CN113452517A

CN113452517A - Key updating method, device, system, storage medium and terminal

Info

Publication number: CN113452517A
Application number: CN202110631090.4A
Authority: CN
Inventors: 桂杰; 李东元; 秦建良; 李春荣; 周小东; 韩召
Original assignee: Beijing Juli Science and Technology Co Ltd
Current assignee: Beijing Juli Science and Technology Co Ltd
Priority date: 2021-06-07
Filing date: 2021-06-07
Publication date: 2021-09-28

Abstract

The application discloses a secret key updating method, a device, a system, a storage medium and a terminal, wherein the secret key updating method is applied to a crypto-tube platform and comprises the following steps: establishing communication with the first vehicle-mounted terminal, and verifying the identities of the first vehicle-mounted terminal and the second vehicle-mounted terminal; if the identity verification of the first vehicle-mounted terminal and the identity verification of the second vehicle-mounted terminal are successful, generating a first secret key according to a first identity of the first vehicle-mounted terminal, and generating a second secret key according to a second identity of the second vehicle-mounted terminal; the first secret key and the second secret key are sent to the first vehicle-mounted terminal and the second vehicle-mounted terminal, so that the first vehicle-mounted terminal stores the first secret key and the second secret key, and the second vehicle-mounted terminal stores the first secret key and the second secret key to indicate the first vehicle-mounted terminal and the second vehicle-mounted terminal to carry out encrypted communication according to the first secret key and the second secret key, and the communication safety of the first vehicle-mounted terminal and the second vehicle-mounted terminal is improved in a one-secret mode.

Description

Key updating method, device, system, storage medium and terminal

Technical Field

The present application relates to the field of communications technologies, and in particular, to a method, an apparatus, a storage medium, and a system for updating a key.

Background

With the rapid development of communication technology and the continuous improvement of traffic systems, Electronic Toll Collection (ETC) is widely used. The electronic toll collection system is characterized in that special short-range communication is carried out between an On Board Unit (OBU) arranged On a vehicle windshield and a microwave antenna On an ETC lane of a toll station, and background settlement processing is carried out with a bank by utilizing a computer networking technology, so that the purpose of paying the toll of the highway or the bridge without stopping when the vehicle passes through the highway or the bridge toll station is achieved.

Since different vehicle models have different charging standards, in order to prevent the on-board unit from being detached and illegally mounted to another vehicle, it is common to bind the on-board unit with the on-board terminal of the vehicle at the time of mounting the on-board unit, and to perform authentication of the on-board unit and the on-board terminal each time the vehicle starts. The existing authentication method is to write the identity information of the vehicle-mounted terminal into the vehicle-mounted unit, write the identity information of the vehicle-mounted unit into the vehicle-mounted terminal, and then authenticate the identity information by verifying the identity information of the other party, and usually encrypt the identity information in the process of verifying the identity information. However, at present, for the convenience of verification, the vehicle-mounted units of the same vehicle type all use the unified root key to encrypt the identity information, and if the unified root key is leaked, all the identity information will be leaked in the process of identity information verification, and the security of other vehicle-mounted terminals will be affected.

Disclosure of Invention

The application provides a key updating method, device, storage medium and system based on a neighbor awareness network, which can improve the security of the communication between a vehicle-mounted unit and a vehicle-mounted terminal.

In a first aspect, a key updating method is provided, where the key updating method is applied to a secure management platform, and includes:

establishing communication with a first vehicle-mounted terminal, and verifying the identities of the first vehicle-mounted terminal and a second vehicle-mounted terminal;

if the identity verification of the first vehicle-mounted terminal and the identity verification of the second vehicle-mounted terminal are successful, generating a first secret key according to a first identity of the first vehicle-mounted terminal, and generating a second secret key according to a second identity of the second vehicle-mounted terminal;

the first secret key and the second secret key are sent to the first vehicle-mounted terminal and the second vehicle-mounted terminal, so that the first vehicle-mounted terminal stores the first secret key and the second secret key, and the second vehicle-mounted terminal stores the first secret key and the second secret key, and the first vehicle-mounted terminal and the second vehicle-mounted terminal are instructed to carry out encrypted communication according to the first secret key and the second secret key.

In a second aspect, a key updating method is applied to a first vehicle-mounted terminal, where a first preset key is stored in the first vehicle-mounted terminal, and the method includes:

establishing communication with a close management platform, wherein the close management platform stores the first preset secret key;

acquiring first encrypted data and second encrypted data sent by the crypto-tube platform, wherein the first encrypted communication data is a first secret key, a second secret key and identity information encrypted by a first preset secret key, and the identity information comprises a first identity mark;

decrypting the first encrypted data by using the first preset key to obtain the first key, the second key and the first identity mark;

if the first identity identification is consistent with the current identity identification of the first vehicle-mounted terminal, updating the first encrypted data into the first vehicle-mounted terminal to indicate the first vehicle-mounted terminal to perform encrypted communication with a second vehicle-mounted terminal connected with the first vehicle-mounted terminal according to the first secret key and the second secret key;

and forwarding the second encrypted data to a second vehicle-mounted terminal connected with the first vehicle-mounted terminal, so that the second vehicle-mounted terminal can update the second encrypted data to the second vehicle-mounted terminal.

In a third aspect, a key updating method is applied to a second vehicle-mounted terminal, where the second vehicle-mounted terminal includes a second preset key, and includes:

acquiring second encrypted data transmitted by a crypto-control platform and forwarded by a first vehicle-mounted terminal connected with the second terminal, wherein the second encrypted data is a first key, a second key and identity information which are encrypted by a preset second key, and the identity information comprises a second identity identifier;

decrypting the second encrypted data according to a preset second key to obtain the first key, the second key and a second identity;

and if the second identity identification is consistent with the current identity identification of the second vehicle-mounted terminal, updating the second encrypted data into the second vehicle-mounted terminal so as to indicate the second vehicle-mounted terminal to use the first secret key and the second secret key to carry out encrypted communication with the first vehicle-mounted terminal.

In a fourth aspect, a key updating system is provided, which includes a sealed pipe platform, and a first vehicle-mounted terminal and a second vehicle-mounted terminal that establish communication with the sealed pipe platform, wherein a first preset key is set and stored in the sealed pipe platform and the first vehicle-mounted terminal, and a second preset key is set and stored in the sealed pipe platform and the second vehicle-mounted terminal, and the system includes:

the confidential management platform verifies the identities of the first vehicle-mounted terminal and a second vehicle-mounted terminal connected with the first vehicle-mounted terminal;

if the identity verification of the first vehicle-mounted terminal and the identity verification of the second vehicle-mounted terminal are successful, the confidential management platform generates a first secret key according to a first identity of the first vehicle-mounted terminal and generates a second secret key according to a second identity of the second vehicle-mounted terminal;

the encrypted management platform encrypts the first key and the second key through the first preset key to obtain first encrypted data, and encrypts the first key and the second key through the second preset key to obtain second encrypted data;

the confidential management platform sends the first encrypted data and the second encrypted data to the first vehicle-mounted terminal and the second vehicle-mounted terminal;

the first vehicle-mounted terminal acquires the first encrypted data and the second encrypted data sent by the confidential management platform;

the first vehicle-mounted terminal decrypts the first encrypted data by using the first preset secret key to obtain the first secret key, a second secret key and a first identity, and if the first identity is consistent with the current identity of the first vehicle-mounted terminal, the first encrypted data is updated to the first vehicle-mounted terminal;

the first vehicle-mounted terminal forwards the second encrypted data to the second vehicle-mounted terminal;

the second vehicle-mounted terminal acquires the second encrypted data which is transmitted by the encrypted management platform and forwarded by the first vehicle-mounted terminal;

the second vehicle-mounted terminal decrypts the second encrypted data according to a preset second key to obtain the first key, the second key and a second identity, and if the second identity is consistent with the current identity of the second vehicle-mounted terminal, the second encrypted data is updated to the second vehicle-mounted terminal;

the first vehicle-mounted terminal performs encrypted communication with the second vehicle-mounted terminal by using the first key and the second key.

In a fifth aspect, a key update apparatus is provided, which is applied to a crypto platform, and includes:

the identity authentication module is used for establishing communication with a first vehicle-mounted terminal and authenticating the identities of the first vehicle-mounted terminal and a second vehicle-mounted terminal;

the key generation module is used for generating a first key according to a first identity of the first vehicle-mounted terminal and generating a second key according to a second identity of the second vehicle-mounted terminal if the identity verification of the first vehicle-mounted terminal and the identity verification of the second vehicle-mounted terminal are successful;

the key sending module is used for sending the first key and the second key to the first vehicle-mounted terminal and the second vehicle-mounted terminal so that the first vehicle-mounted terminal stores the first key and the second vehicle-mounted terminal stores the first key and the second key so as to instruct the first vehicle-mounted terminal and the second vehicle-mounted terminal to carry out encrypted communication according to the first key and the second key.

In a sixth aspect, a key updating apparatus is provided, which is applied to a first vehicle-mounted terminal, where a first preset key is stored in the first vehicle-mounted terminal, and includes:

the communication module is used for establishing communication with a close management platform, and the close management platform stores the first preset secret key;

the acquiring module is used for acquiring first encrypted data and second encrypted data sent by the crypto-tube platform, wherein the first encrypted communication data are a first secret key, a second secret key and identity information which are encrypted by a first preset secret key, and the identity information comprises a first identity;

the decryption module is used for decrypting the first encrypted data by using the first preset key to obtain the first key, the second key and the first identity mark;

the updating module is used for updating the first encrypted data to the first vehicle-mounted terminal if the first identity identification is consistent with the current identity identification of the first vehicle-mounted terminal so as to indicate the first vehicle-mounted terminal to perform encrypted communication with a second vehicle-mounted terminal connected with the first vehicle-mounted terminal according to the first secret key and the second secret key;

the forwarding module is configured to forward the second encrypted data to a second vehicle-mounted terminal connected to the first vehicle-mounted terminal, so that the second vehicle-mounted terminal updates the second encrypted data to the second vehicle-mounted terminal.

A seventh aspect provides a key updating apparatus applied to a second vehicle-mounted terminal, where the second vehicle-mounted terminal includes a second preset key, and the key updating apparatus includes:

the acquisition module is used for acquiring second encrypted data which is transmitted by a confidential management platform and is forwarded by a first vehicle-mounted terminal connected with the second vehicle-mounted terminal, wherein the second encrypted data is a first secret key, a second secret key and identity information which are encrypted by a preset second secret key, and the identity information comprises a second identity;

the decryption module is used for decrypting the second encrypted data according to a preset second key to obtain the first key, the second key and the second identity;

and the updating module is used for updating the second encrypted data to the second vehicle-mounted terminal if the second identity is consistent with the current identity of the second vehicle-mounted terminal so as to indicate the second vehicle-mounted terminal to perform encrypted communication with the first vehicle-mounted terminal by using the first key and the second key.

In an eighth aspect, a computer-readable storage medium is provided, the storage medium having stored therein a plurality of instructions adapted to be loaded by a processor to perform the key update method of the first aspect, or the second aspect, or the third aspect.

In a ninth aspect, a vehicle-mounted terminal is provided, where the vehicle-mounted terminal includes a processor and a memory, and the memory stores a computer program, and the processor is configured to execute the key updating method according to the second aspect by calling the computer program stored in the memory.

A tenth aspect provides a vehicle-mounted terminal, which includes a processor and a memory, wherein the memory stores a computer program, and the processor is used for executing the key updating method of the third aspect by calling the computer program stored in the memory.

The application discloses a secret key updating method, a secret key updating device, a storage medium and a secret key updating system, wherein the secret key updating system comprises a secret management platform, a first vehicle-mounted terminal and a second vehicle-mounted terminal, corresponding secret keys are generated by the secret management platform according to identity marks of the first vehicle-mounted terminal and the second vehicle-mounted terminal respectively, and the secret keys are updated to the first vehicle-mounted terminal and the second vehicle-mounted terminal so as to be used when the first vehicle-mounted terminal and the second vehicle-mounted terminal carry out encrypted communication, information disclosure caused by disclosure of a preset unified secret key adopted during communication is avoided, and safety influence on communication of other terminals when the secret key adopted during communication is intercepted and captured is also avoided, so that the safety of communication between the first vehicle-mounted terminal and the second vehicle-mounted terminal is greatly improved in a one-secret key mode.

Drawings

The technical solution and other advantages of the present application will become apparent from the detailed description of the embodiments of the present application with reference to the accompanying drawings.

Fig. 1 is a schematic structural diagram of a key update system according to an embodiment of the present application.

Fig. 2 is a first flowchart of a key updating method according to an embodiment of the present application.

Fig. 3 is a second flowchart of a key updating method according to an embodiment of the present application.

Fig. 4 is a schematic diagram of a third flow of a key updating method according to an embodiment of the present application.

Fig. 5 is a schematic process diagram of a key updating method according to an embodiment of the present application

Fig. 6 is a schematic diagram of a first structure of a key update apparatus according to an embodiment of the present application.

Fig. 7 is a schematic diagram of a second structure of a key update apparatus according to an embodiment of the present application.

Fig. 8 is a schematic diagram of a second structure of a key update apparatus according to an embodiment of the present application.

Fig. 9 is a schematic structural diagram of a mobile terminal according to an embodiment of the present application.

Fig. 10 is another schematic structural diagram of a mobile terminal according to an embodiment of the present application.

Detailed Description

The technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application. It is to be understood that the embodiments described are only a few embodiments of the present application and not all embodiments. In the drawings, elements having similar structures are denoted by the same reference numerals. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present application.

In the description of the present application, it is to be understood that the terms "first", "second" are used for descriptive purposes only and are not to be construed as indicating or implying relative importance or implying any number of technical features indicated. Thus, features defined as "first", "second", may explicitly or implicitly include one or more of the described features. In the description of the present application, "a plurality" means two or more unless specifically limited otherwise.

The embodiment of the application provides a secret key updating method, a secret key updating system, a secret key updating device and a storage medium.

Referring to fig. 1, fig. 1 is a schematic structural diagram of a key updating system provided in an embodiment of the present application, where the key updating system is composed of a sealed tube platform, a first vehicle-mounted terminal and a second vehicle-mounted terminal, where the first vehicle-mounted terminal may be an OBU (On Board Unit) terminal, the second vehicle-mounted terminal may be an intelligent vehicle, and as shown in fig. 1, the sealed tube platform is in communication connection with the OBU terminal, and the OBU terminal is in communication connection with the intelligent vehicle, so as to form the key updating system.

Specifically, the OBU is a microwave device that communicates with an RSU (Road Side Unit) by using a DSRC (Dedicated Short Range Communication) technology, the OBU terminal is mostly installed on a windshield of a vehicle, and the smart car is an on-board terminal installed on a driver's cab and having multiple functions of 3G or more wireless Communication, online navigation, Road condition information, travel guidance, shopping, entertainment audio and video.

At present, when an OBU terminal is installed on a Vehicle to realize an ETC function, the OBU terminal needs to be bound with an intelligent Vehicle mounted on the Vehicle, so as to realize an anti-disassembly function, that is, a Vehicle Identification Number (VIN) in the intelligent Vehicle is written in the OBU terminal, and/or an identity (Serial Number, SN) of the OBU terminal is written in the intelligent Vehicle, and then, when the intelligent Vehicle is started, the intelligent Vehicle and the OBU terminal communicate with each other to transmit identity information (identity), for example, the intelligent Vehicle transmits a VIN (1) to the OBU terminal, and the OBU terminal checks whether a VIN (2) written in the OBU terminal is consistent with the OBU terminal, so as to judge whether the OBU terminal is illegally disassembled. Generally, an OBU terminal stores a unified root key, that is, an OBU terminal of a certain type or some types encrypts identity information by using the unified root key, so that if a certain OBU terminal is cracked, the unified root key is leaked, or when identity information is transmitted, the unified root key is intercepted, the identity information of the OBU terminal and other OBU terminals is leaked, and great potential safety hazards are provided.

In this application, the close management platform can be ETC key management system, consequently, can with OBU terminal direct communication, the intelligent car machine carries out indirect communication through OBU terminal and ETC key management system. Specifically, in order to guarantee the communication process between OBU terminal and the intelligent car machine, accessible wired or wireless mode is connected with the intelligent car machine. The wired mode CAN comprise CAN, 485, a serial port or other modes and the like, and the wireless mode CAN comprise WIFI, Bluetooth and other modes.

In the application, a first preset secret key is stored in an ETC secret key management system and an OBU terminal, a second preset secret key is stored in the ETC secret key management system and a smart car machine, and the ETC secret key management system verifies the identities of the OBU terminal and the smart car machine; if the identity verification of the OBU terminal and the intelligent vehicle is successful, the ETC key management system generates a first key according to a first identity of the OBU terminal and generates a second key according to a second identity of the intelligent vehicle; the ETC key management system encrypts the first key and the second key through a first preset key to obtain first encrypted data, and encrypts the first key and the second key through a second preset key to obtain second encrypted data; the ETC key management system sends the first encrypted data and the second encrypted data to the OBU terminal and the intelligent vehicle machine; the method comprises the steps that an OBU terminal obtains first encrypted data and second encrypted data sent by an ETC key management system; the OBU terminal decrypts the first encrypted data by using a first preset secret key to obtain a first secret key, a second secret key and a first identity, and if the first identity is consistent with the current identity of the OBU terminal, the first encrypted data is updated to the OBU terminal; the OBU terminal forwards the second encrypted data to the intelligent vehicle machine; the intelligent vehicle machine acquires second encrypted data which is forwarded by the OBU terminal and sent by the encrypted management platform; the intelligent vehicle machine decrypts the second encrypted data according to a preset second key to obtain a first key, a second key and a second identity, and if the second identity is consistent with the current identity of the intelligent vehicle machine, the second encrypted data is updated to the intelligent vehicle machine; and the OBU terminal uses the first key and the second key to carry out encrypted communication with the intelligent vehicle machine. Even a secret key in a certain OBU terminal or the intelligent car machine is revealed, the security influence on other OBUs and the intelligent car machine can not be generated, and the security of the OBU terminal and the intelligent car machine communication is greatly improved.

In addition, the close management platform can also be other key management systems.

Referring to fig. 2, fig. 2 is a schematic flow chart of a key updating method provided in the embodiment of the present application, where the key updating method is applied to a cryptographic management platform, and a specific flow may be as follows:

s101, communication is established with the first vehicle-mounted terminal, and the identities of the first vehicle-mounted terminal and the second vehicle-mounted terminal are verified.

The close management platform can be an ETC key management system, the first vehicle-mounted terminal can be an OBU terminal, and the second vehicle-mounted terminal can be an intelligent vehicle machine. When the OBU terminal is used for the first time, the authentication request can be sent to the close-packed pipe platform, and then the identity of the OBU terminal and the identity of the intelligent vehicle machine are verified by the close-packed pipe platform.

Specifically, the OBU terminal can be connected with the intelligent vehicle machine in a wired or wireless mode.

In some embodiments, a first preset key may be stored in the crypto-pipe platform and the first vehicle-mounted terminal, and a second preset key may be stored in the crypto-pipe platform and the second vehicle-mounted terminal, where the first preset key is a unified root key common to one or some models of OBU terminals, and the second preset key is a unified root key common to one or some models of smart car machines, and it should be noted that different unified root keys may be used for encrypted communication by different OBU terminals, and different crypto-pipe platforms are used, and similarly, different models of smart car machines may use different unified root keys for encrypted communication, and different crypto-pipe platforms are used, so that before the keys are generated and issued, the identities of the OBU terminals and the smart car machines need to be verified to avoid malicious key application by other OBUs, generating a key and issuing the key.

In this embodiment, step S101 may mainly include: generating a first character string and sending the first character string to a first vehicle-mounted terminal; acquiring third encrypted data returned by the first vehicle-mounted terminal, and verifying the identity of the first vehicle-mounted terminal according to the first character string and the third encrypted data, wherein the third encrypted data is generated by encrypting the first character string through a first preset secret key by the first vehicle-mounted terminal; generating a second character string, and sending the second character string to the first vehicle-mounted terminal so that the first vehicle-mounted terminal sends the second character string to a second vehicle-mounted terminal connected with the first vehicle-mounted terminal; acquiring fourth encrypted data returned by the second vehicle-mounted terminal forwarded by the first vehicle-mounted unit, wherein the fourth encrypted data is generated by the second vehicle-mounted terminal through encrypting the second character string through a second preset secret key; and verifying the identity of the second vehicle-mounted terminal according to the second character string and the fourth encrypted data.

Specifically, the step "generating a first character string" and the step "generating a second character string" may specifically include: generating a first random number to obtain a first character string; a second random number is generated to obtain a second string.

It is easy to understand that if the same string of characters is used each time, when the vehicle-mounted terminal intercepts the encrypted data returned after encrypting the string of characters, the encrypted data can be maliciously pretended by terminals of other types, and if random numbers are used, even if the encrypted data is maliciously intercepted by other terminals, the next authentication is unsuccessful because the random numbers used next time are not the same as the current time, so that the safety and reliability of the authentication can be greatly improved.

Specifically, the close management platform is ETC key management system, and the OBU terminal is in the ETC, consequently, can carry out direct communication with the close management platform, and the intelligence car machine does not belong to the ETC, consequently, can communicate with the close management platform through the OBU terminal.

It should be noted that the sequence of performing identity verification on the first vehicle-mounted terminal and the second vehicle-mounted terminal may be synchronous verification, or the OBU terminal may be verified first, and if the OBU terminal is not successful in verification, a result of unsuccessful verification is directly returned, and subsequent steps such as "generating a second character string" and the like do not need to be performed.

Specifically, the steps of "verifying the identity of the first vehicle-mounted terminal according to the first character string and the third encrypted data" and "verifying the identity of the second vehicle-mounted terminal according to the second character string and the fourth encrypted data" mainly include: encrypting the first character string according to a first preset key; if the encrypted first character string is consistent with the third encrypted data, the identity verification of the first vehicle-mounted terminal is determined to be successful; encrypting the second character string according to a second preset key; and if the encrypted second character string is consistent with the fourth encrypted data, determining that the identity verification of the second vehicle-mounted terminal is successful.

It is easy to understand that the third encrypted data is generated by the first vehicle-mounted terminal through encryption by using a preset first secret key, if the encrypted data obtained by the crypto-control platform encrypting the first random number according to the first preset secret key is the same as the second encrypted data, it can be determined that the first vehicle-mounted terminal belongs to the crypto-control platform for management, and the steps of secret key generation and issuing can be performed, and the second character string and the fourth encrypted data are the same.

S102, if the identity verification of the first vehicle-mounted terminal and the identity verification of the second vehicle-mounted terminal are successful, a first secret key is generated according to a first identity of the first vehicle-mounted terminal, and a second secret key is generated according to a second identity of the second vehicle-mounted terminal.

Specifically, the first identity at the OBU terminal can be an SN, the second identity of the smart car machine can be a VIN, it is easy to understand that the OBU terminal can send the SN to the close management platform while returning third encrypted data, the close management platform can also obtain the SN at the OBU terminal after the authentication at the OBU terminal is successful, and similarly, the smart car machine can send the VIN to the close management platform while returning fourth encrypted data, and the close management platform can also obtain the VIN of the smart car machine after the authentication at the smart car machine is successful.

In an embodiment, the step of "generating a first key according to a first identity of a first vehicle-mounted terminal and generating a second key according to a second identity of a second vehicle-mounted terminal" may mainly include: obtaining a first key through two-stage dispersion, wherein the first stage adopts a first identity identification of a first vehicle-mounted terminal as a dispersion factor, and the second stage adopts the current time as the dispersion factor; and obtaining a second key through two-stage dispersion, wherein the first stage adopts a second identity of a second vehicle-mounted terminal as a dispersion factor, and the second stage adopts the current time as the dispersion factor.

Specifically, the close management platform can generate a corresponding secret key according to a default secret key generation rule and the identity identifications of the first vehicle-mounted terminal and the second vehicle-mounted terminal, and because the identifications of each OBU terminal and each intelligent vehicle are different, the secret key with one secret can be obtained and sent to the OBU terminal and the intelligent vehicle in the subsequent steps so as to be used for encrypting the identity information when the subsequent OBU terminal and the intelligent vehicle are used for identity authentication, and even if the identity information of a certain OBU terminal or the intelligent vehicle is maliciously intercepted and cracked, the safety influence on other OBU terminals or the intelligent vehicle can not be generated.

S103, the first secret key and the second secret key are sent to the first vehicle-mounted terminal and the second vehicle-mounted terminal, so that the first vehicle-mounted terminal stores the first secret key and the second secret key, and the second vehicle-mounted terminal stores the first secret key and the second secret key, and the first vehicle-mounted terminal and the second vehicle-mounted terminal are instructed to conduct encryption communication according to the first secret key and the second secret key.

In some embodiments, step S103 may generally include: encrypting the first key and the second key through the first preset key to obtain first encrypted data, and encrypting the first key and the second key through the second preset key to obtain second encrypted data; sending the first encrypted data to a first vehicle-mounted terminal to instruct the first vehicle-mounted terminal to decrypt the first encrypted data according to a first preset secret key and instruct the first vehicle-mounted terminal to update the first secret key and a second secret key to the first vehicle-mounted terminal after checking that the current identity of the first vehicle-mounted terminal is consistent with the first identity carried by the first encrypted data; and forwarding the second encrypted data to the second vehicle-mounted terminal through the first vehicle-mounted terminal to instruct the second vehicle-mounted terminal to decrypt the second encrypted data according to a second preset key, instruct the second vehicle-mounted terminal to check that the current identity of the second vehicle-mounted terminal is consistent with the second identity carried by the second encrypted data, and update the first key and the second key to the second vehicle-mounted terminal.

Specifically, in order to ensure that the first key and the second key are not leaked, the first key and the second key may be encrypted by the first preset key to obtain first encrypted data, the first key and the second key may be encrypted by the second preset key to obtain second encrypted data, and then the first encrypted data and the second encrypted data are respectively sent to the OBU terminal and the smart car machine, so that the OBU terminal and the smart car machine store the first key and the second key after decryption, and perform encrypted communication according to the first key and the second key.

It should be noted that, in order to avoid the cryptographic management platform sending the first key and the second key to other OBU terminals using the first preset key and other smart car machines using the second preset key, the first encrypted data may carry the first identity and the second identity, for example, the first identity and the second identity are encrypted by the first preset key and the second preset key, so that after the OBU terminal receives the first encrypted data, it is checked whether the current identity of the OBU terminal is consistent with the first identity, and after the smart car machine receives the second encrypted data, it is checked whether the current identity of the smart car machine is consistent with the second identity, and if so, the first key and the second key are updated to the OBU terminal and the smart car machine.

Specifically, a first preset key in the OBU terminal may be overwritten with the first key, and a second preset key in the smart car machine may be overwritten with the second key.

In some embodiments, the key update method may further include: and acquiring a key updating result sent by the first vehicle-mounted terminal, wherein the key updating result comprises a key updating result of the first vehicle-mounted terminal and a key updating result of the second vehicle-mounted terminal.

Specifically, after receiving the key update result, the cryptographic management platform may perform subsequent operations according to the key update result, for example, if the key update result indicates that both the first vehicle-mounted terminal and the second vehicle-mounted terminal have completed key update, the cryptographic management platform may further send a verification request, where the verification request indicates that the first vehicle-mounted terminal and the second vehicle-mounted terminal perform bidirectional authentication using the first key and the second key, and obtain a verification result returned by the first vehicle-mounted terminal, and if the first vehicle-mounted terminal and the second vehicle-mounted terminal successfully perform bidirectional authentication using the first key and the second key, it is determined that the key update is successful, and the process is ended.

As can be seen from the above, the embodiment provides a key updating method, where the key updating method is applied to a crypto-tube platform, establishes communication with a first vehicle-mounted terminal, and verifies identities of the first vehicle-mounted terminal and a second vehicle-mounted terminal; if the identity verification of the first vehicle-mounted terminal and the identity verification of the second vehicle-mounted terminal are successful, generating a first secret key according to a first identity of the first vehicle-mounted terminal, and generating a second secret key according to a second identity of the second vehicle-mounted terminal; the first secret key and the second secret key are sent to the first vehicle-mounted terminal and the second vehicle-mounted terminal, so that the first vehicle-mounted terminal stores the first secret key and the second secret key, the second vehicle-mounted terminal stores the first secret key and the second secret key, the first vehicle-mounted terminal and the second vehicle-mounted terminal are indicated to carry out encryption communication according to the first secret key and the second secret key, information leakage caused by leakage of a preset unified secret key adopted during communication is avoided, and the safety of communication between the vehicle-mounted unit and the vehicle-mounted terminal is greatly improved in a one-secret mode.

Referring to fig. 3, fig. 3 is a second flow chart of the key updating method according to the embodiment of the present application, where the key updating method is applied to a first vehicle-mounted terminal, and a specific flow of the first vehicle-mounted terminal storing a first preset key may be as follows:

s201, communication is established with a close management platform, and the close management platform stores a first preset secret key.

The close management platform can be an ETC key management system, and the first vehicle-mounted terminal can be an OBU terminal. Specifically, a first preset key is a unified root key which is common to OBU terminals of the same model, and can be generated by the confidential pipe platform or other confidential pipe platforms, and the OBU terminals of the same model can use the same confidential pipe platform to perform password management, so that it is required to ensure that the first preset key is stored in the first vehicle-mounted terminal and the confidential pipe platform at the same time, so that the first vehicle-mounted terminal and the confidential pipe platform can perform identity authentication, and the OBU terminals which do not belong to the management of the confidential pipe platform can apply for the key maliciously.

In some embodiments, step S201 may mainly include: when OBU terminal used for the first time, can apply for the secret key to close tub of platform, later, close tub of platform can carry out authentication to OBU terminal, and specific authentication flow can be for: the OBU terminal receives the first character string sent by the encrypted management platform, then encrypts the first character string by adopting a first preset secret key to obtain encrypted data, then returns the encrypted data to the encrypted management platform, if the encrypted management platform successfully authenticates the identity of the OBU terminal, establishes communication with the OBU terminal, generates a unique secret key according to the identity of the OBU terminal in the subsequent steps, and sends the unique secret key to the OBU terminal.

S202, first encrypted data and second encrypted data sent by the confidential control platform are obtained, the first encrypted communication data are a first secret key, a second secret key and first identity information which are encrypted through a first preset secret key, and the first identity information comprises a first identity mark.

The first key is generated by the confidential management platform according to a first identity identifier of the OBU terminal, the second key is generated by the confidential management platform according to a VIN of a vehicle corresponding to the intelligent vehicle, and in order to avoid key sending errors, the first encrypted data also carries the first identity identifier, so that the first vehicle-mounted terminal can check whether the first key and the second key are matched with the first vehicle-mounted terminal according to the first identity identifier.

S203, the first encrypted data is decrypted by using the first preset secret key to obtain the first secret key, the second secret key and the first identity mark.

And S204, if the first identity identification is consistent with the current identity identification of the first vehicle-mounted terminal, updating the first encrypted data into the first vehicle-mounted terminal to indicate the first vehicle-mounted terminal to perform encrypted communication with a second vehicle-mounted terminal connected with the first vehicle-mounted terminal according to the first secret key and the second secret key.

Specifically, if the first identity is consistent with the current identity of the first vehicle-mounted terminal, it may be considered that the first key carried by the first encrypted data is generated according to the current identity of the first vehicle-mounted terminal, and the first vehicle-mounted terminal may update the data carried by the first encrypted data to the first vehicle-mounted terminal, so as to perform encrypted communication using the unique first key and the unique second key later.

S205, the second encrypted data are forwarded to a second vehicle-mounted terminal connected with the first vehicle-mounted terminal, so that the second vehicle-mounted terminal can update the second encrypted data to the second vehicle-mounted terminal.

The second vehicle-mounted terminal may be an intelligent vehicle-mounted device, and it is noted that the first vehicle-mounted terminal may directly forward the second encrypted data to the second vehicle-mounted terminal after receiving the first encrypted data and the second encrypted data, or may forward the second encrypted data to the second vehicle-mounted terminal after successfully verifying the first encrypted data.

As can be seen from the above, the key updating method provided in this embodiment is applied to the first vehicle-mounted terminal, and is configured to update the unique first key generated according to the identity of the first vehicle-mounted terminal and the unique second key generated according to the identity of the second vehicle-mounted terminal connected to the first vehicle-mounted terminal, which are sent by the crypto-control platform, into the first vehicle-mounted terminal, and forward the first key and the second key to the second vehicle-mounted terminal, so that the second vehicle-mounted terminal updates the first key and the second key into the second vehicle-mounted terminal and instructs the first vehicle-mounted terminal and the second vehicle-mounted terminal to perform encrypted communication using the first key and the second key, thereby improving the security of communication between the first vehicle-mounted terminal and the second vehicle-mounted terminal.

Referring to fig. 4, fig. 4 is a third flow chart of the key updating method according to the embodiment of the present application, where the key updating method is applied to a second vehicle-mounted terminal, and the second vehicle-mounted terminal stores a second preset key, and the specific flow chart may be as follows:

s301, second encrypted data transmitted by a crypto-control platform and forwarded by a first vehicle-mounted terminal connected with a second vehicle-mounted terminal are obtained, the second encrypted data are a first secret key, a second secret key and identity information which are encrypted through a preset second secret key, and the identity information comprises a second identity identifier and a second identity identifier.

The second vehicle-mounted terminal can be an intelligent vehicle machine, the close management platform can be an ETC key management system, the first vehicle-mounted terminal can be an OBU terminal, and when the OBU terminal is installed on a vehicle, the first vehicle-mounted terminal can be connected with the intelligent vehicle machine in a wired or wireless mode. Specifically, the second preset key is a unified root key common to the smart car machines of a certain model or some models, and may be generated by the secure management platform, or may be generated by other secure management platforms, and the smart car machines of a certain model or some models may use the same secure management platform for password management, so that it is required to ensure that the second preset key is simultaneously stored in the second onboard terminal and the secure management platform, so as to allow the second onboard terminal and the secure management platform to perform identity authentication, so as to prevent the second onboard terminal, which is not managed by the secure management platform, from maliciously applying for the key.

Specifically, before step S301, the method may further include: and performing identity authentication with the confidential management platform, and if the identity authentication is successful, executing the step S301.

In some embodiments, during the authentication with the secure management platform, the identity of the second vehicle-mounted terminal may be sent to the secure management platform, or after the authentication is successful, the identity of the second vehicle-mounted terminal may be sent to the secure management platform.

Specifically, the first secret key is generated by the close management platform according to the received identity of the OBU terminal, the second secret key is generated by the close management platform according to the received identity of the smart car machine, and the second identity is the identity of the smart car machine.

S302, the second encrypted data is decrypted according to a preset second key, so that a first key, a second key and a second identity of the second identity are obtained.

And S303, if the second identity of the second identity is consistent with the current identity of the second vehicle-mounted terminal, updating the second encrypted data into the second vehicle-mounted terminal to indicate the second vehicle-mounted terminal to use the first key and the second key to carry out encrypted communication with the first vehicle-mounted terminal.

If the second identity of the second onboard terminal is consistent with the current identity of the second onboard terminal, it can be considered that the second key carried by the second encrypted data is generated according to the current identity of the second onboard terminal, and the second onboard terminal can update the data carried by the second encrypted data to the second onboard terminal so as to perform encrypted communication by using the unique first key and the unique second key later.

As can be seen from the above, the key updating method provided by the present application is applied to the second vehicle-mounted terminal, and updates the unique first key generated by the crypto platform according to the identity of the first vehicle-mounted terminal and the unique second key generated according to the identity of the second vehicle-mounted terminal, which are forwarded by the first vehicle-mounted terminal connected to the second vehicle-mounted terminal, into the second vehicle-mounted terminal, so as to perform encrypted communication with the first vehicle-mounted terminal by using the first key and the second key, thereby improving the security of communication between the first vehicle-mounted terminal and the second vehicle-mounted terminal.

According to the method described in the foregoing embodiment, the embodiment will be described in terms of the secure management platform, the first vehicle-mounted terminal, and the second vehicle-mounted terminal as a whole, please refer to fig. 5, where fig. 5 is a process diagram of the key updating method provided in the embodiment of the present application, and the specific process may be as follows:

when a first vehicle-mounted terminal is started for the first time (process 1), a key request is sent to a secure management platform (process 2), the secure management platform firstly verifies the identities of the first vehicle-mounted terminal and a second vehicle-mounted terminal connected with the first vehicle-mounted terminal (processes 3 to 14, wherein the first vehicle-mounted terminal can encrypt a first character string by using a first preset key to generate MAC _ obu2, the second vehicle-mounted terminal can encrypt the first character string by using a second preset key to generate MAC _ car2), if the identity verification of the first vehicle-mounted terminal and the second vehicle-mounted terminal is successful, the first key is generated according to a first identity of the first vehicle-mounted terminal, the second key is generated according to a second identity of the second vehicle-mounted terminal (process 15), then the keys are issued to the first vehicle-mounted terminal and the second vehicle-mounted terminal, and the first vehicle-mounted terminal and the second vehicle-mounted terminal are verified, updating the first key and the second key to the first vehicle-mounted terminal and the second vehicle-mounted terminal (processes 16 to 19), after the updating is successful, the second vehicle-mounted terminal sends an updating result to the first vehicle-mounted terminal, the first vehicle-mounted terminal sends the updating result of the first vehicle-mounted terminal and the updating result of the first vehicle-mounted terminal to the confidential control platform together (processes 20 and 21), further, the confidential control platform sends a verification request to the first vehicle-mounted terminal in order to verify the updating result, the first vehicle-mounted terminal initiates bidirectional authentication to the second vehicle-mounted terminal, then sends the result of the bidirectional authentication to the confidential control platform, and if the authentication is successful, the process is ended (processes 22 to 25).

According to the method described in the foregoing embodiment, this embodiment will be further described from the perspective of a key update apparatus, which may be specifically implemented as an independent entity, or may be implemented by being integrated in a terminal device, where the terminal device may be any intelligent electronic device with a mobile communication function.

Referring to fig. 6, fig. 6 specifically describes a key update apparatus provided in this embodiment of the present application, where the key update apparatus 10 is applied to a crypto platform, and the key update apparatus includes an authentication module 11, a key generation module 12, and a key sending module 13, where:

(1) identity verification module 11

And the identity authentication module 11 is configured to establish communication with the first vehicle-mounted terminal and authenticate identities of the first vehicle-mounted terminal and the second vehicle-mounted terminal.

(2) Key generation module 12

The key generation module 12 is configured to generate a first key according to a first identity of the first vehicle-mounted terminal and generate a second key according to a second identity of the second vehicle-mounted terminal if the identity of the first vehicle-mounted terminal and the identity of the second vehicle-mounted terminal are successfully verified.

In this embodiment, the key generation module 12 may be mainly configured to: obtaining a first key through two-stage dispersion, wherein the first stage adopts a first identity identification of a first vehicle-mounted terminal as a dispersion factor, and the second stage adopts the current time as the dispersion factor; and obtaining a second key through two-stage dispersion, wherein the first stage adopts a second identity of a second vehicle-mounted terminal as a dispersion factor, and the second stage adopts the current time as the dispersion factor.

(3) Key transmitting module 13

The key sending module 13 is configured to send the first key and the second key to the first vehicle-mounted terminal and the second vehicle-mounted terminal, so that the first vehicle-mounted terminal stores the first key and the second key, and the second vehicle-mounted terminal stores the first key and the second key, so as to instruct the first vehicle-mounted terminal and the second vehicle-mounted terminal to perform encrypted communication according to the first key and the second key.

In this embodiment, a first preset key is stored in the crypto-tube platform and the first vehicle-mounted terminal, a second preset key is stored in the crypto-tube platform and the second vehicle-mounted terminal, and the key sending module 13 is mainly configured to: encrypting the first key and the second key through the first preset key to obtain first encrypted data, and encrypting the first key and the second key through the second preset key to obtain second encrypted data; sending the first encrypted data to a first vehicle-mounted terminal to instruct the first vehicle-mounted terminal to decrypt the first encrypted data according to a first preset secret key and instruct the first vehicle-mounted terminal to update the first secret key and a second secret key to the first vehicle-mounted terminal after checking that the current identity of the first vehicle-mounted terminal is consistent with the first identity carried by the first encrypted data; and forwarding the second encrypted data to the second vehicle-mounted terminal through the first vehicle-mounted terminal to instruct the second vehicle-mounted terminal to decrypt the second encrypted data according to a second preset key, instruct the second vehicle-mounted terminal to check that the current identity of the second vehicle-mounted terminal is consistent with the second identity carried by the second encrypted data, and update the first key and the second key to the second vehicle-mounted terminal.

Further, the identity verification module 11 may be mainly used for: generating a first character string and sending the first character string to a first vehicle-mounted terminal; acquiring third encrypted data returned by the first vehicle-mounted terminal, verifying the identity of the first vehicle-mounted terminal according to the first character string and the third encrypted data, and encrypting the first character string by the first vehicle-mounted terminal through a first preset secret key to generate the third encrypted data; generating a second character string and sending the second character string to the first vehicle-mounted terminal so that the first vehicle-mounted terminal sends the second character string to the connected second vehicle-mounted terminal; acquiring fourth encrypted data returned by the second vehicle-mounted terminal forwarded by the first vehicle-mounted unit, wherein the fourth encrypted data is generated by the second vehicle-mounted terminal through encrypting the second character string through a second preset secret key; and verifying the identity of the second vehicle-mounted terminal according to the second character string and the fourth encrypted data.

In this embodiment, the identity verification module 11 may specifically be configured to: encrypting the first character string according to a first preset key; if the encrypted first character string is consistent with the third encrypted data, the identity verification of the first vehicle-mounted terminal is determined to be successful; encrypting the second character string according to a second preset key; and if the encrypted second character string is consistent with the fourth encrypted data, determining that the identity verification of the second vehicle-mounted terminal is successful.

As can be seen from the above description, the present embodiment provides a key updating apparatus 10, which is applied to a secure management platform, establishes communication with a first vehicle-mounted terminal through an identity authentication module 11, and authenticates identities of the first vehicle-mounted terminal and a second vehicle-mounted terminal, if the identities of the first vehicle-mounted terminal and the second vehicle-mounted terminal are successfully authenticated, a key generation module 12 generates a first key according to a first identity of the first vehicle-mounted terminal, and generates a second key according to a second identity of the second vehicle-mounted terminal, and then a third determination module 30 sends the first key and the second key to the first vehicle-mounted terminal and the second vehicle-mounted terminal, so that the first vehicle-mounted terminal stores the first key and the second key, and the second vehicle-mounted terminal stores the first key and the second key, so as to instruct the first vehicle-mounted terminal and the second vehicle-mounted terminal to perform encrypted communication according to the first key and the second key, the one-secret mode improves the communication safety of the first vehicle-mounted terminal and the second vehicle-mounted terminal.

In addition, the present application also provides a key updating apparatus, please refer to fig. 7, where the key updating apparatus 20 is applied to the first vehicle-mounted terminal, and the key updating apparatus 20 includes a communication module 21, an obtaining module 22, a decryption module 23, an updating module 24, and a forwarding module 25, where:

the communication module 21 is used for establishing communication with a close management platform, and the close management platform stores a first preset secret key;

the obtaining module 22 is configured to obtain first encrypted data and second encrypted data sent by the crypto-tube platform, where the first encrypted communication data is a first key, a second key, and identity information that are encrypted by a first preset key, and the identity information includes a first identity identifier;

the decryption module 23 is configured to decrypt the first encrypted data using a first preset key to obtain a first key, a second key, and a first identity;

the updating module 24 is configured to update the first encrypted data to the first vehicle-mounted terminal if the first identity is consistent with the current identity of the first vehicle-mounted terminal, so as to instruct the first vehicle-mounted terminal to perform encrypted communication with a second vehicle-mounted terminal connected to the first vehicle-mounted terminal according to the first key and the second key;

the forwarding module 25 is configured to forward the second encrypted data to a second vehicle-mounted terminal connected to the first vehicle-mounted terminal, so that the second vehicle-mounted terminal updates the second encrypted data to the second vehicle-mounted terminal.

As can be seen from the above, the embodiment provides a key updating apparatus 20, which is applied to a first vehicle-mounted terminal, and establishes communication with a secure management platform through a communication module 21, where the secure management platform stores a first preset key, and then an obtaining module 22 obtains first encrypted data and second encrypted data sent by the secure management platform, where the first encrypted data is a first key, a second key, and identity information encrypted by the first preset key, and the identity information includes a first identity identifier, and then a decrypting module 23 decrypts the first encrypted data by using the first preset key to obtain the first key, the second key, and the first identity identifier, and if the first identity identifier is consistent with a current identity identifier of the first vehicle-mounted terminal, an updating module 24 updates the first encrypted data to the first vehicle-mounted terminal to instruct the first vehicle-mounted terminal to perform encrypted communication with a second vehicle-mounted terminal connected to the first vehicle-mounted terminal according to the first key and the second key, and the forwarding module 25 forwards the second encrypted data to the second vehicle-mounted terminal connected with the first vehicle-mounted terminal, so that the second vehicle-mounted terminal updates the second encrypted data to the second vehicle-mounted terminal, thereby improving the security of the communication between the first vehicle-mounted terminal and the second vehicle-mounted terminal.

In addition, the present application further provides a key updating apparatus, please refer to fig. 8, where the key updating apparatus 30 is applied to the second vehicle-mounted terminal, and the key updating apparatus 30 includes an obtaining module 31, a decrypting module 32, and an updating module 33, where:

the obtaining module 31 is configured to obtain second encrypted data sent by the crypto-tube platform and forwarded by a first vehicle-mounted terminal connected to a second vehicle-mounted terminal, where the second encrypted data is a first key, a second key and identity information that are encrypted by a preset second key, and the identity information includes a second identity identifier;

the decryption module 32 is configured to decrypt the second encrypted data according to a preset second key to obtain a first key, a second key, and a second identity;

the updating module 33 is configured to update the second encrypted data to the second vehicle-mounted terminal to instruct the second vehicle-mounted terminal to perform encrypted communication with the first vehicle-mounted terminal by using the first key and the second key if the second identity is consistent with the current identity of the second vehicle-mounted terminal.

As can be seen from the above, the embodiment provides the key updating apparatus 30, which is applied to a second vehicle-mounted terminal, and acquires, by the acquiring module 31, second encrypted data sent by a crypto platform and forwarded by a first vehicle-mounted terminal connected to the second vehicle-mounted terminal, where the second encrypted data is a first key, a second key and identity information that are encrypted by a preset second key, and the identity information includes a second identity, a second identity is included in the identity information, and then the decrypting module 32 decrypts the second encrypted data according to the preset second key to obtain the first key, the second key and the second identity, and if the second identity is consistent with a current identity of the second vehicle-mounted terminal, the updating module 33 updates the second encrypted data to the second vehicle-mounted terminal to instruct the second vehicle-mounted terminal to perform encrypted communication with the first vehicle-mounted terminal by using the first key and the second key, therefore, the communication safety of the first vehicle-mounted terminal and the second vehicle-mounted terminal is improved.

In addition, an embodiment of the present application further provides an in-vehicle terminal, as shown in fig. 9, the in-vehicle terminal includes a processor 101 and a memory 102. The processor 101 is electrically connected to the memory 102.

The processor 101 is a control center of the in-vehicle terminal 100, connects various parts of the entire terminal device with various interfaces and lines, and performs various functions of the terminal device and processes data by running or loading an application stored in the memory 102 and calling data stored in the memory 102, thereby performing overall monitoring of the terminal device.

In this embodiment, the processor 101 in the in-vehicle terminal 100 loads instructions corresponding to processes of one or more application programs into the memory 102, and the processor 101 runs the application programs stored in the memory 102, so as to implement various functions as follows:

establishing communication with a confidential management platform, wherein the confidential management platform stores a first preset secret key; acquiring first encrypted data and second encrypted data sent by a crypto-control platform, wherein the first encrypted communication data is a first secret key, a second secret key and identity information which are encrypted by a first preset secret key, and the identity information comprises a first identity mark; decrypting the first encrypted data by using a first preset key to obtain a first key, a second key and a first identity mark; if the first identity identification is consistent with the current identity identification of the first vehicle-mounted terminal, updating the first encrypted data into the first vehicle-mounted terminal to indicate the first vehicle-mounted terminal to carry out encrypted communication with a second vehicle-mounted terminal connected with the first vehicle-mounted terminal according to the first secret key and the second secret key; and forwarding the second encrypted data to a second vehicle-mounted terminal connected with the first vehicle-mounted terminal so that the second vehicle-mounted terminal can update the second encrypted data to the second vehicle-mounted terminal.

Or acquiring second encrypted data which is transmitted by a crypto-control platform and is forwarded by a first vehicle-mounted terminal connected with a second vehicle-mounted terminal, wherein the second encrypted data is a first secret key, a second secret key and identity information which are encrypted by a preset second secret key, and the identity information comprises a second identity identifier and a second identity identifier; decrypting the second encrypted data according to a preset second key to obtain a first key, a second key and a second identity; and if the second identity is consistent with the current identity of the second vehicle-mounted terminal, updating the second encrypted data into the second vehicle-mounted terminal to indicate the second vehicle-mounted terminal to carry out encrypted communication with the first vehicle-mounted terminal by using the first key and the second key.

Fig. 10 shows a specific structural block diagram of the in-vehicle terminal provided in the embodiment of the present application, which may be used to implement the key updating method provided in the above embodiment.

The RF circuit 210 is used for receiving and transmitting electromagnetic waves, and performs interconversion between the electromagnetic waves and electrical signals, thereby communicating with a communication network or other devices. RF circuit 210 may include various existing circuit elements for performing these functions, such as an antenna, a radio frequency transceiver, a digital signal processor, an encryption/decryption chip, memory, and so forth. The RF circuitry 210 may communicate with a wireless network or with other devices over a wireless network.

The memory 220 may be used for storing software programs and modules, such as the key update method and the corresponding program instructions/modules in the above-mentioned embodiments, and the processor 230 may execute various functions by operating the software programs and modules stored in the memory 220. Memory 220 may include high speed random access memory and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory 220 may further include memory remotely located from the processor 230, which may be connected to the in-vehicle terminal 200 via a network. Examples of such networks include, but are not limited to, the internet, local area networks, mobile communication networks, and combinations thereof.

The processor 230 is a control center of the in-vehicle terminal 200, connects various parts of the entire in-vehicle terminal using various interfaces and lines, and implements various functions of the in-vehicle terminal 200 by running or executing software programs and/or modules stored in the memory 220. Optionally, processor 230 may include one or more processing cores; in some embodiments, processor 230 may integrate a modem processor that handles primarily wireless communications. It will be appreciated that the modem processor described above may not be integrated into processor 230.

The in-vehicle terminal 200 further includes a power supply 240 (e.g., a battery) for supplying power to various components, and in some embodiments, the power supply may be logically connected to the processor 230 through a power management system, so as to implement functions of managing charging, discharging, and power consumption through the power management system. The power supply 240 may also include any component of one or more dc or ac power sources, recharging systems, power failure detection circuitry, power converters or inverters, power status indicators, and the like.

Specifically, in this embodiment, the vehicle-mounted terminal further includes a memory and one or more programs, where the one or more programs are stored in the memory and configured to be executed by the one or more processors, and the one or more programs include instructions for:

In specific implementation, the above modules may be implemented as independent entities, or may be combined arbitrarily to be implemented as the same or several entities, and specific implementation of the above modules may refer to the foregoing method embodiments, which are not described herein again.

It will be understood by those skilled in the art that all or part of the steps of the methods of the above embodiments may be performed by instructions or by associated hardware controlled by the instructions, which may be stored in a computer readable storage medium and loaded and executed by a processor. To this end, an embodiment of the present application provides a storage medium including terminal device executable instructions. The terminal device executable instructions, when executed by a terminal device processor, perform the steps of any one of the key update methods provided by the embodiments of the present application.

Wherein the storage medium may include: read Only Memory (ROM), Random Access Memory (RAM), magnetic or optical disks, and the like.

Since the instructions stored in the storage medium can execute the steps in any one of the key updating methods provided in the embodiments of the present application, beneficial effects that can be achieved by any one of the key updating methods provided in the embodiments of the present application can be achieved, for details, see the foregoing embodiments, and are not described herein again.

The above operations can be implemented in the foregoing embodiments, and are not described in detail herein.

In summary, although the present application has been described with reference to the preferred embodiments, the above-described preferred embodiments are not intended to limit the present application, and those skilled in the art can make various changes and modifications without departing from the spirit and scope of the present application, so that the scope of the present application shall be determined by the appended claims.

Claims

1. A secret key updating method is applied to a close-pipe platform and comprises the following steps:

2. The key updating method according to claim 1, wherein a first preset key is stored in the secure management platform and the first vehicle-mounted terminal, a second preset key is stored in the secure management platform and the second vehicle-mounted terminal, and the sending the first key and the second key to the first vehicle-mounted terminal and the second vehicle-mounted terminal specifically includes:

encrypting the first key and the second key through the first preset key to obtain first encrypted data, and encrypting the first key and the second key through the second preset key to obtain second encrypted data;

sending the first encrypted data to the first vehicle-mounted terminal to instruct the first vehicle-mounted terminal to decrypt the first encrypted data according to the first preset key, instruct the first vehicle-mounted terminal to check that the current identity of the first vehicle-mounted terminal is consistent with the first identity carried by the first encrypted data, and update the first key and the second key to the first vehicle-mounted terminal;

and forwarding the second encrypted data to the second vehicle-mounted terminal through the first vehicle-mounted terminal to instruct the second vehicle-mounted terminal to decrypt the second encrypted data according to the second preset key, and instruct the second vehicle-mounted terminal to update the first key and the second key to the second vehicle-mounted terminal after checking that the current identity of the second vehicle-mounted terminal is consistent with the second identity carried by the second encrypted data.

3. The method for updating a key according to claim 2, wherein the verifying the identities of the first vehicle-mounted terminal and the second vehicle-mounted terminal specifically comprises:

generating a first character string and sending the first character string to the first vehicle-mounted terminal;

acquiring third encrypted data returned by the first vehicle-mounted terminal, and verifying the identity of the first vehicle-mounted terminal according to the first character string and the third encrypted data, wherein the third encrypted data is generated by encrypting the first character string through the first preset secret key by the first vehicle-mounted terminal;

generating a second character string, and sending the second character string to the first vehicle-mounted terminal, so that the first vehicle-mounted terminal sends the second character string to a second vehicle-mounted terminal connected with the first vehicle-mounted terminal;

acquiring fourth encrypted data returned by the second vehicle-mounted terminal forwarded by the first vehicle-mounted unit, wherein the fourth encrypted data is generated by encrypting the second character string through the second preset key by the second vehicle-mounted terminal;

and verifying the identity of the second vehicle-mounted terminal according to the second character string and the fourth encrypted data.

4. The key updating method according to claim 3, wherein the verifying the identity of the first vehicle-mounted terminal according to the first string and the third encrypted data, and the verifying the identity of the second vehicle-mounted terminal according to the second string and the fourth encrypted data specifically include:

encrypting the first character string according to the first preset key; if the encrypted first character string is consistent with the third encrypted data, determining that the identity verification of the first vehicle-mounted terminal is successful;

encrypting the second character string according to the second preset key; and if the encrypted second character string is consistent with the fourth encrypted data, determining that the identity verification of the second vehicle-mounted terminal is successful.

5. The method for updating a key according to claim 1, wherein the generating a first key according to the first identity of the first vehicle-mounted terminal and generating a second key according to the second identity of the second vehicle-mounted terminal specifically includes:

obtaining a first key through two-stage dispersion, wherein the first stage adopts a first identity identification of the first vehicle-mounted terminal as a dispersion factor, and the second stage adopts the current time as the dispersion factor;

and obtaining a second key through two-stage dispersion, wherein the first stage adopts the second identity of the second vehicle-mounted terminal as a dispersion factor, and the second stage adopts the current time as the dispersion factor.

6. A key updating method is applied to a first vehicle-mounted terminal, wherein a first preset key is stored in the first vehicle-mounted terminal, and the method comprises the following steps:

7. A key updating method is applied to a second vehicle-mounted terminal, wherein the second vehicle-mounted terminal comprises a second preset key, and the method comprises the following steps:

acquiring second encrypted data transmitted by a crypto-control platform and forwarded by a first vehicle-mounted terminal connected with the second vehicle-mounted terminal, wherein the second encrypted data is a first secret key, a second secret key and identity information which are encrypted by a preset second secret key, and the identity information comprises a second identity;

8. A secret key updating system is characterized by comprising a secret management platform, a first vehicle-mounted terminal and a second vehicle-mounted terminal, wherein the first vehicle-mounted terminal and the second vehicle-mounted terminal are communicated with the secret management platform, a first preset secret key is stored in the secret management platform and the first vehicle-mounted terminal, a second preset secret key is stored in the secret management platform and the second vehicle-mounted terminal, and the system comprises:

9. A key update apparatus applied to a crypto-tube platform, the key update apparatus comprising:

10. A computer-readable storage medium having stored therein a plurality of instructions adapted to be loaded by a processor to perform the method of rekeying of any of claims 1 to 5, or claim 6, or claim 7.