CN115190484A - Internet of vehicles security defense method, device, equipment and storage medium - Google Patents

Abstract

The present disclosure provides a method, an apparatus, a device and a storage medium for security defense of internet of vehicles, wherein the method comprises the following steps: receiving first authentication data, wherein the first authentication data is generated by symmetrically encrypting a vehicle-mounted chip based on a component number; performing first connection authentication based on decrypting the first authentication data; generating an RLWE key by taking the chip number as a seed code based on the first connection authentication pass; performing RLWE encryption on the randomly generated resource security sequence number by using the RLWE key to obtain second authentication data; and sending the second authentication data to a vehicle-mounted chip so that the vehicle-mounted chip decrypts the second authentication data by using the same RLWE key generated by taking the chip number as the seed code to obtain the resource security serial number. The security defense method for the Internet of vehicles can improve the security of the Internet of vehicles.

Description

Internet of vehicles security defense method, device, equipment and storage medium

Technical Field

The present disclosure relates to the field of computers, and in particular, to a method, an apparatus, a device, and a storage medium for security defense in internet of vehicles.

Background

With the continuous progress of communication technology, the technology of internet of vehicles is developed. By utilizing the Internet of vehicles, the vehicle-mounted device can transmit information with equipment such as a server and the like through technologies such as wireless transmission and the like, and can effectively supervise the running state of the vehicle and provide comprehensive service according to different requirements. However, the car networking is at risk in terms of security (data security, hereinafter referred to as security), such as unauthorized person intruding into the computer system, remote instruction to steal or change data, data being peeped or changed during transmission, etc. And the asymmetric encryption is adopted, so that the decryption is easy.

Disclosure of Invention

The present disclosure provides a method, an apparatus, a device and a storage medium for security defense in internet of vehicles, so as to at least solve the above technical problems in the prior art.

According to a first aspect of the present disclosure, there is provided a method for security defense in internet of vehicles, the method comprising: receiving first authentication data, wherein the first authentication data is generated by symmetrically encrypting the vehicle-mounted chip based on the component number; performing first connection authentication based on decrypting the first authentication data; generating an RLWE (ring learning with errors, RLWE for short) key by taking the chip number as a seed code based on the first connection authentication pass; RLWE encryption is carried out on the randomly generated data security serial number by the RLWE key to obtain second authentication data; and sending the second authentication data to a vehicle-mounted chip so that the vehicle-mounted chip decrypts the second authentication data by using the same RLWE key generated by taking the chip number as the seed code to obtain the resource safety serial number.

In an embodiment, the method further comprises: receiving user password data, wherein the user password data is generated by symmetrically encrypting the resource safety serial number and the one-way encrypted user password by using a chip number of a vehicle-mounted chip and adding a safety serial number; and acquiring a chip number according to the security serial number, and decrypting the user password data based on the chip number to obtain the resource security serial number and the one-way encrypted user password.

In an embodiment, the method further comprises: verifying the obtained one-way encrypted user password based on the passing verification of the resource safety serial number; generating a one-time license using a random value based on the one-way encrypted user password authentication pass; RLWE encryption is carried out on the single license by using an RLWE key generated by taking the chip number as a seed code to obtain single license data; and sending the single permission data to enable the vehicle-mounted chip and the garage server to decrypt the single permission data respectively by using the same RLWE key generated by taking the chip number as the seed code to obtain the single permission, wherein the single permission is used for forming a rear quantum channel between the vehicle-mounted chip and the garage server.

In one embodiment, the first authentication data is generated by the vehicle-mounted chip based on symmetric encryption of the component number, and includes: the vehicle-mounted chip carries out unidirectional encryption on the component number to obtain a unidirectional encryption component number; and the vehicle-mounted chip symmetrically encrypts the one-way encryption component number by using a chip number, and generates the first authentication data after adding a security serial number.

In one embodiment, the performing the first connection authentication based on decrypting the first authentication data includes: obtaining a corresponding chip number by using the security serial number; carrying out symmetric decryption on the chip number to obtain the one-way encryption component number; comparing the obtained one-way encryption component number with the stored one-way encryption component number; and the first connection authentication is passed based on the comparison success.

In one embodiment, the method for generating the RLWE key using the chip number as the seed code includes: a random number is generated by using the chip number as a seed code, and an RLWE key is generated by using the random number.

According to a second aspect of the present disclosure, there is provided a vehicle networking security defense method, the method comprising: generating first authentication data based on component number symmetric encryption; sending the first authentication data to enable the data security server to perform first connection authentication based on decrypting the first authentication data; receiving second authentication data, wherein the second authentication data is generated by performing RLWE encryption on a randomly generated resource security sequence number by a resource security server by using an RLWE key, the RLWE key is passed through by the resource security server based on the first connection authentication, and the RLWE key is generated by using a chip number as a seed code; and decrypting the second authentication data by using the same RLWE key generated by using the chip number as the seed code to obtain the resource security serial number.

In one embodiment, the method further comprises: symmetrically encrypting the information security serial number and the one-way encrypted user password by using a chip number, and adding a security serial number to generate user password data; and sending the user password data to enable the resource safety server to obtain a chip number according to the safety serial number, decrypting the user password data based on the chip number to obtain the resource safety serial number and the one-way encrypted user password, and verifying.

In one embodiment, the method further comprises: receiving single permission data, wherein the single permission data is obtained by performing RLWE encryption on a single permission by a resource security server by using an RLWE key generated by using a chip number as a seed code, and the single permission is sequentially verified and passed by the resource security server based on the resource security serial number and the one-way encrypted user password and is generated by using a random value; and decrypting the single permission data by using the same RLWE key generated by taking the chip number as the seed code to obtain the single permission so as to form a rear quantum channel between the vehicle-mounted chip and the garage server by using the single permission.

In one embodiment, generating the first authentication data based on component number symmetric encryption comprises: carrying out one-way encryption on the component number to obtain a one-way encryption component number; and symmetrically encrypting the one-way encryption component number by using a chip number, and adding a security serial number to generate the first authentication data.

In one embodiment, the data processing method further includes the step of performing, by the data processing system, a first connection authentication based on decrypting the first authentication data, including: the information security server obtains a corresponding chip number by using the security serial number; the information security server carries out symmetric decryption by using the chip number to obtain the one-way encryption component number; and the information security server compares the obtained one-way encryption component number with the stored one-way encryption component number, and the first connection authentication is passed based on the successful comparison.

In one embodiment, the decrypting the second authentication data with the same RLWE key generated with the chip number as the seed code comprises: generating a random number by using the chip number as a seed code, and generating an RLWE key by using the random number; and decrypting the second authentication data by using the RLWE key to obtain the resource safety serial number.

According to a third aspect of the present disclosure, there is provided a networked security defense apparatus, the apparatus comprising: the first receiving module is used for receiving first authentication data, and the first authentication data is generated by the vehicle-mounted chip based on component number symmetric encryption; the first authentication module is used for carrying out first connection authentication based on the decrypted first authentication data; the first encryption module is used for generating an RLWE key by taking the chip number as a seed code based on the first connection authentication; RLWE encryption is carried out on the randomly generated data security serial number by the RLWE key to obtain second authentication data; and the first sending module is used for sending the second authentication data to a vehicle-mounted chip so that the vehicle-mounted chip decrypts the second authentication data by using the same RLWE key generated by taking the chip number as the seed code to obtain the resource safety serial number.

According to a fourth aspect of the present disclosure, there is provided a networked security defense device, the device comprising: the second encryption module is used for generating first authentication data based on symmetrical encryption of the component number; the second sending module is used for sending the first authentication data so that the data security server carries out first connection authentication based on decrypting the first authentication data; the second receiving module is used for receiving second authentication data, the second authentication data is generated by performing RLWE encryption on a randomly generated resource security sequence number by a resource security server by using an RLWE key, the RLWE key passes authentication based on the first connection line by the resource security server, and the RLWE key is generated by using a chip number as a seed code; and the second decryption module is used for decrypting the second authentication data by using the same RLWE key generated by using the chip number as the seed code to obtain the resource security serial number.

According to a fifth aspect of the present disclosure, there is provided an electronic device comprising:

at least one processor; and

a memory communicatively coupled to the at least one processor; wherein the content of the first and second substances,

the memory stores instructions executable by the at least one processor to enable the at least one processor to perform the methods of the present disclosure.

According to a sixth aspect of the present disclosure, there is provided a non-transitory computer readable storage medium having stored thereon computer instructions for causing the computer to perform the method of the present disclosure.

In the Internet of vehicles security defense method, first authentication data generated by symmetrically encrypting the vehicle-mounted chip based on the component number is decrypted, and first connection authentication is carried out; generating an RLWE key by taking the chip number as a seed code based on the first connection authentication pass; RLWE encryption is carried out on the randomly generated data security serial number by the RLWE key to obtain second authentication data; and sending the second authentication data to a vehicle-mounted chip so that the vehicle-mounted chip decrypts the second authentication data by using the same RLWE key generated by taking the chip number as the seed code to obtain the resource security serial number. The car networking security defense method disclosed by the invention adopts the post-quantum encryption to distribute the symmetric keys, which is beneficial to improving the connection security of the vehicle-mounted chip and the car factory server, and on the basis, the received symmetric encryption keys are utilized to carry out symmetric encryption transmission, so that the transmission efficiency can be accelerated.

It should be understood that the statements in this section are not intended to identify key or critical features of the embodiments of the present disclosure, nor are they intended to limit the scope of the present disclosure. Other features of the present disclosure will become apparent from the following description.

Drawings

The above and other objects, features and advantages of exemplary embodiments of the present disclosure will become readily apparent from the following detailed description, which proceeds with reference to the accompanying drawings. Several embodiments of the present disclosure are illustrated by way of example, and not by way of limitation, in the figures of the accompanying drawings and in which:

in the drawings, the same or corresponding reference numerals indicate the same or corresponding parts.

Fig. 1 shows a first implementation flow diagram of a security defense method of the internet of vehicles according to the embodiment of the present disclosure;

FIG. 2 is a schematic diagram illustrating a first component structure of a first embodiment of a security defense apparatus for internet of vehicles according to an embodiment of the present disclosure;

FIG. 3 shows a second implementation flow diagram of the security defense method of the Internet of vehicles according to the embodiment of the present disclosure;

FIG. 4 is a schematic structural diagram illustrating a second embodiment of the networked security defense device according to the present disclosure;

fig. 5 shows a schematic structural diagram of an electronic device according to an embodiment of the present disclosure.

Detailed Description

In order to make the objects, features and advantages of the present disclosure more apparent and understandable, the technical solutions in the embodiments of the present disclosure will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present disclosure, and it is apparent that the described embodiments are only a part of the embodiments of the present disclosure, and not all of the embodiments. All other embodiments, which can be derived by a person skilled in the art from the embodiments disclosed herein without making any creative effort, shall fall within the protection scope of the present disclosure.

Referring to fig. 1, an embodiment of the present disclosure provides a security defense method for internet of vehicles, where the method includes: s101, receiving first authentication data, wherein the first authentication data is generated by symmetrically encrypting a vehicle-mounted chip based on a component number; s102, based on the decrypted first authentication data, performing first connection authentication; s103, based on the first connection authentication, generating an RLWE key by taking the chip number as a seed code; s104, RLWE encryption is carried out on the randomly generated data security serial number by using the RLWE key to obtain second authentication data; s105, the second authentication data is sent to the vehicle-mounted chip, so that the vehicle-mounted chip decrypts the second authentication data by using the same RLWE key generated by taking the chip number as the seed code, and the resource security serial number is obtained.

The security defense method of the internet of vehicles can be used for the resource security server, can realize the security of information transmission between the resource security server and the vehicle-mounted chip, and further can establish a back quantum channel between the vehicle-mounted chip and the vehicle factory server to carry out the security connection transmission. In the method of the embodiment of the disclosure, first authentication data generated by symmetrically encrypting the vehicle-mounted chip based on the component number is decrypted, and first connection authentication is performed; generating an RLWE key by taking the chip number as a seed code based on the first connection authentication pass; RLWE encryption is carried out on the randomly generated data security serial number by using the RLWE key to obtain second authentication data; and sending the second authentication data to the vehicle-mounted chip so that the vehicle-mounted chip decrypts the second authentication data by using the same RLWE key generated by taking the chip number as the seed code to obtain the resource security serial number. The car networking security defense method disclosed by the invention adopts the post-quantum encryption to distribute the symmetric keys, which is beneficial to improving the connection security of the vehicle-mounted chip and the car factory server, and on the basis, the received symmetric encryption keys are utilized to carry out symmetric encryption transmission, so that the transmission efficiency can be accelerated.

In one embodiment, the car networking security defense method of the present disclosure includes: receiving user password data, symmetrically encrypting the resource safety serial number and the one-way encrypted user password by the chip number of the vehicle-mounted chip, and adding a safety serial number to generate the user password data; and obtaining the chip number according to the security serial number, decrypting the user password data based on the chip number to obtain the resource security serial number and the one-way encrypted user password, and verifying. In the embodiment of the disclosure, after receiving the user password data generated by the vehicle-mounted chip, the data security server obtains the corresponding chip number through the security serial number in the user password data, and obtains the one-way encrypted user password based on the decryption of the chip number, and can store the one-way encrypted user password for establishing the connection channel based on obtaining the one-way encrypted user password for the first time. If the one-way encrypted user password exists, the received one-way encrypted user password can be verified through comparison so as to further establish a connection channel.

In the embodiment of the present disclosure, decrypting the user password data specifically includes: and inquiring the corresponding chip number by using the security serial number in the user password data, and symmetrically decrypting by using the chip number to obtain the one-way encrypted user password and the resource security serial number.

In one implementation, the car networking security defense method of the present disclosure includes: verifying the obtained one-way encrypted user password based on the passing verification of the resource safety serial number; generating a single permission by using a random value based on the passing of the user password authentication of the one-way encryption; RLWE encryption is carried out on the single license by using an RLWE key generated by taking the chip number as a seed code to obtain single license data; and sending the single permission data to enable the vehicle-mounted chip and the garage server to decrypt the single permission data respectively by using the same RLWE key generated by taking the chip number as the seed code to obtain the single permission, wherein the single permission is used for forming a rear quantum channel between the vehicle-mounted chip and the garage server. In the embodiment of the disclosure, the post-quantum encryption is adopted to distribute the symmetric encryption keys to the car factory server and the vehicle-mounted chip so as to establish a post-quantum defense channel for connection transmission, which is helpful for ensuring the connection security of the car factory server and the vehicle-mounted chip. And the received symmetric encryption key can be used for symmetric encryption transmission, so that the message transmission and instruction rate and safety are improved. The multiple encrypted data security defense improves security.

In one embodiment, the first authentication data is generated by the vehicle-mounted chip based on symmetric encryption of the component number, and includes: the vehicle-mounted chip carries out unidirectional encryption on the component number to obtain a unidirectional encryption component number; the vehicle-mounted chip symmetrically encrypts the one-way encryption component number by using the chip number, and generates first authentication data after adding the security serial number. The chip number and the corresponding security serial number are respectively stored in the resource safety server, the vehicle-mounted chip and the vehicle factory server, the chip number is used for encrypting and is sent together with the security serial number, when decryption is carried out, the corresponding chip number is obtained according to the security serial number, and the chip number is used for decryption to obtain the data transmitted by the component number and the like.

In one embodiment, the first connection authentication is performed based on decrypting the first authentication data, and the method includes: obtaining a corresponding chip number by using the security serial number; carrying out symmetric decryption by using the chip number to obtain a one-way encryption component number; comparing the obtained one-way encryption component number with the stored one-way encryption component number; and the first connection authentication passes based on the comparison success. And obtaining the stored corresponding chip number according to the security serial number, carrying out symmetric decryption according to the chip number, comparing and verifying the decrypted one-way encryption component number with the stored one-way encryption component number, if the two numbers are the same, successfully comparing, and passing the first connection authentication, otherwise, failing to pass the first connection authentication.

In one embodiment, the generating the RLWE key using the chip number as the seed code includes: a random number is generated using the chip number as a seed code, and an RLWE key is generated using the random number. In the method of the embodiment of the present disclosure, the generating the RLWE key may specifically be generating a random number by using the chip number as a seed code, generating the RLWE key by using the random number, and encrypting and decrypting by using the RLWE key.

In the embodiment of the present disclosure, the component number may be established by a vehicle factory server, and the vehicle factory server establishes a dedicated component number for each vehicle, and the component number is stored in the vehicle factory server and stored in a vehicle chip of the corresponding vehicle. The vehicle factory server encrypts the assembly number in a single direction to form a single-direction encryption assembly number, symmetrically encrypts the single-direction encryption assembly number by using the chip number, transmits the information security server after adding the security serial number, inquires out a corresponding chip number by using the security serial number, symmetrically decrypts the chip number to obtain the single-direction encryption assembly number, and stores the single-direction encryption assembly number in the information security server for comparison with a connection line of the vehicle-mounted chip.

The symmetric encryption and decryption in the embodiment of the present disclosure may specifically adopt AES encryption and decryption. The user password may include any one of manually input information, biometric information, and the like.

Referring to fig. 2, an embodiment of the present disclosure provides a security defense apparatus for car networking, which may be used in a resource security server, and is used to implement the method of the above embodiment. The device comprises: the first receiving module is used for receiving first authentication data, and the first authentication data is generated by the vehicle-mounted chip through symmetrical encryption based on the component number; the first authentication module is used for carrying out first connection authentication based on the decrypted first authentication data; the first encryption module generates an RLWE key by taking the chip number as a seed code based on the first connection authentication pass; RLWE encryption is carried out on the randomly generated data security serial number by using the RLWE key to obtain second authentication data; and the first sending module is used for sending the second authentication data to the vehicle-mounted chip so that the vehicle-mounted chip decrypts the second authentication data by using the same RLWE key generated by taking the chip number as the seed code to obtain the resource security serial number.

In one implementation mode, the receiving module receives user password data, the user password data is generated by symmetrically encrypting the resource safety serial number and the one-way encrypted user password by using a chip number of the vehicle-mounted chip and adding a safety serial number; the first authentication module obtains a chip number according to the security serial number, decrypts user password data based on the chip number, obtains a resource security serial number and a one-way encrypted user password, and verifies the user password.

In one implementation, the first authentication module verifies the obtained one-way encrypted user password; sequentially verifying and passing the user password based on the resource security serial number and the one-way encryption, and generating single permission by using a random value; RLWE encryption is carried out on the single license by using an RLWE key generated by taking the chip number as a seed code to obtain single license data; the first sending module sends the single permission data, so that the vehicle-mounted chip and the garage server respectively decrypt the single permission data by using the same RLWE key generated by taking the chip number as the seed code to obtain the single permission, and the single permission is used for forming a back quantum channel between the vehicle-mounted chip and the garage server.

In one embodiment, the first authentication data is generated by the vehicle-mounted chip based on symmetric encryption of the component number, and includes: the vehicle-mounted chip carries out unidirectional encryption on the component number to obtain a unidirectional encryption component number; the vehicle-mounted chip symmetrically encrypts the one-way encryption component number by using the chip number, and generates first authentication data after adding the security serial number.

In one embodiment, the first authentication module performs the first connection authentication based on decrypting the first authentication data, and includes: the first authentication module obtains a corresponding chip number by using the security serial number; carrying out symmetric decryption by using the chip number to obtain a one-way encryption component number; comparing the obtained one-way encryption component number with the stored one-way encryption component number; and the first connection authentication passes based on the comparison success.

In one embodiment, the first authentication module generates the RLWE key using the chip number as a seed code, including: the first authentication module generates a random number by using the chip number as a seed code, and then generates an RLWE key by using the random number.

The method of the embodiment can be realized by the security defense device of the internet of vehicles according to the embodiment of the present disclosure, and the description of the embodiment of the security defense device of the internet of vehicles is similar to that of the embodiment of the method, so that the security defense device of the internet of vehicles has similar beneficial effects to the embodiment of the method, and therefore, the description is omitted. For technical details that are not disclosed yet in the description of the embodiments of the car networking security defense apparatus of the present disclosure, please refer to the description of the foregoing method embodiments of the present disclosure for understanding, and therefore, for brevity, will not be described again.

Referring to fig. 3, the present disclosure provides a security defense method for internet of vehicles, the method comprising: s301, generating first authentication data based on symmetric encryption of the component number; s302, first authentication data is sent so that the information security server carries out first connection authentication based on the decrypted first authentication data; s303, receiving second authentication data, wherein the second authentication data is generated by the resource security server through RLWE encryption of a randomly generated resource security sequence number by using an RLWE key, the RLWE key is passed through by the resource security server based on the first connection authentication, and the RLWE key is generated by using the chip number as a seed code; s304 decrypts the second authentication data by using the same RLWE key generated by using the chip number as the seed code to obtain the resource security serial number.

The security defense method for the internet of vehicles can be used for the vehicle-mounted chip, can realize the security of information transmission between the resource safety server and the vehicle-mounted chip, and further can establish a back quantum channel between the vehicle-mounted chip and the vehicle factory server to perform the security connection transmission. In the method of the embodiment of the disclosure, first authentication data is generated based on symmetric encryption of the component number and is sent, so that the resource security server performs first connection authentication based on decrypted first authentication data; the RLWE key generated by taking the chip number as the seed code decrypts the second authentication data to obtain the resource security sequence number; the second authentication data is obtained by performing RLWE encryption on the randomly generated resource security serial number by using an RLWE key generated by the resource security server by using the chip number as a seed code. The car networking security defense method of the embodiment of the disclosure adopts post-quantum encryption to distribute the symmetric keys, which is beneficial to improving the connection security between the vehicle-mounted chip and the car factory server, and on the basis, the received symmetric encryption keys are utilized to carry out symmetric encryption transmission, so that the transmission efficiency can be accelerated.

In one embodiment, the car networking security defense method of the present disclosure includes: symmetrically encrypting the information security serial number and the one-way encrypted user password by using the chip number, and adding a security serial number to generate user password data; and sending the user password data to enable the resource safety server to obtain the chip number according to the security serial number, decrypting the user password data based on the chip number to obtain the resource safety serial number and the one-way encrypted user password, and verifying. In the embodiment of the disclosure, the vehicle-mounted chip symmetrically encrypts the one-way encrypted user password by using the chip number, adds the security serial number to generate user password data, and sends the user password data to the resource security server, so that the resource security server obtains the corresponding chip number through the security serial number in the user password data, and can obtain the one-way encrypted user password by decrypting based on the chip number, and the resource security server can store the one-way encrypted user password for establishing the connection channel based on obtaining the one-way encrypted user password for the first time. If the one-way encrypted user password exists, the received one-way encrypted user password can be verified through comparison so as to further establish a connection channel.

In one embodiment, the car networking security defense method of the present disclosure includes: receiving single permission data, wherein the single permission data is obtained by performing RLWE encryption on the single permission by the resource security server by using an RLWE key generated by taking a chip number as a seed code, and the single permission is sequentially verified and passed by the resource security server based on a user password for performing one-way encryption and is generated by using a random value; and decrypting the single license data by using the same RLWE key generated by taking the chip number as the seed code to obtain the single license so as to form a rear quantum channel between the vehicle-mounted chip and the garage server by using the single license. In the embodiment of the disclosure, the vehicle-mounted chip receives single license data obtained by performing RLWE encryption on a single license by the resource security server by using the RLWE key generated by using the chip number as the seed code, decrypts the single license data by using the same RLWE key generated by using the chip number as the seed code to obtain the single license, and forms a back quantum channel with the vehicle-mounted server obtaining the single license in the same way. And the received symmetric encryption key can be used for symmetric encryption transmission, so that the message transmission rate and the command transmission security are improved. The multiple encrypted data security defense improves security.

In one embodiment, generating the first authentication data based on component number symmetric encryption comprises: carrying out one-way encryption on the component number to obtain a one-way encryption component number; and symmetrically encrypting the one-way encryption component number by using the chip number, and generating first authentication data after adding the security serial number. The chip number and the corresponding security serial number are respectively stored in the resource safety server, the vehicle-mounted chip and the vehicle factory server, the chip number is used for encrypting and is sent together with the security serial number, when decryption is carried out, the corresponding chip number is obtained according to the security serial number, and the chip number is used for decryption to obtain the data transmitted by the component number and the like.

In one embodiment, the performing, by the data security server, the first connection authentication based on decrypting the first authentication data includes: the information security server obtains a corresponding chip number by using the security sequence number; the information security server carries out symmetric decryption by using the chip number to obtain a one-way encryption component number; and the information security server compares the obtained one-way encryption component number with the stored one-way encryption component number, and the first connection authentication is passed based on the successful comparison. And obtaining the stored corresponding chip number according to the security serial number, carrying out symmetric decryption according to the chip number, comparing and verifying the decrypted one-way encryption component number with the stored one-way encryption component number, if the two numbers are the same, successfully comparing, and passing the first connection authentication, otherwise, failing to pass the first connection authentication.

In one embodiment, decrypting the second authentication data with the same RLWE key generated using the chip number as the seed code comprises: generating a random number by using the chip number as a seed code, and generating an RLWE key by using the random number; the second authentication data is decrypted by using the RLWE key to obtain the serial number of the resource safety. In the method of the embodiment of the present disclosure, the generating the RLWE key may specifically be generating a random number by using the chip number as a seed code, generating the RLWE key by using the random number, and encrypting and decrypting by using the RLWE key.

Referring to fig. 4, the embodiment of the present disclosure provides a security defense device for a vehicle networking, where the device is used for a vehicle-mounted chip, and the method of the embodiment can be implemented. The device includes: the second encryption module is used for generating first authentication data based on symmetrical encryption of the component number; the second sending module is used for sending the first authentication data so that the resource safety server carries out first connection authentication based on the decrypted first authentication data; the second receiving module is used for receiving second authentication data, the second authentication data is generated by performing RLWE encryption on a randomly generated resource security sequence number by the resource security server through an RLWE key, the RLWE key passes authentication based on the first connecting line by the resource security server, and the RLWE key is generated by taking the chip number as a seed code; and the second decryption module is used for decrypting the second authentication data by using the same RLWE key generated by taking the chip number as the seed code to obtain the resource security serial number.

In one implementation mode, the second encryption module symmetrically encrypts the data security serial number and the one-way encrypted user password by using the chip number, and adds the security serial number to generate user password data; and sending the user password data to enable the resource safety server to obtain a chip number according to the security sequence number, decrypting the user password data based on the chip number to obtain a resource safety sequence number and a one-way encrypted user password, and verifying.

In one implementation, the second receiving module receives single permission data, the single permission data is obtained by performing RLWE encryption on the single permission by the resource security server by using an RLWE key generated by using a chip number as a seed code, and the single permission is sequentially verified and passed by the resource security server based on the resource security serial number and a user password encrypted in a one-way mode and is generated by using a random value; the second authentication module decrypts the single-license data by using the same RLWE key generated by using the chip number as the seed code to obtain the single license so as to form a rear quantum channel between the vehicle-mounted chip and the garage server by using the single license.

In one embodiment, the second encryption module generates the first authentication data based on component number symmetric encryption, and the method includes: the second encryption module performs one-way encryption on the component number to obtain a one-way encryption component number; and symmetrically encrypting the one-way encryption component number by using the chip number, and adding the security serial number to generate first authentication data.

In one embodiment, the performing, by the data security server, the first connection authentication based on decrypting the first authentication data includes: the information security server obtains a corresponding chip number by using the security serial number; the information security server carries out symmetric decryption by using the chip number to obtain a one-way encryption component number; and the information security server compares the obtained one-way encryption component number with the stored one-way encryption component number, and the first connection authentication is passed based on the successful comparison.

In one embodiment, the second authentication module decrypts the second authentication data with the same RLWE key generated by using the chip number as the seed code, and includes: the second authentication module generates a random number by using the chip number as a seed code, and then generates an RLWE key by using the random number; the RLWE key is used to decrypt the second authentication data to obtain the serial number of the data security.

The method of the embodiment can be realized by the security defense device of the internet of vehicles according to the embodiment of the present disclosure, and the above description of the embodiment of the security defense device of the internet of vehicles is similar to the description of the embodiment of the method, and has similar beneficial effects to the embodiment of the method, and therefore, the description is omitted. For technical details that are not disclosed yet in the description of the embodiments of the car networking security defense apparatus of the present disclosure, please refer to the description of the foregoing method embodiments of the present disclosure for understanding, and therefore, for brevity, will not be described again.

The embodiment of the disclosure provides a security defense system for internet of vehicles, the method and the device of the embodiment can be used for the security defense system for internet of vehicles, the above description about the embodiment of the method and the embodiment of the device can be used for understanding the system of the embodiment of the disclosure, and the following description about the embodiment of the system can also be used for understanding the method and the device of each embodiment. The Internet of vehicles security defense system comprises a resource safety server, a vehicle-mounted chip and a vehicle factory server. The internet of vehicles security defense system may implement one or more of the following stages, or some steps in one stage.

In the data establishing stage, the resource safety server generates a chip number and a corresponding safety serial number by using a random value, the chip number and the safety serial number are respectively stored in the resource safety server and the vehicle factory server, and the vehicle-mounted chip is manufactured by the chip number and the safety serial number, so that the resource safety server, the vehicle factory server and the vehicle-mounted chip all have the same group of chip numbers and the corresponding safety serial numbers. The truck factory server establishes exclusive component numbers for all vehicles, the component numbers are stored in the truck factory server and stored in a vehicle-mounted chip of the matched vehicle, the truck factory server performs one-way encryption on the component numbers to form one-way encryption component numbers, the chip numbers are used for performing AES encryption on the one-way encryption component numbers, the security serial numbers are added, and then the one-way encryption component numbers are transmitted to the resource safety server. And the resource safety server inquires out a corresponding chip number by using the safety serial number, and then carries out AES decryption on the chip number to obtain a one-way encryption component number, and the one-way encryption component number is stored for vehicle-mounted chip connection comparison.

And vehicle connection authentication, wherein the vehicle-mounted chip performs one-way encryption on the component number to obtain a one-way encryption component number, and then performs AES encryption on the one-way encryption component number by using the chip number, adds a security serial number and transmits the security serial number to the resource security server. And the resource security server queries the corresponding chip number by using the security serial number, and then carries out AES decryption on the chip number to obtain the one-way encryption component number. Further, the information security server compares the obtained one-way encryption component number with the stored one-way encryption component number to complete the authentication connection in the first stage. After the one-way encryption component numbers of the vehicles are received and are matched, the resource security server generates a resource security sequence number by using a random value, generates a random number by using a chip number as a seed code, generates an RLWE (radio link WeChat) key by using the random number, performs RLWE encryption on the resource security sequence number by using the RLWE key to generate an RLWE encryption resource security sequence number, sends the RLWE encryption resource security sequence number to the vehicle-mounted chip, generates the same random number by using the chip number as the seed code by using the vehicle-mounted chip, generates the RLWE key by using the random number, decrypts the RLWE encryption resource security sequence number to obtain the resource security sequence number, and stores the resource security sequence number in the vehicle-mounted chip to finish the authentication connection of the second stage.

Establishing a connection password, setting and storing a user password after the vehicle-mounted chip obtains the information security serial number, firstly carrying out unidirectional encryption on the user password to obtain a unidirectional encrypted user password and adding the information security serial number, then carrying out AES encryption by using the chip number, finally adding the security serial number to obtain user password data, sending the user password data to the information security server, inquiring the corresponding chip number by the information security server by using the security serial number, carrying out AES decryption by using the chip number to obtain the unidirectional encrypted user password and the information security serial number, verifying the received information security serial number, comparing the received information security serial number with the information security serial number stored on the information security server, and passing the verification. If the one-way encrypted user password is received for the first time, the one-way encrypted user password is further stored in the resource safety database after the verification of the received resource safety serial number is passed.

If the one-way encrypted user password is not received for the first time, the data security server compares the received one-way encrypted user password after the received data security serial number passes verification every time the data security server receives the one-way encrypted user password, judges whether the received one-way encrypted user password is correct or not, generates a single permission by using a random value, performs RLWE encryption on the single permission by using an RLWE key generated by using a chip number as a seed code to obtain the RLWE encrypted single permission, sends the RLWE encrypted single permission to a vehicle-mounted chip and the vehicle factory server, generates the same random number by using the chip number as the seed code, generates the same RLWE key by using the random number, and finally decrypts the RLWE encrypted single permission by using the RLWE key to obtain the single permission. The single license is used for symmetric encryption and decryption, and a back quantum channel is formed between the vehicle-mounted chip and the vehicle factory server for safe connection transmission between the vehicle-mounted chip and the vehicle factory server.

The present disclosure also provides an electronic device and a readable storage medium according to an embodiment of the present disclosure.

FIG. 5 illustrates a schematic block diagram of an example electronic device 500 that can be used to implement embodiments of the present disclosure. Electronic devices are intended to represent various forms of digital computers, such as laptops, desktops, workstations, personal digital assistants, servers, blade servers, mainframes, and other appropriate computers. The electronic device may also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions, are meant to be examples only, and are not intended to limit implementations of the disclosure described and/or claimed herein.

As shown in fig. 5, the apparatus 500 comprises a computing unit 501 which may perform various appropriate actions and processes in accordance with a computer program stored in a Read Only Memory (ROM) 502 or a computer program loaded from a storage unit 508 into a Random Access Memory (RAM) 503. In the RAM 503, various programs and data required for the operation of the device 500 can also be stored. The calculation unit 501, the ROM 502, and the RAM 503 are connected to each other by a bus 504. An input/output (I/O) interface 505 is also connected to bus 504.

A number of components in the device 500 are connected to the I/O interface 505, including: an input unit 506 such as a keyboard, a mouse, or the like; an output unit 507 such as various types of displays, speakers, and the like; a storage unit 508, such as a magnetic disk, optical disk, or the like; and a communication unit 509 such as a network card, modem, wireless communication transceiver, etc. The communication unit 509 allows the device 500 to exchange information/data with other devices through a computer network such as the internet and/or various telecommunication networks.

The computing unit 501 may be a variety of general and/or special purpose processing components with processing and computing capabilities. Some examples of the computing unit 501 include, but are not limited to, a Central Processing Unit (CPU), a Graphics Processing Unit (GPU), various dedicated Artificial Intelligence (AI) computing chips, various computing units running machine learning model algorithms, a Digital Signal Processor (DSP), and any suitable processor, controller, microcontroller, and so forth. The computing unit 501 performs the various methods and processes described above, such as the internet of vehicles security defense methods. For example, in some embodiments, the internet of vehicles security defense method may be implemented as a computer software program tangibly embodied in a machine-readable medium, such as storage unit 508. In some embodiments, part or all of the computer program may be loaded and/or installed onto the device 500 via the ROM 502 and/or the communication unit 509. When loaded into RAM 503 and executed by computing unit 501, may perform one or more of the steps of the above-described internet of vehicles security defense method. Alternatively, in other embodiments, the computing unit 501 may be configured to perform the internet of vehicles security defense method by any other suitable means (e.g., by way of firmware).

Various implementations of the systems and techniques described here above may be implemented in digital electronic circuitry, integrated circuitry, field Programmable Gate Arrays (FPGAs), application Specific Integrated Circuits (ASICs), application Specific Standard Products (ASSPs), system on a chip (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and/or combinations thereof. These various embodiments may include: implemented in one or more computer programs that are executable and/or interpretable on a programmable system including at least one programmable processor, which may be special or general purpose, receiving data and instructions from, and transmitting data and instructions to, a storage system, at least one input device, and at least one output device.

Program code for implementing the methods of the present disclosure may be written in any combination of one or more programming languages. These program codes may be provided to a processor or controller of a general purpose computer, special purpose computer, or other programmable data processing apparatus, such that the program codes, when executed by the processor or controller, cause the functions/operations specified in the flowchart and/or block diagram to be performed. The program code may execute entirely on the machine, partly on the machine, as a stand-alone software package partly on the machine and partly on a remote machine or entirely on the remote machine or server.

In the context of this disclosure, a machine-readable medium may be a tangible medium that can contain, or store a program for use by or in connection with an instruction execution system, apparatus, or device. The machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. More specific examples of a machine-readable storage medium would include an electrical connection based on one or more wires, a portable computer diskette, a hard disk, a Random Access Memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

To provide for interaction with a user, the systems and techniques described here can be implemented on a computer having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to a user; and a keyboard and a pointing device (e.g., a mouse or a trackball) by which a user can provide input to the computer. Other kinds of devices may also be used to provide for interaction with a user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form, including acoustic, speech, or tactile input.

The systems and techniques described here can be implemented in a computing system that includes a back-end component (e.g., as a data server), or that includes a middleware component (e.g., an application server), or that includes a front-end component (e.g., a user computer having a graphical user interface or a web browser through which a user can interact with an implementation of the systems and techniques described here), or any combination of such back-end, middleware, or front-end components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: local Area Networks (LANs), wide Area Networks (WANs), and the Internet.

The computer system may include clients and servers. A client and server are generally remote from each other and typically interact through a communication network. The relationship of client and server arises by virtue of computer programs running on the respective computers and having a client-server relationship to each other. The server may be a cloud server, a server of a distributed system, or a server combining a blockchain.

It should be understood that various forms of the flows shown above, reordering, adding or deleting steps, may be used. For example, the steps described in the present disclosure may be executed in parallel, sequentially, or in different orders, and are not limited herein as long as the desired results of the technical solutions disclosed in the present disclosure can be achieved.

Furthermore, the terms "first", "second" and "first" are used for descriptive purposes only and are not to be construed as indicating or implying relative importance or implicitly indicating the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of the feature. In the description of the present disclosure, "a plurality" means two or more unless specifically limited otherwise.

The above description is only for the specific embodiments of the present disclosure, but the scope of the present disclosure is not limited thereto, and any person skilled in the art can easily think of the changes or substitutions within the technical scope of the present disclosure, and shall cover the scope of the present disclosure. Therefore, the protection scope of the present disclosure should be subject to the protection scope of the claims.

Claims (16)

1. A method for defending safety of internet of vehicles, which is characterized in that the method comprises the following steps:

receiving first authentication data, wherein the first authentication data is generated by symmetrically encrypting the vehicle-mounted chip based on the component number;

performing a first connection authentication based on decrypting the first authentication data;

generating an RLWE key by taking the chip number as a seed code based on the first connection authentication pass;

performing RLWE encryption on the randomly generated resource security sequence number by using the RLWE key to obtain second authentication data;

and sending the second authentication data to a vehicle-mounted chip so that the vehicle-mounted chip decrypts the second authentication data by using the same RLWE key generated by taking the chip number as the seed code to obtain the resource security serial number.

2. The method of claim 1, further comprising:

receiving user password data, wherein the user password data is generated by symmetrically encrypting the resource safety serial number and the one-way encrypted user password by using a chip number of a vehicle-mounted chip and adding a safety serial number;

and acquiring a chip number according to the security serial number, and decrypting the user password data based on the chip number to obtain the resource security serial number and the one-way encrypted user password.

3. The method of claim 2, further comprising:

verifying the obtained one-way encrypted user password based on the passing verification of the resource safety serial number;

generating a one-time license using a random value based on the one-way encrypted user password authentication pass;

RLWE encryption is carried out on the single license by using an RLWE key generated by taking the chip number as a seed code to obtain single license data;

and sending the single permission data to enable the vehicle-mounted chip and the garage server to decrypt the single permission data respectively by using the same RLWE key generated by taking the chip number as the seed code to obtain the single permission, wherein the single permission is used for forming a rear quantum channel between the vehicle-mounted chip and the garage server.

4. The method of claim 1, wherein the first authentication data is generated by a vehicle chip based on component number symmetric encryption, comprising:

the vehicle-mounted chip carries out unidirectional encryption on the component number to obtain a unidirectional encryption component number;

and the vehicle-mounted chip symmetrically encrypts the one-way encryption component number by using a chip number, and generates the first authentication data after adding a security serial number.

5. The method of claim 4, wherein performing a first connection authentication based on decrypting the first authentication data comprises:

obtaining a corresponding chip number by using the security serial number;

symmetrically decrypting the chip number to obtain the one-way encryption component number;

comparing the obtained one-way encryption component number with the stored one-way encryption component number;

and the first connection authentication is passed based on the comparison success.

6. The method of claim 1, wherein generating the RLWE key using the chip number as a seed code comprises:

a random number is generated by using the chip number as a seed code, and an RLWE key is generated by using the random number.

7. A method for defending safety of internet of vehicles, which is characterized in that the method comprises the following steps:

generating first authentication data based on component number symmetric encryption;

sending the first authentication data to enable the data security server to perform first connection authentication based on decrypting the first authentication data;

receiving second authentication data, wherein the second authentication data is generated by performing RLWE encryption on a randomly generated resource security sequence number by a resource security server by using an RLWE key, the RLWE key is passed through by the resource security server based on the first connection authentication, and the RLWE key is generated by using a chip number as a seed code;

and decrypting the second authentication data by using the same RLWE key generated by taking the chip number as the seed code to obtain the resource safety serial number.

8. The method of claim 7, further comprising:

symmetrically encrypting the data security serial number and the one-way encrypted user password by using a chip number, and adding a security serial number to generate user password data;

and sending the user password data to enable the resource safety server to obtain a chip number according to the safety serial number, decrypting the user password data based on the chip number to obtain the resource safety serial number and the one-way encrypted user password, and verifying.

9. The method of claim 8, further comprising:

receiving single permission data, wherein the single permission data is obtained by performing RLWE encryption on a single permission by a resource security server by using an RLWE key generated by using a chip number as a seed code, and the single permission is sequentially verified and passed by the resource security server based on the resource security serial number and the one-way encrypted user password and is generated by using a random value;

and decrypting the single permission data by using the same RLWE key generated by taking the chip number as the seed code to obtain the single permission so as to form a rear quantum channel between the vehicle-mounted chip and the garage server by using the single permission.

10. The method of claim 7, wherein generating the first authentication data based on component number symmetric encryption comprises:

carrying out one-way encryption on the component number to obtain a one-way encryption component number;

and symmetrically encrypting the one-way encryption component number by using a chip number, and adding a security serial number to generate the first authentication data.

11. The method of claim 10, wherein the data security server performs a first connection authentication based on decrypting the first authentication data, comprising:

the information security server obtains a corresponding chip number by using the security serial number;

the information security server carries out symmetric decryption by using the chip number to obtain the one-way encryption component number;

and the information security server compares the obtained one-way encryption component number with the stored one-way encryption component number, and the first connection authentication is passed based on the successful comparison.

12. The method of claim 7, wherein decrypting the second authentication data with the same RLWE key generated using the chip number as the seed code comprises:

generating a random number by using the chip number as a seed code, and generating an RLWE key by using the random number;

and decrypting the second authentication data by using the RLWE key to obtain the serial number of the resource safety.

13. A networked security defense apparatus, the apparatus comprising:

the first receiving module is used for receiving first authentication data, and the first authentication data is generated by the vehicle-mounted chip based on component number symmetric encryption;

the first authentication module is used for carrying out first connection authentication based on the decrypted first authentication data;

the first encryption module is used for generating an RLWE key by taking the chip number as a seed code based on the first connection authentication; RLWE encryption is carried out on the randomly generated data security serial number by the RLWE key to obtain second authentication data;

and the first sending module is used for sending the second authentication data to a vehicle-mounted chip so that the vehicle-mounted chip decrypts the second authentication data by using the same RLWE key generated by taking the chip number as the seed code to obtain the resource safety serial number.

14. A networked security defense apparatus, the apparatus comprising:

the second encryption module is used for generating first authentication data based on symmetrical encryption of the component number;

the second sending module is used for sending the first authentication data so that the data security server carries out first connection authentication based on decrypting the first authentication data;

the second receiving module is used for receiving second authentication data, the second authentication data is generated by performing RLWE encryption on a randomly generated resource security sequence number by a resource security server by using an RLWE key, the RLWE key passes authentication based on the first connection line by the resource security server, and the RLWE key is generated by using a chip number as a seed code;

and the second authentication module is used for decrypting the second authentication data by using the same RLWE key generated by using the chip number as the seed code to obtain the resource security serial number.

15. An electronic device, comprising:

at least one processor; and

a memory communicatively coupled to the at least one processor; wherein the content of the first and second substances,

the memory stores instructions executable by the at least one processor to enable the at least one processor to perform the method of any one of claims 1-12.

16. A non-transitory computer readable storage medium storing computer instructions for causing a computer to perform the method according to any one of claims 1-12.

Images