WO2023185492A1 - 车辆控制器诊断方法、装置、设备和介质 - Google Patents
车辆控制器诊断方法、装置、设备和介质 Download PDFInfo
- Publication number
- WO2023185492A1 WO2023185492A1 PCT/CN2023/081904 CN2023081904W WO2023185492A1 WO 2023185492 A1 WO2023185492 A1 WO 2023185492A1 CN 2023081904 W CN2023081904 W CN 2023081904W WO 2023185492 A1 WO2023185492 A1 WO 2023185492A1
- Authority
- WO
- WIPO (PCT)
- Prior art keywords
- diagnostic device
- controller
- authentication
- vehicle
- response
- Prior art date
Links
- 238000002405 diagnostic procedure Methods 0.000 title claims abstract description 11
- 230000004044 response Effects 0.000 claims abstract description 54
- 238000000034 method Methods 0.000 claims abstract description 48
- 238000013475 authorization Methods 0.000 claims description 60
- 238000004590 computer program Methods 0.000 claims description 8
- 238000003745 diagnosis Methods 0.000 abstract description 27
- 230000007246 mechanism Effects 0.000 abstract description 6
- 230000015654 memory Effects 0.000 description 13
- 238000010586 diagram Methods 0.000 description 9
- 230000008569 process Effects 0.000 description 7
- 238000005516 engineering process Methods 0.000 description 6
- 230000002452 interceptive effect Effects 0.000 description 5
- 230000006870 function Effects 0.000 description 3
- 230000009471 action Effects 0.000 description 2
- 238000004891 communication Methods 0.000 description 2
- 238000012217 deletion Methods 0.000 description 2
- 230000037430 deletion Effects 0.000 description 2
- 230000003213 activating effect Effects 0.000 description 1
- 230000009286 beneficial effect Effects 0.000 description 1
- 238000011161 development Methods 0.000 description 1
- 230000014509 gene expression Effects 0.000 description 1
- 238000010295 mobile communication Methods 0.000 description 1
- 238000012986 modification Methods 0.000 description 1
- 230000004048 modification Effects 0.000 description 1
- 230000003287 optical effect Effects 0.000 description 1
- 238000012545 processing Methods 0.000 description 1
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
-
- G—PHYSICS
- G07—CHECKING-DEVICES
- G07C—TIME OR ATTENDANCE REGISTERS; REGISTERING OR INDICATING THE WORKING OF MACHINES; GENERATING RANDOM NUMBERS; VOTING OR LOTTERY APPARATUS; ARRANGEMENTS, SYSTEMS OR APPARATUS FOR CHECKING NOT PROVIDED FOR ELSEWHERE
- G07C5/00—Registering or indicating the working of vehicles
- G07C5/08—Registering or indicating performance data other than driving, working, idle, or waiting time, with or without registering driving, working, idle or waiting time
- G07C5/0808—Diagnosing performance data
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
- H04L9/3247—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving digital signatures
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L2209/00—Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
- H04L2209/84—Vehicles
Definitions
- the present disclosure relates to the field of vehicle communication technology, and in particular, to a vehicle controller diagnostic method, device, equipment and medium.
- each controller in the vehicle's Ethernet can be accessed and diagnosed.
- the after-sales diagnostic instrument PC, client program and other equipment
- PC can perform specified business operations on the vehicle by connecting to this interface and using a specific protocol (for example: DoIP protocol, (Diagnostic On IP, Internet diagnostic protocol)), such as reading Get version information, modify vehicle configuration, read fault codes, etc.
- the present disclosure provides a vehicle controller diagnosis method, device, equipment and medium.
- an embodiment of the present disclosure provides a vehicle controller diagnostic method, including:
- the controller with access rights to the diagnostic device is authorized.
- the mutual authentication with the diagnostic device includes:
- a first authentication message is generated and Send the first authentication message to the diagnostic device, including:
- a first authentication message is generated and sent to the diagnostic device, so that the diagnostic device uses the first public key to authenticate the first authentication message. Perform authentication, wherein the first public key and the first private key are a key pair.
- authenticating the second authentication message includes:
- the second authentication message is authenticated through a second public key, where the second authentication message is generated by the diagnostic device after signing the identification information based on the second private key.
- the public key and the second private key are a key pair.
- the access request includes authorized controller identification information
- authorizing the controller with access rights to the diagnostic device includes:
- the access request includes user identification information
- authorizing the controller with access rights to the diagnostic device includes:
- a target controller to which the diagnostic device has access rights is determined based on the user identification information, and the target controller to which the diagnostic device has access rights is authorized.
- the access request includes authorization controller identification information and user identification information
- authorizing the controller with access rights to the diagnostic device includes:
- the access authority of the diagnostic device to the target controller is determined from the target controller based on the user identification information, so that the authorization module authorizes the target controller within the access authority based on the authorization request.
- the method further includes:
- the access permission issued to the controller is deleted.
- an embodiment of the present disclosure provides a vehicle controller diagnostic device, including:
- An identity authentication module configured to perform mutual authentication with the diagnostic device in response to an identity authentication request sent by the diagnostic device
- An authorization module configured to authorize a controller with access rights to the diagnostic device in response to the access request sent by the diagnostic device.
- an electronic device including:
- processors one or more processors
- a storage device for storing one or more programs
- the one or more processors When the one or more programs are executed by the one or more processors, the one or more processors are caused to implement the method as described in any one of the first aspects.
- embodiments of the present disclosure provide a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, the method as described in any one of the first aspects is implemented.
- embodiments of the present disclosure provide a computer program product, including a computer program that, when executed by a processor, implements the method as described in any one of the first aspects.
- the vehicle controller diagnostic method, device, equipment and medium provided by the embodiments of the present disclosure perform mutual authentication with the diagnostic device in response to the identity authentication request sent by the diagnostic device; after the mutual authentication is passed, in response to the access request sent by the diagnostic device, Authorize the controller that has access rights to the diagnostic device.
- the identity authentication request is a request for mutual authentication with the diagnostic device, that is, the mutual authentication of the identities between the vehicle and the diagnostic device, which is implemented before the diagnostic device diagnoses the controller. Through the mutual authentication mechanism, the identities of the diagnostic equipment and the vehicle are authenticated, thereby ensuring the security of subsequent diagnosis of the controller by the diagnostic equipment.
- Figure 1 is a schematic flowchart of a vehicle controller diagnosis method provided by an embodiment of the present disclosure
- Figure 2 is a schematic flowchart of a vehicle controller diagnostic method provided by an embodiment of the present disclosure
- Figure 3 is an interactive schematic diagram of vehicle controller diagnosis provided by an embodiment of the present disclosure
- Figure 4 is a schematic flowchart of a vehicle controller diagnostic method provided by an embodiment of the present disclosure
- Figure 5 is an interactive schematic diagram of vehicle controller diagnosis provided by an embodiment of the present disclosure
- Figure 6 is an interactive schematic diagram of vehicle controller diagnosis provided by an embodiment of the present disclosure.
- Figure 7 is a schematic structural diagram of a vehicle controller diagnostic device provided by an embodiment of the present disclosure.
- FIG. 8 is a schematic structural diagram of an electronic device provided by an embodiment of the present disclosure.
- the vehicle controller diagnosis method provided by the embodiment of the present disclosure is applied to intelligent vehicles.
- the method provided by the embodiment of the present disclosure can Executed by smart vehicles.
- FIG. 1 is a schematic flow chart of a vehicle controller diagnosis method provided by an embodiment of the present disclosure. As shown in Figure 1, the vehicle controller diagnosis method specifically includes the following:
- Mutual authentication refers to the identity authentication of the vehicle diagnostic device and the authentication of the vehicle's identity by the diagnostic device.
- the diagnostic device sends an identity authentication request to the vehicle.
- the vehicle After receiving the identity authentication request sent by the diagnostic device, the vehicle authenticates with the diagnostic device. mutual authentication.
- the diagnostic device in the embodiment of the present application may be an intelligent diagnostic device/personal computer/personal handheld terminal/OBD device or other device capable of Ethernet communication with an intelligent vehicle.
- the access request in the embodiment of the present application includes: requesting a read operation, requesting a write operation, requesting a read-write operation, etc.
- request permissions of the controller in the embodiment of the present application can also be divided into more different divisions.
- the embodiment of the present application will not list them one by one. It should be understood that the specific expressions of the scope of requested permissions in the embodiments of this application are examples.
- Authorization includes authorization operations for read permissions, authorization operations for write permissions, authorization operations for read and write permissions, etc.
- authorizing the controller with access to the diagnostic device includes:
- the vehicle issues an authorization request to the authorization module in the vehicle to authorize the controller that has access rights to the diagnostic device through the authorization module.
- the vehicle Ethernet controller includes a domain control unit and an electronic control unit.
- One domain control unit is communicatively connected to one or more electronic controller units, and the domain control unit can obtain information related to the electronic control unit.
- different domain control units correspond to one identification information, and each domain control unit communicates with the authorization module respectively.
- the controller corresponding to the authorization controller identification information is determined, and the authorization request is sent to the authorization module, so that the authorization module authorizes the controller based on the authorization request.
- the access request sent by the diagnostic device includes authorized controller identification information.
- the authorized controller identification information included in the access request is controller 1, controller 3, and controller 5.
- the vehicle receives After the access request is sent by the diagnostic device, based on the authorized controller identification information included in the access request, the controller corresponding to the authorized controller identification information is selected. After the vehicle determines the controller corresponding to the authorized identification information, it sends the authorization request to The authorization module of the vehicle enables the authorization module to authorize the controller corresponding to the authorization identification information.
- a target controller to which the diagnostic device has access rights is determined based on the user identification information, and the target controller to which the diagnostic device has access rights is authorized.
- the access request sent by the diagnostic device includes user identification information.
- the vehicle After receiving the access request sent by the diagnostic device, the vehicle selects a target controller to which the diagnostic device has access rights based on the user identification information included in the access request. The vehicle After the target controller is determined, the access request is issued to the authorization module of the vehicle so that the authorization module can match the The target controller authorizes.
- the process of authorizing the target controller includes: activating rules for specified services and other operations, allowing the specified controller to read or write related functional operations.
- the target controller in response to the access request sent by the diagnostic device, is determined based on the authorization controller identification information; the access permission of the diagnostic device to the target controller is determined from the target controller based on the user identification information, so that the authorization module Authorize the target controller within the access rights based on the authorization request.
- the access request sent by the diagnostic device includes authorized controller identification information and user identification information.
- the authorized controller identification information included in the access request is controller 1, controller 3, and controller 5.
- the vehicle After receiving the access request sent by the diagnostic device, the vehicle selects the target controller corresponding to the authorized controller identification information based on the authorized controller identification information included in the access request, and then selects the target controller from the determined target based on the user identification information included in the access request.
- the controller determines the access rights of the diagnostic device to the target controller. For example, if it is determined that the controller 5 has access rights to the user identification information, then the authorization request is issued to the authorization module of the vehicle, so that the authorization module controls the target controller. 5 for authorization.
- the vehicle controller diagnostic method performs mutual authentication with the diagnostic device in response to the identity authentication request sent by the diagnostic device; after passing the mutual authentication, in response to the access request sent by the diagnostic device, it has access rights to the diagnostic device
- the controller is authorized, where the identity authentication request is a request for mutual authentication with the diagnostic device, that is, the mutual authentication of the identity between the vehicle and the diagnostic device.
- the mutual authentication mechanism is used to authenticate the controller.
- the identities of the diagnostic equipment and the vehicle are authenticated to ensure the safety of subsequent diagnosis of the controller by the diagnostic equipment.
- FIG. 2 is a schematic flowchart of a vehicle controller diagnosis method provided by an embodiment of the present disclosure.
- FIG. 3 is an interactive schematic diagram of a vehicle controller diagnosis provided by an embodiment of the present disclosure. The embodiment of the present disclosure is based on the above embodiment.
- an implementation of step S10 includes:
- the diagnostic device sends an identity authentication request to the vehicle.
- the vehicle After receiving the identity authentication request sent by the diagnostic device, the vehicle generates a first authentication message based on the identity authentication request and sends it to the diagnostic device, so that the diagnostic device responds to the first authentication message. Authentication message for authentication.
- the vehicle sends a first authentication message including vehicle information to the diagnostic device, so that the diagnostic device authenticates the identity of the vehicle based on the first authentication message sent by the vehicle.
- the diagnostic device authenticates the first authentication message sent by the vehicle.
- the diagnostic device sends the second authentication message.
- the authentication message is sent to the vehicle, so that the vehicle authenticates the identity of the diagnostic device based on the second authentication message sent by the diagnostic device.
- the vehicle After the vehicle passes the authentication of the second authentication message, it can be determined that both the diagnostic device and the vehicle have passed the authentication. After receiving the access request sent by the diagnostic device, the vehicle authorizes the controller that has access rights to the diagnostic device. .
- FIG 4 is a schematic flowchart of a vehicle controller diagnosis method provided by an embodiment of the present disclosure.
- Figure 5 is an interactive schematic diagram of a vehicle controller diagnosis provided by an embodiment of the present disclosure. The embodiment of the present disclosure is based on the above embodiments. As shown in Figure 4, a specific implementation of step S11 includes:
- the identification information is used to identify the identity of the vehicle. In some embodiments, the identification information is used to identify the ID of the vehicle.
- the diagnostic device sends an identity authentication request to the vehicle. After receiving the identity authentication request sent by the diagnostic device, the vehicle first generates identification information of the vehicle based on the identity authentication request.
- the first public key and the first private key are a key pair.
- the vehicle After the vehicle obtains the identity authentication request and generates the identification information, it signs the identification information generated by the vehicle with the first private key, generates a first authentication message, and sends the first authentication message to the diagnostic device. At this time, the diagnostic device receives the first authentication message and verifying the first authentication message.
- the vehicle randomly generates identification information in response to the identity authentication request sent by the diagnostic device, the vehicle signs the generated identification information with the first private key, generates a first authentication message, and sends the first authentication message to Diagnostic equipment. Since the first private key is private and the first public key is public, when the diagnostic device can use the first public key to authenticate the first authentication message, it indicates that the diagnostic device has passed the authentication of the vehicle.
- step S11 of the vehicle controller diagnosis method includes steps S110 and S111
- step S12 includes:
- the second authentication message is generated by the diagnostic device after signing the identification information based on the second private key, and the second public key and the second private key are a key pair.
- the diagnostic device After the diagnostic device authenticates the first authentication message, the diagnostic device will send a second authentication message to the vehicle, and the second authentication message is generated by the diagnostic device signing the identification information with the second private key. If the vehicle Including the second public key corresponding to the second private key, after receiving the second authentication message, the vehicle can decrypt the second authentication message through the second public key, thereby realizing the vehicle's authentication of the diagnostic device.
- the action of signing the identification information or performing the action of authenticating the second authentication message may be performed based on the vehicle.
- it may be an identity authentication module in the vehicle.
- the vehicle after receiving the identity authentication request, the vehicle generates identification information, and after signing the identification information based on the first private key, generates a first authentication message and sends the first authentication message.
- Send the message to the diagnostic device so that the diagnostic device authenticates the first authentication message through the first public key, that is, the diagnostic device decrypts the first authentication message through the first public key, thereby realizing the authentication of the vehicle by the diagnostic device, and
- the diagnostic device signs the identification information with the second private key to generate a second authentication message, and then sends the second authentication message to the vehicle, so that the vehicle uses the second public key pair to The second authentication message is authenticated, that is, the vehicle passes the second public key to the second
- the authentication message is decrypted to complete the vehicle's authentication of the diagnostic device and implement a two-way authentication mechanism to ensure the safety of the diagnostic device's diagnosis of the controller.
- the vehicle controller diagnosis method provided by the embodiment of the present disclosure also includes:
- the vehicle when the vehicle receives the shutdown request sent by the diagnostic device, the vehicle deletes the access rights issued to the controller, thereby turning off the diagnostic device's access rights to the vehicle.
- the access permission issued to the controller is deleted.
- the diagnostic device does not send a shutdown request after completing the diagnosis of the controller, but directly shuts down the diagnostic device, then the corresponding diagnostic device is not offline.
- the vehicle detects that the diagnostic device is offline, the vehicle shuts down. Access rights issued to the controller.
- the vehicle side is used as the execution subject for illustration.
- the following will be described in detail by using the diagnostic equipment side as the execution subject in some embodiments.
- a vehicle controller diagnostic method includes:
- the diagnostic device sends an identity authentication request to the vehicle. After receiving the identity authentication request sent by the diagnostic device, the vehicle performs identity authentication with the diagnostic device based on the identity authentication request.
- an access request is sent to the vehicle, so that the vehicle authorizes the controller with access rights to the diagnostic device based on the access request.
- the diagnostic device sends an access request to the vehicle, so that the vehicle has access control to the diagnostic device based on the access request. server for authorization.
- the first authentication message sent by the vehicle is received, and the first authentication message is authenticated.
- the diagnostic device sends an identity authentication request to the vehicle.
- the vehicle After receiving the identity authentication request sent by the diagnostic device, the vehicle generates a first authentication message based on the identity authentication request and sends it to the diagnostic device, so that the diagnostic device processes the first authentication message. Certification. That is, the vehicle sends a first authentication message including vehicle information to the diagnostic device, so that the diagnostic device authenticates the identity of the vehicle based on the first authentication message sent by the vehicle.
- the first authentication message sent by the vehicle is received, and the first authentication message is authenticated through the first public key.
- the first authentication message is generated after the vehicle signs the identification information based on the first private key.
- the first public key and the first private key are a key pair, and the identification information is generated by the vehicle after receiving the identity authentication request. .
- the diagnostic device sends an identity authentication request to the vehicle. After receiving the identity authentication request sent by the diagnostic device, the vehicle first generates identification information of the vehicle based on the identity authentication request. After the vehicle obtains the identity authentication request and generates the identification information, it signs the identification information generated by the vehicle with the first private key, generates a first authentication message, and sends the first authentication message to the diagnostic device. At this time, the diagnostic device passes The first public key verifies the first authentication message.
- the diagnostic device After the vehicle sends the first authentication message to the diagnostic device, the diagnostic device authenticates the first authentication message sent by the vehicle. When the diagnostic device passes the authentication of the first authentication message, it is confirmed that the vehicle has been authenticated. The diagnostic device Send a second authentication message to the vehicle, so that the vehicle verifies the identity of the diagnostic device based on the second authentication message sent by the diagnostic device.
- a second authentication message is sent to the vehicle, so that the vehicle authenticates the second authentication message.
- a second authentication message is sent to the vehicle so that the vehicle authenticates the second authentication message, wherein the second authentication message is sent to the vehicle.
- the public key and the second private key are a key pair.
- the diagnostic device After the diagnostic device authenticates the first authentication message, the diagnostic device will send a second authentication message to the vehicle, and the second authentication message is generated by the diagnostic device signing the identification information with the second private key. If the vehicle Including the second public key corresponding to the second private key, after receiving the second authentication message, the vehicle can decrypt the second authentication message through the second public key, thereby realizing the vehicle's authentication of the diagnostic device.
- the diagnostic device authenticates the first authentication message through the first public key, that is, the diagnostic device decrypts the first authentication message through the first public key, thereby realizing the diagnosis device Authentication of the vehicle, and after the diagnostic device authenticates the first authentication message, the diagnostic device signs the identification information with the second private key to generate a second authentication message, and then sends the second authentication message to the vehicle, so that the vehicle is based on
- the second public key authenticates the second authentication message, that is, the vehicle decrypts the second authentication message through the second public key, thereby completing the vehicle's authentication of the diagnostic device.
- the first two key pairs implement a two-way authentication mechanism. Ensure the safety of diagnostic equipment for controller diagnosis.
- the vehicle Ethernet diagnosis method also includes:
- the vehicle After the vehicle passes the authentication of the second authentication message, it can be determined that the authentication requests from both the diagnostic device and the vehicle have passed. After receiving the access request sent by the diagnostic device, the vehicle has access rights to the controller of the diagnostic device. Authorization, thereby enabling diagnostic equipment to diagnose the controller.
- FIG. 7 is a schematic structural diagram of a vehicle controller diagnostic device provided by an embodiment of the present disclosure. As shown in Figure 7, the vehicle controller diagnostic device includes:
- the identity authentication module 710 is used to perform mutual authentication with the diagnostic device in response to the identity authentication request sent by the diagnostic device;
- the authorization module 720 is configured to authorize a controller with access rights to the diagnostic device in response to an access request sent by the diagnostic device.
- the vehicle controller device provided by the embodiment of the present disclosure performs mutual authentication with the diagnostic device in response to the identity authentication request sent by the diagnostic device; after the mutual authentication is passed, in response to the access request sent by the diagnostic device, those who have access rights to the diagnostic device
- the controller authorizes, where the identity authentication request is a request for mutual authentication with the diagnostic device, that is, the mutual authentication of the identities between the vehicle and the diagnostic device, which enables the diagnostic device to diagnose the controller through a mutual authentication mechanism before the diagnostic device diagnoses the controller.
- the identity of the device and vehicle is authenticated to ensure the safety of subsequent diagnosis of the controller by diagnostic equipment.
- the identity authentication module includes:
- a first authentication message sending module configured to respond to the identity authentication request sent by the diagnostic device, generate a first authentication message and send the first authentication message to the diagnostic device;
- the message authentication module is used to receive the second authentication message sent by the diagnostic device after the first authentication message is authenticated, and to authenticate the second authentication message;
- the first judgment module is used to confirm that the mutual authentication is passed when the second authentication message is authenticated.
- the first authentication message sending module is specifically used to:
- a first authentication message is generated and sent to the diagnostic device, so that the diagnostic device authenticates the first authentication message through the first public key, wherein: A public key and a first private key are a key pair.
- the message authentication module is specifically used to:
- the second authentication message sent by the diagnostic device is authenticated using the second public key, where the second authentication message is generated after the diagnostic device signs the identification information based on the second private key.
- the second public key and the second private key are used to authenticate the second authentication message.
- a key is a pair of keys.
- a specific implementation of the authorization module includes:
- the access request includes authorized controller identification information
- the diagnostic device In response to the access request sent by the diagnostic device, determine the controller corresponding to the authorization controller identification information, and send the authorization request to the authorization module, so that the authorization module authorizes the controller based on the authorization request.
- another specific implementation of the authorization module includes:
- Access requests include user identification information
- a target controller to which the diagnostic device has access rights is determined based on the user identification information, and the target controller to which the diagnostic device has access rights is authorized.
- another specific implementation of the authorization module includes:
- the access request includes authorized controller identification information and user identification information
- the access permission of the diagnostic device to the target controller is determined from the target controller based on the user identification information, so that the authorization module authorizes the target controller within the access permission based on the authorization request.
- it also includes:
- the first access permission deletion module is configured to delete the access permission issued to the controller in response to a shutdown request sent by the diagnostic device.
- the second access permission deletion module is configured to delete the access permission issued to the controller when detecting that the status of the diagnostic device is offline.
- the device provided by the embodiment of the present invention can execute the method provided by any embodiment of the present invention, and has corresponding functional modules and beneficial effects for executing the method.
- Figure 8 is a schematic structural diagram of an electronic device provided by an embodiment of the present disclosure.
- the electronic device includes a processor 810, a memory 820, an input device 830 and an output device 840; the number of processors 810 in the computer device It can be one or more.
- one processor 810 is taken as an example; the processor 810, the memory 820, the input device 830 and the output device 840 in the electronic device can be connected through a bus or other means.
- a bus is used. Take connection as an example.
- the memory 820 can be used to store software programs, computer-executable programs and modules, such as program instructions/modules corresponding to the methods in the embodiments of the present invention.
- the processor 810 executes software programs, instructions, and modules stored in the memory 820 to execute various functional applications and data processing of the computer device, that is, to implement the method provided by the embodiment of the present invention.
- the memory 820 may mainly include a stored program area and a stored data area, where the stored program area may store an operating system and an application program required for at least one function; the stored data area may store data created according to the use of the terminal, etc.
- the memory 820 may include high-speed random access memory, and may also include non-volatile memory, such as at least one magnetic disk storage device, flash memory device, or other non-volatile solid-state storage device.
- memory 820 may further include memory located remotely relative to processor 810, and these remote memories may be connected to the computer device through a network. Examples of the above-mentioned networks include but are not limited to the Internet, intranets, local area networks, mobile communication networks and combinations thereof.
- the input device 830 may be used to receive input numeric or character information and generate key signal input related to user settings and function control of the electronic device, and may include a keyboard, a mouse, etc.
- the output device 840 may include a display device such as a display screen.
- An embodiment of the present disclosure also provides a vehicle, which includes the electronic device provided in the above embodiment.
- Embodiments of the present disclosure also provide a storage medium containing computer-executable instructions, which, when executed by a computer processor, are used to implement the methods provided by embodiments of the present invention.
- the embodiments of the present invention provide a storage medium containing computer-executable instructions.
- the computer-executable instructions are not limited to the method operations described above, and can also perform related operations in the methods provided by any embodiment of the present invention. .
- Embodiments of the present disclosure also provide a computer program product, including a computer program that, when executed by a processor, implements the method provided by any embodiment of the present invention.
- the present invention can be implemented with the help of software and necessary general hardware. Of course, it can also be implemented with hardware, but in many cases the former is a better implementation. . Based on this understanding, the technical solution of the present invention can be embodied in the form of a software product in essence or that contributes to the existing technology.
- the computer software product can be stored in a computer-readable storage medium, such as a computer floppy disk.
- ROM read-only memory
- RAM random access memory
- FLASH flash memory
- hard disk or optical disk etc., including a number of instructions to make a computer device (which can be a personal computer , server, or network device, etc.) to perform the methods described in various embodiments of the present invention.
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Computer Hardware Design (AREA)
- Computing Systems (AREA)
- General Engineering & Computer Science (AREA)
- Physics & Mathematics (AREA)
- General Physics & Mathematics (AREA)
- Lock And Its Accessories (AREA)
Abstract
本公开涉及一种车辆控制器诊断方法、装置、设备和介质，包括：响应于诊断设备发送的身份认证请求，与诊断设备进行互认证；在互认证通过后，响应于诊断设备发送的访问请求，对诊断设备有访问权限的控制器进行授权，实现在诊断设备对控制器进行诊断之前，通过互认证机制，对诊断设备以及车辆的身份进行认证，进而保证后续诊断设备对控制器进行诊断的安全性。
Description
相关申请的交叉引用
本申请基于申请号为202210346806.0、申请日为2022年3月31日的中国专利申请提出，并要求该中国专利申请的优先权，该中国专利申请的全部内容在此引入本申请作为参考。
本公开涉及车辆通信技术领域，尤其涉及一种车辆控制器诊断方法、装置、设备和介质。
随着车辆的电子化、智能化以及网络化的快速发展，车内电子系统的规模和复杂性日益增强。其中，车辆以太网技术有望成为未来智能车辆的主干网络。
现有技术中，基于开放的OBD(On Board Diagnostics，车载自动诊断系统)网络接口或其他接口，可以对车辆的以太网中的各个控制器进行访问、诊断。具体的，售后诊断仪(PC、客户端程序等设备)通过连接该接口，使用特定协议(例如：DoIP协议，(Diagnostic On IP，互联网诊断协议))可以对车辆进行指定业务的操作，如读取版本信息，修改车辆配置，读取故障码等。
现有技术中，基于OBD网络接口实现对车辆以太网中的各个控制器进行访问诊断的过程中，会存在车辆信息安全风险问题，例如，OBD接口易遭黑客攻击、车载总线网络遭受黑客攻击等。
因此，如何在车辆以太网技术中保证诊断各个控制器的安全性成为需要解决的问题。
发明内容
为了解决上述技术问题或者至少部分地解决上述技术问题，本公开提供了一种车辆控制器诊断方法、装置、设备和介质。
第一方面，本公开实施例提供一种车辆控制器诊断方法，包括：
响应于诊断设备发送的身份认证请求，与所述诊断设备进行互认证；
在所述互认证通过后，响应于所述诊断设备发送的访问请求，对所述诊断设备有访问权限的控制器进行授权。
在一些实施例中，所述与所述诊断设备进行互认证，包括：
响应于所述诊断设备发送的身份认证请求，生成第一认证报文并向诊断设备发送所述第一认证报文；
接收所述诊断设备在所述第一认证报文认证通过后发送的第二认证报文，并对所述第二认证报文进行认证；
在所述第二认证报文认证通过时，确认所述互认证通过。
在一些实施例中，所述响应于所述诊断设备发送的身份认证请求，生成第一认证报文并
向诊断设备发送第一认证报文，包括：
响应于所述诊断设备发送的身份认证请求，获取标识信息；
基于第一私钥对所述标识信息进行签名后，生成第一认证报文并发送所述第一认证报文至诊断设备，以使得诊断设备通过第一公钥对所述第一认证报文进行认证，其中，所述第一公钥和所述第一私钥为一对钥匙对。
在一些实施例中，所述对所述第二认证报文进行认证，包括：
通过第二公钥对所述第二认证报文进行认证，其中，所述第二认证报文为所述诊断设备基于第二私钥对所述标识信息进行签名后生成的，所述第二公钥和所述第二私钥为一对钥匙对。
在一些实施例中，所述访问请求包括授权控制器标识信息；
所述响应于所述诊断设备发送的访问请求，对所述诊断设备有访问权限的控制器进行授权，包括：
响应于所述诊断设备发送的访问请求，确定与所述授权控制器标识信息对应的控制器，并发送授权请求至授权模块，以使所述授权模块基于所述授权请求对所述控制器进行授权。
在一些实施例中，所述访问请求包括用户标识信息；
所述响应于所述诊断设备发送的访问请求，对所述诊断设备有访问权限的控制器进行授权，包括：
响应于所述诊断设备发送的访问请求，基于所述用户标识信息确定所述诊断设备有访问权限的目标控制器，并对所述诊断设备有访问权限的目标控制器进行授权。
在一些实施例中，所述访问请求包括授权控制器标识信息和用户标识信息；
所述响应于所述诊断设备发送的访问请求，对所述诊断设备有访问权限的控制器进行授权，包括：
响应于所述诊断设备发送的访问请求，基于所述授权控制器标识信息确定目标控制器；
基于所述用户标识信息从所述目标控制器中确定所述诊断设备对所述目标控制器的访问权限，以使授权模块基于授权请求对所述目标控制器进行访问权限内的授权。
在一些实施例中，所述在对所述诊断设备认证通过后，响应于所述诊断设备发送的访问请求，对所述诊断设备有访问权限的控制器进行授权之后，所述方法还包括：
响应于诊断设备发送的关闭请求，删除下发至控制器的访问权限；或，
在检测所述诊断设备的状态为离线状态时，删除下发至控制器的访问权限。
第二方面，本公开实施例提供一种车辆控制器诊断装置，包括：
身份认证模块，用于响应于诊断设备发送的身份认证请求，与所述诊断设备进行互认证；
授权模块，用于响应于所述诊断设备发送的访问请求，对所述诊断设备有访问权限的控制器进行授权。
第三方面，本公开实施例提供一种电子设备，包括：
一个或多个处理器；
存储装置，用于存储一个或多个程序，
当所述一个或多个程序被所述一个或多个处理器执行，使得所述一个或多个处理器实现如第一方面中任一所述的方法。
第四方面，本公开实施例提供一种计算机可读存储介质，其上存储有计算机程序，该程序被处理器执行时实现如第一方面中任一所述的方法。
第五方面，本公开实施例提供一种计算机程序产品，包括计算机程序，所述计算机程序在被处理器执行时实现如第一方面中任一所述的方法。
本公开实施例提供的车辆控制器诊断方法、装置、设备和介质，响应于诊断设备发送的身份认证请求，与诊断设备进行互认证；在互认证通过后，响应于诊断设备发送的访问请求，对诊断设备有访问权限的控制器进行授权，其中，身份认证请求是与诊断设备进行互认证的请求，即车辆和诊断设备之间身份的互认证，实现在诊断设备对控制器进行诊断之前，通过互认证机制，对诊断设备以及车辆的身份进行认证，进而保证后续诊断设备对控制器进行诊断的安全性。
此处的附图被并入说明书中并构成本说明书的一部分，示出了符合本公开的实施例，并与说明书一起用于解释本公开的原理。
为了更清楚地说明本公开实施例或现有技术中的技术方案，下面将对实施例或现有技术描述中所需要使用的附图作简单地介绍，显而易见地，对于本领域普通技术人员而言，在不付出创造性劳动性的前提下，还可以根据这些附图获得其他的附图。
图1是本公开实施例提供的一种车辆控制器诊断方法的流程示意图；
图2是本公开实施例提供的一种车辆控制器诊断方法的流程示意图；
图3是本公开实施例提供的一种车辆控制器诊断的交互示意图；
图4是本公开实施例提供的一种车辆控制器诊断方法的流程示意图；
图5是本公开实施例提供的一种车辆控制器诊断的交互示意图；
图6是本公开实施例提供的一种车辆控制器诊断的交互示意图；
图7是本公开实施例提供的一种车辆控制器诊断装置的结构示意图；
图8是本公开实施例提供的一种电子设备的结构示意图。
为了能够更清楚地理解本公开的上述目的、特征和优点，下面将对本公开的方案进行进一步描述。需要说明的是，在不冲突的情况下，本公开的实施例及实施例中的特征可以相互组合。
在下面的描述中阐述了很多具体细节以便于充分理解本公开，但本公开还可以采用其他不同于在此描述的方式来实施；显然，说明书中的实施例只是本公开的一部分实施例，而不是全部的实施例。
本公开实施例提供的车辆控制器诊断方法应用于智能车辆，本公开实施例提供的方法可
由智能车辆来执行。
图1是本公开实施例提供的一种车辆控制器诊断方法的流程示意图，如图1所示，车辆控制器诊断方法具体包括如下：
S10、响应于诊断设备发送的身份认证请求，与诊断设备进行互认证。
互认证指的是车辆诊断设备的身份认证，以及诊断设备对车辆的身份的认证，首先诊断设备发送身份认证请求至车辆，车辆在接收到诊断设备发送的身份认证请求后，与诊断设备进行身份的互认证。
本申请实施例中的诊断设备可以是智能诊断设备/个人计算机/个人手持终端/OBD设备等能够与智能车辆进行以太网通信的设备。
S20、在互认证通过后，响应于诊断设备发送的访问请求，对诊断设备有访问权限的控制器进行授权。
在一个具体的例子中，本申请实施例中的访问请求包括：请求读操作、请求写操作、请求读写操作等。当然，本申请实施例中对控制器的请求权限还可以有更多不同的划分，为了表述的清晰简洁，本申请实施例再此不一一列举。应对了解，本申请实施例中对请求权限范围的具体表达均为举例。授权包括读权限的授权操作、写权限的授权操作、读写权限的授权操作等。
在一些实施例中，对诊断设备有访问权限的控制器进行授权包括：
车辆下发授权请求至车辆中的授权模块，以通过授权模块对诊断设备有访问权限的控制器进行授权。
需要说明的是，在一些实施方式中，车辆以太网的控制器包括域控制单元和电子控制单元，一个域控制单元与一个或多个电子控制器单元通信连接，域控制单元可以获取到与该域控制单元通信连接的一个或多个电子控制单元对应的报文信息，因此，本公开实施例中，对诊断设备有访问权限的控制器进行授权主要是对车辆以太网中的域控制单元进行授权操作，不同域控制单元对应一个标识信息，各域控制单元分别与授权模块通信连接。
在一些实施例中，响应于诊断设备发送的访问请求，确定与授权控制器标识信息对应的控制器，并发送授权请求至授权模块，以使授权模块基于授权请求对控制器进行授权。
在一些实施例中，诊断设备发送的访问请求包括授权控制器标识信息，例如，访问请求包括的授权控制器标识信息为控制器1、控制器3和控制器5，此时，车辆在接收到诊断设备发送的访问请求后，基于访问请求包括的授权控制器标识信息，选取与授权控制器标识信息对应的控制器，车辆在确定与授权标识信息对应的控制器后，通过下发授权请求至车辆的授权模块，使得授权模块对与授权标识信息对应的控制器进行授权。
在一些实施例中，响应于诊断设备发送的访问请求，基于用户标识信息确定诊断设备有访问权限的目标控制器，并对诊断设备有访问权限的目标控制器进行授权。
在一些实施例中，诊断设备发送的访问请求包括用户标识信息，车辆在接收到诊断设备发送的访问请求后，基于访问请求包括的用户标识信息，选取诊断设备有访问权限的目标控制器，车辆在确定目标控制器后，通过下发访问请求至车辆的授权模块，使得授权模块对与
目标控制器进行授权。
示例性的，对目标控制器进行授权的过程包括：开通指定业务的规则等操作，允许对指定的控制器进行读或是写相关功能操作。
在一些实施例中，响应于诊断设备发送的访问请求，基于授权控制器标识信息确定目标控制器；基于用户标识信息从目标控制器中确定诊断设备对目标控制器的访问权限，以使授权模块基于授权请求对目标控制器进行访问权限内的授权。
在一些实施例中，诊断设备发送的访问请求包括授权控制器标识信息和用户标识信息，例如，访问请求包括的授权控制器标识信息为控制器1、控制器3和控制器5，此时，车辆在接收到诊断设备发送的访问请求后，基于访问请求包括的授权控制器标识信息，选取与授权控制器标识信息对应的目标控制器，然后基于访问请求包括的用户标识信息，从确定的目标控制器中确定诊断设备对目标控制器的访问权限，例如，确定控制器5对应该用户标识信息有访问权限，则通过下发授权请求至车辆的授权模块，使得授权模块对目标控制器即控制器5进行授权。
本公开实施例提供的车辆控制器诊断方法，响应于诊断设备发送的身份认证请求，与诊断设备进行互认证；在互认证通过后，响应于诊断设备发送的访问请求，对诊断设备有访问权限的控制器进行授权，其中，身份认证请求是与诊断设备进行互认证的请求，即车辆和诊断设备之间身份的互认证，实现在诊断设备对控制器进行诊断之前，通过互认证机制，对诊断设备以及车辆的身份进行认证，进而保证后续诊断设备对控制器进行诊断的安全性。
图2是本公开实施例提供的一种车辆控制器诊断方法的流程示意图，图3是本公开实施例提供的一种车辆控制器诊断的交互示意图，本公开实施例是在上述实施例的基础上，结合图2和图3，步骤S10的一种可实施方式包括：
S11、响应于诊断设备发送的身份认证请求，生成第一认证报文并向诊断设备发送第一认证报文。
结合图3，首先诊断设备发送身份认证请求至车辆，车辆在接收到诊断设备发送的身份认证请求后，基于身份认证请求生成第一认证报文并发送至诊断设备，以使得诊断设备对第一认证报文进行认证。
即车辆发送包括车辆信息的第一认证报文至诊断设备，使得诊断设备基于车辆发送的第一认证报文对车辆的身份进行认证。
S12、接收诊断设备在第一认证报文认证通过后发送的第二认证报文，并对第二认证报文进行认证。
继续参见图3，在车辆发送第一认证报文至诊断设备后，诊断设备对车辆发送的第一认证报文进行认证，当诊断设备对第一认证报文认证通过后，诊断设备发送第二认证报文至车辆，使得车辆基于诊断设备发送的第二认证报文对诊断设备的身份进行认证。
S13、在第二认证报文认证通过时，确认对互认证通过。
当车辆对第二认证报文认证通过后，此时可以确定，诊断设备和车辆两端认证均通过，当接收到诊断设备发送的访问请求后，车辆对诊断设备有访问权限的控制器进行授权。
图4是本公开实施例提供的一种车辆控制器诊断方法的流程示意图，图5是本公开实施例提供的一种车辆控制器诊断的交互示意图，本公开实施例是在上述实施例的基础上，如图4所示，步骤S11的一种具体可实施方式包括：
S110、响应于诊断设备发送的身份认证请求，获取标识信息。
其中，标识信息用于标识车辆身份，在一些实施例中，标识信息用于标识车辆的ID。
诊断设备发送身份认证请求至车辆，车辆在接收到诊断设备发送的身份认证请求后，基于身份认证请求，首先生成该车辆的标识信息。
S111、基于第一私钥对标识信息进行签名后，生成第一认证报文并发送第一认证报文至诊断设备，以使得诊断设备通过第一公钥对第一认证报文进行认证。
其中，第一公钥和第一私钥为一对钥匙对。
车辆在获取到身份认证请求，并生成标识信息后，通过第一私钥对车辆生成的标识信息进行签名后生成第一认证报文并发送第一认证报文至诊断设备，此时诊断设备接收第一认证报文并对第一认证报文进行验证。
在一些实施例中，车辆响应于诊断设备发送的身份认证请求，随机生成标识信息，车辆对生成的标识信息采用第一私钥进行签名后生成第一认证报文并发送第一认证报文至诊断设备。由于第一私钥为私密的，第一公钥为公开的，当诊断设备可以采用第一公钥对第一认证报文进行认证，此时，表明诊断设备对车辆的认证通过。
当车辆控制器诊断方法步骤S11的实现方式包括步骤S110和步骤S111时，步骤S12的一种可实现方式包括：
S120、通过第二公钥对诊断设备发送的第二认证报文进行认证。
其中，第二认证报文为诊断设备基于第二私钥对标识信息进行签名后生成的，第二公钥和第二私钥为一对钥匙对。
当诊断设备对第一认证报文认证通过后，诊断设备会发送第二认证报文至车辆，且第二认证报文是诊断设备通过第二私钥对标识信息进行签名生成的，若车辆中包括与第二私钥对应的第二公钥，则车辆在接收到第二认证报文后，可通过第二公钥对第二认证报文进行解密，进而实现车辆对诊断设备的认证。
需要说明的是，上述实施例提供的车辆控制器诊断方法中，基于第一私钥对标识信息进行签名以及通过第二公钥对诊断设备发送的第二认证报文进行认证的过程中，执行对标识信息进行签名的动作或执行对第二认证报文进行认证的动作可以基于车辆执行，在一些实施例中，可以为车辆中的身份认证模块。
本公开实施例提供的车辆控制器诊断方法，车辆在接收到身份认证请求后，生成标识信息，在基于第一私钥对标识信息进行签名后，生成第一认证报文并发送第一认证报文至诊断设备，以使得诊断设备通过第一公钥对第一认证报文进行认证，即诊断设备通过第一公钥对第一认证报文进行解密，进而实现诊断设备对车辆的认证，而在诊断设备对第一认证报文认证通过后，诊断设备通过第二私钥对标识信息进行签名生成第二认证报文后，发送第二认证报文至车辆，使得车辆基于第二公钥对第二认证报文进行认证，即车辆通过第二公钥对第二
认证报文进行解密，进而完成车辆对诊断设备的认证，实现双向认证机制，保证诊断设备对控制器进行诊断的安全性。
作为一种可实施方式，本公开实施例提供的车辆控制器诊断方法还包括：
响应于诊断设备发送的关闭请求，删除下发至控制器的访问权限。
如图6所示，当车辆接收到诊断设备发送的关闭请求后，车辆删除下发至控制器的访问权限，使得关闭诊断设备对车辆访问的权限。
作为另一种可实施方式，继续参见图6，在检测到诊断设备的状态为离线状态时，删除下发至控制器的访问权限。
此外，若诊断设备在完成对控制器的诊断后，诊断设备未发送关闭请求，而是直接关闭诊断设备，此时对应诊断设备未离线状态，当车辆检测到诊断设备为离线状态时，车辆关闭下发至控制器的访问权限。
上述实施例中，示例性以车辆端为执行主体进行举例说明，以下将通过在一些实施例中实施例介绍以诊断设备侧为执行主体进行具体说明。
在一些实施例中，车辆控制器诊断方法包括：
发送身份认证请求至车辆，以使车辆基于访问请求与诊断设备进行互认证。
首先诊断设备发送身份认证请求至车辆，车辆在接收到诊断设备发送的身份认证请求后，基于身份认证请求与诊断设备进行身份认证。
在对车辆认证通过后，发送访问请求至车辆，以使得车辆基于访问请求对诊断设备有访问权限的控制器进行授权。
当诊断设备与车辆身份互认证通过后，此时车辆与诊断设备之间的双向认证完成，此时，诊断设备发送访问请求至车辆，以使的车辆基于访问请求对诊断设备有访问权限的控制器进行授权。
作为一种可实施方式，发送身份认证请求至车辆后，接收车辆发送的第一认证报文，对第一认证报文进行认证。
首先诊断设备发送身份认证请求至车辆，车辆在接收到诊断设备发送的身份认证请求后，基于身份认证请求生成第一认证报文并发送至诊断设备，以使得诊断设备对第一认证报文进行认证。即车辆发送包括车辆信息的第一认证报文至诊断设备，使得诊断设备基于车辆发送的第一认证报文对车辆的身份进行认证。
在一些实施例中，接收车辆发送的第一认证报文，通过第一公钥对第一认证报文进行认证。
其中，第一认证报文为车辆基于第一私钥对标识信息进行签名后生成的，第一公钥和第一私钥为一对钥匙对，标识信息为车辆在接收到身份认证请求生成的。
诊断设备发送身份认证请求至车辆，车辆在接收到诊断设备发送的身份认证请求后，基于身份认证请求，首先生成该车辆的标识信息。车辆在获取到身份认证请求，并生成标识信息后，通过第一私钥对车辆生成的标识信息进行签名后生成第一认证报文并发送第一认证报文至诊断设备，此时诊断设备通过第一公钥对第一认证报文进行验证。
作为一种可实施方式，在第一认证报文认证通过后，确认对车辆认证通过。
在车辆发送第一认证报文至诊断设备后，诊断设备对车辆发送的第一认证报文进行认证，当诊断设备对第一认证报文认证通过后，此时确认对车辆认证通过，诊断设备发送第二认证报文至车辆，以使得车辆基于诊断设备发送的第二认证报文对诊断设备的身份进行验证。
在对车辆认证通过后，发送第二认证报文至车辆，以使车辆对第二认证报文进行认证。
在一些实施例中，在对车辆认证通过后，基于第二私钥对标识信息进行签名后，发送第二认证报文至车辆，以使车辆对第二认证报文进行认证，其中，第二公钥和第二私钥为一对钥匙对。
当诊断设备对第一认证报文认证通过后，诊断设备会发送第二认证报文至车辆，且第二认证报文是诊断设备通过第二私钥对标识信息进行签名生成的，若车辆中包括与第二私钥对应的第二公钥，则车辆在接收到第二认证报文后，可通过第二公钥对第二认证报文进行解密，进而实现车辆对诊断设备的认证。
本公开实施例提供的车辆以太网诊断方法，诊断设备通过第一公钥对第一认证报文进行认证，即诊断设备通过第一公钥对第一认证报文进行解密，进而实现诊断设备对车辆的认证，而在诊断设备对第一认证报文认证通过后，诊断设备通过第二私钥对标识信息进行签名生成第二认证报文后，发送第二认证报文至车辆，使得车辆基于第二公钥对第二认证报文进行认证，即车辆通过第二公钥对第二认证报文进行解密，进而完成车辆对诊断设备的认证，第一两个钥匙对，实现双向认证机制，保证诊断设备对控制器进行诊断的安全性。
作为一种可实施方式，车辆以太网诊断方法还包括：
发送关闭请求至车辆，以使得车辆基于关闭请求删除下发至控制器的访问权限。
当车辆对第二认证报文认证通过后，此时可以确定，诊断设备和车辆两端认证请求均通过，当接收到诊断设备发送的访问请求后，车辆对诊断设备有访问权限的控制器进行授权，进而使得诊断设备能够对控制器进行诊断。
图7是本公开实施例提供的一种车辆控制器诊断装置的结构示意图，如图7所示，车辆控制器诊断装置包括：
身份认证模块710，用于响应于诊断设备发送的身份认证请求，与诊断设备进行互认证；
授权模块720，用于响应于诊断设备发送的访问请求，对诊断设备有访问权限的控制器进行授权。
本公开实施例提供的车辆控制器装置，响应于诊断设备发送的身份认证请求，与诊断设备进行互认证；在互认证通过后，响应于诊断设备发送的访问请求，对诊断设备有访问权限的控制器进行授权，其中，身份认证请求是与诊断设备进行互认证的请求，即车辆和诊断设备之间身份的互认证，实现在诊断设备对控制器进行诊断之前，通过互认证机制，对诊断设备以及车辆的身份进行认证，进而保证后续诊断设备对控制器进行诊断的安全性。
在一些实施例中，身份认证模块包括：
第一认证报文发送模块，用于响应于诊断设备发送的身份认证请求，生成第一认证报文并向诊断设备发送第一认证报文；
报文认证模块，用于接收诊断设备在第一认证报文认证通过后发送的第二认证报文，并对第二认证报文进行认证；
第一判断模块，用于在第二认证报文认证通过时，确认互认证通过。
在一些实施例中，第一认证报文发送模块具体用于：
响应于诊断设备发送的身份认证请求，获取标识信息；
基于第一私钥对标识信息进行签名后，生成第一认证报文并发送第一认证报文至诊断设备，以使得诊断设备通过第一公钥对第一认证报文进行认证，其中，第一公钥和第一私钥为一对钥匙对。
在一些实施例中，报文认证模块具体用于：
通过第二公钥对诊断设备发送的第二认证报文进行认证，其中，第二认证报文为诊断设备基于第二私钥对标识信息进行签名后生成的，第二公钥和第二私钥为一对钥匙对。
在一些实施例中，授权模块的一种具体实现方式包括：
访问请求包括授权控制器标识信息；
响应于诊断设备发送的访问请求，确定与授权控制器标识信息对应的控制器，并发送授权请求至授权模块，以使授权模块基于授权请求对控制器进行授权。
在一些实施例中，授权模块的另一种具体实现方式包括：
访问请求包括用户标识信息；
响应于诊断设备发送的访问请求，基于用户标识信息确定诊断设备有访问权限的目标控制器，并对诊断设备有访问权限的目标控制器进行授权。
在一些实施例中，授权模块的又一种具体实现方式包括：
访问请求包括授权控制器标识信息和用户标识信息；
响应于诊断设备发送的访问请求，基于授权控制器标识信息确定目标控制器；
基于用户标识信息从目标控制器中确定诊断设备对目标控制器的访问权限，以使授权模块基于授权请求对目标控制器进行访问权限内的授权。
在一些实施例中，还包括：
第一访问权限删除模块，用于响应于诊断设备发送的关闭请求，删除下发至控制器的访问权限。
第二访问权限删除模块，用于在检测所述诊断设备的状态为离线状态时，删除下发至控制器的访问权限。
本发明实施例所提供的装置可执行本发明任意实施例所提供的方法，具备执行方法相应的功能模块和有益效果。
值得注意的是，上述装置的实施例中，所包括的各个单元和模块只是按照功能逻辑进行划分的，但并不局限于上述的划分，只要能够实现相应的功能即可；另外，各功能单元的具体名称也只是为了便于相互区分，并不用于限制本发明的保护范围。
图8是本公开实施例提供的一种电子设备的结构示意图，如图8所示，该电子设备包括处理器810、存储器820、输入装置830和输出装置840；计算机设备中处理器810的数量
可以是一个或多个，图8中以一个处理器810为例；电子设备中的处理器810、存储器820、输入装置830和输出装置840可以通过总线或其他方式连接，图8中以通过总线连接为例。
存储器820作为一种计算机可读存储介质，可用于存储软件程序、计算机可执行程序以及模块，如本发明实施例中方法对应的程序指令/模块。处理器810通过运行存储在存储器820中的软件程序、指令以及模块，从而执行计算机设备的各种功能应用以及数据处理，即实现本发明实施例所提供的方法。
存储器820可主要包括存储程序区和存储数据区，其中，存储程序区可存储操作系统、至少一个功能所需的应用程序；存储数据区可存储根据终端的使用所创建的数据等。此外，存储器820可以包括高速随机存取存储器，还可以包括非易失性存储器，例如至少一个磁盘存储器件、闪存器件、或其他非易失性固态存储器件。在一些实例中，存储器820可进一步包括相对于处理器810远程设置的存储器，这些远程存储器可以通过网络连接至计算机设备。上述网络的实例包括但不限于互联网、企业内部网、局域网、移动通信网及其组合。
输入装置830可用于接收输入的数字或字符信息，以及产生与电子设备的用户设置以及功能控制有关的键信号输入，可以包括键盘、鼠标等。输出装置840可包括显示屏等显示设备。
本公开实施例还提供了一种车辆，所述车辆包括上述实施例提供的电子设备。
本公开实施例还提供了一种包含计算机可执行指令的存储介质，所述计算机可执行指令在由计算机处理器执行时用于实现本发明实施例所提供的方法。
当然，本发明实施例所提供的一种包含计算机可执行指令的存储介质，其计算机可执行指令不限于如上所述的方法操作，还可以执行本发明任意实施例所提供的方法中的相关操作。
本公开实施例还提供了一种计算机程序产品，包括计算机程序，所述计算机程序在被处理器执行时实现本发明任意实施例所提供的方法。
通过以上关于实施方式的描述，所属领域的技术人员可以清楚地了解到，本发明可借助软件及必需的通用硬件来实现，当然也可以通过硬件实现，但很多情况下前者是更佳的实施方式。基于这样的理解，本发明的技术方案本质上或者说对现有技术做出贡献的部分可以以软件产品的形式体现出来，该计算机软件产品可以存储在计算机可读存储介质中，如计算机的软盘、只读存储器(Read-Only Memory,ROM)、随机存取存储器(Random Access Memory，RAM)、闪存(FLASH)、硬盘或光盘等，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本发明各个实施例所述的方法。
需要说明的是，在本文中，诸如“第一”和“第二”等之类的关系术语仅仅用来将一个实体或者操作与另一个实体或操作区分开来，而不一定要求或者暗示这些实体或操作之间存在任何这种实际的关系或者顺序。而且，术语“包括”、“包含”或者其任何其他变体意在涵盖非排他性的包含，从而使得包括一系列要素的过程、方法、物品或者设备不仅包括那些要素，而且还包括没有明确列出的其他要素，或者是还包括为这种过程、方法、物品或者设备所固有的要素。在没有更多限制的情况下，由语句“包括一个……”限定的要素，并不排除在包括所述要素的过程、方法、物品或者设备中还存在另外的相同要素。
以上所述仅是本公开的具体实施方式，使本领域技术人员能够理解或实现本公开。对这些实施例的多种修改对本领域的技术人员来说将是显而易见的，本文中所定义的一般原理可以在不脱离本公开的精神或范围的情况下，在其它实施例中实现。因此，本公开将不会被限制于本文所述的这些实施例，而是要符合与本文所公开的原理和新颖特点相一致的最宽的范围。
Claims (12)
- 一种车辆控制器诊断方法，包括：响应于诊断设备发送的身份认证请求，与所述诊断设备进行互认证；在所述互认证通过后，响应于所述诊断设备发送的访问请求，对所述诊断设备有访问权限的控制器进行授权。
- 根据权利要求1所述的方法，其中，所述与所述诊断设备进行互认证，包括：响应于所述诊断设备发送的身份认证请求，生成第一认证报文并向诊断设备发送所述第一认证报文；接收所述诊断设备在所述第一认证报文认证通过后发送的第二认证报文，并对所述第二认证报文进行认证；在所述第二认证报文认证通过时，确认所述互认证通过。
- 根据权利要求2所述的方法，其中，所述响应于所述诊断设备发送的身份认证请求，生成第一认证报文并向诊断设备发送第一认证报文，包括：响应于所述诊断设备发送的身份认证请求，获取标识信息；基于第一私钥对所述标识信息进行签名后，生成第一认证报文并发送所述第一认证报文至诊断设备，以使得诊断设备通过第一公钥对所述第一认证报文进行认证，其中，所述第一公钥和所述第一私钥为一对钥匙对。
- 根据权利要求2或3所述的方法，其中，所述对所述第二认证报文进行认证，包括：通过第二公钥对所述第二认证报文进行认证，其中，所述第二认证报文为所述诊断设备基于第二私钥对所述标识信息进行签名后生成的，所述第二公钥和所述第二私钥为一对钥匙对。
- 根据权利要求1至4中任一项所述的方法，其中，所述访问请求包括授权控制器标识信息；所述响应于所述诊断设备发送的访问请求，对所述诊断设备有访问权限的控制器进行授权，包括：响应于所述诊断设备发送的访问请求，确定与所述授权控制器标识信息对应的控制器，并发送授权请求至授权模块，以使所述授权模块基于所述授权请求对所述控制器进行授权。
- 根据权利要求1至4中任一项所述的方法，其中，所述访问请求包括用户标识信息；所述响应于所述诊断设备发送的访问请求，对所述诊断设备有访问权限的控制器进行授权，包括：响应于所述诊断设备发送的访问请求，基于所述用户标识信息确定所述诊断设备有访问权限的目标控制器，并对所述诊断设备有访问权限的目标控制器进行授权。
- 根据权利要求1至4中任一项所述的方法，其中，所述访问请求包括授权控制器标识信息和用户标识信息；所述响应于所述诊断设备发送的访问请求，对所述诊断设备有访问权限的控制器进行授权，包括：响应于所述诊断设备发送的访问请求，基于所述授权控制器标识信息确定目标控制器；基于所述用户标识信息从所述目标控制器中确定所述诊断设备对所述目标控制器的访问权限，以使授权模块基于授权请求对所述目标控制器进行访问权限内的授权。
- 根据权利要求5-7中任一项所述的方法，其中，所述在对所述诊断设备认证通过后，响应于所述诊断设备发送的访问请求，对所述诊断设备有访问权限的控制器进行授权之后，还包括：响应于诊断设备发送的关闭请求，删除下发至控制器的访问权限；或在检测所述诊断设备的状态为离线状态时，删除下发至控制器的访问权限。
- 一种车辆控制器诊断装置，包括：身份认证模块，用于响应于诊断设备发送的身份认证请求，与所述诊断设备进行互认证；授权模块，用于响应于所述诊断设备发送的访问请求，对所述诊断设备有访问权限的控制器进行授权。
- 一种电子设备，包括：一个或多个处理器；存储装置，用于存储一个或多个程序，当所述一个或多个程序被所述一个或多个处理器执行，使得所述一个或多个处理器实现如权利要求1～8中任一所述的方法。
- 一种计算机可读存储介质，其上存储有计算机程序，其中，该程序被处理器执行时实现如权利要求1～8中任一所述的方法。
- 一种计算机程序产品，包括计算机程序，所述计算机程序在被处理器执行时实现根据权利要求1至8中任一项所述的方法。
Applications Claiming Priority (2)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202210346806.0A CN115442064A (zh) | 2022-03-31 | 2022-03-31 | 一种车辆控制器诊断方法、装置、设备和介质 |
| CN202210346806.0 | 2022-03-31 |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| WO2023185492A1 true WO2023185492A1 (zh) | 2023-10-05 |
Family
ID=84240763
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| PCT/CN2023/081904 WO2023185492A1 (zh) | 2022-03-31 | 2023-03-16 | 车辆控制器诊断方法、装置、设备和介质 |
Country Status (2)
| Country | Link |
|---|---|
| CN (1) | CN115442064A (zh) |
| WO (1) | WO2023185492A1 (zh) |
Families Citing this family (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN115437341A (zh) * | 2022-03-18 | 2022-12-06 | 北京罗克维尔斯科技有限公司 | 一种车辆以太网诊断方法、装置、设备和介质 |
| CN115442064A (zh) * | 2022-03-31 | 2022-12-06 | 北京罗克维尔斯科技有限公司 | 一种车辆控制器诊断方法、装置、设备和介质 |
Citations (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20150351137A1 (en) * | 2013-02-08 | 2015-12-03 | Bayerische Motoren Werke Aktiengesellschaft | Method and Device for Connecting a Diagnostic Unit to a Control Unit in a Motor Vehicle |
| CN112327796A (zh) * | 2020-10-21 | 2021-02-05 | 诚迈科技（南京）股份有限公司 | 一种汽车诊断服务的控制方法和电子控制单元 |
| CN112585549A (zh) * | 2020-02-29 | 2021-03-30 | 华为技术有限公司 | 一种故障诊断方法、装置及车辆 |
| CN113759883A (zh) * | 2021-10-26 | 2021-12-07 | 深圳市元征科技股份有限公司 | 车辆诊断方法、车辆网关设备、服务器及存储介质 |
| CN113960978A (zh) * | 2021-09-29 | 2022-01-21 | 岚图汽车科技有限公司 | 车辆诊断方法、装置及存储介质 |
| CN115442064A (zh) * | 2022-03-31 | 2022-12-06 | 北京罗克维尔斯科技有限公司 | 一种车辆控制器诊断方法、装置、设备和介质 |
| CN115437341A (zh) * | 2022-03-18 | 2022-12-06 | 北京罗克维尔斯科技有限公司 | 一种车辆以太网诊断方法、装置、设备和介质 |
-
2022
- 2022-03-31 CN CN202210346806.0A patent/CN115442064A/zh active Pending
-
2023
- 2023-03-16 WO PCT/CN2023/081904 patent/WO2023185492A1/zh unknown
Patent Citations (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20150351137A1 (en) * | 2013-02-08 | 2015-12-03 | Bayerische Motoren Werke Aktiengesellschaft | Method and Device for Connecting a Diagnostic Unit to a Control Unit in a Motor Vehicle |
| CN112585549A (zh) * | 2020-02-29 | 2021-03-30 | 华为技术有限公司 | 一种故障诊断方法、装置及车辆 |
| CN112327796A (zh) * | 2020-10-21 | 2021-02-05 | 诚迈科技（南京）股份有限公司 | 一种汽车诊断服务的控制方法和电子控制单元 |
| CN113960978A (zh) * | 2021-09-29 | 2022-01-21 | 岚图汽车科技有限公司 | 车辆诊断方法、装置及存储介质 |
| CN113759883A (zh) * | 2021-10-26 | 2021-12-07 | 深圳市元征科技股份有限公司 | 车辆诊断方法、车辆网关设备、服务器及存储介质 |
| CN115437341A (zh) * | 2022-03-18 | 2022-12-06 | 北京罗克维尔斯科技有限公司 | 一种车辆以太网诊断方法、装置、设备和介质 |
| CN115442064A (zh) * | 2022-03-31 | 2022-12-06 | 北京罗克维尔斯科技有限公司 | 一种车辆控制器诊断方法、装置、设备和介质 |
Also Published As
| Publication number | Publication date |
|---|---|
| CN115442064A (zh) | 2022-12-06 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| AU2022203766B2 (en) | Confirming authenticity of a user to a third-party system | |
| WO2023185492A1 (zh) | 车辆控制器诊断方法、装置、设备和介质 | |
| US10829088B2 (en) | Identity management for implementing vehicle access and operation management | |
| WO2017193741A1 (zh) | 机载终端支付鉴权方法、装置以及系统 | |
| CN108898389A (zh) | 基于区块链的内容验证方法及装置、电子设备 | |
| US10212151B2 (en) | Method for operating a designated service, service unlocking method, and terminal | |
| KR101451359B1 (ko) | 사용자 계정 회복 | |
| CN110175448B (zh) | 一种可信设备登录认证方法及具有认证功能的应用系统 | |
| CN113132404B (zh) | 身份认证方法、终端及存储介质 | |
| WO2023216813A1 (zh) | 安全认证方法、装置、系统、电子设备及存储介质 | |
| JP2007280393A (ja) | コンピューターログインをコントロールする装置およびその方法 | |
| CN111813078B (zh) | 一种车辆的安全诊断方法、装置、设备及介质 | |
| CN111600888B (zh) | 用于登录验证的方法、装置和登录验证系统 | |
| CN116915493A (zh) | 安全登录方法、装置、系统、计算机设备和存储介质 | |
| CN109858235B (zh) | 一种便携式设备及其暗码获取方法和装置 | |
| JP2008117378A (ja) | 装置へのユーザーの認可 | |
| CN110968632B (zh) | 一种数据统一交换的方法与系统 | |
| JP4729457B2 (ja) | 自動分析装置 | |
| JP2008090701A (ja) | 認証アクセス制御システム及びこれに使用するアドインモジュール | |
| AU2024203796B2 (en) | Confirming authenticity of a user to a third-party system | |
| TW202018626A (zh) | 於簽章時驗證使用者身分之系統及方法 | |
| TWI813905B (zh) | 以線上快速認證之認證機制啟用數位憑證之系統及方法 | |
| CN113139166B (zh) | 基于云证书的评标专家签名方法及装置 | |
| US20240154956A1 (en) | Authentication System and Method for Windows Systems | |
| WO2020173019A1 (zh) | 访问凭证验证方法、装置、计算机设备及存储介质 |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| 121 | Ep: the epo has been informed by wipo that ep was designated in this application |
Ref document number: 23777867 Country of ref document: EP Kind code of ref document: A1 |