, a communication device is provided. Referring to FIG. 2 and FIG. 3 , in the device, a key generation module 10 may be used to:

[0111] Generate a first temporary public key based on the first temporary private key;

[0112] The first temporary public key is transmitted to the second terminal, so that the second terminal generates a shared key based on the second temporary private key and the first temporary public key.

[0113] In an exemplary embodiment, a communication device is provided. Referring to FIG. 2 and FIG. 3 , in the device, a key generation module 10 may be used to:

[0114] The first temporary private key is processed based on the curve equation curve25519 to obtain a first temporary public key.

[0115] In an exemplary embodiment, a communication device is provided. Referring to FIG. 2 and FIG. 3 , in the device, a key generation module 10 may be used to:

[0116] generating shared key coordinates of the shared key based on the first temporary private key and the second temporary public key received from the second terminal;

[0117] Generate a shared key based on the hash function and the shared key coordinates.

[0118] In an exemplary embodiment, a communication device is provided. Referring to FIG. 2 and FIG. 3 , in the device, a key generation module 10 may be used to:

[0119] Concatenate the vehicle manufacturer's unique identifier in the ICCOA vehicle server certificate extension and / or the vehicle owner key unique identifier in the ICCOA vehicle owner key certificate extension with the shared key coordinates to obtain the shared key input data;

[0120] The key input data is hashed randomly based on the hash function to obtain the shared key.

[0121] In an exemplary embodiment, a communication device is provided. Referring to FIG. 2 and FIG. 3 , in the device, an encryption communication module 20 may be used to:

[0122] Authenticating the encrypted data based on the shared secret key and a second temporary public key corresponding to the shared secret key;

[0123] If the encrypted data is verified to be successful, the shared key is used for encrypted communication.

[0124] In an exemplary embodiment, a communication device is provided. Referring to FIG. 2 and FIG. 3 , in the device, a key generation module 10 may be used to:

[0125] Before generating the first temporary private key based on random number data in the ICCOA protocol authentication process, it is determined that the first terminal does not have a valid shared key.

[0126] This embodiment provides a terminal, which can be used as a first terminal (such as a vehicle terminal) or a second terminal (such as a car key terminal), without limitation.

[0127] As shown in FIG4 , the terminal 100 may include at least one processor 101, a memory 102, at least one network interface 104, and another user interface 103. The various components in the terminal 100 are coupled together via a bus system 105. It will be appreciated that the bus system 105 is used to enable communication between these components. In addition to a data bus, the bus system 105 also includes a power bus, a control bus, and a status signal bus. However, for clarity, all of these buses will be labeled as the bus system 105.

[0128] The user interface 103 may include a display, a keyboard, or a pointing terminal (eg, a mouse, a trackball, a touch pad, or a touch screen).

[0129] It is understood that the memory 102 in the embodiment of the present application can be a volatile memory or a non-volatile memory, or can include both volatile and non-volatile memories. Among them, the non-volatile memory can be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory can be a random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of RAM are available, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate synchronous DRAM (DDRSDRAM), enhanced synchronous DRAM (ESDRAM), synchronous link DRAM (SLDRAM), and direct RAM bus random access memory (DRRAM). The memory 102 described herein is intended to include, but is not limited to, these and any other suitable types of memory.

[0130] In some embodiments, the memory 102 stores the following elements, executable units, or data structures, or a subset thereof, or an extended set thereof: an operating system 1021 and application programs 1022 .

[0131] Among them, the operating system 1021 includes various system programs, such as the framework layer, the core library layer, and the driver layer, which are used to implement various basic services and process hardware-based tasks. The application 1022 includes various application programs, such as a media player (Media Player), a browser (Browser), etc., which are used to implement various application services. The program implementing the method of the embodiment of the application can be included in the application 1022.

[0132] In the embodiment of the present application, the processor 101 is used to execute the methods provided in each method embodiment by calling the program or instructions stored in the memory 102, specifically, the program or instructions stored in the application 1022.

[0133] The methods disclosed in the above embodiments of the present application can be applied to or implemented by processor 101. Processor 101 may be an integrated circuit chip with signal processing capabilities. During implementation, each step of the above method can be completed by hardware integrated logic circuits in processor 101 or by software instructions. The above processor 101 may be a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. The methods, steps, and logic block diagrams disclosed in the embodiments of the present application can be implemented or executed. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the methods disclosed in the embodiments of the present application can be directly implemented and executed by a hardware decoding processor, or by a combination of hardware and software units in the decoding processor. The software units can be located in a storage medium mature in the art, such as random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, etc. The storage medium is located in the memory 102 , and the processor 101 reads the information in the memory 102 and implements the above method in combination with its hardware.

[0134] It is understood that the embodiments described herein may be implemented using hardware, software, firmware, middleware, microcode, or a combination thereof. For hardware implementation, the processing unit may be implemented in one or at least one application-specific integrated circuit (ASIC), digital signal processor (DSP), digital signal processing terminal (DSPD), programmable logic device (PLD), field-programmable gate array (FPGA), general-purpose processor, controller, microcontroller, microprocessor, other electronic unit for performing the functions described herein, or a combination thereof.

[0135] For software implementation, the technology described herein can be implemented by a unit that performs the functions described herein. The software code can be stored in a memory and executed by a processor. The memory can be implemented in the processor or outside the processor.

[0136] The present application also provides a storage medium (computer-readable storage medium). The storage medium stores one or at least one program. The storage medium may include volatile memory, such as random access memory; the memory may also include non-volatile memory, such as read-only memory, flash memory, hard disk, or solid-state drive; and the memory may also include a combination of the aforementioned types of memory.

[0137] When one or at least one program in a storage medium can be executed by one or at least one processor, the storage medium, when used in a terminal, can implement the aforementioned method for executing the program in the terminal. The processor is configured to execute the terminal control program stored in the memory to implement the aforementioned method for executing the program in the terminal.

[0138] Professionals should also be further aware that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the above description has generally described the components and steps of each example according to their functions. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0139] It should be noted that references in this specification to "one embodiment," "an embodiment," "an exemplary embodiment," "some embodiments," and the like indicate that the described embodiments may include a particular feature, structure, or characteristic, but not necessarily every embodiment includes that particular feature, structure, or characteristic. Furthermore, such phrases do not necessarily refer to the same embodiment. Furthermore, when a particular feature, structure, or characteristic is described in conjunction with an embodiment, it is within the knowledge of those skilled in the art to implement such feature, structure, or characteristic in conjunction with other embodiments, whether explicitly described or not.

[0140] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or terminal that includes a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or terminal. In the absence of more limitations, an element defined by the sentence "comprises a..." does not exclude the presence of other identical elements in the process, method, article or terminal that includes the element.

[0141] The above embodiments are only preferred embodiments for fully illustrating the present application, and the protection scope of the present application is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art based on the present application are within the protection scope of the present application.

Claims

1. A communication method, characterized in that: The communication method comprises: After the ICCOA protocol authentication between the first terminal and the second terminal is completed, generating a first temporary private key based on random number data in the ICCOA protocol authentication process; Generate a shared key based on the first temporary private key and a second temporary public key received from the second terminal; wherein the second temporary public key is generated based on the second temporary private key, and the second temporary private key is generated by the second terminal based on random number data during the ICCOA protocol authentication process; Perform encrypted communication with the second terminal based on the shared key.

2. The communication method according to claim 1, wherein: The generating of the first temporary private key based on random number data in the ICCOA protocol authentication process includes: Decrypting encrypted data received from the second terminal; wherein the encrypted data is data obtained by encrypting target random number data by the second terminal, the target random number data being obtained by concatenating first random number data generated by the first terminal and second random number data generated by the second terminal during the ICCOA protocol authentication process; If the decrypted data of the encrypted data is identical to the target random number data of the first terminal, the first temporary private key is generated based on the encrypted data.

3. The communication method according to claim 2, wherein: The generating the first temporary private key based on the encrypted data includes: Concatenate the vehicle manufacturer unique identifier of the ICCOA vehicle server certificate extension and / or the vehicle owner key unique identifier of the ICCOA vehicle owner key certificate extension with the encrypted data to obtain private key input data for generating the first temporary private key; The first temporary private key is generated based on the private key input data.

4. The communication method according to claim 1, wherein: Before performing encrypted communication with the second terminal based on the shared key, the communication method includes: generating a first temporary public key based on the first temporary private key; The first temporary public key is transmitted to the second terminal, so that the second terminal generates a shared key based on the second temporary private key and the first temporary public key.

5. The communication method according to claim 4, characterized in that: The generating a first temporary public key based on the first temporary private key includes: The first temporary private key is processed based on the curve equation curve25519 to obtain the first temporary public key.

6. The communication method according to claim 1, wherein: The generating a shared key based on the first temporary private key and the second temporary public key received from the second terminal includes: generating shared key coordinates of the shared key based on the first temporary private key and the second temporary public key received from the second terminal; The shared key is generated based on a hash function and the shared key coordinates.

7. The communication method according to claim 6, characterized in that: The generating the shared key based on the hash function and the shared key coordinates includes: Concatenate the vehicle manufacturer unique identifier of the ICCOA vehicle server certificate extension and / or the vehicle owner key unique identifier of the ICCOA vehicle owner key certificate extension with the shared key coordinates to obtain key input data of the shared key; The key input data is hashed randomly based on a hash function to obtain the shared key.

8. The communication method according to claim 1, wherein: The performing encrypted communication with the second terminal based on the shared key includes: Performing encrypted data verification based on the shared secret key and a second temporary public key corresponding to the shared secret key; If it is determined that the encrypted data verification is passed, the shared key is used for encrypted communication.

9. The communication method according to any one of claims 1 to 8, characterized in that: Before generating the first temporary private key based on random number data in the ICCOA protocol authentication process, the communication method includes: It is determined that the first terminal does not have a valid shared key.

10. A communication device, characterized in that: The communication device comprises: A key generation module, configured to, after ICCOA protocol authentication is completed between a first terminal and a second terminal, generate a first temporary private key based on random number data during the ICCOA protocol authentication process; further configured to generate a shared key based on the first temporary private key and a second temporary public key received from the second terminal; wherein the second temporary public key is generated based on the second temporary private key, which is generated by the second terminal based on random number data during the ICCOA protocol authentication process; and further configured to generate a shared key based on the shared key coordinates; An encryption communication module is used to perform encrypted communication with the second terminal based on the shared key.

11. A terminal, characterized in that: include: A processor and a memory, wherein the processor is configured to execute a control program stored in the memory to implement the communication method according to any one of claims 1 to 9.

12. A storage medium, characterized in that: The storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the communication method according to any one of claims 1 to 9.

Images