WO2023061029A1 - Procédé, dispositif et système d'activation de clé numérique - Google Patents

Procédé, dispositif et système d'activation de clé numérique Download PDF

Info

Publication number
WO2023061029A1
WO2023061029A1 PCT/CN2022/112505 CN2022112505W WO2023061029A1 WO 2023061029 A1 WO2023061029 A1 WO 2023061029A1 CN 2022112505 W CN2022112505 W CN 2022112505W WO 2023061029 A1 WO2023061029 A1 WO 2023061029A1
Authority
WO
WIPO (PCT)
Prior art keywords
key
digital key
data
server
terminal
Prior art date
Application number
PCT/CN2022/112505
Other languages
English (en)
Chinese (zh)
Inventor
王思善
高帅鸿
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2023061029A1 publication Critical patent/WO2023061029A1/fr

Links

Images

Classifications

    • G—PHYSICS
    • G07—CHECKING-DEVICES
    • G07C—TIME OR ATTENDANCE REGISTERS; REGISTERING OR INDICATING THE WORKING OF MACHINES; GENERATING RANDOM NUMBERS; VOTING OR LOTTERY APPARATUS; ARRANGEMENTS, SYSTEMS OR APPARATUS FOR CHECKING NOT PROVIDED FOR ELSEWHERE
    • G07C9/00—Individual registration on entry or exit
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/041—Key generation or derivation
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/043—Key management, e.g. using generic bootstrapping architecture [GBA] using a trusted network node as an anchor
    • H04W12/0433—Key management protocols

Definitions

  • the present application relates to the field of computer technology, in particular to a method, device and system for unlocking a digital key.
  • the present application provides a digital key activation method, device, system, computer-storage-readable storage medium, and computer program product, which can be implemented in a digital key system that has been developed under a business agreement, using the existing digital key system Some functions are used to activate the digital key system under another business agreement, which reduces the development workload and the cost of the PKI system, and improves the user experience.
  • the present application provides a method for unlocking a digital key, which is applied to a first device, wherein a first service agreement has been pre-configured among the first device, the second device, and the server, and the first device is configured in the first service agreement
  • the first digital key can be opened under the following method, and the method includes: sending a target request to the server, and the target request is used to request to apply for opening the second digital key under the second service agreement; using the first communication mechanism defined by the first service agreement to obtain the server sent Target data, the target data is used to construct the first data structure of the second digital key; in response to the acquired target data, generate the public key and private key of the second digital key, and construct the second digital key of the second digital key based on at least the target data A data structure, and writing at least target data into the first data structure; using the second communication mechanism defined by the first service protocol to send a first message to the second device, the first message includes the public key of the second digital key, The first message is used to instruct the second device to store the public
  • the server remotely issues the data under the second service agreement.
  • the data required for unlocking the key uses the mechanism defined under the first service agreement to complete the opening of the digital key between the first device and the second device under the second service agreement, and realizes the digital key under a service agreement that has been developed.
  • the existing functions of the digital key system are used to activate the digital key system under another business agreement, which reduces the development workload and the cost of the PKI system, and improves the user experience.
  • the method before writing at least part of the target data into the first data structure, the method further includes: using the first communication mechanism defined in the first service protocol to send a target filing request to the server, and the target filing The request is used to request the recordation of the public key of the second digital key; obtain the target recordation certificate sent by the server, and the target recordation certificate is used to prove that the server has completed the recordation of the public key of the second digital key. In this way, the server can record the public key of the second digital key.
  • the first message further includes the target filing certificate.
  • the second device After the second device obtains the first message, it will verify the target filing certificate to ensure that the public key of the second digital key contained in the first message comes from a legitimate device, thereby improving the security of digital key activation sex.
  • the target data includes one or more of the following: an identifier of the second device, a public key of the second device, a box identifier, an authorized public key group, key capability data, a private mailbox size, or , the confidential mailbox size.
  • the first data structure includes one or more of the following: the second device identifier, the identifier defined inside the first device for the second digital key, the digital key identifier, the compartment identifier, and the instance CA identifier , key capability data, public key of the second digital key, public key of the second device, authorized public key group, private mailbox, or, confidential mailbox.
  • the identifier defined inside the first device for the second digital key, the digital key identifier, the compartment identifier, the instance CA identifier and the public key of the second digital key are all provided by the first device.
  • the second device ID, box location ID, key capability data, public key and authorized public key group of the second device are all obtained from the target data, and the private mailbox and confidential mailbox are obtained by the first device based on the target data creation.
  • both the first device and the second device are configured with a digital key system matching the first digital key and a digital key system matching the second digital key.
  • the first service protocol is an ICCE standard protocol
  • the second service protocol is a CCC standard protocol
  • the first communication mechanism is a communication mechanism that encrypts/decrypts data based on a key between devices to provide security;
  • the second communication mechanism is a key and authentication protocol based on the first digital key and Provides a secure communication mechanism.
  • the present application provides a method for unlocking a digital key, which is applied to a server, wherein a first service agreement has been pre-configured among the server, the first device, and the second device, and the first device can use the first service agreement under the first service agreement.
  • the method includes: acquiring a target request sent by the first device, the target request is used to request to apply for activation of the second digital key under the second service agreement; responding to the target request, acquiring target data, and using the first service
  • the first communication mechanism defined by the protocol sends target data to the first device, and the target data is used to construct the first data structure of the second digital key.
  • the method further includes: using the first communication mechanism defined in the first service agreement to acquire the first device to send a target recordation request, where the target recordation request is used to request recordation of the public key of the second digital key; In response to the target filing request, record the public key of the second digital key, and generate a target filing certificate, which is used to prove that the server has completed the filing of the public key of the second digital key; A communication mechanism sends the target filing certificate to the first device.
  • the target data includes one or more of the following: an identifier of the second device, a public key of the second device, a box identifier, an authorized public key group, key capability data, a private mailbox size, or , the confidential mailbox size.
  • the first data structure includes one or more of the following: the second device identifier, the identifier defined inside the first device for the second digital key, the digital key identifier, the compartment identifier, and the instance CA identifier , key capability data, public key of the second digital key, public key of the second device, authorized public key group, private mailbox, or, confidential mailbox.
  • both the first device and the second device are configured with a digital key system matching the first digital key and a digital key system matching the second digital key.
  • the first service protocol is an ICCE standard protocol
  • the second service protocol is a CCC standard protocol.
  • the first communication mechanism is a communication mechanism that encrypts/decrypts data based on a key between devices to provide security.
  • the application provides a digital key unlocking system, including a first device, a second device, and a server.
  • the first service agreement has been pre-configured between the first device, the second device, and the server.
  • the first device is The first digital key can be activated under a business agreement, wherein the first device is used to execute the method in the first aspect, the server is used to execute the method in the second aspect, and the second device is used to respond to the first device sent by the first digital key.
  • a message storing the public key of the second digital key.
  • the present application provides a device, which is characterized in that it includes:
  • At least one memory for storing programs
  • At least one processor is used to execute the program stored in the memory, and when the program stored in the memory is executed, the processor is used to execute the method in the first aspect or the second aspect.
  • the present application provides a computer-readable storage medium, on which is stored a computer program (also referred to as an instruction or code) for implementing the method in the first aspect or the second aspect.
  • a computer program also referred to as an instruction or code
  • the computer when the computer program is executed by a computer, the computer can execute the method in the first aspect or the second aspect.
  • the present application provides a chip, including a processor.
  • the processor is used to read and execute the computer program stored in the memory, so as to implement the method in the first aspect or the second aspect.
  • the chip further includes a memory, and the memory is connected to the processor through a circuit or wires.
  • the present application provides a computer program product.
  • the computer program product includes a computer program (also referred to as an instruction or code).
  • the computer program When the computer program is executed by a computer, the computer implements the method in the first aspect or the second aspect.
  • Fig. 1 is a schematic diagram of a digital key activation process under the ICCE standard provided by the embodiment of the present application;
  • Fig. 2 is a schematic diagram of a digital key pairing process under the CCC standard provided by the embodiment of the present application;
  • Fig. 3 is a schematic diagram of a digital key structure that meets the requirements of the CCC standard provided by the embodiment of the present application;
  • Fig. 4a is a schematic diagram of an application scenario provided by an embodiment of the present application.
  • Fig. 4b is a schematic diagram of a digital key issuance system architecture provided by an embodiment of the present application.
  • FIG. 5 is a schematic structural diagram of a terminal provided in an embodiment of the present application.
  • FIG. 6 is a schematic structural diagram of a server provided by an embodiment of the present application.
  • Fig. 7 is a schematic flow chart of a digital key pairing method provided by an embodiment of the present application.
  • Fig. 8 is a schematic flowchart of another digital key pairing method provided by the embodiment of the present application.
  • FIG. 9 is a schematic flow chart of a digital key sharing method provided by an embodiment of the present application.
  • Fig. 10 is a schematic diagram of an authentication data packet in a digital key provided by an embodiment of the present application.
  • Fig. 11 is a schematic diagram of an authentication data packet in another digital key provided by an embodiment of the present application.
  • Fig. 12 is a schematic flow chart of a digital key opening method provided by the embodiment of the present application.
  • FIG. 13 is a schematic structural diagram of a chip provided by an embodiment of the present application.
  • first and second and the like in the specification and claims herein are used to distinguish different objects, not to describe a specific order of objects.
  • first response message and the second response message are used to distinguish different response messages, rather than describing a specific order of the response messages.
  • words such as “exemplary” or “for example” are used as examples, illustrations or illustrations. Any embodiment or design scheme described as “exemplary” or “for example” in the embodiments of the present application shall not be interpreted as being more preferred or more advantageous than other embodiments or design schemes. Rather, the use of words such as “exemplary” or “such as” is intended to present related concepts in a concrete manner.
  • multiple means two or more, for example, multiple processing units refer to two or more processing units, etc.; multiple A component refers to two or more components or the like.
  • the design idea of the ICCE standard is mainly to realize the online distribution of digital keys based on the industry's mature server-managed key distribution architecture. Among them, the digital key system under the ICCE standard currently adopts a symmetric key system.
  • Fig. 1 shows a digital key unlocking process under the ICCE standard.
  • the digital key pairing process under the ICCE standard includes the following steps:
  • the terminal sends a digital key activation request to a server.
  • the owner of the vehicle (hereinafter referred to as “vehicle owner") can log in to an application related to the digital key on the terminal, and can choose to apply for the digital key on the application.
  • vehicle owner can log in to an application related to the digital key on the terminal, and can choose to apply for the digital key on the application.
  • the terminal sends a digital key activation request to the server.
  • the digital key activation request may carry information for verifying the identity of the owner and the identity of the vehicle owned by the owner.
  • the information used to verify the identity of the vehicle owner may include one or more items of the vehicle owner's identity or the terminal's identity. Among them, it can be determined according to the identity of the owner and the identity of the vehicle whether the owner has the authorization to activate the digital key service. That is, it has the authorization to open the digital key service. It can be determined according to the identity of the terminal whether the terminal has the qualification for opening the digital key service; for example, a white list of terminals with the qualification for opening the digital key service can be preset, and when the identity of the terminal belongs to the white list, then The terminal has the qualification to activate the digital key service. As a result, the security of unlocking with the digital key is improved.
  • the server In response to the digital key activation request, the server verifies the identity of the vehicle owner, the requested authority, etc., and generates a digital key after the verification is passed.
  • the digital key includes a service key and related data (such as operation authority, validity period, etc.).
  • the server can verify the identity of the vehicle owner, and detect whether the vehicle owner has the authority to activate the digital key function of the relevant vehicle, for example, detect whether the vehicle owner signs up for the digital key function service, etc.
  • the server determines that the information on the owner and the vehicle carried in the digital key activation request is consistent with the stored information on the owner and the vehicle owned by the owner, the verification of the identity of the owner passes.
  • the server detects that the car owner has the authorization to activate the digital key, it can generate a digital key for the car owner's device (ie terminal), wherein the service key used by the digital key can be but not limited to a symmetric key.
  • the identity of the car owner when verifying the identity of the car owner, it can be verified by means of SMS verification code, email verification code, electronic ID card, face recognition, etc., but not limited to.
  • the server when the server generates the service key contained in the digital key, it can also generate data information related to the service key, such as: the use authority of the service key (such as whether to allow unlocking, activating the engine , unlock the trunk, unlock the windows, etc.), expiration date, etc.
  • the use authority of the service key such as whether to allow unlocking, activating the engine , unlock the trunk, unlock the windows, etc.
  • expiration date etc.
  • the server sends the generated digital key to the terminal.
  • the server after the server generates the digital key, it can send the digital key to the terminal. In addition, the server can also send data information related to the digital key to the terminal. Afterwards, after the terminal acquires the digital key, it can store the digital key. At this point, the terminal obtains the digital key.
  • the terminal or the server provides the digital key to the vehicle.
  • the terminal after the terminal obtains the digital key, it can interact with the vehicle and perform authentication. Wherein, during the authentication process, the vehicle can be made to derive the service key corresponding to the terminal and the session key required for this communication according to the preset master key.
  • the server after the server generates the digital key, it can send the digital key to the vehicle, so that the vehicle can obtain the service key contained in the digital key matched with the terminal.
  • the terminal or the server can also send the data information related to the service key included in the digital key to the vehicle.
  • the activation process of the digital key between the vehicle and the terminal is completed. Afterwards, the owner can use the terminal to control the vehicle.
  • the vehicle when the vehicle obtains the service key matching the terminal through interaction with the terminal, in the process shown in Figure 1, after the execution of S103 is completed, it can be understood that the issuance of the digital key has been completed; Afterwards, the vehicle and the terminal can directly interact to obtain the service key contained in the digital key matched with the terminal.
  • the vehicle obtains the service key matching the terminal through interaction with the server, in the process shown in Figure 1, after the execution of S104 is completed, it can be understood that the issuance of the digital key has been completed.
  • the design idea of the CCC standard is mainly: based on the public key infrastructure (public key infrastructure, PKI) system and asymmetric key mechanism to complete the offline (ie: not dependent on the server) mutual trust between the terminal and the vehicle, that is, between the terminal and the vehicle Establish a mutual trust relationship based on PKI, and securely exchange and save the other party's public key and related key data.
  • PKI public key infrastructure
  • Fig. 2 shows a digital key pairing process under the CCC standard.
  • the digital key pairing process under the CCC standard includes the following steps:
  • the terminal establishes a connection with the vehicle.
  • a connection can be established between the terminal and the vehicle through wireless communication technologies such as Bluetooth (bluetooth) or near field communication (near field communication, NFC).
  • wireless communication technologies such as Bluetooth (bluetooth) or near field communication (near field communication, NFC).
  • the car owner can enter the vehicle with the physical key and the terminal, and then control the terminal to establish a connection with the vehicle and initiate pairing.
  • the vehicle sends the vehicle's certificate chain and key creation data required to generate the digital key to the terminal.
  • the vehicle can send the vehicle's certificate chain and key creation data required to generate the digital key to the terminal.
  • the key creation data may include vehicle identifier, vehicle public key, slot identifier, authorized public keys, key capability data ( key options), private mailbox size (private mailbox size), confidential mailbox size (confidential mailbox size), protocol version number (protocol version), and one or more of the vehicle's public key certificate.
  • the slot identifier may identify a digital key and confidential data associated with the digital key.
  • the vehicle can uniquely identify a digital key and the confidential data related to the digital key by relying on the value of the compartment identification.
  • the authorized public key group may include at least one public key of a certificate authority approved by the vehicle manufacturer.
  • the key capability data may indicate the type of authentication supported by the key, and/or, usage conditions, etc.
  • the private mailbox can store some data of the vehicle.
  • both vehicles and mobile phones can read data in private mailboxes.
  • the confidential mailbox can store some confidential data of the vehicle.
  • vehicles can read data in confidential mailboxes.
  • the vehicle's public key certificate can be understood as the digital certificate of the vehicle's public key.
  • the digital certificate is actually a certification of the public key issued by the electronic visa authority (certificate authority, CA).
  • the content of the digital certificate may include: the signature of the electronic visa authority, the identity information of the certificate owner, public key, private key and validity period, etc.
  • certificate formats and verification methods generally follow the X.509 international standard.
  • the certificate chain of the vehicle includes the certificate of the server, the certificate of the vehicle, and the public key certificate of the vehicle generated in the vehicle.
  • the terminal verifies the key creation data, and generates a public-private key pair of the digital key and a digital key structure that meets the requirements of the CCC standard when the verification is passed.
  • the terminal can verify the key creation data based on the certificate chain of the vehicle. For example: verify whether the public key certificate of the vehicle is legal, etc., wherein, when it is determined that the public key certificate of the vehicle is issued by a trusted manufacturer, it can be determined that the verification is passed. It can be understood that there is a trust relationship between the vehicle and the vehicle manufacturer, and a trust relationship between the terminal manufacturer and the terminal. Then, when the trust relationship is established between the vehicle manufacturer and the terminal manufacturer in advance, the vehicle and the terminal are immediately connected. The trust relationship is established indirectly. At this time, after the terminal obtains the vehicle's public key certificate sent by the vehicle, and confirms that the vehicle's public key certificate is certified by the vehicle manufacturer, it can determine that the digital certificate is legal. Then it can be determined that the vehicle is a legal vehicle approved by the manufacturer of the vehicle.
  • the terminal can generate the public-private key pair of the digital key after verifying that the key creation data is passed.
  • it may be an RSA public-private key pair.
  • the terminal can also generate a digital key structure that meets the requirements of the CCC standard based on the key creation data.
  • the digital key structure that meets the requirements of the CCC standard may include: vehicle identifier (vehicle identifier), node identifier (endpoint identifier), digital key identifier (digital key identifier), box position identifier (slot identifier), instance certificate identifier (instance CA identifier), key capability data (key options), terminal public key (device public key), vehicle public key (vehicle public key), authorized public key group (authorized public keys), private mailbox (private mailbox), confidential mailbox (confidential mailbox).
  • vehicle identifier vehicle identifier
  • node identifier endpoint identifier
  • digital key identifier digital key identifier
  • box position identifier box position identifier
  • instance certificate identifier instance CA identifier
  • key capability data key options
  • terminal public key device public key
  • vehicle public key vehicle public key
  • authorized public key group authorized public key group
  • private mailbox private mailbox
  • confidential mailbox confidential mailbox
  • a node identifier (endpoint identifier), a digital key identifier (digital key identifier), and a terminal public key (device public key) may be provided by the terminal.
  • the instance CA identifier may be provided by the terminal.
  • Vehicle identifier, slot identifier, key options, vehicle public key, authorized public keys can create data from the key provided by the vehicle obtained from.
  • a private mailbox and a confidential mailbox can be created based on the size of the private mailbox and the size of the confidential mailbox included in the key creation data provided by the vehicle.
  • the node identifier may be an identifier defined inside the terminal for the digital key.
  • the digital key identifier may be a numerical value generated by calculating the digest of the generated public key after the terminal generates the public-private key pair.
  • the terminal generates a public key certificate of the digital key for the public key in the public-private key pair of the digital key.
  • the terminal after the terminal generates the public-private key pair of the digital key, it can use the preset instance CA private key to sign the public key and other related information in the public-private key pair of the digital key, and then generate the public key certificate of the digital key .
  • the public key certificate of the digital key of the terminal can be understood as the digital certificate of the digital key paired with the vehicle on the terminal, which generally conforms to the X.509 format.
  • the terminal sends a certificate chain at least including the public key certificate of the digital key to the vehicle.
  • the terminal after the terminal generates the public key certificate of the digital key, it can send a certificate chain at least including the public key certificate of the digital key to the vehicle, so that the vehicle can obtain the public key of the digital key generated by the terminal.
  • the certificate chain including at least the public key of the digital key generated by it may include the server's certificate, the terminal's certificate (instance CA certificate) and the public key certificate of the digital key generated by the terminal.
  • the vehicle verifies the public key certificate of the digital key, and stores the public key of the digital key contained in the public key certificate after the verification is passed.
  • the vehicle can verify the public key certificate of the digital key of the terminal based on the certificate chain of the terminal. When it is verified that the public key certificate of the digital key of the terminal is issued by a legal terminal, the verification is passed. It can be understood that there is a trust relationship between the vehicle and the vehicle manufacturer (such as a server), and a trust relationship between the terminal manufacturer and the terminal. Then, when the trust relationship is established between the vehicle manufacturer and the terminal manufacturer in advance, the vehicle A trust relationship is indirectly established between the terminal and the terminal. At this time, after the vehicle obtains the public key certificate of the digital key sent by the terminal, it can determine whether the public key certificate is legal.
  • the vehicle can store the public key of the digital key contained in the public key certificate, that is, store the public key of the digital key of the terminal.
  • the vehicle sends key configuration data to the terminal.
  • the vehicle after the vehicle stores the public key of the digital key, it can send key configuration data to the terminal.
  • the key configuration data may include: an opaque attestation of the public key used to prove that the vehicle is authenticated and stores the digital key, an owner immobilizer token, a slot identifier bitmap), slot identifier, manufacturer private data structure (vehicle OEM proprietary data structure), anti-theft token for shared key, and key filing request for filing with the server.
  • the terminal and/or the vehicle sends a key filing request to the server.
  • the key filing request includes the public key of the digital key, the certificate chain, and the pairing certificate between the vehicle and the terminal.
  • the terminal may send a key recordation request to the server, so as to perform recordation to the server.
  • the key filing request may include the public key and certificate chain of the digital key of the terminal, the public key for data protection, the pairing certificate between the vehicle and the terminal, and the like.
  • the pairing certificate between the vehicle and the terminal can be generated by the vehicle itself and sent to the terminal by the vehicle, and the certificate can represent the pairing relationship between the two.
  • the data protection public key may be provided by the terminal, and the data protection public key may be a public key used to encrypt data when the server sends data, and the communication data sent by the server to the terminal is encrypted by using the public key, so as to Improve data security.
  • the vehicle after the vehicle stores the public key of the digital key of the terminal, it can also send a key filing request to the server for filing to the server.
  • the server records (key tracking) the public key of the digital key and the pairing relationship between the terminal and the vehicle, and generates a record certificate.
  • the server after the server obtains the key filing request, it can record the public key of the digital key of the terminal and the pairing relationship between the terminal and the vehicle, for example, by storing the public key of the digital key of the terminal and the pairing relationship between the terminal and the vehicle, and at the same time , to generate a filing certificate by signing the public key of the digital key of the terminal, thereby proving that the pairing of the terminal and the vehicle has been filed.
  • the filing certificate is mainly used to prove that the server has completed the filing.
  • the filing certificate may include a key tracking signature (key tracking signature).
  • the server sends the filing certificate to the terminal and/or the vehicle.
  • the server can send a record certificate to the terminal and/or the vehicle.
  • the terminal may also send the filing certificate to the vehicle through the communication protocol between the terminal and the vehicle defined by the CCC standard.
  • the vehicle when it obtains the record certificate, it can verify the record certificate according to the preset verification rules, and after the verification is passed, it can send the shared configuration data to the terminal, such as the anti-theft device token used for sharing ( immobilizer tokens for sharing), etc.
  • the terminal such as the anti-theft device token used for sharing ( immobilizer tokens for sharing), etc.
  • the vehicle can activate all permissions of the digital key. So far, the digital key pairing process between the vehicle and the terminal is completed, and then the owner can use the terminal to control the vehicle. It can be understood that since the vehicle and the terminal have completed the authentication and storage of each other's public key, a trust relationship can be established between the two in the subsequent use stage, so that the terminal can control the vehicle, such as unlocking the door and activate the engine etc.
  • the digital key activation in the ICCE standard is realized remotely based on the server.
  • the vehicle verifies the terminal based on the preset root key or the key obtained from the server.
  • the user can remotely verify the identity anytime and anywhere and obtain it in advance.
  • the key, and then interact with the vehicle, the experience is better, and it is also helpful to design various experiences in commercial modes such as leasing and express delivery.
  • the CCC standard is to obtain a digital key by pairing the terminal used by the car owner with the vehicle used by the car owner; during the pairing process, because the car owner's terminal and the vehicle have not communicated before, it is impossible to establish a mutual trust relationship, so the car owner It is necessary to carry the physical key to the vehicle to prove the identity of the owner and/or the key authorization to initiate the pairing; in addition, since the asymmetric key pair needs to be exchanged securely, for two devices that have not communicated, only rely on the PKI public key infrastructure construction The certificate system and the user triggers the pairing mode to ensure the safety of the pairing process, so as to ensure that the vehicle is correctly paired with the device with the key unlocking authority.
  • the technical solution provided by this application is mainly: when the digital key system of the ICCE standard has been adopted in the vehicle, the vehicle can use the mechanism defined by the ICCE standard to complete the CCC standard between the terminal implementing the ICCE standard and the vehicle.
  • the opening of the digital key under the ICCE standard realizes the addition of support for the digital key system of the CCC standard under the digital key system of the ICCE standard, so that the digital key pairing under the CCC system can be realized without implementing or implementing the CCC pairing protocol. required data interaction.
  • Fig. 4a shows an application scenario.
  • the communication between the terminal 100 and the server 300 can be performed through the network, and the communication between the vehicle 200 and the server 300 can also be performed through the network.
  • the network may be a network connection such as a wired network or a wireless network.
  • the network may be a local area network (local area networks, LAN), or a wide area network (wide area networks, WAN) (such as the Internet).
  • Communication between the terminal 100 and the vehicle 200 can be performed through wireless communication technology.
  • the wireless communication technology may include: bluetooth (bluetooth) technology, near field communication (NFC) technology or ultra wide band (ultra wide band, UWB) technology, etc.
  • the server 300 may be a server of a vehicle manufacturer.
  • the server 300 can issue digital keys under the ICCE standard to the terminal 100 and the vehicle 200 .
  • the server 300 can also provide the terminal 100 with the data of the vehicle required to generate the digital key under the CCC standard, such as: the identification of the vehicle, the public key of the vehicle, the public key certificate of the vehicle, and key configuration data, such as the mailbox size (mailbox size), key capability data (key options), etc.
  • the terminal 100 can generate a public-private key pair of the digital key of the terminal 100 under the CCC standard based on the data provided by the server 300 , and send a key filing request to the server 300 .
  • the terminal 100 can send the generated digital key public key (and/or the certificate chain of the digital key public key certificate) and the filing certificate sent by the server 300 to the vehicle 200 .
  • the vehicle 200 obtains the data required in the digital key system under the CCC standard, and then can activate its authority for the digital key of the terminal 100 to achieve the state of completing pairing with the terminal 100 under the CCC standard. After that, the terminal 100 can control the vehicle 200 .
  • Fig. 4b shows a system architecture of digital key issuance.
  • the system architecture includes the terminal 100, the vehicle 200 and the server 300 shown in FIG. 4a.
  • the terminal 100 includes a security unit 110
  • the security unit 110 includes an ICCE car key application (applet) 111 and a CCC car key application 112 .
  • the ICCE car key application 111 is a car key application related to the ICCE standard, in which at least digital keys under the ICCE standard can be safely received, stored and used
  • the CCC car key application 112 is a car key application related to the CCC standard. At least digital keys under the CCC standard can be held in this application.
  • the security unit 110 can instantiate the ICCE car key application (applet) 111 and the CCC car key application 112 respectively.
  • the ICCE car key application 111 may have a function for instructing the vehicle 200 to activate the digital key system under the CCC standard.
  • an application program for applying for a digital key can also be set on the terminal 100, through which at least the digital key can be applied for.
  • the vehicle 200 includes an ICCE digital key system 210 , a key management module 220 and a CCC digital key system 230 .
  • the ICCE digital key system 210 includes an authentication module 211 and a key storage module 212
  • the CCC digital key system 230 includes an authentication module 231 and a key storage module 232 .
  • the ICCE digital key system 210 can manage digital keys under the ICCE standard.
  • both the vehicle 200 and the terminal 100 have implemented the ICCE standard, and have completed the issuance of digital keys.
  • the authentication module 211 can detect the terminal 100 obtained by the vehicle 200 (that is, the owner's device holding the ICCE digital key, which can also be understood as a trusted device) or the server 300 (that is, the server that has the management right to the vehicle) sent with Whether the data related to the digital key under the CCC standard is sent to the vehicle 200 using the communication mechanism and/or security mechanism under the ICCE standard, and whether the data received by the vehicle 200 is detected using the communication mechanism and/or security mechanism under the ICCE standard After being sent to the vehicle 200 , the received data is sent to the key management module 220 .
  • the authentication module 211 can also detect whether the control instruction obtained by the vehicle 200 from the terminal 100 is legal or not based on the key authentication protocol between the terminal and the vehicle defined in the ICCE standard.
  • the key storage module 212 can store digital keys under the ICCE standard, and/or data related to the digital keys under the ICCE standard.
  • the key management module 220 can have a configuration function for the CCC digital key system 230, which can configure and initialize digital keys under the CCC standard.
  • the key management module 220 can authenticate the data it acquires, And after it is determined that the data comes from a device and server that is legal, trusted and has the corresponding authority to unlock the key, the data is sent to the key storage module 232 in the CCC digital key system 230 .
  • the CCC digital key system 230 can manage digital keys under the CCC standard.
  • the authentication module 231 can detect whether the control instruction based on the CCC standard acquired by the vehicle 200 from the terminal 100 is legal or not.
  • the key storage module 232 can store the digital key under the CCC standard, and/or data related to the digital key under the CCC standard.
  • the server 300 may include, but is not limited to, a data processing module 310 .
  • the data processing module 310 can have the configuration function of the digital key under the CCC standard, which can provide the terminal 100 with at least part of the data required to generate the digital key under the CCC standard, record the public key of the digital key, and generate Record certificate, etc.
  • the terminal can reuse the trust relationship and security mechanism under the ICCE standard system, and securely obtain the digital key generated under the CCC standard from the server.
  • the data of the required vehicle can generate the digital key under the CCC standard, and ensure that the vehicle can ensure that the public key of the CCC digital key sent by the terminal based on the trust mechanism of the ICCE system comes from a legal and authorized vehicle owner device (holding ICCE The owner's key under the system), thus realizing the addition of support for the digital key system of the CCC standard under the digital key system of the ICCE standard, so that the digital key under the CCC system can be realized without implementing or implementing the CCC pairing protocol
  • the data interaction required for pairing reduces the development workload and the cost of the PKI system, and improves the user experience.
  • FIG. 5 shows a schematic diagram of a hardware structure of a terminal 100 provided in an embodiment of the present application.
  • the terminal 100 may include a processor 110 , a memory 120 and a communication module 130 .
  • the processor 110 may be a general purpose processor or a special purpose processor.
  • the processor 110 may include a central processing unit (central processing unit, CPU) and/or a baseband processor.
  • the baseband processor can be used to process communication data
  • the CPU can be used to implement corresponding control and processing functions, execute software programs, and process data of the software programs.
  • the processor 110 may include one or more processing units.
  • the processor 110 may include an application processor (application processor, AP), a modem (modem), a graphics processing unit (graphics processing unit, GPU), an image signal processor (image signal processor, ISP), a controller, a video encoder One or more of a decoder, a digital signal processor (digital signal processor, DSP), a baseband processor, and/or a neural network processor (neural-network processing unit, NPU), etc.
  • the terminal 100 may include one or more processors 110 . Wherein, different processing units may be independent devices, or may be integrated in one or more processors.
  • the processor 110 may generate a public-private key pair of a digital key under the CCC standard, generate a public key certificate of a digital key, and the like.
  • the memory 120 can store programs, and the programs can be executed by the processor 110 .
  • the memory 120 may also store data.
  • the processor 110 can read data stored in the memory 120 .
  • the memory 120 and the processor 110 may be provided separately.
  • the memory 120 may also be integrated in the processor 110 .
  • data related to the digital key and the like may be stored in the memory 120 .
  • the communication module 130 may include at least one of a mobile communication module and a wireless communication module. Wherein, when the communication module 130 includes a mobile communication module, the communication module 130 may provide solutions for wireless communication including 2G/3G/4G/5G applied on electronic devices. For example, global system for mobile communications (GSM), general packet radio service (GPRS), code division multiple access (CDMA), wideband code division multiple access (wideband code division multiple access (WCDMA), time-division code division multiple access (TD-SCDMA), long term evolution (LTE), new radio (NR), etc.
  • GSM global system for mobile communications
  • GPRS general packet radio service
  • CDMA code division multiple access
  • WCDMA wideband code division multiple access
  • TD-SCDMA time-division code division multiple access
  • LTE long term evolution
  • NR new radio
  • the communication module 130 may include at least one filter, switch, power amplifier, low noise amplifier (low noise amplifier, LNA) and the like.
  • the communication module 130 can receive electromagnetic waves through at least one antenna, filter and amplify the received electromagnetic waves, and send them to the modem for demodulation.
  • the communication module 130 can also amplify the signal modulated by the modem, convert it into electromagnetic wave and radiate it through the antenna.
  • at least part of the functional modules of the communication module 130 may be disposed in the processor 110 .
  • at least part of the functional modules of the communication module 130 and at least part of the modules of the processor 110 may be disposed in the same device.
  • the communication module 130 can provide applications on the terminal 100 including wireless local area networks (wireless local area networks, WLAN) (such as wireless fidelity (wireless fidelity, Wi-Fi) network), bluetooth ( bluetooth, BT), global navigation satellite system (global navigation satellite system, GNSS), frequency modulation (frequency modulation, FM), near field communication technology (near field communication, NFC), infrared technology (infrared, IR) and other wireless communication solution.
  • WLAN wireless local area networks
  • WLAN wireless local area networks
  • wireless fidelity wireless fidelity, Wi-Fi
  • bluetooth bluetooth, BT
  • global navigation satellite system global navigation satellite system
  • frequency modulation frequency modulation, FM
  • near field communication technology near field communication
  • NFC near field communication technology
  • infrared technology infrared, IR
  • the communication module 130 may be one or more devices integrating at least one communication processing module.
  • the communication module 130 receives electromagnetic waves via the antenna, frequency-modulates and filters the electromagnetic wave signals, and sends the processed signals to the processor 110 .
  • the communication module 130 can also receive the signal to be sent from the processor 110, frequency-modulate it, amplify it, and convert it into electromagnetic wave and radiate it through the antenna.
  • the communication module 130 may receive data sent by the server 300 , or send data to the server 300 , or send data to the vehicle 200 , or receive data sent by the vehicle 200 and so on.
  • the structure illustrated in the embodiment of the present application does not constitute a specific limitation on the terminal 100 .
  • the terminal 100 may include more or fewer components than shown in the figure, or combine certain components, or separate certain components, or arrange different components.
  • the illustrated components can be realized in hardware, software or a combination of software and hardware.
  • the hardware structure of the vehicle 200 may have the same hardware structure as that of the terminal 100, or may have more or less components than the terminal 100, which is not limited here.
  • FIG. 6 shows a schematic diagram of a hardware structure of a server 300 provided in an embodiment of the present application.
  • the server 300 may include: a processor 310 , a network interface 320 , and a memory 330 .
  • the processor 310 may be a general purpose processor or a special purpose processor.
  • the processor 210 may include a central processing unit (central processing unit, CPU) and/or a baseband processor.
  • the baseband processor can be used to process communication data
  • the CPU can be used to implement corresponding control and processing functions, execute software programs, and process data of the software programs.
  • the processor 210 may obtain the vehicle data required for generating the digital key structure, record the public key of the digital key generated by the terminal, and so on.
  • the network interface 320 may optionally include a standard wired interface, a wireless interface (such as Wi-Fi, a mobile communication interface, etc.), which is controlled by the processor 310 for sending and receiving data, for example, receiving data from the communication module 130 in the terminal 100 from the network.
  • the transmitted data is either data transmitted to the terminal 100 , or data transmitted to the vehicle 200 , or the like.
  • the memory 330 can store programs, and the programs can be executed by the processor 310 .
  • the memory 330 may also store data (eg, the vehicle's identification, the vehicle's public key, the vehicle's public key certificate, etc.).
  • the processor 310 can read data stored in the memory 330 .
  • the memory 330 and the processor 310 may be provided separately.
  • the memory 330 may also be integrated in the processor 310 .
  • the structure shown in the embodiment of the present application does not constitute a specific limitation on the server 300 .
  • the server 300 may include more or fewer components than shown in the figure, or combine some components, or split some components, or arrange different components.
  • the illustrated components can be realized in hardware, software or a combination of software and hardware.
  • FIG. 7 shows a schematic flow chart of a digital key pairing method provided by an embodiment of the present application. As shown in Figure 7, the method may include the following steps:
  • the terminal establishes a connection with the server.
  • a connection can be established between the terminal and the server through a network.
  • the car owner can log in to an application related to the digital key on the terminal.
  • a connection is established between the terminal and the server.
  • the registered account of the vehicle owner may have an association relationship with the vehicle.
  • a secure data channel can be established between the two to ensure security during data communication.
  • the two can reuse the security mechanism, service interface, software development kit (software development kit, SDK), etc. in the key issuance/update process under the ICCE standard for data interaction.
  • the terminal sends a first request to the server, where the first request is used to apply for activation of a digital key under the CCC standard.
  • the terminal may send a first request to the server for applying for a digital key under the CCC standard.
  • the terminal may send the first request to the server by multiplexing the communication mechanism in the key issue/update process under the ICCE standard.
  • the first request may include an encryption public key used to encrypt data, and the encryption public key may be used to encrypt communication data between the terminal and the server.
  • the terminal can send the first request to the server when the car owner applies for a digital key under the ICCE standard. ask.
  • the terminal may also send the first request to the server when the car owner has applied for activation of the digital key under the ICCE standard and then applies for activation of the digital key under the CCC standard.
  • the details may be determined according to actual conditions, and are not limited here.
  • the server acquires first data in response to the first request, and the first data is used to generate a digital key structure.
  • the server may respond to the first request and obtain first data, and the first data is used to generate the digital key structure.
  • the first data may include a vehicle identifier, a vehicle public key, a slot identifier, authorized public keys, key capability data ( key options), private mailbox size (private mailbox size), confidential mailbox size (confidential mailbox size) in one or more.
  • the first data can be pre-configured in the server by the manufacturer of the vehicle, so that the server can directly read the first data.
  • the server may also obtain the first data from the vehicle. At this point, the server may send a data acquisition request to the vehicle. After receiving the data acquisition request, the vehicle may send the first data to the server, so that the server acquires the first data.
  • the server may verify the identity of the vehicle owner, and obtain the first data after the verification is passed, thereby improving security.
  • the server may verify the identity of the vehicle owner, and obtain the first data after the verification is passed, thereby improving security.
  • the server determines that the information on the owner and the vehicle carried in the first request is consistent with the stored information on the owner and the vehicle owned by the owner, the verification is passed.
  • the server can also generate a first credential, which can be used to indicate the public key of the digital key stored in the vehicle terminal.
  • a first credential which can be used to indicate the public key of the digital key stored in the vehicle terminal.
  • the vehicle stores the public key of the digital key of the terminal after obtaining the first credential, so that the vehicle can confirm the reliability of the source of the public key, adding a layer of protection and improving data security sex.
  • the server sends the first data to the terminal.
  • the server may send the first data to the terminal.
  • the server may send the first data to the terminal by multiplexing the secure communication mechanism in the key issue/update process under the ICCE standard.
  • the first data may be protected by using the encrypted public key in the first request.
  • the terminal generates a public-private key pair of the digital key, and generates a digital key structure that meets the requirements of the CCC standard based on the first data.
  • the terminal can generate a public-private key pair of the digital key, and generate a digital key structure that meets the requirements of the CCC standard based on the first data.
  • the digital key structure that meets the requirements of the CCC standard may include: vehicle identifier (vehicle identifier), node identifier (endpoint identifier), digital key identifier (digital key identifier), box position identifier (slot identifier), applet instance CA identifier (instance CA identifier), key capability data (key options), public key of the digital key generated on the terminal (device public key), vehicle public key (vehicle public key), authorized public key group ( authorized public keys), private mailbox (private mailbox), confidential mailbox (confidential mailbox).
  • vehicle identifier vehicle identifier
  • node identifier endpoint identifier
  • digital key identifier digital key identifier
  • box position identifier box position identifier
  • applet instance CA identifier instance CA identifier
  • key capability data key options
  • public key of the digital key generated on the terminal device public key
  • vehicle public key vehicle public key
  • authorized public key group authorized public keys
  • private mailbox private mailbox
  • confidential mailbox confidential mailbox
  • a node identifier (endpoint identifier), a digital key identifier (digital key identifier), and a terminal public key (device public key) may be generated by the terminal.
  • the applet instance CA identifier (instance CA identifier) may be provided by the terminal.
  • the vehicle identifier, slot identifier, key options, vehicle public key, and authorized public keys can be provided by the server.
  • the terminal can generate them based on the size of private mailboxes and confidential mailboxes provided by the server.
  • the terminal writes data into the digital key structure.
  • the terminal after the terminal generates the digital key structure, it can write data into the digital key structure.
  • the terminal may obtain the vehicle data contained in the private mailbox and the confidential mailbox from the server.
  • the vehicle data contained in the private mailbox and the confidential mailbox can be pre-stored in the server.
  • the server can also communicate with the vehicle to obtain the data of the vehicle contained in the private mailbox and the confidential mailbox.
  • the terminal completes the instantiation of the CCC applet in its own secure element (secure element, SE) (such as the secure element 110 shown in Figure 4b), and generates a digital key structure according to the first data, and The public-private key pair of the digital key is generated, and the first data is written into the digital key structure, that is, the terminal-side pairing completion state under the CCC standard can be entered.
  • secure element such as the secure element 110 shown in Figure 4b
  • the terminal completes the instantiation of the CCC applet in its own secure element (secure element, SE) (such as the secure element 110 shown in Figure 4b), and the first data is decrypted by the secure element 110, and the The CCC applet111 generates the digital key structure and the public-private key pair of the digital key, and writes the first data into the digital key structure, that is, it can enter the state where the pairing is completed on the terminal side under the CCC standard.
  • secure element secure element
  • the terminal sends data at least including the public key of the digital key to the vehicle.
  • the terminal after the terminal writes data into the digital key structure, it can send at least data containing the public key of the digital key to the vehicle, such as: public key of the digital key, public key certificate of the digital key, certificate chain of the digital key, etc. wait.
  • the vehicle such as: public key of the digital key, public key certificate of the digital key, certificate chain of the digital key, etc. wait.
  • the terminal when the terminal interacts with the vehicle through the car key application (applet) under the ICCE standard (for example: the ICCE car key application 111 in Figure 4b), when the terminal detects that there is a CCC
  • the terminal can use a special indicator bit in the ICCE instruction during the transaction process to indicate that the current interaction requires the CCC protocol and the digital key. Activation, for example, is marked by the P1P2 value of the command, or other custom tags.
  • the terminal can generate a digital key (digital key, DK) certificate (that is, the public key certificate of the digital key) or a certificate chain that conforms to the CCC standard, and save it in the manufacturer-defined field of the ICCE protocol, such as 9F05Cardinfo1, or other Vendor-defined fields or binary files.
  • DK digital key
  • the certificate chain can be sent to the vehicle, and then the data including at least the public key of the digital key can be sent to the vehicle.
  • the vehicle After the vehicle obtains the data sent by the terminal that includes at least the public key of the digital key, it can store the public key of the digital key. So far, the digital key pairing between the vehicle and the terminal under the CCC standard is completed, and then the terminal and the vehicle can use the digital key system under the CCC standard to communicate.
  • authentication can be performed between the vehicle and the terminal first. After the authentication is completed, the vehicle can trust the terminal, and obtain from the terminal the data sent by the terminal that contains at least the public key of the digital key. For example: the public key of the digital key and other necessary data (such as the nickname of the key, etc.).
  • the authentication module (for example: authentication module 211 in Figure 4b) in the ICCE digital key system in the vehicle uses the key under the ICCE standard to complete the authentication of the terminal, and obtains the The public key and other necessary data carried; after that, the vehicle can verify the integrity of the data and other additional verifications, such as verifying the first certificate, etc., to ensure that these data come from the owner's device holding the digital key, and after the verification is passed , the vehicle can configure these data to the CCC digital key system to activate the digital key under the CCC standard.
  • the vehicle can verify the integrity of the data and other additional verifications, such as verifying the first certificate, etc., to ensure that these data come from the owner's device holding the digital key, and after the verification is passed , the vehicle can configure these data to the CCC digital key system to activate the digital key under the CCC standard.
  • the terminal, the server, and the vehicle can fully comply with the ICCE standard, and the communication can be based on the communication mechanism and security mechanism defined by the ICCE standard.
  • the security mechanism may include business verification, user identity verification, trust relationship verification, data delivery and other mechanisms. It can be understood that the communication mechanism between the terminal and the server, the service verification mechanism, the user identity verification mechanism and the security data distribution mechanism defined in the ICCE standard are adopted between the terminal and the server in Figure 7.
  • the terminal and the vehicle The communication mechanism between the terminal and the vehicle defined in the ICCE standard and the trust relationship verification mechanism such as the verification of the digital key and related data are used.
  • the communication mechanism defined in the ICCE standard is also used between the vehicle and the server. and security mechanisms.
  • FIG. 8 shows a schematic flowchart of another digital key pairing method provided by the embodiment of the present application. As shown in Figure 8, the method may include the following steps:
  • the terminal establishes a connection with the server.
  • a connection can be established between the terminal and the server through a network.
  • a connection can be established between the terminal and the server through a network.
  • the terminal sends a first request to the server, where the first request is used to apply for activation of a digital key under the CCC standard.
  • the terminal may send a first request to the server for applying for a digital key under the CCC standard.
  • the server acquires first data in response to the first request, and the first data is used to generate a digital key structure.
  • the server may obtain first data in response to the first request, and the first data is used to generate the digital key structure.
  • the server may obtain first data in response to the first request, and the first data is used to generate the digital key structure.
  • the server sends the first data to the terminal.
  • the server may send the first data to the terminal.
  • the terminal generates a public-private key pair of the digital key, and generates a digital key structure that meets the requirements of the CCC standard based on the first data.
  • the terminal can generate a public-private key pair of the digital key, and generate a digital key structure that meets the requirements of the CCC standard based on the first data.
  • the terminal can generate a public-private key pair of the digital key, and generate a digital key structure that meets the requirements of the CCC standard based on the first data.
  • the terminal after the terminal obtains the first data, it can activate the intermediate certificate of the terminal-side certificate chain of the CCC system, generate a DK certificate satisfying the CCC system, and prepare a key tracking request.
  • the terminal sends a first recordation request to the server.
  • the first recordation request includes the public key of the digital key, and the first recordation request is used to request recordation of the public key of the digital key.
  • the terminal after the terminal generates the public-private key pair of the digital key and the digital key structure, it can send a first filing request to the server.
  • the first filing request includes the public key of the digital key of the terminal.
  • the first filing request is used to request the terminal The public key of the digital key is recorded.
  • the first filing request may include a proof of pairing between the terminal and the vehicle.
  • the proof of pairing may be that the public key of the digital key generated by the terminal is guaranteed by the root of trust in the ICCE system (for example, using the SCP03 secure channel protocol Upload the public key to the server securely), or use the preset device identity key to sign the public key, or use the digital key private key to self-sign the public key. Since the server has already known the pairing relationship between the terminal and the vehicle when the server generates the first data, so here, the pairing certificate can be used to determine that the public key of the digital key in the filing request is generated based on the first data, And come from the terminal sending the first data.
  • the terminal can send the first filing request to the server through the communication mechanism between the terminal and the server under the ICCE standard, so as to prove to the server the public key requested for filing in the first filing request and/or the information between the terminal and the vehicle. Proof of pairing comes from the terminal, not another device.
  • the server records the public key of the digital key of the terminal, and generates a first record certificate.
  • the server can record the public key of the digital key of the terminal and generate a first filing certificate, which is mainly used to prove that the server has registered the public key of the digital key of the terminal.
  • the server may generate the first filing certificate by storing the public key of the digital key of the terminal and signing the public key of the digital key of the terminal or the pairing relationship between the public key of the terminal and the vehicle.
  • the first filing certificate may include a key tracking signature (key tracking signature).
  • the server may also store the pairing certificate for filing of the pairing certificate.
  • the server sends the first filing certificate to the terminal.
  • the server may send the first record certificate to the terminal.
  • the server may also send some other necessary data to the terminal, such as the immo token for sharing, or other data not delivered in S804.
  • the terminal writes data into the digital key structure in response to the obtained first filing certificate.
  • the terminal may write data into the generated digital key structure in response to the obtained first filing certificate.
  • the terminal when the terminal writes data, it can be written in stages, that is, a part of the data is written when it is obtained, or it can be written at one time, that is, it is written after all the data is obtained.
  • the terminal has all the data required for sharing under the CCC standard, that is, the digital key structure.
  • the terminal enters a state of completion of pairing.
  • the data to be written by the terminal can be delivered by the server at one time, or can be delivered by the server in stages, which can be determined according to actual conditions, and is not limited here.
  • the terminal may obtain the vehicle data contained in the private mailbox and the confidential mailbox from the server.
  • the vehicle data contained in the private mailbox and the confidential mailbox can be pre-stored in the server.
  • the server can also communicate with the vehicle to obtain the data of the vehicle contained in the private mailbox and the confidential mailbox.
  • the terminal sends at least data including the public key of the digital key and the first filing certificate to the vehicle.
  • the terminal after the terminal writes data into the digital key structure, it can send at least the data including the public key of the digital key and the first filing certificate to the vehicle.
  • the terminal After the terminal writes data into the digital key structure, it can send at least the data including the public key of the digital key and the first filing certificate to the vehicle.
  • the terminal After the terminal writes data into the digital key structure, it can send at least the data including the public key of the digital key and the first filing certificate to the vehicle.
  • the vehicle verifies the first filing certificate, and stores the public key of the digital key after the verification is passed.
  • the vehicle can verify the first filing certificate according to the preset verification rules. After the verification is passed, it can Knowing that the obtained data including at least the public key of the digital key comes from a legal owner's device (that is, a trusted device), it can store the public key of the digital key of the terminal. So far, the digital key pairing between the vehicle and the terminal under the CCC standard is completed, and then the terminal and the vehicle can use the digital key system under the CCC standard to communicate. For details, refer to the description in S708 in FIG. 7 above, and details will not be repeated here.
  • the terminal, the server, and the vehicle can fully comply with the ICCE standard, and the communication can be performed based on the communication mechanism and security mechanism defined by the ICCE standard.
  • the security mechanism may include business verification, user identity verification, trust relationship verification, data delivery and other mechanisms. It can be understood that the communication mechanism between the terminal and the server, the business verification mechanism, the user identity verification mechanism and the security data delivery mechanism defined in the ICCE standard are adopted between the terminal and the server in Figure 8.
  • the terminal and the vehicle The communication mechanism between the terminal and the vehicle defined in the ICCE standard and the trust relationship verification mechanism such as the verification of the digital key and related data are used.
  • the communication mechanism defined in the ICCE standard is also used between the vehicle and the server. and security mechanisms.
  • Figure 8 the terminal needs to send the generated public key to the server for filing, and the vehicle further confirms that the key comes from a legal public key through the filing certificate issued by the server. terminal, thereby further enhancing security.
  • FIG. 9 shows a schematic flowchart of a digital key sharing method provided by the embodiment of the present application. As shown in Figure 9, the method may include the following steps:
  • the server obtains the sharing operation instruction issued by the car owner.
  • the server can communicate with the terminal used by the car owner, so that when the car owner initiates a sharing operation on the terminal used by the car owner, the server can obtain the sharing operation instruction issued by the car owner.
  • the sharing operation instruction may include the identity of the terminal to be shared, and the vehicle-related operation authority granted by the owner to the terminal to be shared, such as: digital key authority, validity period, sharing password information, etc.
  • the server acquires first data, where the first data is used to generate a digital key structure.
  • the server may obtain the first data, which is used to generate the digital key structure.
  • the server may obtain the first data, which is used to generate the digital key structure.
  • the server sends the first data to the terminal to be shared.
  • the server may send the first data to the terminal to be shared.
  • the server may multiplex the security mechanism in the key issue/update process under the ICCE standard to send the first data to the terminal to be shared.
  • a connection can be established between the terminal to be shared and the server first, and then a secure data channel can be established between the two to ensure security during data communication.
  • the two can reuse the secure communication mechanism in the key issue/update process under the ICCE standard for data interaction.
  • the server can collect the digital key based on the identity pair of the terminal to be shared included in the shared operation instruction obtained by the server and the application.
  • the terminal to be shared is verified, and when the verification is passed, the first data is sent to the terminal to be shared.
  • the server can also verify the identity of the shared terminal by using the method of verifying the identity of the vehicle owner described in Figure 1 above, see the above description for details, and will not go into details here.
  • the terminal to be shared may send a request to the server for applying for a digital key under the CCC standard.
  • the server can obtain the first data and send the first data to the terminal to be shared.
  • the terminal to be shared generates a public-private key pair of the digital key, and generates a digital key structure that meets the requirements of the CCC standard based on the first data.
  • the terminal to be shared After the terminal to be shared obtains the first data, it can generate a public-private key pair of the digital key, and generate a digital key structure that meets the requirements of the CCC standard based on the first data.
  • the terminal to be shared After the terminal to be shared obtains the first data, it can generate a public-private key pair of the digital key, and generate a digital key structure that meets the requirements of the CCC standard based on the first data.
  • the terminal to be shared sends a second filing request to the server.
  • the second filing request includes the public key of the digital key of the terminal to be shared.
  • the second filing request is used to request the public key of the digital key of the terminal to be shared to be filed.
  • the terminal to be shared After the terminal to be shared generates the public-private key pair of the digital key and the digital key structure, it can send a second filing request to the server.
  • the second filing request includes the public key of the digital key of the terminal to be shared.
  • the second filing request uses To request the recordation of the public key of the digital key of the terminal to be shared.
  • the second filing request may include a proof of pairing between the terminal to be shared and the vehicle.
  • the proof of pairing may be that the terminal to be shared is guaranteed by the public key of the digital key generated by the root of trust in the ICCE system (such as using SCP03 secure channel protocol to securely upload the public key to the server), or use the preset device identity key to sign the public key, or use the digital key private key to self-sign the public key. Since the server has already known the pairing relationship between the terminal to be shared and the vehicle when the server generates the first data, so here, the pairing certificate can be used to determine that the public key of the digital key in the filing request is generated based on the first data , and come from the terminal to be shared that sends the first data.
  • the terminal to be shared may send a second filing request to the server through the communication mechanism between the terminal and the server under the ICCE standard, so as to prove to the server that the public key requested for filing in the second filing request comes from the terminal to be shared, not other devices.
  • the terminal to be shared can use the SCP03 secure channel protocol in the ICCE standard to prove to its manufacturer's server that the source of the second filing request is legal, and then the manufacturer's server of the terminal to be shared and the business server (that is, the one described in Figure 9 server) to communicate with the second filing request to the business server.
  • the terminal to be shared can also use the server's public key to encrypt the second filing request and send it to the server, so as to ensure that only the server can decrypt the second filing request with the private key, thereby improving data security.
  • the server records the public key of the digital key of the terminal to be shared, and generates a second record certificate.
  • the server after the server obtains the second filing request, it can record the public key of the digital key of the terminal to be shared, and generate a second filing certificate.
  • the second filing certificate is mainly used to prove that the server has received the digital key of the terminal to be shared.
  • the public key is filed.
  • the server may generate the second filing certificate by storing the public key of the digital key of the terminal to be shared and signing the public key of the digital key of the terminal to be shared.
  • the second filing certificate may include a key tracking signature (key tracking signature).
  • the second filing certificate may also include an attestation package, and the attestation package may be used to construct the data structure of the digital key during the digital key sharing process.
  • the data structure of the authentication data packet may include: the public key (friend public key) of the digital key of the terminal to be shared, configuration data (profile), sharing password information (sharing password information), box One or more of slot identifier, validity start/end, and key friendly name.
  • the configuration data (profile) may include data such as manipulation authority.
  • Shared password information can include information about whether the owner's device policy requires the vehicle to request a shared password from a friend before activating the shared digital key.
  • the authentication data package may also include the signature of the vehicle owner device (owner signature).
  • owner signature the signature of the vehicle owner device
  • the server can send a signature request to the owner's device.
  • the owner's device signs, for example, use the RSA key of CCC for digital signature operation, or use the ICCE protocol key for encryption or message authentication code (message authentication code, MAC ) operation
  • the authentication certificate signed by the owner's device can be obtained. This shows that the sharing is authorized by the owner's device, further improving security.
  • the server sends the second filing certificate to the terminal to be shared.
  • the server may send the second recordation certificate to the terminal to be shared.
  • the terminal to be shared writes data into the digital key structure in response to the obtained second filing certificate.
  • the terminal to be shared can write data into the generated digital key structure.
  • the terminal to be shared when the terminal to be shared writes data, it can be written in stages, that is, a part of the data is written when it is obtained, or it can be written at one time, that is, it is written after all the data is obtained.
  • the terminal to be shared has all the data required for sharing under the CCC standard, that is, the digital key structure.
  • the terminal to be shared enters a state of completion of pairing.
  • the data to be written by the terminal to be shared can be delivered by the server at one time, or can be delivered by the server in stages, which can be determined according to the actual situation, and is not limited here.
  • the terminal to be shared can obtain it from the server.
  • the vehicle data contained in the private mailbox and the confidential mailbox can be pre-stored in the server.
  • the server can also communicate with the vehicle to obtain the data of the vehicle contained in the private mailbox and the confidential mailbox.
  • the terminal to be shared sends at least the data including the public key of the digital key and the second filing certificate to the vehicle.
  • the terminal to be shared after the terminal to be shared writes data into the digital key structure, it can send at least the data including the public key of the digital key and the second filing certificate to the vehicle.
  • the vehicle verifies the second filing certificate, and stores the public key of the digital key of the terminal to be shared after the verification is passed.
  • the vehicle can verify the second filing certificate according to the preset verification rules. After the verification is passed, it can Knowing that the acquired data including at least the public key of the digital key comes from the terminal to be shared (that is, a trusted device), it can store the public key of the digital key at this time. So far, the digital key sharing under the CCC standard is completed. After that, the digital key system under the CCC standard can be used for communication between the terminal to be shared and the vehicle.
  • the terminal to be shared can directly execute S908 and the steps after S908, that is, omit the intermediate filing process, that is, omit S905 to S907, and omit sending the second filing when executing the steps after S908
  • the proof can be determined according to the actual situation, and is not limited here.
  • the terminal to be shared, the server, and the vehicle can be executed in full compliance with the ICCE standard, and the communication can be performed based on the communication mechanism and security mechanism defined by the ICCE standard.
  • the security mechanism may include business verification, user identity verification, trust relationship verification, data delivery and other mechanisms. It can be understood that the communication mechanism between the terminal to be shared and the server, the service verification mechanism, the user identity verification mechanism and the security data distribution mechanism defined in the ICCE standard are adopted between the terminal to be shared and the server in Figure 9
  • the communication mechanism between the terminal to be shared and the vehicle defined in the ICCE standard and the verification mechanism of the digital key and related data are used between the terminal to be shared and the vehicle. It adopts the communication mechanism and security mechanism defined in the ICCE standard.
  • the server remotely sends the data required for sharing the digital key under the CCC standard, so that the owner does not need to Establish a secure communication mechanism between the device and the shared device, that is, the digital key sharing under the CCC standard can be completed under the digital key system of the ICCE standard, which simplifies the sharing process and realizes the addition of pairing under the digital key system of the ICCE standard.
  • the support of the digital key system of the CCC standard enables the data interaction required for the sharing of the CCC system to be realized without implementing the CCC sharing protocol, reduces the development workload and the cost of the PKI system, and improves the user experience.
  • FIG. 12 is a schematic flowchart of a method for unlocking a digital key provided in an embodiment of the present application.
  • the method can be executed by any device, device, platform, or device cluster that has computing and processing capabilities.
  • a first service agreement has been preconfigured among the first device, the second device, and the server, wherein the first device can apply for activation of the first digital key under the first service agreement.
  • the first device in FIG. 12 may be a terminal such as a mobile phone.
  • the first device may be the terminal 100 shown in FIG. A vehicle 200 is shown in Figure 4a.
  • the first device can control the second device through the digital key.
  • the first device may also be the terminal to be shared described in FIG. 9 above.
  • the first service protocol may be the ICCE standard protocol
  • the second service protocol may be the CCC standard protocol.
  • the unlocking method of the digital key may include the following steps:
  • the first device sends a target request to the server, where the target request is used to request to apply for activation of the second digital key under the second service agreement.
  • the first device may send a target request for applying for the second digital key under the second service agreement to the server.
  • the target request may be the first request described above.
  • the first device may multiplex the communication mechanism in the key issue/update process under the first service protocol to send the target request to the server.
  • the target request may be sent when the user applies for the first digital key under the first service agreement by using the first device, or it may be generated when the user has applied for the first digital key and then applies for the second digital key .
  • the server acquires target data in response to the target request, and uses the first communication mechanism defined by the first service protocol to send the target data to the first device, where the target data is used to construct a data structure of the second digital key.
  • the server can be used to construct the target data of the data structure of the second digital key.
  • the target data may be preconfigured in the server, and may also be obtained from the second device in real time or in advance.
  • the server may send the target data to the first device by using the first communication mechanism defined by the first service protocol.
  • the target data may be the first data described above.
  • the first communication mechanism refers to a communication mechanism between the first device and the server defined under the first service agreement. For example, a secure communication mechanism is provided between devices by encrypting/decrypting data with a key.
  • the target data may include one or more of the following: the identity of the second device, the public key of the second device, the slot ID, the authorized public key group, key capability data, private mailbox size, or, confidential mailbox size.
  • the first device generates a public key and a private key of the second digital key in response to the acquired target data, constructs a first data structure based at least on the target data, and writes at least the information in the target data into the first data structure part of data.
  • the first device after the first device obtains the target data, it can generate the public key and private key of the second digital key, construct a first data structure based on at least the target data, and write at least the target data into the first data structure. part of the data. So far, the first device enters into a state where pairing on the first device side is completed under the second service protocol.
  • the first data structure may be the digital key structure described above in FIG. 3 that meets the requirements of the CCC standard.
  • the first data structure includes one or more of the following: the second device identifier, the identifier defined inside the first device for the second digital key, the digital key identifier, the compartment identifier, the instance CA identifier, key capability data, The public key of the second digital key, the public key of the second device, an authorized public key group, a private mailbox, or a confidential mailbox.
  • the identification defined for the second digital key inside the first device can be understood as the node identification described in FIG. 3 above.
  • the identifier defined inside the first device for the second digital key, the digital key identifier, the compartment identifier, the instance CA identifier and the public key of the second digital key may all be provided by the first device.
  • the second device identifier, the compartment identifier, the key capability data, the public key of the second device and the authorized public key group can all be obtained from the target data. Private mailboxes and confidential mailboxes may be created by the first device based on the target data.
  • the first device may use the first communication mechanism defined in the first service protocol to send a target filing request to the server, wherein, The target recordation request is used to request recordation of the public key of the second digital key.
  • the server can record the public key of the second digital key and generate a target recordation certificate, wherein the target recordation certificate is used to prove that the server has completed the recordation of the public key of the second digital key.
  • the server may use the first communication mechanism defined in the first service protocol to send the target filing certificate to the first device.
  • the first device can obtain the target filing certificate sent by the server.
  • the target filing certificate may be the first filing certificate described in FIG. 8 above, or the second filing certificate described in FIG. 9 above.
  • the first device uses the second communication mechanism defined by the first service protocol to send a first message to the second device.
  • the first message includes the public key of the second digital key, and the first message is used to instruct the second device to store the second digital key.
  • the public key of the digital key is used to instruct the second device to store the second digital key.
  • the first device After the first device writes data into the first data structure, the first device has completed the state of digital key pairing on its own side. At this time, the first device can use the The second communication mechanism sends a first message to the second device, the first message includes the public key of the second digital key, and the first message is used to instruct the second device to store the public key of the second digital key.
  • the second communication mechanism refers to the communication mechanism between the first device and the second device defined under the first service agreement. For example: the key and authentication protocol based on the digital key between devices to provide a secure communication mechanism.
  • the first device may also add the target filing certificate to the first message.
  • the second device can further reconfirm that the public key of the second digital key comes from a legitimate device through the filing certificate issued by the server, thereby further improving security.
  • the second device stores the public key of the second digital key in response to the first message.
  • the second device may store the public key of the second digital key. So far, the activation of the second digital key under the second service agreement between the first device and the second device is completed, and then the first device and the second device can use the second digital key system for communication, and the second A device can use the second digital key to control a second device.
  • the second device can verify the target record certificate according to the preset verification rules, and when the verification is passed, it can know that it has obtained
  • the public key of the second digital key comes from a legitimate device, which can store the public key of the second digital key at this time.
  • both the first device and the second device are configured with a digital key system matching the first digital key and a digital key system matching the second digital key.
  • both the first device and the second device are configured with two sets of digital key systems, and different digital key systems can support different service protocols.
  • the server remotely issues the data required for the activation of the digital key under the second service agreement.
  • the mechanism defined under the first service agreement enables the opening of the digital key under the second service agreement between the first device and the second device implementing the second service agreement, and realizes the digital key system under the first service agreement.
  • Add support for the digital key system under the second service agreement so that the data interaction required for the activation of the digital key under the second service agreement can be realized without implementing or executing the pairing agreement under the second service agreement, reducing
  • the development workload and the cost of the PKI system have improved the user experience.
  • each step in any embodiment of the present application can be adjusted according to the actual situation on the premise of no contradiction, and the adjusted technical solution is also within the scope of the present application.
  • each step in any embodiment of the present application may also be selectively executed, which is not limited here.
  • FIG. 13 is a schematic structural diagram of a chip provided by an embodiment of the present application.
  • a chip 1300 includes one or more processors 1301 and an interface circuit 1302 .
  • the chip 1300 may also include a bus 1303 . in:
  • the processor 1301 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method may be completed by an integrated logic circuit of hardware in the processor 1301 or instructions in the form of software.
  • the above-mentioned processor 1301 may be a general-purpose processor, a digital communicator (DSP), an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components .
  • DSP digital communicator
  • ASIC application-specific integrated circuit
  • FPGA field programmable gate array
  • a general-purpose processor may be a microprocessor, or the processor may be any conventional processor, or the like.
  • the interface circuit 1302 can be used for sending or receiving data, instructions or information.
  • the processor 1301 can use the data, instructions or other information received by the interface circuit 1302 to process, and can send the processing completion information through the interface circuit 1302.
  • the chip further includes a memory, which may include a read-only memory and a random access memory, and provides operation instructions and data to the processor.
  • a portion of the memory may also include non-volatile random access memory (NVRAM).
  • the memory stores executable software modules or data structures, and the processor can execute corresponding operations by calling operation instructions stored in the memory (the operation instructions can be stored in the operating system).
  • the interface circuit 1302 may be used to output an execution result of the processor 1301 .
  • processor 1301 and the interface circuit 1302 can be realized by hardware design, software design, or a combination of software and hardware, which is not limited here.
  • each step in the foregoing method embodiments may be implemented by logic circuits in the form of hardware or instructions in the form of software in the processor.
  • the chip can be applied to the terminal 100, the vehicle 200 or the server 300 in FIG. 4a above, so as to implement the method provided in the embodiment of the present application.
  • processor in the embodiments of the present application may be a central processing unit (central processing unit, CPU), and may also be other general processors, digital signal processors (digital signal processor, DSP), application specific integrated circuits (application specific integrated circuit, ASIC), field programmable gate array (field programmable gate array, FPGA) or other programmable logic devices, transistor logic devices, hardware components or any combination thereof.
  • CPU central processing unit
  • DSP digital signal processor
  • ASIC application specific integrated circuit
  • FPGA field programmable gate array
  • a general-purpose processor can be a microprocessor, or any conventional processor.
  • the method steps in the embodiments of the present application may be implemented by means of hardware, or may be implemented by means of a processor executing software instructions.
  • the software instructions can be composed of corresponding software modules, and the software modules can be stored in random access memory (random access memory, RAM), flash memory, read-only memory (read-only memory, ROM), programmable read-only memory (programmable rom) , PROM), erasable programmable read-only memory (erasable PROM, EPROM), electrically erasable programmable read-only memory (electrically EPROM, EEPROM), register, hard disk, mobile hard disk, CD-ROM or known in the art any other form of storage medium.
  • An exemplary storage medium is coupled to the processor such the processor can read information from, and write information to, the storage medium.
  • the storage medium may also be a component of the processor.
  • the processor and storage medium can be located in the ASIC.
  • all or part of them may be implemented by software, hardware, firmware or any combination thereof.
  • software When implemented using software, it may be implemented in whole or in part in the form of a computer program product.
  • the computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on the computer, the processes or functions according to the embodiments of the present application will be generated in whole or in part.
  • the computer can be a general purpose computer, a special purpose computer, a computer network, or other programmable devices.
  • the computer instructions may be stored in or transmitted via a computer-readable storage medium.
  • the computer instructions may be transmitted from one website site, computer, server, or data center to another website site by wired (such as coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (such as infrared, wireless, microwave, etc.) , computer, server or data center for transmission.
  • the computer-readable storage medium may be any available medium that can be accessed by a computer, or a data storage device such as a server or a data center integrated with one or more available media.
  • the available medium may be a magnetic medium (such as a floppy disk, a hard disk, or a magnetic tape), an optical medium (such as a DVD), or a semiconductor medium (such as a solid state disk (solid state disk, SSD)), etc.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Lock And Its Accessories (AREA)

Abstract

Procédé d'activation de clé numérique, appliqué à un premier dispositif (100). Un premier protocole de service est préconfiguré entre un premier dispositif (100), un second dispositif (200) et un serveur (300), et le procédé d'activation de clé numérique peut être mis en œuvre dans un système de clé numérique sous le premier protocole de service ; sur la base des relations de confiance entre le premier dispositif (100), le second dispositif (200) et le serveur (300), des données requises pour une activation de clé numérique dans un second protocole de service sont émises à distance par le serveur (300) ; un mécanisme défini sous le premier protocole de service est utilisé pour achever une activation de clé numérique entre le premier dispositif (100) et le second dispositif (200) sous le second protocole de service. Un support pour un système de clé numérique sous le second protocole est ainsi ajouté sous le système de clé numérique sous le premier protocole, ce qui permet d'obtenir l'interaction de données requise pour une activation de clé numérique sous le second protocole de service sans mettre en œuvre un protocole d'appariement sous le second protocole de service, ce qui permet de réduire la charge de développement et les coûts du système PKI, et d'améliorer l'expérience utilisateur.
PCT/CN2022/112505 2021-10-13 2022-08-15 Procédé, dispositif et système d'activation de clé numérique WO2023061029A1 (fr)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202111194038.3 2021-10-13
CN202111194038.3A CN115966038A (zh) 2021-10-13 2021-10-13 一种数字钥匙开通方法、设备及系统

Publications (1)

Publication Number Publication Date
WO2023061029A1 true WO2023061029A1 (fr) 2023-04-20

Family

ID=85894970

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/112505 WO2023061029A1 (fr) 2021-10-13 2022-08-15 Procédé, dispositif et système d'activation de clé numérique

Country Status (2)

Country Link
CN (1) CN115966038A (fr)
WO (1) WO2023061029A1 (fr)

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN116760867B (zh) * 2023-08-15 2023-11-21 小米汽车科技有限公司 数字车钥匙的创建方法、装置、存储介质及系统
CN116887221B (zh) * 2023-09-07 2023-11-24 上海银基信息安全技术股份有限公司 跨协议数字钥匙分享方法、系统及计算机可读存储介质

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101997682A (zh) * 2009-08-10 2011-03-30 北京多思科技发展有限公司 安全通信系统及方法
JP2016206813A (ja) * 2015-04-20 2016-12-08 株式会社 ディー・エヌ・エー 車両を管理するシステム及び方法
CN106487783A (zh) * 2016-09-28 2017-03-08 深圳市速美特电子科技有限公司 用于车辆通讯连接的加密方法及装置
CN111080857A (zh) * 2019-12-30 2020-04-28 华人运通(上海)云计算科技有限公司 车辆数字钥匙管理使用方法、装置、移动终端及存储介质
CN111200496A (zh) * 2019-11-05 2020-05-26 储长青 一种基于车辆的数字钥匙实现方法
CN113301167A (zh) * 2021-06-30 2021-08-24 深圳市雪球科技有限公司 数字钥匙的跨规范分享方法、装置和设备

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101997682A (zh) * 2009-08-10 2011-03-30 北京多思科技发展有限公司 安全通信系统及方法
JP2016206813A (ja) * 2015-04-20 2016-12-08 株式会社 ディー・エヌ・エー 車両を管理するシステム及び方法
CN106487783A (zh) * 2016-09-28 2017-03-08 深圳市速美特电子科技有限公司 用于车辆通讯连接的加密方法及装置
CN111200496A (zh) * 2019-11-05 2020-05-26 储长青 一种基于车辆的数字钥匙实现方法
CN111080857A (zh) * 2019-12-30 2020-04-28 华人运通(上海)云计算科技有限公司 车辆数字钥匙管理使用方法、装置、移动终端及存储介质
CN113301167A (zh) * 2021-06-30 2021-08-24 深圳市雪球科技有限公司 数字钥匙的跨规范分享方法、装置和设备

Also Published As

Publication number Publication date
CN115966038A (zh) 2023-04-14

Similar Documents

Publication Publication Date Title
US11888594B2 (en) System access using a mobile device
US11876896B2 (en) ID-based control unit-key fob pairing
WO2023061029A1 (fr) Procédé, dispositif et système d'activation de clé numérique
US11777936B2 (en) Friend key sharing
WO2019109727A1 (fr) Appareil et procédé de vérification d'identité
CN111314274B (zh) 一种车载终端与中心平台双向认证方法及系统
CN109428874B (zh) 基于服务化架构的注册方法及装置
EP3175597B1 (fr) Appareil et procédé pour partager une interface de module de sécurité matériel dans un réseau collaboratif
CN110290525A (zh) 一种车辆数字钥匙的分享方法及系统、移动终端
CN110637328A (zh) 一种基于便携式设备的车辆访问方法
CN105408910A (zh) 用于利用无线通信令牌在操作系统被引导之前对由用户对操作系统的访问进行验证的系统和方法
US20220311625A1 (en) Certificate Application Method And Device
US11522695B2 (en) Sharing system access using a mobile device
CN114238900A (zh) 一种数据传输方法及电子设备
WO2023279283A1 (fr) Procédé pour établir des communications sécurisées de véhicule, et véhicule, terminal et système
WO2021129511A1 (fr) Procédé de communication et produit associé
CN114245375B (zh) 一种密钥跨设备分发方法及电子设备
CN111127715A (zh) 一种蓝牙钥匙更换方法及其装置
US20180034785A1 (en) Method for providing an authenticated connection between at least two communication partners
CN113316916A (zh) 数字密钥共享系统中更新防盗令牌的设备及方法
EP4362390A1 (fr) Procédé de maintien d'une ressource de stockage, appareil, véhicule, programme informatique
CN117813804A (zh) 通信方法及相关设备

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22879976

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE