CN117201047A

CN117201047A - Security authentication method, security authentication device, electronic device, and computer-readable storage medium

Info

Publication number: CN117201047A
Application number: CN202210604326.XA
Authority: CN
Inventors: 尹磊; 郑丹
Original assignee: WM Smart Mobility Shanghai Co Ltd
Current assignee: WM Smart Mobility Shanghai Co Ltd
Priority date: 2022-05-30
Filing date: 2022-05-30
Publication date: 2023-12-08

Abstract

The embodiment of the application provides a security authentication method, a security authentication device, electronic equipment and a computer readable storage medium, and relates to the technical field of security authentication. The method comprises the following steps: acquiring a first security certificate sent by a mobile phone terminal, encrypting initial information through a public key in a preset first key pair if the first security certificate passes authentication to obtain first encrypted information, indicating the mobile phone terminal to decrypt the first encrypted information according to a private key in a second key pair to obtain first decrypted information, encrypting the first decrypted information through the public key in the second key pair to obtain and returning second encrypted information; receiving the second encrypted information, and decrypting the second encrypted information through a private key in the first key pair to obtain second decrypted information; and if the initial information is consistent with the second decryption information, establishing data connection with the mobile phone terminal. The embodiment of the application verifies the safety of the mobile phone terminal through the double authentication of certificate authentication and key authentication so as to ensure the safety of the vehicle-mounted terminal.

Description

Security authentication method, security authentication device, electronic device, and computer-readable storage medium

Technical Field

The present application relates to the field of security authentication technologies, and in particular, to a security authentication method, device, electronic apparatus, and computer readable storage medium.

Background

Because of the intelligent development of automobiles, the automobile host machine of the automobile terminal cannot meet some intelligent scenes, extra cost is increased if the performance of the automobile host machine is improved to meet more intelligent scenes, and in order to solve the problem, technicians choose to access the mobile phone terminal into the automobile terminal, take the mobile phone terminal as the automobile host machine of the automobile terminal, and meanwhile, no extra expense is caused when the automobile host machine with high performance is provided for the automobile terminal.

The mobile phone terminal can bring a series of benefits as a host of the mobile phone, but brings some potential safety hazards at the same time. The data in the vehicle-mounted terminal comprises vehicle system data, vehicle driving data and other vehicle-mounted terminal related data, and also comprises user privacy data, so that the mobile phone terminal is connected with the vehicle-mounted terminal as a vehicle host, the mobile phone terminal can directly read the data, and meanwhile leakage of the data is easy to cause.

The existing authentication method is a hardware authentication method, and matched encryption and decryption hardware components (such as encryption and decryption chips) are additionally implanted in the mobile phone terminal and the vehicle-mounted terminal, so that the authentication method of the additionally implanted hardware ensures the safety of data interaction between the mobile phone terminal and the vehicle-mounted terminal to a certain extent, but the flexibility of the hardware authentication method is poor due to the fact that the hardware components are implanted in both the vehicle-mounted terminal and the mobile phone terminal, and meanwhile, the purchase cost and the use cost of the hardware components of a user are increased.

Disclosure of Invention

The embodiment of the application provides a method, a device, electronic equipment, a computer readable storage medium and a computer program product for safety authentication, which can solve the problem of high cost of a hardware component authentication method. The technical scheme is as follows:

according to a first aspect of an embodiment of the present application, there is provided a security authentication method applied to a vehicle-mounted terminal, the method including:

acquiring a first security certificate sent by a mobile phone terminal, and authenticating the first security certificate;

if the authentication is passed, encrypting the initial information through a public key in a preset first key pair to obtain first encrypted information;

The first encryption information is sent to the mobile phone terminal to instruct the mobile phone terminal to decrypt the first encryption information according to the private key in the second key pair to obtain first decryption information, the first decryption information is encrypted through the public key in the second key pair to obtain second encryption information, and the second encryption information is returned to the vehicle-mounted terminal;

receiving second encryption information sent by the mobile phone terminal, and decrypting the second encryption information through a private key in the first key pair to obtain second decryption information;

and if the initial information is consistent with the second decryption information, establishing data connection with the mobile phone terminal.

In one possible implementation manner, the vehicle-mounted terminal is pre-implanted with a second security certificate; authenticating the first security certificate includes:

the first security certificate is authenticated based on the second security certificate.

In one possible implementation, after authenticating the first security certificate according to the second security certificate, the method further includes:

if the authentication is not passed, recording first log information, sending first alarm information to the mobile phone terminal, and terminating subsequent authentication; the first alarm information is used for prompting that connection cannot be established with the vehicle-mounted terminal due to certificate authentication failure.

In one possible implementation, after obtaining the second decryption information, the method further includes:

if the initial information is inconsistent with the second decryption information, recording second log information, sending second alarm information to the mobile phone terminal, and rejecting data interaction; the second alarm information is used for prompting that connection cannot be established with the vehicle-mounted terminal due to failure of key authentication.

In one possible implementation manner, before obtaining the first security certificate sent by the mobile phone terminal, the method further includes:

acquiring account information of the mobile phone terminal, authenticating the account information, and if the authentication is passed, determining to send a certificate acquisition request to acquire a first security certificate of the mobile phone terminal.

According to a second aspect of the embodiment of the present application, there is provided a security authentication method applied to a mobile phone terminal, the method including:

the method comprises the steps of sending a first security certificate to a vehicle-mounted terminal to instruct the vehicle-mounted terminal to authenticate the first security certificate, encrypting initial information through a public key in a preset first key pair after authentication is passed, obtaining first encrypted information, and sending the first encrypted information to a mobile phone terminal;

receiving first encryption information sent by the vehicle-mounted terminal, decrypting the first encryption information according to a private key in a second key pair to obtain first decryption information, and encrypting the first decryption information through a public key in the second key pair to obtain second encryption information;

And returning the second encrypted information to the vehicle-mounted terminal so as to instruct the vehicle-mounted terminal to decrypt the second encrypted information according to the private key in the first key pair to obtain second decrypted information, and establishing data connection with the mobile phone terminal when the initial information and the second decrypted information are determined to be consistent.

According to a third aspect of the embodiment of the present application, there is provided a security authentication apparatus applied to a vehicle-mounted terminal, the apparatus including:

the certificate authentication module is used for acquiring a first security certificate sent by the mobile phone terminal and authenticating the first security certificate;

the first encryption information determining module is used for encrypting the initial information through a public key in a preset first key pair if the authentication is passed, so as to obtain first encryption information;

the first encryption information sending module is used for sending the first encryption information to the mobile phone terminal to instruct the mobile phone terminal to decrypt the first encryption information according to the private key in the second key pair to obtain first decryption information, encrypting the first decryption information through the public key in the second key pair to obtain second encryption information, and returning the second encryption information to the vehicle-mounted terminal;

the second decryption information obtaining module is used for receiving second encryption information sent by the mobile phone terminal, and decrypting the second encryption information through a private key in the first key pair to obtain second decryption information;

And the data connection establishment module is used for establishing data connection with the mobile phone terminal if the initial information and the second decryption information are determined to be consistent.

According to a fourth aspect of the embodiment of the present application, there is provided a security authentication device applied to a mobile phone terminal, the device including:

the mobile phone comprises a first safety certificate sending module, a second safety certificate sending module and a second safety certificate sending module, wherein the first safety certificate sending module is used for sending a first safety certificate to the vehicle-mounted terminal so as to instruct the vehicle-mounted terminal to authenticate the first safety certificate, encrypting initial information through a public key in a preset first key pair after the authentication is passed, obtaining first encrypted information, and sending the first encrypted information to the mobile phone terminal;

the second encryption information obtaining module is used for receiving the first encryption information sent by the vehicle-mounted terminal, decrypting the first encryption information according to the private key in the second key pair to obtain first decryption information, and encrypting the first decryption information through the public key in the second key pair to obtain second encryption information;

the data connection establishment module is used for returning the second encryption information to the vehicle-mounted terminal so as to instruct the vehicle-mounted terminal to decrypt the second encryption information according to the private key in the first key pair to obtain second decryption information, and establishing data connection with the mobile phone terminal when the initial information and the second decryption information are determined to be consistent.

According to a fifth aspect of embodiments of the present application there is provided an electronic device comprising a memory, a processor and a computer program stored on the memory, the processor implementing the steps of the method as provided in the first and second aspects when the program is executed.

According to a sixth aspect of embodiments of the present application, there is provided a computer readable storage medium having stored thereon a computer program which, when executed by a processor, implements the steps of the method as provided by the first and second aspects.

According to a seventh aspect of embodiments of the present application, there is provided a computer program product comprising computer instructions stored in a computer readable storage medium, which when read from the computer readable storage medium by a processor of a computer device, cause the computer device to perform the steps of the method as provided in the first and second aspects.

The technical scheme provided by the embodiment of the application has the beneficial effects that: according to the embodiment of the application, the first security certificate sent by the mobile phone terminal is acquired, and the first security certificate is authenticated; if the authentication is passed, encrypting the initial information through a public key in a preset first key pair to obtain first encrypted information; the first encryption information is sent to the mobile phone terminal to instruct the mobile phone terminal to decrypt the first encryption information according to the private key in the second key pair to obtain first decryption information, the first decryption information is encrypted through the public key in the second key pair to obtain second encryption information, and the second encryption information is returned to the vehicle-mounted terminal; receiving second encryption information sent by the mobile phone terminal, and decrypting the second encryption information through a private key in the first key pair to obtain second decryption information; and if the initial information is consistent with the second decryption information, establishing data connection with the mobile phone terminal. The embodiment of the application determines the safety of the mobile phone terminal through the double authentication of the certificate authentication and the secret key authentication before the data interaction with the mobile phone terminal, so that the vehicle-mounted terminal can perform the data interaction with the safe mobile phone terminal, and the safety of the data of the vehicle-mounted terminal is ensured.

Drawings

In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings that are required to be used in the description of the embodiments of the present application will be briefly described below.

Fig. 1 is a schematic structural diagram of a conventional vehicle-mounted terminal according to an embodiment of the present application;

fig. 2 is a schematic structural diagram of a mobile phone terminal as a host of a vehicle according to an embodiment of the present application;

fig. 3 is a flow chart of a method for security authentication according to an embodiment of the present application;

FIG. 4 is a flowchart illustrating another method for security authentication according to an embodiment of the present application;

fig. 5 is a schematic flow chart of interaction between a vehicle-mounted terminal and a mobile phone terminal according to an embodiment of the present application;

fig. 6 is a schematic structural diagram of a security authentication device according to an embodiment of the present application;

fig. 7 is a schematic structural diagram of another security authentication device according to an embodiment of the present application;

fig. 8 is a schematic structural diagram of an electronic device according to an embodiment of the present application.

Detailed Description

Embodiments of the present application are described below with reference to the drawings in the present application. It should be understood that the embodiments described below with reference to the drawings are exemplary descriptions for explaining the technical solutions of the embodiments of the present application, and the technical solutions of the embodiments of the present application are not limited.

As used herein, the singular forms "a", "an", "the" and "the" are intended to include the plural forms as well, unless expressly stated otherwise, as understood by those skilled in the art. It will be further understood that the terms "comprises" and "comprising," when used in this specification, specify the presence of stated features, information, data, steps, operations, elements, and/or components, but do not preclude the presence or addition of other features, information, data, steps, operations, elements, components, and/or groups thereof, all of which may be included in the present specification. It will be understood that when an element is referred to as being "connected" or "coupled" to another element, it can be directly connected or coupled to the other element or intervening elements may be present. Further, "connected" or "coupled" as used herein may include wirelessly connected or wirelessly coupled. The term "and/or" as used herein indicates that at least one of the items defined by the term, e.g., "a and/or B" may be implemented as "a", or as "B", or as "a and B".

For the purpose of making the objects, technical solutions and advantages of the present application more apparent, the embodiments of the present application will be described in further detail with reference to the accompanying drawings.

With the development of intelligent automobile technology, automobile cabins are developed towards intellectualization, namely, larger and clear screens, richer applications, better interaction, smoother touch control, faster network speed and the like, and the performances are developed towards the upgrading direction of mobile phones.

The existing intelligent cabin mainly comprises a vehicle host, a vehicle screen and a vehicle networking module, as shown in fig. 1, the structure diagram of the existing vehicle-mounted terminal is exemplarily shown, the vehicle host controls the whole vehicle, the whole vehicle is connected to a whole vehicle communication network, one end of the vehicle host is connected with the vehicle display screen through LVDS, the vehicle display screen can display navigation, weather and other information, the other end of the vehicle host is connected with the vehicle networking module through LVDS, and the vehicle networking module is connected with a remote server through a 4G/5G network.

Because of the intelligent development of automobiles, the host machine of the automobile-mounted terminal can not meet some intelligent scenes, if the performance of the host machine of the automobile-mounted terminal is improved to meet more intelligent scenes, additional cost is increased, in order to solve the problem, a technician selects to connect the mobile phone terminal into the automobile-mounted terminal, and uses the mobile phone terminal as the host machine of the automobile-mounted terminal, so that a plurality of difficulties in use of the automobile-mounted terminal when the automobile-mounted terminal is taken off can be solved:

1) The vehicle has limited usable application;

2) User characteristic data such as audio and video of interest to a vehicle owner, difficulty in synchronizing a mobile phone with a vehicle end;

3) The central control system has long hardware and software upgrading period and high cost.

The structure schematic diagram of taking the mobile phone terminal as a host machine of the automobile is shown in fig. 2, the mobile phone is connected with the communication conversion module of the automobile end through Type C or Lighting as the host machine of the automobile, and then is connected with the communication network of the whole automobile through CAN/Ethernet, and the mobile phone terminal is connected with the remote server through a 4G/5G network; the vehicle-end communication conversion module is connected with the standby remote terminal through LVDS, and meanwhile the standby remote terminal is connected with the remote server through standby networking.

The application provides a security authentication method, a security authentication device, an electronic device, a computer readable storage medium and a computer program product, which aim to solve the technical problems in the prior art.

The technical solutions of the embodiments of the present application and technical effects produced by the technical solutions of the present application are described below by describing several exemplary embodiments. It should be noted that the following embodiments may be referred to, or combined with each other, and the description will not be repeated for the same terms, similar features, similar implementation steps, and the like in different embodiments.

The embodiment of the application provides a security authentication method applied to a vehicle-mounted terminal, as shown in fig. 3, comprising the following steps:

Step S301, a first security certificate sent by a mobile phone terminal is obtained, and the first security certificate is authenticated.

The embodiment of the application carries out safety authentication between the mobile phone terminal and the vehicle-mounted terminal before the vehicle-mounted terminal and the mobile phone terminal carry out data interaction, and comprises a certificate authentication stage and a secret key authentication stage. The certificate authentication stage is used for authenticating whether a first security certificate in the mobile phone terminal is correct and valid; the key authentication stage is used for authenticating whether the key pair stored in the mobile phone terminal is correct and valid.

The mobile phone terminal of the embodiment of the application can also be other terminals which can be interconnected with the vehicle-mounted terminal, such as a tablet terminal and the like.

In the embodiment of the application, the mobile phone terminal is provided with the target application program, the target application program is in a login state when being started, and when the starting operation of the target application program is detected, the target application program sends a data connection request to the vehicle-mounted terminal, namely the mobile phone terminal sends the data connection request to the vehicle-mounted terminal.

After receiving the data connection request, the vehicle-mounted terminal does not directly perform data connection with the mobile phone terminal so as to perform data interaction, but sends a certificate authentication request to the mobile phone terminal so as to acquire a first security certificate of the mobile phone terminal and authenticate the first security certificate.

The target application program carries a first security certificate, and after receiving a certificate authentication request of the vehicle-mounted terminal, the target application program sends the first security certificate to the vehicle-mounted terminal.

After receiving the first security certificate from the mobile phone terminal, the vehicle-mounted terminal acquires a second security certificate of the vehicle-mounted terminal, and authenticates the first security certificate through the second security certificate to determine whether the first security certificate is secure.

Step S302, if the authentication is passed, the initial information is encrypted by a public key in a preset first key pair to obtain first encrypted information.

If the first security certificate passes the authentication, the key authentication is performed subsequently. In the embodiment of the application, the preset first key pair is stored in the vehicle-mounted terminal, the preset second key pair is stored in the mobile phone terminal, if the first key pair and the second key pair are the same, the subsequent key authentication can pass, and if the second key pair is tampered, the first key pair and the second key pair are different key pairs, and the subsequent key authentication can not pass.

After the vehicle-mounted terminal authenticates the first security certificate and passes the authentication, the vehicle-mounted terminal encrypts the initial information through a public key in a preset first key pair to obtain first encrypted information, wherein the initial information can be any information, for example, a string of character strings.

Step S303, the first encryption information is sent to the mobile phone terminal to instruct the mobile phone terminal to decrypt the first encryption information according to the private key in the second key pair to obtain first decryption information, the first decryption information is encrypted through the public key in the second key pair to obtain second encryption information, and the second encryption information is returned to the vehicle-mounted terminal.

After the initial information is encrypted to obtain the first encrypted information, the vehicle-mounted terminal sends the first encrypted information to the target application program in the mobile phone terminal, so that the target application program in the mobile phone terminal decrypts the first encrypted information through the private key in the second key pair after receiving the first encrypted information, and the first decrypted information is obtained.

After the target application program in the mobile phone terminal obtains the first decryption information, the target application program encrypts the first decryption information through the public key in the second key pair to obtain second encryption information, and returns the second encryption information to the value vehicle-mounted terminal.

Step S304, receiving the second encrypted information sent by the mobile phone terminal, and decrypting the second encrypted information through the private key in the first key pair to obtain second decrypted information.

After receiving the second encrypted information sent by the mobile phone terminal, the vehicle-mounted terminal decrypts the second encrypted information through the private key in the first key pair to obtain second decrypted information.

After obtaining the second decryption information, the vehicle-mounted terminal compares the second decryption information with the initial information to determine whether the first key pair is consistent with the second key pair, and if the second decryption information is consistent with the initial information, the vehicle-mounted terminal characterizes that the first key pair is consistent with the second key pair; if the second decryption information and the initial information are inconsistent, the first key pair and the second key pair are inconsistent, and the second key pair has been tampered with.

Step S305, if the initial information and the second decryption information are consistent, the data connection is established with the mobile phone terminal.

After the initial information and the second decryption information are consistent, the embodiment of the application characterizes that the mobile phone terminal is safe, and can establish data connection with the mobile phone terminal so as to perform data interaction.

According to the embodiment of the application, the first security certificate sent by the mobile phone terminal is acquired, and the first security certificate is authenticated; if the authentication is passed, encrypting the initial information through a public key in a preset first key pair to obtain first encrypted information; the first encryption information is sent to the mobile phone terminal to instruct the mobile phone terminal to decrypt the first encryption information according to the private key in the second key pair to obtain first decryption information, the first decryption information is encrypted through the public key in the second key pair to obtain second encryption information, and the second encryption information is returned to the vehicle-mounted terminal; receiving second encryption information sent by the mobile phone terminal, and decrypting the second encryption information through a private key in the first key pair to obtain second decryption information; and if the initial information is consistent with the second decryption information, establishing data connection with the mobile phone terminal. The embodiment of the application determines the safety of the mobile phone terminal through the double authentication of the certificate authentication and the secret key authentication before the data interaction with the mobile phone terminal, so that the vehicle-mounted terminal can perform the data interaction with the safe mobile phone terminal, and the safety of the data of the vehicle-mounted terminal is ensured.

The embodiment of the application provides a possible implementation mode, and the vehicle-mounted terminal is pre-implanted with a second security certificate; authenticating the first security certificate includes:

The target application program of the mobile phone terminal comprises the first security certificate, the second security certificate is implanted in the vehicle-mounted terminal in advance, and the first security certificate can be authenticated through the second security certificate to check whether the first security certificate in the target application program of the mobile phone terminal is correct and effective, and subsequent secret key authentication is carried out after the first security certificate is correct and effective.

The embodiment of the application provides a possible implementation manner, after the first security certificate is authenticated according to the second security certificate, the method further comprises the following steps:

In the certificate authentication stage, if the first security certificate authentication is not passed, the vehicle-mounted terminal records the first log information, sends the first alarm information to the mobile phone terminal, and terminates the subsequent authentication. The first log information includes account information of the mobile phone client, time of sending a data connection request by the mobile phone terminal, time of performing first security certificate authentication, and the like.

If the first security certificate authentication is not passed, the vehicle-mounted terminal can send the first alarm information to the mobile phone terminal, and meanwhile, the subsequent authentication is terminated so as to avoid invalid authentication, and meanwhile, the vehicle-mounted terminal and the mobile phone terminal can not directly perform data interaction so as to protect the data security of the vehicle-mounted terminal.

The first alarm information is used for prompting that connection cannot be established with the vehicle-mounted terminal due to certificate authentication failure.

The embodiment of the application provides a possible implementation manner, and after obtaining the second decryption information, the method further comprises the following steps:

In the key authentication stage, if the initial information of the vehicle-mounted terminal is inconsistent with the second decryption information sent by the target application program of the mobile phone terminal, the second log information is recorded, the second alarm information is sent to the mobile phone terminal, and data interaction with the mobile phone terminal is refused. The second alarm information is used for prompting that connection cannot be established with the vehicle-mounted terminal due to key authentication failure.

The embodiment of the application provides a possible implementation manner, and before obtaining the first security certificate sent by the mobile phone terminal, the method further comprises the following steps:

Before the first security certificate sent by the mobile phone terminal is obtained, the embodiment of the application also obtains the account information of the mobile phone terminal, judges whether the account information of the mobile phone terminal is a trusted user of the vehicle-mounted terminal, and for the vehicle-mounted terminal, the owner of the vehicle-mounted terminal is the trusted user, and other users allowed to use the vehicle, which are set by the vehicle-mounted terminal, are trusted users.

After the account information of the mobile phone terminal is obtained, the account information is authenticated firstly to determine whether the user corresponding to the account information is a trusted user, if the authentication is passed, the user corresponding to the account information is characterized as a trusted user, and the security certificate and the secret key pair of the mobile phone terminal can be further authenticated to determine the security of the mobile phone terminal.

The embodiment of the application provides a secure authentication method, which is applied to a mobile phone terminal, as shown in fig. 4, and comprises the following steps:

Step S401, a first security certificate is sent to a vehicle-mounted terminal to instruct the vehicle-mounted terminal to authenticate the first security certificate, after authentication is passed, initial information is encrypted through a public key in a preset first key pair to obtain first encrypted information, and the first encrypted information is sent to a mobile phone terminal;

The mobile phone terminal of the embodiment of the application can also be other terminals which can be interconnected with the vehicle-mounted terminal, such as a paid terminal and the like.

And after the vehicle-mounted terminal determines that the first security certificate is correct and effective, the vehicle-mounted terminal subsequently performs key authentication. In the embodiment of the application, the preset first key pair is stored in the vehicle-mounted terminal, the preset second key pair is stored in the mobile phone terminal, if the first key pair and the second key pair are the same, the subsequent key authentication can pass, and if the second key pair is tampered, the first key pair and the second key pair are different key pairs, and the subsequent key authentication can not pass.

And after the first security certificate is authenticated, the vehicle-mounted terminal encrypts the initial information through a public key in a preset first key pair to obtain first encrypted information, and sends the first encrypted information to the mobile phone terminal.

Step S402, receiving first encryption information sent by the vehicle-mounted terminal, decrypting the first encryption information according to a private key in the second key pair to obtain first decryption information, and encrypting the first decryption information through a public key in the second key pair to obtain second encryption information.

After receiving the first encryption information, the target application program in the mobile phone terminal decrypts the first encryption information through the private key in the second key pair of the target application program to obtain first decryption information, encrypts the first decryption information through the public key in the second key pair to obtain second encryption information, and returns the second encryption information to the vehicle-mounted terminal.

Step S403, the second encryption information is returned to the vehicle-mounted terminal so as to instruct the vehicle-mounted terminal to decrypt the second encryption information according to the private key in the first key pair, obtain second decryption information, and establish data connection with the mobile phone terminal when the initial information and the second decryption information are consistent.

The embodiment of the application sends a first security certificate to the vehicle-mounted terminal to instruct the vehicle-mounted terminal to authenticate the first security certificate, encrypts initial information through a public key in a preset first key pair after authentication is passed, and sends first encrypted information to the mobile phone terminal; receiving first encryption information sent by the vehicle-mounted terminal, decrypting the first encryption information according to a private key in a second key pair to obtain first decryption information, and encrypting the first decryption information through a public key in the second key pair to obtain second encryption information; and returning the second encrypted information to the vehicle-mounted terminal so as to instruct the vehicle-mounted terminal to decrypt the second encrypted information according to the private key in the first key pair to obtain second decrypted information, and establishing data connection with the mobile phone terminal when the initial information and the second decrypted information are determined to be consistent. The embodiment of the application determines the safety of the mobile phone terminal through the double authentication of the certificate authentication and the secret key authentication before the data interaction with the mobile phone terminal, so that the vehicle-mounted terminal can perform the data interaction with the safe mobile phone terminal, and the safety of the data of the vehicle-mounted terminal is ensured.

As shown in fig. 5, which is an exemplary flow chart illustrating interaction between the vehicle-mounted terminal and the mobile phone terminal, the whole process includes: after detecting the operation of the target application program of the mobile phone terminal, sending a data connection request to the vehicle-mounted terminal; after receiving the data connection request, the vehicle-mounted terminal sends a certificate authentication request to a target application program of the mobile phone terminal; after receiving the certificate authentication request, the target application program of the mobile phone terminal sends a first security certificate to the vehicle-mounted terminal; after receiving the first security certificate, the vehicle-mounted terminal authenticates the first security certificate and judges whether the authentication passes or not; if the authentication is passed, generating random information, encrypting the initial information through a public key in a preset first key pair to obtain first encrypted information, and transmitting the first encrypted information to a target application program of the mobile phone terminal; if the authentication is not passed, the vehicle-mounted terminal generates a first log and sends first alarm information to a target application program of the mobile phone terminal; the mobile phone terminal decrypts the first encrypted information according to the private key in the second key pair to obtain first decrypted information; the mobile phone terminal encrypts the first decryption information through the public key in the second key pair to obtain second encryption information, and returns the second encryption information to the vehicle-mounted terminal; the vehicle-mounted terminal receives second encrypted information sent by the mobile phone terminal, and decrypts the second encrypted information through a private key in the first key pair to obtain second decrypted information; the vehicle-mounted terminal judges whether the initial information and the second decryption information are consistent; if the data is consistent, establishing data connection with the mobile phone terminal, and performing data interaction; if the first log information is inconsistent with the second log information, the second alarm information is recorded, and the second alarm information is sent to the mobile phone terminal.

The specific implementation process of the above steps is identical to that of the foregoing embodiment, and the embodiments of the present application are not repeated here.

The embodiment of the application provides a security authentication device 60, which is applied to a vehicle-mounted terminal, as shown in fig. 6, the device 60 comprises:

the certificate authentication module 610 is configured to obtain a first security certificate sent by the mobile phone terminal, and authenticate the first security certificate;

the first encryption information determining module 620 is configured to encrypt the initial information by a public key in a preset first key pair if the authentication is passed, so as to obtain first encryption information;

the first encryption information sending module 630 is configured to send the first encryption information to the mobile phone terminal to instruct the mobile phone terminal to decrypt the first encryption information according to the private key in the second key pair to obtain first decryption information, encrypt the first decryption information by the public key in the second key pair to obtain second encryption information, and return the second encryption information to the vehicle-mounted terminal;

a second decryption information obtaining module 640, configured to receive second encryption information sent by the mobile phone terminal, and decrypt the second encryption information through a private key in the first key pair to obtain second decryption information;

The data connection establishment module 650 is configured to establish a data connection with the mobile phone terminal if it is determined that the initial information and the second decryption information are consistent.

The embodiment of the application provides a possible implementation manner, and the certificate authentication module is specifically used for authenticating the first security certificate according to the second security certificate.

The embodiment of the application provides a possible implementation manner, and the certificate authentication module further comprises:

the first alarm information sending module is used for recording first log information if the authentication is not passed, sending the first alarm information to the mobile phone terminal and terminating the subsequent authentication; the first alarm information is used for prompting that connection cannot be established with the vehicle-mounted terminal due to certificate authentication failure.

In one possible implementation manner provided in the embodiment of the present application, the second decryption information obtaining module further includes:

the second alarm information sending sub-module is used for recording second log information if the initial information is inconsistent with the second decryption information, sending the second alarm information to the mobile phone terminal and rejecting data interaction; the second alarm information is used for prompting that connection cannot be established with the vehicle-mounted terminal due to failure of key authentication.

The embodiment of the application provides a possible implementation manner, and the device further comprises:

the account authentication module is used for acquiring account information of the mobile phone terminal, authenticating the account information, and if the authentication is passed, determining to send a certificate acquisition request to acquire a first security certificate of the mobile phone terminal.

The embodiment of the application provides a security authentication device 70, which is applied to a mobile phone terminal, as shown in fig. 7, the device 70 comprises:

the first security certificate sending module 710 is configured to send a first security certificate to the vehicle-mounted terminal, so as to instruct the vehicle-mounted terminal to authenticate the first security certificate, encrypt the initial information by using a public key in a preset first key pair after the authentication is passed, obtain first encrypted information, and send the first encrypted information to the mobile phone terminal;

the second encrypted information obtaining module 720 is configured to receive the first encrypted information sent by the vehicle-mounted terminal, decrypt the first encrypted information according to the private key in the second key pair to obtain first decrypted information, and encrypt the first decrypted information through the public key in the second key pair to obtain second encrypted information;

the data connection establishment module 730 is configured to return the second encrypted information to the vehicle-mounted terminal, so as to instruct the vehicle-mounted terminal to decrypt the second encrypted information according to the private key in the first key pair, obtain second decrypted information, and establish data connection with the mobile phone terminal when it is determined that the initial information and the second decrypted information are consistent.

The device of the embodiment of the present application may perform the method provided by the embodiment of the present application, and its implementation principle is similar, and actions performed by each module in the device of the embodiment of the present application correspond to steps in the method of the embodiment of the present application, and detailed functional descriptions of each module of the device may be referred to the descriptions in the corresponding methods shown in the foregoing, which are not repeated herein.

The embodiment of the application provides an electronic device, which comprises a memory, a processor and a computer program stored on the memory, wherein the processor executes the computer program to realize the steps of a security authentication method, and compared with the related technology, the steps of the security authentication method can be realized: according to the embodiment of the application, the first security certificate sent by the mobile phone terminal is acquired, and the first security certificate is authenticated; if the authentication is passed, encrypting the initial information through a public key in a preset first key pair to obtain first encrypted information; the first encryption information is sent to the mobile phone terminal to instruct the mobile phone terminal to decrypt the first encryption information according to the private key in the second key pair to obtain first decryption information, the first decryption information is encrypted through the public key in the second key pair to obtain second encryption information, and the second encryption information is returned to the vehicle-mounted terminal; receiving second encryption information sent by the mobile phone terminal, and decrypting the second encryption information through a private key in the first key pair to obtain second decryption information; and if the initial information is consistent with the second decryption information, establishing data connection with the mobile phone terminal. The embodiment of the application determines the safety of the mobile phone terminal through the double authentication of the certificate authentication and the secret key authentication before the data interaction with the mobile phone terminal, so that the vehicle-mounted terminal can perform the data interaction with the safe mobile phone terminal, and the safety of the data of the vehicle-mounted terminal is ensured.

In an alternative embodiment, there is provided an electronic device, as shown in fig. 8, the electronic device 4000 shown in fig. 8 includes: a processor 4001 and a memory 4003. Wherein the processor 4001 is coupled to the memory 4003, such as via a bus 4002. Optionally, the electronic device 4000 may further comprise a transceiver 4004, the transceiver 4004 may be used for data interaction between the electronic device and other electronic devices, such as transmission of data and/or reception of data, etc. It should be noted that, in practical applications, the transceiver 4004 is not limited to one, and the structure of the electronic device 4000 is not limited to the embodiment of the present application.

The processor 4001 may be a CPU (Central Processing Unit ), general purpose processor, DSP (Digital Signal Processor, data signal processor), ASIC (Application Specific Integrated Circuit ), FPGA (Field Programmable Gate Array, field programmable gate array) or other programmable logic device, transistor logic device, hardware components, or any combination thereof. Which may implement or perform the various exemplary logic blocks, modules and circuits described in connection with this disclosure. The processor 4001 may also be a combination that implements computing functionality, e.g., comprising one or more microprocessor combinations, a combination of a DSP and a microprocessor, etc.

Bus 4002 may include a path to transfer information between the aforementioned components. Bus 4002 may be a PCI (Peripheral Component Interconnect, peripheral component interconnect standard) bus or an EISA (Extended Industry Standard Architecture ) bus, or the like. The bus 4002 can be divided into an address bus, a data bus, a control bus, and the like. For ease of illustration, only one thick line is shown in fig. 8, but not only one bus or one type of bus.

Memory 4003 may be, but is not limited to, ROM (Read Only Memory) or other type of static storage device that can store static information and instructions, RAM (Random Access Memory ) or other type of dynamic storage device that can store information and instructions, EEPROM (Electrically Erasable Programmable Read Only Memory ), CD-ROM (Compact Disc Read Only Memory, compact disc Read Only Memory) or other optical disk storage, optical disk storage (including compact discs, laser discs, optical discs, digital versatile discs, blu-ray discs, etc.), magnetic disk storage media, other magnetic storage devices, or any other medium that can be used to carry or store a computer program and that can be Read by a computer.

The memory 4003 is used for storing a computer program for executing an embodiment of the present application, and is controlled to be executed by the processor 4001. The processor 4001 is configured to execute a computer program stored in the memory 4003 to realize the steps shown in the foregoing method embodiment.

Among them, the electronic device package may include, but is not limited to, mobile terminals such as mobile phones, notebook computers, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), in-vehicle terminals (e.g., in-vehicle navigation terminals), and the like, and stationary terminals such as digital TVs, desktop computers, and the like. The electronic device shown in fig. 8 is merely an example, and should not impose any limitations on the functionality and scope of use of embodiments of the present disclosure.

Embodiments of the present application provide a computer readable storage medium having a computer program stored thereon, which when executed by a processor, implements the steps of the foregoing method embodiments and corresponding content. Compared with the prior art, can realize: according to the embodiment of the application, the first security certificate sent by the mobile phone terminal is acquired, and the first security certificate is authenticated; if the authentication is passed, encrypting the initial information through a public key in a preset first key pair to obtain first encrypted information; the first encryption information is sent to the mobile phone terminal to instruct the mobile phone terminal to decrypt the first encryption information according to the private key in the second key pair to obtain first decryption information, the first decryption information is encrypted through the public key in the second key pair to obtain second encryption information, and the second encryption information is returned to the vehicle-mounted terminal; receiving second encryption information sent by the mobile phone terminal, and decrypting the second encryption information through a private key in the first key pair to obtain second decryption information; and if the initial information is consistent with the second decryption information, establishing data connection with the mobile phone terminal. The embodiment of the application determines the safety of the mobile phone terminal through the double authentication of the certificate authentication and the secret key authentication before the data interaction with the mobile phone terminal, so that the vehicle-mounted terminal can perform the data interaction with the safe mobile phone terminal, and the safety of the data of the vehicle-mounted terminal is ensured.

It should be noted that the computer readable medium described in the present disclosure may be a computer readable signal medium or a computer readable medium, or any combination of the two. The computer readable storage medium can be, for example, but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or a combination of any of the foregoing. More specific examples of the computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer diskette, a hard disk, a Random Access Memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing. In the context of this disclosure, a computer-readable storage medium may be any tangible medium that can contain, or store a program for use by or in connection with an instruction execution system, apparatus, or device. In the present disclosure, however, the computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, with the computer-readable program code embodied therein. Such a propagated data signal may take any of a variety of forms, including, but not limited to, electro-magnetic, optical, or any suitable combination of the foregoing. A computer readable signal medium may also be any computer readable medium that is not a computer readable storage medium and that can communicate, propagate, or transport a program for use by or in connection with an instruction execution system, apparatus, or device. Program code embodied on a computer readable medium may be transmitted using any appropriate medium, including but not limited to: electrical wires, fiber optic cables, RF (radio frequency), and the like, or any suitable combination of the foregoing.

The embodiment of the application also provides a computer program product, which comprises a computer program, wherein the computer program can realize the steps and corresponding contents of the embodiment of the method when being executed by a processor. Compared with the prior art, can realize: according to the embodiment of the application, the first security certificate sent by the mobile phone terminal is acquired, and the first security certificate is authenticated; if the authentication is passed, encrypting the initial information through a public key in a preset first key pair to obtain first encrypted information; the first encryption information is sent to the mobile phone terminal to instruct the mobile phone terminal to decrypt the first encryption information according to the private key in the second key pair to obtain first decryption information, the first decryption information is encrypted through the public key in the second key pair to obtain second encryption information, and the second encryption information is returned to the vehicle-mounted terminal; receiving second encryption information sent by the mobile phone terminal, and decrypting the second encryption information through a private key in the first key pair to obtain second decryption information; and if the initial information is consistent with the second decryption information, establishing data connection with the mobile phone terminal. The embodiment of the application determines the safety of the mobile phone terminal through the double authentication of the certificate authentication and the secret key authentication before the data interaction with the mobile phone terminal, so that the vehicle-mounted terminal can perform the data interaction with the safe mobile phone terminal, and the safety of the data of the vehicle-mounted terminal is ensured.

The terms "first," "second," "third," "fourth," "1," "2," and the like in the description and in the claims and in the above figures, if any, are used for distinguishing between similar objects and not necessarily for describing a particular sequential or chronological order. It is to be understood that the data so used may be interchanged where appropriate, such that the embodiments of the application described herein may be implemented in other sequences than those illustrated or otherwise described.

It should be understood that, although various operation steps are indicated by arrows in the flowcharts of the embodiments of the present application, the order in which these steps are implemented is not limited to the order indicated by the arrows. In some implementations of embodiments of the application, the implementation steps in the flowcharts may be performed in other orders as desired, unless explicitly stated herein. Furthermore, some or all of the steps in the flowcharts may include multiple sub-steps or multiple stages based on the actual implementation scenario. Some or all of these sub-steps or phases may be performed at the same time, or each of these sub-steps or phases may be performed at different times, respectively. In the case of different execution time, the execution sequence of the sub-steps or stages can be flexibly configured according to the requirement, which is not limited by the embodiment of the present application.

The foregoing is only an optional implementation manner of some implementation scenarios of the present application, and it should be noted that, for those skilled in the art, other similar implementation manners based on the technical ideas of the present application are adopted without departing from the technical ideas of the scheme of the present application, which also belongs to the protection scope of the embodiments of the present application.

Claims

1. A security authentication method, applied to a vehicle-mounted terminal, comprising:

the first encryption information is sent to the mobile phone terminal to instruct the mobile phone terminal to decrypt the first encryption information according to a private key in a second key pair to obtain first decryption information, the first decryption information is encrypted through a public key in the second key pair to obtain second encryption information, and the second encryption information is returned to the vehicle-mounted terminal;

2. The method according to claim 1, wherein the vehicle-mounted terminal has a second security certificate pre-embedded therein; the authenticating the first security certificate includes:

and authenticating the first security certificate according to the second security certificate.

3. The method of claim 2, wherein after authenticating the first security certificate based on the second security certificate, further comprising:

4. The method of claim 1, wherein after obtaining the second decryption information, further comprising:

if the initial information is inconsistent with the second decryption information, recording second log information, sending second alarm information to the mobile phone terminal, and rejecting data interaction; the second alarm information is used for prompting that connection cannot be established with the vehicle-mounted terminal due to key authentication failure.

5. The method of claim 1, wherein before the step of obtaining the first security certificate sent by the mobile phone terminal, the method further comprises:

6. The security authentication method is characterized by being applied to a mobile phone terminal and comprising the following steps of:

sending a first security certificate to the vehicle-mounted terminal to instruct the vehicle-mounted terminal to authenticate the first security certificate, encrypting initial information through a public key in a preset first key pair after authentication is passed, obtaining first encrypted information, and sending the first encrypted information to a mobile phone terminal;

and returning the second encryption information to the vehicle-mounted terminal so as to instruct the vehicle-mounted terminal to decrypt the second encryption information according to the private key in the first key pair to obtain second decryption information, and establishing data connection with the mobile phone terminal when the initial information and the second decryption information are determined to be consistent.

7. A security authentication device, characterized by being applied to a vehicle-mounted terminal, comprising:

8. A security authentication device, applied to a mobile phone terminal, comprising:

the mobile phone comprises a first safety certificate sending module, a second safety certificate sending module and a mobile phone terminal, wherein the first safety certificate sending module is used for sending a first safety certificate to the vehicle-mounted terminal so as to instruct the vehicle-mounted terminal to authenticate the first safety certificate, encrypting initial information through a public key in a preset first key pair after authentication is passed, obtaining first encrypted information, and sending the first encrypted information to the mobile phone terminal;

the data connection establishing module is used for returning the second encryption information to the vehicle-mounted terminal so as to instruct the vehicle-mounted terminal to decrypt the second encryption information according to the private key in the first key pair to obtain second decryption information, and establishing data connection with the mobile phone terminal when the initial information is determined to be consistent with the second decryption information.

9. An electronic device comprising a memory, a processor and a computer program stored on the memory, characterized in that the processor executes the computer program to carry out the steps of the method according to any one of claims 1-7.

10. A computer readable storage medium, on which a computer program is stored, characterized in that the computer program, when being executed by a processor, implements the steps of the method of any of claims 1-7.