CN115333793A - On-board diagnostics (OBD) interface authentication method based on networking diagnostic equipment and vehicle - Google Patents

Abstract

The invention discloses an OBD interface authentication method based on networking diagnostic equipment and a vehicle, and the method specifically comprises the following steps: the central computing unit integrates an OBD authentication component of the central computing unit, and identity authentication is carried out on the diagnostic equipment based on a signature verification mechanism of a digital certificate; the diagnostic equipment integrates an OBD authentication component of the diagnostic equipment and applies for a digital certificate to a trust center on line; the diagnostic equipment is connected with the central computing unit, and the central computing unit performs security authentication on the diagnostic equipment and judges whether the diagnostic equipment has a preset authority; the trust center is accessed to the PKI system and provides functions of digital certificate on-line application, authority verification and on-line downloading for the diagnostic equipment; and the diagnostic equipment OBD authentication component presets a certificate and automatically applies for a trust center to obtain a digital certificate corresponding to the diagnostic equipment. Through the scheme, the problem of insufficient safety when the diagnosis equipment diagnoses the vehicle ECU is solved, and the vehicle is prevented from being attacked through illegal diagnosis service.

Description

A kind of OBD interface authentication method based on networkable diagnostic equipment, vehicle

technical field

The invention relates to the field of OBD interface authentication, in particular to an OBD interface authentication method based on networkable diagnostic equipment, diagnostic equipment, a central computing unit, and a vehicle.

Background technique

At present, most car models use the offline seed and key mechanism (Seed&Key) to authenticate diagnostic equipment for certain specific diagnostic services. A small number of models are also based on PKI public key infrastructure, using USB-Shield to issue and store digital certificates offline for authentication of diagnostic equipment.

The encryption algorithm used by the former is a private algorithm, which is not strong enough, and the key is easy to leak; the latter needs to download the certificate offline, which is not flexible enough, and it is difficult to issue certificates in large quantities, and the issued certificates are not easy to manage.

In the vehicle information security design, the OBD interface is the key external physical interface of the vehicle, through which diagnostic equipment can access each electronic control unit (ECU) for diagnostic services, and there is a risk of attacking the vehicle through the OBD interface.

In order to ensure communication security and prevent vehicles from being attacked through illegal diagnostic services, it is necessary to take corresponding protective measures for the OBD interface.

Contents of the invention

The object of the present invention is to provide a kind of OBD interface authentication method based on networkable diagnostic equipment, and diagnostic equipment, central computing unit, trust center, vehicle; In order to solve the problem that diagnostic equipment can visit each electronic control unit (ECU) through OBD interface ) for diagnostic services, there is a problem with the risk of attacking the vehicle through the OBD interface.

The present invention provides following scheme:

According to one aspect of the present invention, there is provided an OBD interface authentication method based on a networkable diagnostic device, which specifically includes:

The central computing unit integrates the OBD authentication component of the central computing unit, and authenticates the identity of the diagnostic device based on the signature verification mechanism of the digital certificate;

The diagnostic equipment integrates the diagnostic equipment OBD certification component, and applies for a digital certificate to the trust center online;

The diagnostic equipment is connected to the central computing unit, and the central computing unit performs security authentication on the diagnostic equipment to determine whether the diagnostic equipment has preset permissions.

According to another aspect of the present invention, an OBD interface authentication method based on a networkable diagnostic device is provided, specifically comprising:

The diagnostic device reads the serial number of the diagnostic device;

The diagnostic device OBD authentication component compares the serial number of the diagnostic device with the local certificate list, and determines whether the local certificate list contains a digital certificate corresponding to the serial number of the diagnostic device;

If the digital certificate corresponding to the serial number of the diagnostic equipment is not included, apply for the digital certificate online;

If the status of the digital certificate corresponding to the serial number of the diagnostic device is unavailable, apply for the digital certificate online;

If the status of the digital certificate corresponding to the serial number of the diagnostic device exceeds the renewal threshold, apply for the digital certificate online.

Further, it also includes:

Steps for the diagnostic device to read the serial number of the diagnostic device:

Start the diagnostic device software;

The diagnostic device establishes a connection with the trust center;

Call the diagnostic device OBD authentication component initialization interface;

Import diagnostic device serial numbers.

Further, it also includes:

The diagnostic device sends a certificate application message to the trust center;

Among them, the diagnostic device OBD authentication component generates an SM2 key pair, and generates a CSR file containing the key;

Use the preset certificate of the diagnostic device to perform P7 signature on the CSR file and the serial number of the diagnostic device, and construct a certificate application message;

The diagnostic device OBD authentication component receives the digital certificate from the trust center;

Among them, the application message has passed the P7 signature verification of the trust center, and the serial number of the diagnostic device recorded in the application message has passed the verification of the white list of the trust center.

Further, it also includes:

The diagnostic device receives the digital certificate from the trust center;

The diagnostic equipment OBD authentication component verifies the digital certificate;

like,

Verify that the digital certificate subject serial number matches the serial number of the diagnostic device,

Verify that the digital certificate matches the SM2 key generated by the OBD authentication component of the diagnostic device,

The verification digital certificate is issued by this CA;

Then, the diagnostic device OBD authentication component imports the digital certificate, and updates the local certificate list.

Further, it also includes:

The diagnostic equipment sends a verified digital certificate to the central computing unit;

The diagnostic device sends a request for obtaining random numbers to the central computing unit;

The diagnostic device receives random numbers from the central computing unit;

The diagnostic device OBD authentication component signs the random number;

The diagnostic device sends the signed results to the central computing unit.

According to another aspect of the present invention, there is provided an OBD interface authentication method based on a networkable diagnostic device, which specifically includes:

The central computing unit integrates the OBD authentication component of the central computing unit, and the root certificate is preset;

The central computing unit receives the digital certificate sent from the calibration diagnostic equipment;

The central computing unit OBD authentication component verifies the digital certificate sent by the diagnostic equipment;

If the verification is passed, a random number is returned to the diagnostic device;

The central computing unit receives the signature result of the random number from the diagnostic device;

The central computing unit OBD authentication component authenticates the signature result of the random number;

If the authentication is passed, the central computing unit releases preset permissions to the diagnostic equipment.

According to another aspect of the present invention, a diagnostic device is provided, comprising:

Diagnostic equipment integrates diagnostic equipment OBD authentication components, and preset root certificates;

Apply for a digital certificate to the trust center through Ethernet; implement an OBD interface authentication method based on a networkable diagnostic device.

According to still another aspect of the present invention, a kind of central computing unit is provided, comprising:

The central computing unit integrates the OBD authentication component of the central computing unit, and presets the root certificate; the digital certificate-based signature verification mechanism authenticates the identity of the diagnostic device; executes the OBD interface authentication method based on the networkable diagnostic device.

According to another aspect of the present invention, a vehicle is provided, including: a central computing unit; an OBD authentication component of the central computing unit is integrated in the central computing unit, and the diagnostic device is authenticated based on a signature verification mechanism of a digital certificate;

The diagnostic equipment integrates the diagnostic equipment OBD authentication component, and applies for a digital certificate from the trust center online;

The diagnostic equipment is connected to the central computing unit based on the diagnostic protocol, and the central computing unit performs security authentication on the diagnostic equipment; if the diagnostic equipment passes the authentication, data exchange under the protection of the authentication mechanism is allowed between the central computing unit and the diagnostic equipment.

Compared with the prior art, the present invention has the following advantages:

Security certification for diagnostic equipment reduces the risk of attacking vehicles through the OBD interface;

Through online security certification, digital certificates are updated in time to improve the security level;

Through online PKI, reduce the risk of key leakage;

Issue digital certificates online, improving the flexibility of certificate acquisition;

Download digital certificates online, no need to store a large number of certificates locally, and the number of certificates is limited;

It does not store a large number of certificates locally, which simplifies the difficulty of certificate management.

Description of drawings

In order to more clearly illustrate the specific implementation of the present invention or the technical solutions in the prior art, the following will briefly introduce the accompanying drawings that need to be used in the specific implementation or description of the prior art. Obviously, the accompanying drawings in the following description The drawings show some implementations of the present invention, and those skilled in the art can obtain other drawings based on these drawings without any creative work.

Fig. 1 is a kind of main flowchart of the OBD interface authentication method based on networkable diagnostic equipment;

Fig. 2 is a flow chart of diagnosing equipment based on the OBD interface authentication method of networkable diagnosing equipment;

Fig. 3 is a flow chart of the central computing unit of the OBD interface authentication method based on networkable diagnostic equipment;

Fig. 4 is a hardware connection block diagram of a specific embodiment;

Fig. 5 is a flow chart of applying for a certificate of a diagnostic device OBD authentication component in a specific embodiment;

Fig. 6 is a flow chart of verification before certificate renewal in a specific embodiment;

Fig. 7 is an authentication flowchart of the OBD port between the certificate diagnosis device and the central computing unit of a specific embodiment;

FIG. 8 is a system architecture diagram of an electronic device.

Detailed ways

The technical solutions of the present invention will be clearly and completely described below in conjunction with the accompanying drawings. Apparently, the described embodiments are some of the embodiments of the present invention, but not all of them. Based on the embodiments of the present invention, all other embodiments obtained by persons of ordinary skill in the art without making creative efforts belong to the protection scope of the present invention.

As shown in FIG. 1 , a main flow of an OBD interface authentication method based on a networkable diagnostic device is disclosed.

Step S1, the central computing unit integrates the OBD authentication component of the central computing unit, and authenticates the identity of the diagnostic device based on the signature verification mechanism of the digital certificate;

Step S2, the diagnostic device integrates the OBD authentication component of the diagnostic device, and applies for a digital certificate to the trust center online;

In step S3, the diagnostic device is connected to the central computing unit, and the central computing unit performs security authentication on the diagnostic device to determine whether the diagnostic device has a preset authority.

In this embodiment, the OBD authentication component of the diagnostic equipment has a built-in certificate in advance; the OBD authentication component of the diagnostic equipment applies to the trust center for a digital certificate corresponding to the diagnostic equipment; Functions of application, permission review, and online download; the OBD authentication component of the central computing unit has a built-in root certificate; the connection between the central computing unit and the diagnostic device is based on a diagnostic protocol; the OBD authentication component of the diagnostic device applies for a digital certificate to the trust center through Ethernet; With the help of the VPN technology platform under the national SSL technical specification, Ethernet ensures the security of data between the diagnostic equipment and the trust center.

Compared with the prior art, the present invention has the following advantages:

Security certification for diagnostic equipment reduces the risk of attacking vehicles through the OBD interface;

Through online security certification, digital certificates are updated in time to improve the security level;

Through online PKI, reduce the risk of key leakage;

Issue digital certificates online, improving the flexibility of certificate acquisition;

Download digital certificates online, no need to store a large number of certificates locally, and the number of certificates is limited;

It does not store a large number of certificates locally, which simplifies the difficulty of certificate management.

As shown in FIG. 2 , this embodiment discloses the workflow of the diagnostic device in the OBD interface authentication method based on the networkable diagnostic device.

Step P1, a step for the diagnosis device to determine the digital certificate in the local certificate list;

The diagnostic device reads the serial number of the diagnostic device;

The diagnostic device OBD authentication component compares the serial number of the diagnostic device with the local certificate list, and determines whether the local certificate list contains a digital certificate corresponding to the serial number of the diagnostic device;

If the digital certificate corresponding to the serial number of the diagnostic equipment is not included, apply for the digital certificate online;

If the status of the digital certificate corresponding to the serial number of the diagnostic device is unavailable, apply for the digital certificate online;

If the status of the digital certificate corresponding to the serial number of the diagnostic device exceeds the renewal threshold, apply for the digital certificate online.

Step P2, the steps for the diagnostic equipment to read the serial number of the diagnostic equipment:

Start the diagnostic device software;

The diagnostic device establishes a connection with the trust center;

Call the diagnostic device OBD authentication component initialization interface;

Import diagnostic device serial numbers.

Step P3, the step of performing signature verification between the diagnostic device and the trust center;

The diagnostic device sends a certificate application message to the trust center;

Among them, the diagnostic device OBD authentication component generates an SM2 key pair, and generates a CSR file containing the key;

Use the preset certificate of the diagnostic device to perform P7 signature on the CSR file and the serial number of the diagnostic device, and construct a certificate application message;

The diagnostic device OBD authentication component receives the digital certificate from the trust center;

Among them, the application message has passed the P7 signature verification of the trust center, and the serial number of the diagnostic device recorded in the application message has passed the verification of the white list of the trust center.

Step P4, a step of verifying before importing the digital certificate into the diagnostic device OBD authentication component of the diagnostic device;

The diagnostic device receives the digital certificate from the trust center;

The diagnostic equipment OBD authentication component verifies the digital certificate;

like,

Verify that the digital certificate subject serial number matches the serial number of the diagnostic device,

Verify that the digital certificate matches the SM2 key generated by the OBD authentication component of the diagnostic device,

The verification digital certificate is issued by this CA;

Then, the diagnostic device OBD authentication component imports the digital certificate, and updates the local certificate list.

Step P5, a step for the diagnostic device to verify the signature of the central computing unit;

The diagnostic equipment sends a verified digital certificate to the central computing unit;

The diagnostic device sends a request for obtaining random numbers to the central computing unit;

The diagnostic device receives random numbers from the central computing unit;

The diagnostic device OBD authentication component signs the random number;

The diagnostic device sends the signed results to the central computing unit.

As shown in FIG. 3 , this embodiment discloses the workflow of the central computing unit of the OBD interface authentication method based on networkable diagnostic equipment.

Step P6, a step for the central computing unit to verify the digital certificate of the diagnostic device;

Step P601 The central computing unit integrates the OBD authentication component of the central computing unit, and presets the root certificate;

Step P602 The central computing unit receives the digital certificate sent from the verification diagnostic equipment;

Step P603 The central computing unit OBD authentication component verifies the digital certificate sent by the diagnostic device;

In step P604, if the verification is passed, a random number is returned to the diagnostic equipment;

Step P605 The central computing unit receives the signature result of the random number from the diagnostic device;

Step P606 central computing unit OBD authentication component authenticates the signature result of the random number;

In step P607, if the authentication is passed, the central computing unit releases the preset authority to the diagnostic equipment.

As shown in Figure 4, the present invention also discloses a specific embodiment, regarding the hardware environment for realizing OBD port encryption verification, it is used to explain the operation mode of the OBD authentication component to realize the signature verification mechanism of the digital certificate, and the diagnostic equipment and the central Digital certification of computing units.

The OBD authentication component is integrated in the central computing unit, and the root certificate is preset, and the identity authentication of the diagnostic device is performed based on the signature verification mechanism of the digital certificate. Integrate the diagnostic equipment OBD authentication component on the diagnostic equipment side, and apply for a digital certificate to the trust center through Ethernet. The diagnostic equipment integrates OBD authentication components. After connecting to the central computing unit based on the diagnostic protocol, the central computing unit performs security authentication on the diagnostic equipment based on legal digital certificates.

The trust center is connected to the PKI system to provide functions such as online application for certificates, authority review, and online download for diagnostic equipment.

Certificate application refers to the application of diagnostic device components to the trust center for a certificate corresponding to the connected diagnostic device, including the first application for a certificate for a diagnostic device, the expiration of a diagnostic device certificate, and the invalidation of a diagnostic device certificate.

The diagnostic device OBD certification component can maintain multiple sets of certificates.

As shown in FIG. 5 , the process of applying for a certificate of a diagnostic device OBD authentication component in a specific embodiment is disclosed.

The application process for the OBD certification component certificate of diagnostic equipment is as follows:

Step 11. After starting the diagnostic equipment software and establishing a connection between the diagnostic equipment and the trust center, the diagnostic equipment software calls the diagnostic equipment OBD authentication component initialization interface, and passes in the serial number of the diagnostic equipment;

Step 12. The OBD authentication component of the diagnostic device searches for the corresponding certificate from the local certificate list through the serial number of the diagnostic device; if the certificate is not found, or the certificate status is unavailable, or the certificate update threshold is reached, apply for the certificate online;

Step 13. The diagnostic device OBD authentication component generates an SM2 key pair and generates a CSR certificate application, uses the preset certificate to perform P7 signature on the CSR and the serial number of the diagnostic device, and constructs a certificate application message;

Step 14. The diagnostic device OBD authentication component uses the preset certificate to establish an SSL secure connection with the trust center, and sends the certificate application message to the trust center;

Step 15. After receiving the certificate application message, the trust center verifies the P7 signature, verifies the serial number of the diagnostic device according to the white list, issues the certificate, and returns it to the diagnostic device;

Step 16. When importing the certificate of the OBD authentication component of the diagnostic device, the certificate must be verified first;

Step 17. After the certificate verification is successfully imported, update the local certificate list, which will be used to query the digital certificate when the diagnostic device is re-connected next time.

As shown in FIG. 6 , a certificate verification process of a specific embodiment is disclosed.

When importing the certificate of the OBD certification component of the diagnostic equipment, the steps of verifying the certificate are required first;

Step 16a. Verify whether the serial number of the subject of the certificate matches the diagnostic device;

Step 16b. Check whether the certificate matches the SM2 key;

Step 16c. Check whether the certificate is issued by this CA;

Step 16d. If the verification conditions match, the certificate is valid and can be imported; otherwise, the certificate is illegal and cannot be imported;

As shown in FIG. 7 , an authentication process of an OBD port between a diagnostic device and a central computing unit according to a specific embodiment is disclosed.

After the diagnostic device applies for a certificate, the authentication of the OBD port between the diagnostic device and the central computing unit begins, and the process is as follows:

Step 21. Initiated by the diagnostic device, obtain a digital certificate from the OBD authentication component of the diagnostic device;

Step 22. After the diagnostic device OBD authentication component verifies the serial number of the diagnostic device, it returns a digital certificate to the diagnostic device;

Step 23. The diagnostic device sends the digital certificate to the central computing unit, and requests a random number from the central computing unit;

Step 24. The central computing unit of the preset root certificate calls the OBD authentication component to verify the digital certificate sent by the diagnostic device, and returns a random number to the diagnostic device after the verification is passed;

Step 25. The diagnostic device invokes the OBD authentication component of the diagnostic device to sign the random number;

Step 26. The diagnostic device sends the signature result to the central computing unit for authentication;

Step 27. The central computing unit calls the OBD authentication component, and uses the cached digital certificate to authenticate the random number. If the authentication is passed, the central computing unit and the diagnostic device are allowed to exchange data under the protection of the authentication mechanism.

In this embodiment, the preset root certificate or preset certificate in the OBD authentication component needs to be properly stored, and a method of hardware curing is generally adopted.

In this embodiment, the online digital certificate authentication is done through Ethernet, and the national secret SSL secure connection can be used to apply for and issue the remote certificate of the diagnostic equipment.

In this embodiment, the digital certificate is applied for and bound through the serial number of the diagnostic device, so that the authority of the digital certificate and the OBD interface of the diagnostic device is unique, clearly indicating the identity of the diagnostic device.

In this embodiment, each time the diagnostic device is connected to the central computing platform, the central computing platform will start to interact with the underlying ECU data managed by the central computing platform to prevent illegal diagnosis after the identity authentication process of the diagnostic device is completed. The device hacks the ECU.

The present invention also discloses another embodiment, which relates to the diagnosis equipment.

A diagnostic device comprising:

Diagnostic equipment integrates diagnostic equipment OBD authentication components, and preset root certificates;

Apply for a digital certificate to the trust center through Ethernet; implement an OBD interface authentication method based on a networkable diagnostic device.

The present invention also discloses another embodiment, about the central computing unit.

A central computing unit comprising:

The central computing unit integrates the OBD authentication component of the central computing unit, and presets the root certificate; the digital certificate-based signature verification mechanism authenticates the identity of the diagnostic device; executes the OBD interface authentication method based on the networkable diagnostic device.

As shown in FIG. 8 , the communication bus mentioned in the above electronic device may be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus or the like. The communication bus can be divided into an address bus, a data bus, a control bus, and the like. For ease of representation, only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus.

An electronic device includes a hardware layer, an operating system layer running on the hardware layer, and an application layer running on the operating system. The hardware layer includes hardware such as a central processing unit (CPU, Central Processing Unit), a memory management unit (MMU, Memory Management Unit) and memory. The operating system can be any one or more computer operating systems that realize electronic device control through processes, for example, Linux operating system, Unix operating system, Android operating system, iOS operating system, or windows operating system. And in the embodiment of the present invention, the electronic device may be a handheld device such as a smart phone or a tablet computer, or may be an electronic device such as a desktop computer or a portable computer, which is not particularly limited in the embodiment of the present invention.

The execution subject of electronic device control in the embodiment of the present invention may be an electronic device, or a functional module in the electronic device that can call a program and execute the program. The electronic device can obtain the firmware corresponding to the storage medium. The firmware corresponding to the storage medium is provided by the supplier. The firmware corresponding to different storage media may be the same or different, which is not limited here. After the electronic device obtains the firmware corresponding to the storage medium, it may write the firmware corresponding to the storage medium into the storage medium, specifically burn the firmware corresponding to the storage medium into the storage medium. The process of burning the firmware into the storage medium can be realized by using the existing technology, and will not be repeated in the embodiment of the present invention.

The electronic device can also obtain a reset command corresponding to the storage medium. The reset command corresponding to the storage medium is provided by the supplier. The reset commands corresponding to different storage media can be the same or different, which is not limited here.

At this time, the storage medium of the electronic device is the storage medium in which the corresponding firmware is written, and the electronic device can respond to the reset command corresponding to the storage medium in the storage medium in which the corresponding firmware is written, so that the electronic device can The reset command resets the storage medium in which the corresponding firmware is written. The process of resetting the storage medium according to the reset command can be implemented in the prior art, and will not be described in detail in this embodiment of the present invention.

The invention also discloses another embodiment, which relates to the vehicle.

A vehicle, comprising: a central computing unit; an OBD authentication component of the central computing unit is integrated in the central computing unit, and a diagnostic device is authenticated based on a signature verification mechanism of a digital certificate;

The diagnostic equipment integrates the diagnostic equipment OBD authentication component, and applies for a digital certificate from the trust center online;

The diagnostic equipment is connected to the central computing unit based on the diagnostic protocol, and the central computing unit performs security authentication on the diagnostic equipment; if the diagnostic equipment passes the authentication, data exchange under the protection of the authentication mechanism is allowed between the central computing unit and the diagnostic equipment.

For the convenience of description, when describing the above devices, the functions are divided into various units and modules and described separately. Of course, when implementing the present application, the functions of each unit and module can be implemented in one or more software and/or hardware.

Those skilled in the art can understand that, unless otherwise defined, all terms (including technical terms and scientific terms) used herein have the same meaning as commonly understood by those of ordinary skill in the art to which this invention belongs. It should also be understood that terms, such as those defined in commonly used dictionaries, should be understood to have meanings consistent with the meanings in the context of the prior art, and will not be used in an idealized or overly formal sense unless specifically defined to explain.

It should be noted that certain terms are used in the specification and claims to refer to specific elements. Those skilled in the art should understand that vehicle manufacturers may use different terms to refer to the same component. The specification and claims do not use the difference in nouns as a way to distinguish components, but use the difference in function of components as a criterion for distinguishing. As mentioned throughout the specification and claims, "comprising" or "comprising" is an open term, so it should be understood as "including but not limited to". The preferred implementation modes of the present invention will be described later, but the descriptions are for the purpose of general principles of the description, and are not intended to limit the scope of the present invention. The protection scope of the present invention should be defined according to the appended claims.

It can be known from the above description of the implementation manners that those skilled in the art can clearly understand that the present application can be implemented by means of software plus a necessary general hardware platform. Based on this understanding, the essence of the technical solution of this application or the part that contributes to the prior art can be embodied in the form of software products, and the computer software products can be stored in storage media, such as ROM/RAM, disk , CD, etc., including several instructions to make a computer device (which may be a personal computer, server, or network device, etc.) execute the methods described in various embodiments or some parts of the embodiments of this application.

The device implementation described above is only illustrative, and the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in One place, or it can be distributed to multiple network elements. Part or all of the modules can be selected according to actual needs to achieve the purpose of the solution of this embodiment. It can be understood and implemented by those skilled in the art without creative effort.

This application can be used in numerous general purpose or special purpose computing system environments or configurations, such as: personal computers, server computers, handheld or portable devices, tablet-type devices, multiprocessor systems, microprocessor-based systems, set-top boxes, Programmed consumer electronic devices, network PCs, minicomputers, mainframe computers, distributed computing environments including any of the above systems or devices, and more.

This application may be described in the general context of computer-executable instructions, such as program modules, being executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform particular tasks or implement particular abstract data types. The application may also be practiced in distributed computing environments where tasks are performed by remote processing devices that are linked through a communications network. In a distributed computing environment, program modules may be located in both local and remote computer storage media including storage devices.

In the description of this specification, descriptions with reference to the terms "one embodiment", "example", "specific example" and the like mean that specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment of the present invention. In an embodiment or example. In this specification, schematic representations of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials or characteristics described may be combined in any suitable manner in any one or more embodiments or examples.

Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the present invention, rather than limiting them; although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that: It is still possible to modify the technical solutions described in the foregoing embodiments, or perform equivalent replacements for some or all of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the technical solutions of the various embodiments of the present invention. scope.

Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the present invention, rather than limiting them; although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that: It is still possible to modify the technical solutions described in the foregoing embodiments, or perform equivalent replacements for some or all of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the technical solutions of the various embodiments of the present invention. scope.

Claims (10)

1. An OBD interface authentication method based on a network-connectable diagnosis device is characterized by specifically comprising the following steps:

the central computing unit integrates an OBD authentication component of the central computing unit, and identity authentication is carried out on the diagnostic equipment based on a signature verification mechanism of a digital certificate;

the diagnostic equipment integrates an OBD authentication component of the diagnostic equipment and applies for a digital certificate to a trust center on line;

the diagnostic equipment is connected with the central computing unit, and the central computing unit carries out safety certification on the diagnostic equipment and judges whether the diagnostic equipment has a preset authority.

2. An OBD interface authentication method based on a network-connectable diagnosis device is characterized by specifically comprising the following steps:

the diagnostic equipment reads the serial number of the diagnostic equipment;

the diagnostic equipment OBD authentication component compares the serial number of the diagnostic equipment with a local certificate list and judges whether the local certificate list contains a digital certificate corresponding to the serial number of the diagnostic equipment;

if the digital certificate corresponding to the serial number of the diagnostic equipment is not included, the digital certificate is applied online;

if the digital certificate state corresponding to the serial number of the diagnostic equipment is unavailable, applying for the digital certificate on line;

and if the digital certificate state corresponding to the serial number of the diagnostic equipment exceeds the updating threshold, performing online application on the digital certificate.

3. The network-enabled diagnostic device based OBD interface authentication method as claimed in claim 2, further comprising:

the diagnostic device reads the serial number of the diagnostic device:

starting the diagnostic equipment software;

the diagnostic equipment establishes connection with the trust center;

calling an initialization interface of an OBD authentication component of the diagnostic equipment;

and importing a serial number of the diagnostic equipment.

4. The On Board Diagnostic (OBD) interface authentication method based on a network-enabled OBD device according to claim 2, further comprising:

the diagnostic equipment sends a certificate application message to the trust center;

the diagnostic equipment OBD authentication component generates an SM2 key pair and generates a CSR file containing a key;

performing P7 signature on the CSR file and the serial number of the diagnostic equipment by using a preset certificate of the diagnostic equipment to construct a certificate application message;

the diagnostic device OBD authentication component receives a digital certificate from a trust center;

the application message is subjected to signature verification of a trust center P7, and the diagnostic equipment serial number recorded in the application message passes verification of a white list of the trust center.

5. The network-enabled diagnostic device based OBD interface authentication method as claimed in claim 2, further comprising:

the diagnostic device receives a digital certificate from a trust center;

the diagnostic equipment OBD authentication component verifies the digital certificate;

if the number of the first time interval and the second time interval is less than the preset threshold,

verifying that the digital certificate subject serial number matches the serial number of the diagnostic device,

the verification digital certificate matches the SM2 key generated by the diagnostic device OBD authentication component,

verifying that the digital certificate is issued by the CA;

then the diagnostic device OBD authentication component imports the digital certificate and updates the local certificate list.

6. The On Board Diagnostic (OBD) interface authentication method based on a network-enabled OBD device according to claim 5, further comprising:

the diagnostic equipment sends the verified digital certificate to the central computing unit;

the diagnostic device sends a request for obtaining a random number to the central computing unit;

the diagnostic device receives the random number from the central computing unit;

the diagnostic equipment OBD authentication component signs the random number;

the diagnostic device sends the result of the signature to the central computing unit.

7. An OBD interface authentication method based on a network-connectable diagnosis device is characterized by specifically comprising the following steps:

the central computing unit integrates an OBD authentication component of the central computing unit and presets a root certificate;

the central computing unit receives the digital certificate sent by the checking and diagnosing equipment;

the central computing unit OBD authentication component verifies the digital certificate sent by the diagnostic equipment;

if the verification is passed, returning a random number to the diagnostic equipment;

the central computing unit receives a signature result of the random number from the diagnostic device;

the central computing unit OBD authentication component authenticates the signature result of the random number;

and if the authentication is passed, the central computing unit opens the preset authority to the diagnostic equipment.

8. A diagnostic device, comprising:

the diagnostic equipment integrates an OBD authentication component of the diagnostic equipment and presets a root certificate;

applying for a digital certificate to a trust center through Ethernet; performing the network-connectable diagnostic device based OBD interface authentication method of any of claims 2 to 6.

9. A central computing unit, comprising:

the central computing unit integrates an OBD authentication component of the central computing unit and presets a root certificate; the identity authentication is carried out on the diagnostic equipment based on a signature verification mechanism of the digital certificate; an OBD interface authentication method based on a networkable diagnostic device, as claimed in claim 7, is performed.

10. A vehicle, characterized by comprising: a central computing unit; the central computing unit is internally integrated with an OBD authentication component of the central computing unit, and the identity authentication is carried out on the diagnostic equipment based on a signature verification mechanism of a digital certificate;

the diagnostic equipment integrates an OBD authentication component of the diagnostic equipment and applies for a digital certificate to the trust center in an online mode;

the diagnostic equipment is connected with the central computing unit based on a diagnostic protocol, and the central computing unit carries out safety certification on the diagnostic equipment; and if the diagnostic equipment passes the authentication, allowing the central computing unit and the diagnostic equipment to perform data interaction under the protection of an authentication mechanism.

Images