WO2021217559A1

WO2021217559A1 - Data protection method and apparatus

Info

Publication number: WO2021217559A1
Application number: PCT/CN2020/088065
Authority: WO
Inventors: 陈幼雷
Original assignee: 华为技术有限公司
Priority date: 2020-04-30
Filing date: 2020-04-30
Publication date: 2021-11-04
Also published as: CN112543928A; CN112543928B

Abstract

A data protection method and apparatus. The method comprises: a deflection encryption unit acquiring an expected measurement value (S301); the deflection encryption unit making a request to call a trusted measurement unit to execute a first trusted measurement (S302); the trusted measurement unit executing the first trusted measurement to generate a running measurement value (S303); the trusted measurement unit feeding back the running measurement value to the deflection encryption unit (S304); and the deflection encryption unit verifying, by comparing the expected measurement value and the running measurement value, the security of data operation execution in a vehicle (S305). The deflection encryption unit compares the acquired expected measurement value with the running measurement value generated by the trusted measurement unit, such that the security of data operation execution in a vehicle is effectively verified, thereby effectively ensuring the security of vehicle data.

Description

Data protection method and device

Technical field

This application relates to the technical fields of automatic driving and intelligent networked vehicles, and in particular to a data protection method and device.

Background technique

With the continuous development of autonomous driving technology, vehicle coordinate processing has also made considerable progress. According to relevant regulations, coordinate processing methods and coordinate deflection methods need to be protected to ensure data security.

At present, when protecting the coordinate processing method and the coordinate deflection method, it is usually to provide the module related to coordinate processing and the module to realize coordinate deflection to the supervisory department, and the supervisory department will perform unified compilation to generate a large Binary program module, and then the system can implement related coordinate processing according to the binary program module.

However, the above method lacks an effective protection mechanism, which cannot prevent the coordinate data from being maliciously intercepted, resulting in lower vehicle data security.

Summary of the invention

The embodiments of the present application provide a data protection method and device to improve the security of vehicle data.

In the first aspect, an embodiment of the present application provides a data protection method applied to a vehicle-mounted computing device, wherein the vehicle-mounted computing device includes a deflection encryption unit and a trusted measurement unit, and the deflection encryption unit and the trusted measurement unit operate on In a trusted execution environment, the method includes:

The deflection encryption unit obtains the expected metric value; and the deflection encryption unit requests to call the credibility measurement unit to execute the first credibility metric. In a possible implementation manner, the deflection encryption unit may call the application program interface API , So as to call the trusted measurement unit to execute the first trusted measurement.

And the credibility measurement unit executes the first credibility metric to generate an operation metric value; the credibility metric unit feeds back the operation metric value to the deflection encryption unit; the deflection encryption unit compares the The expected metric value and the operational metric value verify the safety of performing data operations in the vehicle.

In the above process, the deflection encryption unit compares the obtained expected metric value with the operating metric value generated by the trusted measurement unit, thereby effectively verifying the security of data operations performed in the vehicle, thereby effectively ensuring the security of vehicle data.

In a possible implementation manner, before the deflection encryption unit obtains the expected metric value, the method further includes:

The deflection encryption unit determines the expected metric value that is not prefabricated locally. In a possible implementation, the deflection encryption unit can be queried in a local hardware security module (HSM), or the deflection encryption unit can also be locally Query in the non-volatile storage of the device to determine the expected metric value of local non-prefabrication; or the deflection encryption unit also judges the expected metric value of local non-prefabricated according to the status flag.

When it is determined that there is no expected metric value locally, the deflection encryption unit may request to call the credibility measurement unit to execute a second credibility metric; the credibility metric unit executes the second credibility metric to generate an initial metric value;

Wherein, acquiring the expected metric value by the deflection encryption unit includes: the deflection encryption unit acquiring the initial metric value.

In the above process, when it is determined that there is no expected metric value locally, the deflection encryption unit calls the trusted metric unit to generate an initial metric value, which can effectively improve the flexibility of obtaining the expected metric value.

In a possible implementation manner, the execution of the second credibility metric by the credibility measurement unit to generate an initial metric value includes:

The trusted measurement unit generates the initial measurement value by performing hash calculation on a predefined program module and operating environment.

Among them, the initial measurement value is obtained by performing hash calculation on the pre-defined program module and operating environment, which can effectively verify the integrity of the program and the environment.

Among them, the program module refers to a high-precision map application program used for processing sensitive data, which may be a whole program, or may be composed of multiple programs with relatively independent functions.

Among them, the operating environment refers to the system service components that run the high-precision map application program, such as library files (dynamic link library or static link library), middleware (such as database middleware), virtual machine environment (such as java virtual machine) Or operating system service components, etc.

Among them, the hash algorithm can use standard hash algorithms, such as SHA-1/SHA-256 or SM3, etc.

Determining, by the deflection encryption unit, the expected metric value with no local prefabrication;

At this time, the deflection encryption unit can perform mutual authentication with the supervision server and establish a secure channel. By establishing the secure channel, the security of subsequent data transmission can be guaranteed. At this time, the deflection encryption unit requests the server to obtain the expected metric value;

Wherein, obtaining the expected metric value by the deflection encryption unit includes: the deflection encryption unit receiving the expected metric value returned by the server.

In the above implementation, in the case that the deflection encryption unit determines that there is no local prefabricated expected metric value, a secure channel can be established with the server, so as to obtain the expected metric value from the server in an online manner, so as not to reduce the security. , There is no need to perform the credibility measurement process during the startup phase, which reduces the computational overhead.

The deflection encryption unit determines that the expected metric value prefabricated locally;

Obtaining the expected metric value by the deflection encryption unit includes: the deflection encryption unit obtaining the locally pre-made expected metric value.

Wherein, in the case where the expected metric value is prefabricated locally, the local expected metric value is directly obtained, so that the acquisition of the expected metric value can be conveniently and efficiently achieved.

In a possible implementation manner, after the deflection encryption unit obtains the expected metric value, the method further includes:

The deflection encryption unit requests to call the credibility measurement unit to execute the third credibility measurement;

The credibility measurement unit executes the third credibility metric to generate an initial metric value;

Determining, by the deflection encryption unit, that the expected metric value is not equal to the initial metric value;

The deflection encryption unit turns off the data operation function or alarms.

Among them, by comparing the expected metric value and the initial metric value in the startup phase, the subsequent processing is performed when the expected metric value is consistent with the initial metric value, which can effectively improve the security of the data and prevent the system from being offline. The metric is expected to be updated or tampered with.

In a possible implementation manner, the deflection encryption unit, by comparing the expected metric value and the operating metric value, to verify the security of performing data operations in the vehicle includes:

The deflection encryption unit determines that the expected metric value is equal to the operating metric value;

The deflection encryption unit performs the data operation.

The data operation may be, for example, a deflection encryption module that performs processing procedures such as deflection and encryption of sensitive data such as coordinates, and sends the processed results to a high-precision map application program.

Determining, by the deflection encryption unit, that the expected metric value is not equal to the operating metric value;

The deflection encryption unit turns off the data operation function or alarms.

In the above process, the data operation is performed only when the deflection encryption unit determines that the expected metric value is equal to the operating metric value; when it is determined that the metric value is not equal, the data operation function is directly turned off or an alarm is issued, which can effectively ensure the program and environment. safety.

In a possible implementation manner, the execution of the first credibility metric by the credibility measurement unit, and generating the running metric value includes:

The trusted measurement unit generates the operating measurement value by performing hash calculation on a predefined program module and operating environment.

In a second aspect, an embodiment of the present application provides a vehicle-mounted computing device, including a deflection encryption unit and a trusted measurement unit, where the deflection encryption unit and the trusted measurement unit operate in a trusted execution environment;

Wherein, the deflection encryption unit is used to obtain the expected metric value, and request to call the credibility metric unit to execute the first credibility metric;

The credibility measurement unit is configured to execute the first credibility metric, generate an operating metric value, and feed back the operating metric value to the deflection encryption unit;

The deflection encryption unit is also used to verify the safety of data operations performed in the vehicle by comparing the expected metric value and the operating metric value.

In a possible implementation manner, the deflection encryption unit is further configured to determine the expected metric value that is not prefabricated locally before obtaining the expected metric value, and request to call the trusted metric module to execute the second trusted metric. ；

The credibility measurement unit is further configured to execute the second credibility metric to generate an initial metric value;

The obtaining of the expected metric value by the deflection encryption unit includes: the deflection encryption unit obtaining the initial metric value.

In a possible implementation manner, the deflection encryption unit is further configured to determine the expected metric value that is not prefabricated locally before obtaining the expected metric value, and request the server to obtain the expected metric value;

The obtaining of the expected metric value by the deflection encryption unit includes: the deflection encryption unit receiving the expected metric value returned by the server.

In a possible implementation manner, the deflection encryption unit is further configured to determine that the expected metric value is prefabricated locally before obtaining the expected metric value;

In a possible implementation manner, the deflection encryption unit is further configured to request to call the credibility metric module to execute the third credibility metric after obtaining the expected metric value;

The credibility measurement unit is further configured to execute the third credibility metric to generate an initial metric value;

The deflection encryption unit is also used to determine that the expected metric value is not equal to the initial metric value, and then close the data operation function or give an alarm.

In a possible implementation manner, the deflection encryption unit is further configured to compare the expected metric value and the operating metric value to verify the security of performing data operations in the vehicle, including:

The deflection encryption unit is also used to determine that the expected metric value is equal to the operating metric value, and to execute the data operation.

The deflection encryption unit is also used to determine that the expected metric value is not equal to the operating metric value, and to close the data operation function, or to give an alarm.

In a possible implementation manner, the credibility measurement unit is configured to execute the first credibility metric, and generating a running metric value includes:

The trusted measurement unit is used to generate the operating measurement value by performing hash calculation on a predefined program module and operating environment.

In a third aspect, an embodiment of the present application provides an in-vehicle computing device, which is characterized by including a memory and a processor, the memory stores computer program instructions, and the processor runs the computer program instructions to execute the above first aspect and The method of any one of the various possible implementations of the first aspect.

In a fourth aspect, an embodiment of the present application provides a computer storage medium, which is characterized by including computer instructions. When the computer instructions are executed by a processor, the above first aspect and various possible implementation manners of the first aspect are implemented. Any method.

In a fifth aspect, an embodiment of the present application provides a computer program product, characterized in that, when the computer program product runs on a processor, it implements any one of the first aspect and various possible implementation manners of the first aspect. Methods.

In a sixth aspect, an embodiment of the present application provides a data processing system, which is characterized by including a server and the vehicle-mounted computing device as described in the second aspect and any of the various possible implementation manners of the second aspect.

In a seventh aspect, an embodiment of the present application provides a smart car, including an in-vehicle communication device and an in-vehicle computing device as described in the second aspect and any of the various possible implementation manners of the second aspect.

The embodiments of the present application provide a data protection method and device. The method includes: deflecting an encryption unit to obtain an expected metric value. The deflection encryption unit requests to call the trusted measurement unit to execute the first trusted measurement. The credibility measurement unit executes the first credibility metric and generates a running metric value. The trusted measurement unit feeds back the running measurement value to the deflection encryption unit. The deflection encryption unit verifies the security of data operations performed in the car by comparing the expected metric value and the operating metric value. The deflection encryption unit compares the acquired expected metric value with the operating metric value generated by the trusted measurement unit, thereby effectively verifying the security of data operations performed in the vehicle, thereby effectively ensuring the security of vehicle data.

Description of the drawings

FIG. 1 is a schematic diagram of an automatic driving system in a vehicle to which an embodiment of the application is applicable;

FIG. 2 is a schematic diagram of a high-precision map navigation system applicable to an embodiment of this application;

FIG. 3 is a flowchart of a data protection method provided by an embodiment of this application;

FIG. 4 is a flowchart of another data protection method provided by an embodiment of the application;

FIG. 5 is a flowchart of another data protection method provided by an embodiment of this application;

FIG. 6 is a flowchart of yet another data protection method provided by an embodiment of this application;

FIG. 7 is a structural block diagram of a vehicle-mounted computing device provided by an embodiment of the application;

FIG. 8 is a structural block diagram of another vehicle-mounted computing device provided by an embodiment of the application.

Detailed ways

First, introduce the related concepts involved in this application:

Global Navigation Satellite System: Global Navigation Satellite System (GNSS) is the same name for a single satellite navigation and positioning system that currently exists. The global navigation satellite system can provide all-weather services on the surface of the earth or anywhere in near-Earth space. 3D coordinates, speed, and time information.

Inertial measurement unit: Inertial measurement unit (IMU) is a device that measures the three-axis attitude angle (or angular rate) and acceleration of an object. Usually an IMU contains three single-axis accelerometers and three single-axis gyroscopes. The accelerometer detects the acceleration signal of the object in the independent three-axis coordinate system of the carrier, while the gyroscope detects the angular velocity signal of the carrier relative to the navigation coordinate system, and measures the object in Angular velocity and acceleration in three-dimensional space, and to obtain the posture of the object, IMU has very important application value in navigation.

Telematics processor: Telematics BOX (T-BOX) is used to implement vehicle communication. For example, it can communicate with the back-end system, or it can also communicate with terminal equipment to display and display vehicle information. control.

WGS84: The full name is World Geodetic System 1984. WGS84 is a coordinate system established for the use of the Global Positioning System (GPS), which can be the coordinates output by GNSS.

GCJ-02: GCJ-02 is a coordinate format defined by the national surveying and mapping administration.

C-V2X: C-V2X (Cellular V2X) Internet of Vehicles based on cellular communication mechanism.

After explaining related concepts, the following describes the application scenario of this embodiment with reference to FIG. 1. FIG. 1 is a schematic diagram of the application scenario of the data protection method provided by an embodiment of the application, as shown in FIG. 1:

The application scenario includes a vehicle 10. In this embodiment, the vehicle 10 can realize automatic driving. In an automatic driving scenario, the automatic driving system inside the vehicle 10 may include a sensor perception module (sensor perception) and a planning control module (planning). , High-precision map and positioning module (HD map/Localization), global navigation satellite system/inertial measurement unit (GNSS/IMU), sensor fusion module (sensor fusion), etc. This embodiment has Not limited.

Those skilled in the art can understand that it is very important to determine the position of the vehicle during the automatic driving of the vehicle. Therefore, the automatic driving system in this embodiment can realize the coordinate processing of the vehicle. For example, see Figure 1, Global Navigation The satellite system/inertial measurement unit can send the WGS84 coordinates of its own car to the high-precision map and positioning module, and the T-box can also obtain the GCJ-02 of other objects (such as external static objects or dynamic objects such as other vehicles) transmitted in the cloud. And send the acquired GCJ-02 coordinates of other objects to the high-precision map and positioning module.

At the same time, the high-precision map and positioning module can convert the received WGS84 coordinates of the own vehicle and/or the GCJ-02 coordinates of other objects into the GCJ-02 coordinates of the own vehicle, and provide them to the sensor fusion module and the planning control module. The sensor fusion module and the planning control module can control the vehicle according to the GCJ-02 coordinates of the vehicle, such as adjusting the position of the vehicle or changing the direction of the vehicle.

Based on the above introduction, it can be determined that in the application process of vehicle automatic driving, the processing of coordinates will be involved, such as the processing of WGS84 coordinates and GCJ-02 coordinates, including sensitive data such as coordinate data and coordinate data deflection processing methods. According to the regulations of the Chinese Surveying and Mapping Department, the processing of the coordinates needs to be protected accordingly, and the deflection method of the coordinates also needs to be protected. The deflection of the coordinates can be, for example, the conversion of WGS84 coordinates to GCJ-02 coordinates. Processing and coordinate deflection methods are protected, so as to ensure the security of coordinate data.

For example, in a high-precision map-based autonomous driving application scenario, the program module used to process coordinates in the car can process GCJ-02 coordinates, but it must prevent the GCJ-02 coordinates from being stolen by illegal programs or directly exposed to the outside (such as coordinates). Transfer directly to the outside of the program).

At present, the existing technical solutions are usually implemented by the supervisory authority (such as the Ministry of Natural Resources) when realizing the coordinate processing and coordinate deflection method. Among them, the supervisory authority has designed a set of binding mechanism, namely It is said that all modules related to coordinate processing and modules that implement the deflection method will be compiled by the regulatory authority (source code level) to generate a large binary program module. Among them, the module that implements the deflection method can be provided by the regulatory authority. of.

Then, the regulatory authority provides the generated binary program module to the autonomous driving software developer (or navigation service provider), and the autonomous driving software developer can perform follow-up operations according to the received binary program module to realize the automatic driving process.

The above processing method has two purposes. The first is to prevent the coordinates from being exposed to the outside of the built module, and the second is to prevent the deflection of the deflection method, because the more the number of modules involved in the compilation, the more they are directly reversed and deflected. The more difficult the method is. For example, the sensor fusion module, planning control module, high-precision map, and positioning module in Figure 1 should participate in the binding as required.

The above-mentioned method of implementing the protection of coordinates through the joint compilation of the supervision part has been popularized in ordinary navigation electronic map applications, because ordinary navigation electronic maps have low accuracy requirements, relatively single functions, and do not involve automatic driving functions, so they can solve the problem. Deflection method and protection of coordinate data.

However, if the above-mentioned method is applied to the application scenario of autonomous driving based on high-precision maps, the above-mentioned method will have the following problems:

1. Insufficient security, only static protection of coordinate data and deflection methods can be achieved.

Specifically, in the actual operation process, the existing binding mechanism cannot prevent the data of each module participating in the binding from being intercepted by other malicious programs during the operation, and it lacks a dynamic protection mechanism.

Moreover, due to the numerous functional modules of the vehicle-mounted autopilot system and its operating environment including complete operating system functions, it also provides an environment for the operation of malicious programs. Malicious programs are easier to call through interfaces between modules, memory access, and system components. Vulnerabilities, etc., attack the program during operation, resulting in the leakage of coordinate data or deflection methods.

2. Unable to meet the update requirements of autonomous driving.

Specifically, in the actual application process of automatic driving, due to the various functions of automatic driving, especially the algorithm update is more frequent, and this update usually adopts the over-the-air (OTA) method for online update, if you follow In the existing binding model, each updated module needs to be provided to the supervisory department before each update, which will lead to a long update time for automatic driving and fail to meet the update requirements of automatic driving.

3. The efficiency is low, and the supervision methods of the supervisory authority are weak.

Specifically, the current build is an offline manual method, which means that the developer needs to provide the module to be built offline to the supervisory department, and the supervisory department will compile it in an offline state. After the compilation is completed, it needs to be generated. The binary program modules are provided offline to developers, and there are a large number of developers who provide modules for linking, resulting in low efficiency in the development and application of autonomous driving.

At the same time, after the linking is completed, the supervisory department cannot achieve control, and there is a risk of loss of control, which makes it impossible to effectively protect the coordinate data and the deflection method.

In response to the problems in the prior art, this application proposes the following technical idea: when the program is tampered with, the credibility measurement unit is added to the on-board computing component according to the generated program, so as to realize the comparison of the measurement value and verify the security of the data. sex.

On the basis of the content described above, the data processing system provided by an embodiment of the present application will be described below with reference to FIG. 2. FIG. 2 is a schematic diagram of the data processing system provided by an embodiment of the present application.

As shown in Figure 2, the system includes: a vehicle-mounted computing device, a vehicle-mounted communication device, and a map application cloud platform.

First, the vehicle-mounted computing device is introduced. In this application, the vehicle-mounted computing device can be used to run the high-precision map application unit and the deflection encryption unit as shown in FIG. 2.

In a possible implementation, the vehicle-mounted computing device can run an independent operating system (Operating System, OS), a trusted execution environment (Trusted Execution Environment, TEE), and a high-precision map application unit. In a possible implementation For example, the implementation of the high-precision map application unit can refer to the sensor fusion module, planning control module, high-precision map and positioning module introduced in Figure 1 above, or the high-precision map application unit can also include other processing modules, etc. The embodiment does not specifically limit this.

In the actual implementation process, the vehicle-mounted computing device can obtain coordinate data from the vehicle-mounted sensor and the Global Navigation Satellite System (GNSS). See Figure 2. For example, the high-precision map application unit in the vehicle-mounted computing device can obtain the coordinate data from the vehicle-mounted sensor. The relative position of the map OBJ is obtained, and the deflection encryption unit in the on-board computing device can obtain the WGS84 coordinates from the GNSS.

At the same time, the coordinate data obtained by the vehicle-mounted computing device can be processed by the deflection encryption unit, and the coordinates of the self-vehicle GCJ-02 can be obtained after processing, and then the deflection encryption unit can send the coordinates of the self-vehicle GCJ-02 to the high-precision map application unit for processing.

In this embodiment, the deflection encryption unit and the trusted measurement unit operate in a TEE environment, where the TEE environment can provide protection for the deflection encryption unit and the trusted measurement unit, and the TEE environment can also provide transmission of high-precision map application units. Protection of the channel of coordinate data.

In addition, the vehicle-mounted computing device also includes a hardware security module (Hardware Security Module, HSM), where the HSM can be used to store security parameters, for example.

In this embodiment, before transmitting the coordinates, the deflection encryption unit can call the credibility measurement module to verify the credibility of the high-precision map application unit, and transmit the coordinate data after the verification is passed, thereby effectively ensuring the security of the data. .

Next, the vehicle-mounted communication device in this embodiment will be introduced. The vehicle-mounted communication module in this embodiment is used to establish a network connection between the vehicle-mounted computing device and the server on the map application cloud platform. See Figure 2. The vehicle-mounted communication device includes a communication unit. In a possible implementation manner, the communication unit may use, for example, the C-V2X mechanism, where C-V2X can provide a secure communication mechanism; or, the communication unit may also use any other communication mechanism, which is not in this embodiment. Make special restrictions.

Next, the map application cloud platform in this embodiment will be described. Referring to Figure 2, the map application cloud platform includes a supervisory server and an application server. The supervisory server is used to manage and configure the security parameters in the deflection encryption unit. The security parameters may be, for example, Is the expected metric value; and, the application server is used to process the encrypted self-vehicle high-precision GCJ-02 coordinates uploaded by the deflection encryption unit.

In this embodiment, by setting the credibility measurement unit, the credibility verification process can be realized, thereby realizing the integrity measurement of the high-precision map application unit and the associated operating environment module. The environment module may include, for example, the need to call System services, middleware, software libraries, etc.

And, by running the deflection encryption unit and the trusted measurement unit that need to be protected in the TEE, a secure isolation environment can be established on the vehicle-mounted computing device through the TEE, where the programs in the ordinary operating system operating environment cannot access the isolation environment Resources, thereby preventing the deflection encryption unit and the credibility measurement unit from being damaged by malicious programs in the external system, effectively ensuring the security of the system.

At the same time, by setting up a supervisory server in the cloud, online configuration of the deflection encryption unit can be realized, for example, configuration requests initiated by the deflection encryption unit can be received, and/or online configuration or online update of expected metric values, thereby avoiding the existing binding mode The offline manual method in the Internet has effectively improved the operation efficiency; and the supervision server can be set up in the cloud, and the integrity value of the module submitted online can be reviewed, and the expected measurement value can be generated after the review is passed; and the supervision server can also protect the The state of the deflection encryption unit and related data processing applications are monitored in real time, thereby further improving the security of the system and data.

On the basis of the above-mentioned system, the data protection method provided by this application will be introduced below with reference to FIG. 3. FIG. 3 is a flowchart of the data protection method provided by one of the embodiments of this application.

The method provided in this application is applied to a vehicle-mounted computing device, where the vehicle-mounted computing device includes a deflection encryption unit and a trusted measurement unit, wherein the deflection encryption unit and the trusted measurement unit both operate in a trusted execution environment, and the deflection encryption unit and the trusted measurement unit are both operating in a trusted execution environment. For the specific implementation of the measurement unit, reference may be made to the content introduced in the embodiment in FIG. 2, which will not be repeated here.

As shown in Figure 3, the method includes:

S301. The deflection encryption unit obtains an expected metric value.

In this embodiment, the deflection encryption unit can obtain the expected metric value during the startup phase of the vehicle, for example.

In a possible implementation manner, the expected metric value may be, for example, pre-sent by the supervisory server to the vehicle-mounted computing device, and the deflection encryption unit may directly obtain the expected metric value locally.

Among them, the system or component manufacturer can submit the expected metric value to the management department for review in advance. After the audit is passed, the supervisory server can issue the expected metric value to the deflection encryption unit through the secure channel, so that the deflection encryption unit can obtain the expected value. The metric value, where the expected metric value can be, for example, the integrity value of each unit in the system and the main operating environment (Figure TEE, critical dependency library, etc.).

It is understandable that when the system unit and the operating environment that need to be measured change, the system or component manufacturer can submit the updated value to the management department for review, and the supervision server updates the expected measurement value.

In another possible implementation manner, the expected metric value may be generated by the trusted metric unit executing the trusted metric, and the deflection encryption unit may receive the metric value fed back by the trusted metric unit to obtain the expected metric value. This implementation The example does not limit the implementation of the deflection encryption unit to obtain the expected metric value.

S302. The deflection encryption unit requests to call the trusted measurement unit to execute the first trusted measurement.

In this embodiment, the credibility measurement unit may perform the credibility measurement, where the deflection encryption unit may request, for example, to call the credibility measurement unit to execute the first credibility measurement during the verification phase of the vehicle.

In a possible implementation manner, the deflection encryption unit may call the application programming interface (API), thereby calling the trusted measurement unit to execute the first trusted measurement.

S303. The credibility measurement unit executes the first credibility metric to generate a running metric value.

Wherein, the trusted measurement unit may execute the first trusted measurement in response to the call of the deflection encryption unit, thereby generating the operating measurement value. It is understandable that the expected measurement value and the operating measurement value in this embodiment may be the same or may not same.

In a possible implementation manner, the trusted measurement unit may perform hash calculation through a predefined program module and operating environment, thereby generating an operating measurement value.

Among them, a program module refers to a high-precision map application program used to process sensitive data. It can be a whole program, or it can be composed of multiple programs with relatively independent functions, and there is no order requirement among multiple program modules. .

And, the operating environment refers to the system service components that run the high-precision map application program, such as library files (dynamic link library or static link library), middleware (such as database middleware), virtual machine environment (such as java virtual machine) , And operating system service components, etc., and can be a list of program modules formed in a certain loading order.

For example, there is currently a pre-configured list, and the list includes multiple programs, then the first credibility metric can perform code hash calculation on each program in the list one by one in order according to the pre-configured list. The hash calculation values obtained by the program are H1, H2, H3, H4,..., then the generated hash calculation values can be linked together in order to obtain the hash calculation value after the link: H1||H2||H3 ||H4||....

Then, the hash calculation value after the link can be hashed to obtain the running metric value, where the running metric value may satisfy the following formula one, for example:

M=Hash(H1||H2||H3||H4||...) Formula One

Among them, M is the running metric value, Hash is the hash function, H1||H2||H3||H4||...is the hash calculation value after linking.

Among them, the hash algorithm can adopt, for example, a standard hash algorithm, such as SHA-1/SHA-256 or SM3, which is not limited in this embodiment.

What needs to be explained here is that the method of generating the expected metric value can be the same as the method of generating the running metric value. Therefore, if the program has not been tampered with and the data is not illegally output, the expected metric value and the running metric value should be the same.

In another possible implementation, the first credibility metric can also be implemented in a standard way, such as using the remote certification protocol of the Trusted Computing Group (TCG) standard, or using other lightweight For the integrity measurement framework (Integrity Measurement Architecture, IMA), etc., the specific implementation of the first credibility metric in this embodiment is not particularly limited, as long as the first credibility metric can generate a running metric value.

In this embodiment, the credibility measurement is performed by the credibility measurement unit, that is, the initial measurement value is obtained by performing a hash calculation on the pre-defined program module and the operating environment, which can effectively verify the integrity of the program and the environment, so that the integrity of the program and environment can be effectively verified. Find out whether the program has been tampered with or whether there is an illegal program, so it can prevent the data from being accessed by the illegal program during processing.

S304. The trusted measurement unit feeds back the running measurement value to the deflection encryption unit.

After the trusted measurement unit generates the operating measurement value, it feeds back the operating measurement value to the deflection encryption unit.

S305. The deflection encryption unit verifies the safety of performing data operations in the vehicle by comparing the expected metric value and the operating metric value.

In this embodiment, the expected metric value may be obtained during the vehicle startup phase, and the operating metric value may be generated during the vehicle verification phase. It is understandable that after the vehicle is started, if the program runs normally and there is If illegal output of data occurs, the running metric value and the expected metric value are the same; however, if the program is tampered with or the data is illegally output, the running metric will change accordingly, and the deflection encryption unit can pass Compare the expected metric value and the operational metric value to verify the safety of performing data operations in the car.

In a possible implementation, the deflection encryption unit determines that the expected metric value and the running metric value are equal, the deflection encryption unit can determine that there is no program tampering or illegal output of the data, and then the security of the current data and the program can be determined. Thus, the deflection encryption unit can perform data operations.

The data operation performed by the deflection encryption unit may be, for example, deflection processing of sensitive data such as coordinates, encryption processing of sensitive data such as coordinates, and/or sending the processed result to the high-precision map application unit.

In another possible implementation manner, if the deflection encryption unit determines that the expected metric value and the operating metric value are not equal, the deflection encryption unit can determine that the data and/or the program is not secure, and the deflection encryption unit can turn off the above data operation function, Or perform alarm processing, which can effectively ensure the safety of data processing.

The data protection method provided by the embodiment of the present application includes: deflecting an encryption unit to obtain an expected metric value. The deflection encryption unit requests to call the trusted measurement unit to execute the first trusted measurement. The credibility measurement unit executes the first credibility metric and generates a running metric value. The trusted measurement unit feeds back the running measurement value to the deflection encryption unit. The deflection encryption unit verifies the security of data operations performed in the car by comparing the expected metric value and the operating metric value. The deflection encryption unit compares the acquired expected metric value with the operating metric value generated by the trusted measurement unit, thereby effectively verifying the security of data operations performed in the vehicle, thereby effectively ensuring the security of vehicle data.

On the basis of the above-mentioned embodiment, in a possible implementation, the deflection encryption unit can obtain the expected metric value through the trusted measurement unit; or the deflection encryption unit can also obtain the expected metric value locally. The specific implementation is as follows The example further introduces the data protection method provided by the present application in detail, and is described with reference to FIG. 4, which is a flowchart of the data protection method provided by another embodiment of the application.

As shown in Figure 4, the method includes:

S401. The deflection encryption unit judges whether there is a pre-made expected metric value locally, if yes, execute S402, if not, execute S403.

In this embodiment, when there is a preset expected metric value locally, the deflection encryption unit can obtain the expected metric value locally, and when the preset expected metric value does not exist locally, the deflection encryption unit can request to call the trusted metric unit to generate Measure value to obtain local metric value.

Then the deflection encryption unit judges whether there is a prefabricated expected metric value locally. In a possible implementation, the deflection encryption unit can, for example, query whether there is a prefabricated expected metric value locally in the local hardware security module (HSM); or deflection The encryption unit can also inquire whether there is an expected metric value in the local non-volatile storage; or the deflection encryption unit can also determine whether there is a pre-made expected metric value locally based on the status flag.

S402. The deflection encryption unit obtains a local prefabricated expected metric value.

In a possible situation, the deflection encryption unit determines that there is a prefabricated expected metric value locally, then the deflection encryption unit can directly obtain the local prefabricated expected metric value.

S403. The deflection encryption unit requests to call the trusted measurement unit to execute the second trusted measurement.

S404: The trusted measurement unit executes the second trusted measurement to generate an initial measurement value.

S405. The trusted measurement unit feeds back the initial measurement value to the deflection encryption unit.

S403 ~ S405 are introduced together below:

In another possible situation, if the deflection encryption unit determines that there is no pre-made expected metric value locally, the deflection encryption unit can call the trusted metric unit to generate the expected metric value.

Among them, the deflection encryption unit can request to call the trusted measurement unit to execute the second trusted measurement, thereby generating the initial measurement value. In a possible implementation, the trusted measurement unit can execute the program module and operating environment in advance. Hash calculation to generate initial metric value.

Among them, the implementation of the second credibility metric is similar to the implementation of the first credibility metric introduced in step S303. The difference lies in the pre-defined program modules and operating environment, that is, the input data for executing the credibility metric. The difference is that the specific implementation of the second credibility metric is not described in detail in this embodiment.

S406. The deflection encryption unit obtains an initial metric value.

In this embodiment, the deflection encryption unit can obtain the preset metric value by obtaining the initial metric value, that is, determine the initial metric value as the preset metric value.

Based on the above introduction, it can be determined that in this embodiment, the deflection encryption unit can directly obtain the expected metric value locally when determining that there is a pre-made expected metric value locally; when determining the expected metric value without a local threshold, it can directly obtain the expected metric value. By obtaining the initial measurement value generated by the trusted measurement unit, the expected measurement value is generated and obtained.

In this embodiment, when it is determined that there is no expected metric value locally, the deflection encryption unit calls the trusted metric unit to generate the initial metric value, which can effectively improve the flexibility of obtaining the expected metric value.

S407. The deflection encryption unit requests to call the trusted measurement unit to execute the first trusted measurement.

S408. The trustworthy measurement unit executes the first trustworthy metric to generate a running metric value.

S409. The trusted measurement unit feeds back the running measurement value to the deflection encryption unit.

Among them, the implementation manners of S407-S409 are similar to the implementation manners of S302-S304, and will not be repeated here.

S410. The deflection encryption unit judges whether the expected metric value and the running metric value are equal, if yes, execute S411, if not, execute S412.

In this embodiment, the expected metric value may be obtained locally. It can be understood that the expected metric value obtained locally is sent to the deflection encryption unit in advance by the supervisory server, and the expected metric value sent by the server is the system or component. It is obtained by the manufacturer in advance by performing a hash calculation on a pre-defined program module and operating environment.

Alternatively, the expected metric value may also be obtained by the trustworthiness measurement unit executing the second trustworthiness metric, and the second trustworthiness metric is also obtained by performing hash calculation on a predefined program module and operating environment.

And the running metric value in this embodiment is obtained by the credibility measurement unit executing the first credibility metric, and the first credibility metric is also obtained by performing hash calculation on a predefined program module and operating environment.

Based on the above introduction, it can be determined that if the predefined program module and operating environment have not changed, the expected measurement value and the operating measurement value should be equal; on the contrary, if the predefined program module and operating environment have changed, then It is expected that the metric value and the operational metric value will not be equal.

S411. The deflection encryption unit performs data operations.

In a possible implementation, the deflection encryption unit determines that the expected metric value and the operating metric value are equal, then it can be determined that the predefined program module and operating environment have not changed, and the security of the current data and program can be determined, thereby deflection The encryption unit can perform data operations.

S412: The deflection encryption unit closes the data operation function, or generates an alarm.

The data protection method provided by the embodiment of the present application includes: a deflection encryption unit judging whether there is a prefabricated expected metric value locally, and if so, the deflection encryption unit obtains the local prefabricated expected metric value. If not, the deflection encryption unit requests to call the trusted measurement unit to execute the second trusted measurement. The credibility measurement unit executes the second credibility metric to generate an initial metric value. The trusted measurement unit feeds back the initial measurement value to the deflection encryption unit. The deflection encryption unit obtains the initial metric value. The deflection encryption unit requests to call the trusted measurement unit to execute the first trusted measurement. The credibility measurement unit executes the first credibility metric and generates a running metric value. The trusted measurement unit feeds back the running measurement value to the deflection encryption unit. The deflection encryption unit judges whether the expected metric value and the running metric value are equal, and if so, the deflection encryption unit executes the data operation. If not, the deflection encryption unit closes the data operation function, or alarms. By judging whether the expected measurement value is equal to the operating measurement value generated by the trusted measurement unit, the data security can be verified, and sensitive data such as coordinates can be effectively protected from unauthorized access in a simple and efficient manner, and the data in the vehicle can be enhanced. At the same time, the method provided in this embodiment avoids the overall binding of processing units, so that the management and control of each processing unit can be realized in an online manner in a simple and efficient manner.

On the basis of the foregoing embodiment, when the deflection encryption unit determines the expected metric value that is not pre-made locally, in another possible implementation manner, it can also request the server to obtain the expected metric value, and the following is to request the server to obtain the expected metric value The implementation of the metric value is explained. It is introduced in conjunction with FIG. 5, which is a flowchart of a data protection method provided by another embodiment of the application.

As shown in Figure 5, the method includes:

S501. The deflection encryption unit judges whether there is a prefabricated expected metric value locally, if yes, execute S502, if not, execute S503.

S502. The deflection encryption unit obtains a local prefabricated expected metric value.

Among them, the implementation manners of S501 and S502 are the same as the implementation manners of S401 and S402, and will not be repeated here.

S503. The deflection encryption unit performs mutual authentication with the supervision server and establishes a secure channel.

S504. The deflection encryption unit requests the server to obtain the expected metric value.

S505: The deflection encryption unit receives the expected metric value returned by the server.

S503 ~ S505 are described together below:

In this embodiment, if the deflection encryption unit determines that there is no local pre-prepared expected metric value, it can request the server to obtain the expected metric value. First, the deflection encryption unit performs mutual authentication with the supervisory server and establishes a secure channel, thereby ensuring subsequent data transmission Security.

Then the deflection encryption unit requests the supervisory server to obtain the expected metric value, the supervisory server can return the expected metric value to the deflection encryption unit through the secure channel, and the deflection encryption unit receives the expected metric value returned by the supervisory server to obtain the expected metric value.

S506. The deflection encryption unit requests to call the trusted measurement unit to execute the first trusted measurement.

S507: The trustworthy measurement unit executes the first trustworthy metric to generate a running metric value.

S508. The trusted measurement unit feeds back the running measurement value to the deflection encryption unit.

Among them, the implementation manners of S506 to S508 are similar to the implementation manners of S302 to S304, and will not be repeated here.

S509. The deflection encryption unit judges whether the expected metric value and the running metric value are equal, if yes, execute S510, and if not, execute S511.

S510. The deflection encryption unit performs data operations.

S511. The deflection encryption unit closes the data operation function, or generates an alarm.

Among them, the implementation manners of S509-S511 are similar to the implementation manners of S410-S412, and will not be repeated here.

In the data protection method provided by the embodiments of the present application, when the deflection encryption unit determines that there is no pre-made expected metric value locally, a secure channel can be established with the server, thereby obtaining the expected metric value from the server in an online manner, so as not to reduce In the case of security, there is no need to perform the credibility measurement process during the startup phase, which reduces the computational overhead.

At the same time, in this embodiment, the expected metric value is obtained online from the server, so there is no need to permanently store the expected metric value locally, which reduces the local storage overhead and can effectively increase the applicable scenarios, such as when the vehicle cannot pre-predetermine the expected metric value. In this case, the method of obtaining from the server can be effectively flexible.

On the basis of the above-mentioned embodiments, in order to prevent static attack scenarios such as illegal flashing or tampering of the system before the vehicle is started, the verification process of the initial metric value at start-up can be added. Whether there is an expected measurement value, the trusted measurement unit must be called to perform the trusted measurement. At the same time, if there is no expected measurement value locally, the expected measurement value needs to be obtained online from the server, and the initial measurement value and the expected measurement value are compared. If they are consistent, In order to continue the subsequent process. This implementation manner will be described in detail below, and will be described with reference to FIG. 6, which is a flowchart of a data protection method provided by still another embodiment of this application.

As shown in Figure 6, the method includes:

S601. The deflection encryption unit judges whether there is a pre-made expected metric value locally, if yes, execute S602, if not, execute S603.

S602. The deflection encryption unit obtains a local prefabricated expected metric value.

Among them, the implementation manners of S601 and S602 are the same as the implementation manners of S401 and S402, and will not be repeated here.

S603. The deflection encryption unit performs mutual authentication with the supervision server and establishes a secure channel.

S604. The deflection encryption unit requests the server to obtain the expected metric value.

S605. The deflection encryption unit receives the expected metric value returned by the server.

Among them, the implementation manners of S603-S605 are the same as the implementation manners of S503-S505, and will not be repeated here.

S606. The deflection encryption unit requests to call the trustworthiness measurement module to execute the third trustworthiness measurement.

S607: The trusted measurement unit executes a third trusted measurement to generate an initial measurement value.

In this embodiment, after the deflection encryption unit obtains the expected metric value, in order to prevent the expected metric value from being tampered with during the vehicle startup phase, the trusted metric unit can be requested to execute the third trusted metric, thereby generating the initial metric value, and The trust measurement unit can also feed back the initial measurement value to the encryption unit.

In a possible implementation manner, the trusted measurement unit may generate an initial measurement value by performing hash calculation on a pre-defined program module and operating environment.

Among them, the implementation of the third credibility metric is similar to the implementation of the first credibility metric introduced in step S303. The difference lies in the pre-defined program modules and operating environment, that is, the input data for executing the credibility metric. The difference is that the specific implementation of the third credibility metric is not described in detail in this embodiment.

S608. The deflection encryption unit judges whether the expected metric value is equal to the initial metric value, if not, execute S609, and if yes, execute S610.

Then, the deflection encryption unit judges whether the expected metric value and the initial metric value are equal. It can be understood that when the vehicle is not started, there may be system software updates or illegal refreshes. Therefore, when the vehicle is started, the expected metric value and the initial metric value are passed. The comparison of metric values can verify whether the system has changed since the last audit passed, which can effectively improve security.

S609. The deflection encryption unit closes the data operation function, or generates an alarm.

In a possible implementation manner, if the deflection encryption unit determines that the expected metric value and the initial metric value are not equal, the deflection encryption unit can turn off the data operation function or perform guarantees, thereby ensuring the security of the vehicle data.

S610. The deflection encryption unit requests to call the trusted measurement unit to execute the first trusted measurement.

S611. The trustworthy measurement unit executes the first trustworthy metric, and generates a running metric value.

S612. The trusted measurement unit feeds back the running measurement value to the deflection encryption unit.

In another possible implementation manner, the deflection encryption unit determines that the expected metric value is equal to the initial metric value, and then subsequent operations can be performed.

Among them, the implementation manners of S610 to S612 are similar to the implementation manners of S302 to S304, and will not be repeated here.

S613. The deflection encryption unit judges whether the expected metric value and the running metric value are equal, if yes, execute S614, and if not, execute S615.

S614. The deflection encryption unit performs data operations.

S615. The deflection encryption unit closes the data operation function, or alarms.

Among them, the implementation manners of S613-S614 are similar to the implementation manners of S410-S412, and will not be repeated here.

The data protection method provided by the embodiments of the present application compares the expected metric value and the initial metric value during the startup phase, and performs subsequent processing only when it is determined that the expected metric value is consistent with the initial metric value, thereby effectively improving data security , To prevent the expected metric value from being updated or tampered when the system is offline, and, for the supervisory authority, it can verify whether the target object has changed when the vehicle is started, and the result of the verification can be sent back to the supervisory service in real time Therefore, it provides a mechanism for the regulator to realize real-time supervision, which can help the supervisory department to carry out real-time monitoring.

FIG. 7 is a schematic structural diagram of a vehicle-mounted computing device provided by an embodiment of the application. As shown in FIG. 7, the device 70 can be used to execute the data protection method described in any one of FIGS. 3-6. The device 70 includes: a deflection encryption unit 701 and a credibility measurement unit 702, the deflection encryption unit 701 and a credibility The measurement unit 702 runs in a trusted execution environment;

Wherein, the deflection encryption unit 701 is configured to obtain an expected metric value, and request to call the credibility measurement unit 702 to execute the first credibility metric;

The credibility measurement unit 702 is configured to execute the first credibility metric, generate a running metric value, and feed back the running metric value to the deflection encryption unit 701;

The deflection encryption unit 701 is also used to verify the security of performing data operations in the vehicle by comparing the expected metric value and the operating metric value.

In a possible implementation manner, the deflection encryption unit 701 is further configured to determine the expected metric value that is not pre-made locally before obtaining the expected metric value, and request to call the trusted metric module to execute the second trusted metric value. measure;

The credibility measurement unit 702 is further configured to execute the second credibility metric to generate an initial metric value;

The obtaining of the expected metric value by the deflection encryption unit 701 includes: the deflection encryption unit 701 obtaining the initial metric value.

In a possible implementation manner, the credibility measurement unit 702 executes the second credibility metric, and generating an initial metric value includes:

The trusted measurement unit 702 generates the initial measurement value by performing hash calculation on a predefined program module and operating environment.

In a possible implementation manner, the deflection encryption unit 701 is further configured to determine the expected metric value that is not prefabricated locally before obtaining the expected metric value, and request the server to obtain the expected metric value;

The obtaining of the expected metric value by the deflection encryption unit 701 includes: the deflection encryption unit 701 receives the expected metric value returned by the server.

In a possible implementation manner, the deflection encryption unit 701 is further configured to determine that the expected metric value is prefabricated locally before obtaining the expected metric value;

The deflection encryption unit 701 obtaining the expected metric value includes: the deflection encryption unit 701 obtains the local pre-made expected metric value.

In a possible implementation manner, the deflection encryption unit 701 is further configured to request to call the credibility metric module to execute the third credibility metric after obtaining the expected metric value;

The credibility measurement unit 702 is further configured to execute the third credibility metric to generate an initial metric value;

The deflection encryption unit 701 is further configured to determine that the expected metric value is not equal to the initial metric value, and then turn off the data operation function, or issue an alarm.

In a possible implementation manner, the deflection encryption unit 701 is further configured to compare the expected metric value and the operating metric value to verify the security of performing data operations in the vehicle, including:

The deflection encryption unit 701 is further configured to determine that the expected metric value is equal to the operating metric value, and execute the data operation.

The deflection encryption unit 701 is also used to determine that the expected metric value is not equal to the operating metric value, and to close the data operation function, or to give an alarm.

In a possible implementation manner, the credibility measurement unit 702 is configured to execute the first credibility metric, and generating a running metric value includes:

The trusted measurement unit 702 is configured to generate the operating measurement value by performing hash calculation on a predefined program module and operating environment.

The device provided in this embodiment can be used to implement the technical solutions of the foregoing method embodiments, and its implementation principles and technical effects are similar, and will not be repeated here in this embodiment.

Only one or more of the various modules in FIG. 7 can be implemented by software, hardware, firmware or a combination thereof. The software or firmware includes but is not limited to computer program instructions or codes, and can be executed by a hardware processor. The hardware includes, but is not limited to, various types of integrated circuits, such as a central processing unit (CPU), a digital signal processor (DSP), a field programmable gate array (FPGA), or an application specific integrated circuit (ASIC).

FIG. 8 is a schematic diagram of the hardware structure of a vehicle-mounted computing device provided by an embodiment of the application. As shown in FIG. 8, the vehicle-mounted computing device 80 can be used to execute the data protection method described in any one of FIGS. 3-6. The vehicle-mounted computing device 80 includes ：Processor 801 and memory 802; among them

The memory 802 is used to store computer execution instructions;

The processor 801 is configured to execute computer-executable instructions stored in the memory to implement each step performed by the data protection method in the foregoing embodiment. For details, please refer to the relevant description in the foregoing method embodiment.

Optionally, the memory 802 may be independent or integrated with the processor 801.

When the memory 802 is independently provided, the vehicle-mounted computing device further includes a bus 803 for connecting the memory 802 and the processor 801.

Optionally, the foregoing processor may be a central processing unit (Central Processing Unit, CPU), or other general-purpose processors, digital signal processors (Digital Signal Processor, DSP), and application specific integrated circuits (ASICs). )Wait. The general-purpose processor may be a microprocessor or the processor may also be any conventional processor or the like. The steps in the embodiment of the service processing method disclosed in the embodiment of the present application may be directly embodied as being executed and completed by a hardware processor, or executed and completed by a combination of hardware and software modules in the processor.

An embodiment of the present application also provides a computer storage medium, including computer instructions, when the computer instructions are executed by a processor, implement the data protection method performed by the on-vehicle computing device.

The embodiments of the present application provide a computer program product, which when the computer program product runs on a processor, realizes the data protection method executed by the on-board computing device.

An embodiment of the present application also provides a smart car, including an in-vehicle communication device and the in-vehicle computing device described in the above embodiment.

All or part of the steps in the foregoing method embodiments may be implemented by a program instructing relevant hardware. The aforementioned program can be stored in a readable memory. When the program is executed, it executes the steps that include the foregoing method embodiments; and the foregoing memory (storage medium) includes: read-only memory (English: read-only memory, abbreviation: ROM), RAM, flash memory, hard disk, Solid state hard disk, magnetic tape (English: magnetic tape), floppy disk (English: floppy disk), optical disc (English: optical disc) and any combination thereof.

The embodiments of the present application are described with reference to the flowcharts and/or block diagrams of the methods, equipment (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and/or block in the flowchart and/or block diagram, and the combination of processes and/or blocks in the flowchart and/or block diagram can be realized by computer program instructions. These computer program instructions can be provided to the processing unit of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing equipment to generate a machine, so that the instructions executed by the processing unit of the computer or other programmable data processing equipment can be used to generate It is a device that realizes the functions specified in one process or multiple processes in the flowchart and/or one block or multiple blocks in the block diagram.

These computer program instructions can also be stored in a computer-readable memory that can guide a computer or other programmable data processing equipment to work in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture including the instruction device. The device implements the functions specified in one process or multiple processes in the flowchart and/or one block or multiple blocks in the block diagram.

These computer program instructions can also be loaded on a computer or other programmable data processing equipment, so that a series of operation steps are executed on the computer or other programmable equipment to produce computer-implemented processing, so as to execute on the computer or other programmable equipment. The instructions provide steps for implementing the functions specified in one process or multiple processes in the flowchart and/or one block or multiple blocks in the block diagram.

Obviously, those skilled in the art can make various changes and modifications to the embodiments of the present application without departing from the spirit and scope of the embodiments of the present application. In this way, if these modifications and variations of the embodiments of the present application fall within the scope of the claims of the embodiments of the present application and their equivalent technologies, the embodiments of the present application are also intended to include these changes and modifications.

In the embodiments of the present application, the term "including" and its variations may refer to non-limiting inclusion; the term "or" and its variations may refer to "and/or". The terms "first", "second", etc. in the embodiments of the present application are used to distinguish similar objects, and are not necessarily used to describe a specific sequence or sequence. In the embodiments of the present application, "multiple" refers to two or more. "And/or" describes the association relationship of the associated objects, indicating that there can be three types of relationships, for example, A and/or B, which can mean: A alone exists, A and B exist at the same time, and B exists alone. The character "/" generally indicates that the associated objects before and after are in an "or" relationship.

The above are only specific implementations of this application, but the protection scope of this application is not limited to this. Any person skilled in the art can easily think of changes or substitutions within the technical scope disclosed in this application. Should be covered within the scope of protection of this application. Therefore, the protection scope of this application shall be subject to the protection scope of the claims.

Claims

A data protection method, characterized by being applied to a vehicle-mounted computing device, wherein the vehicle-mounted computing device includes a deflection encryption unit and a trusted measurement unit, and the deflection encryption unit and the trusted measurement unit operate in a trusted execution environment, The method includes:

The deflection encryption unit obtains the expected metric value;

The deflection encryption unit requests to call the credibility measurement unit to execute the first credibility measurement;

The credibility measurement unit executes the first credibility metric to generate a running metric value;

The trustworthy measurement unit feeds back the operation measurement value to the deflection encryption unit;

The deflection encryption unit verifies the security of data operations performed in the vehicle by comparing the expected metric value and the operating metric value.
The method according to claim 1, wherein before the deflection encryption unit obtains the expected metric value, the method further comprises:

Determining, by the deflection encryption unit, the expected metric value with no local prefabrication;

The deflection encryption unit requests to call the trustworthiness measurement unit to execute the second trustworthiness measurement;

The credibility measurement unit executes the second credibility metric to generate an initial metric value;

The obtaining of the expected metric value by the deflection encryption unit includes: the deflection encryption unit obtaining the initial metric value.
The method according to claim 2, wherein the trustworthiness measurement unit executes the second trustworthiness metric, and generating an initial metric value comprises:

The trusted measurement unit generates the initial measurement value by performing hash calculation on a predefined program module and operating environment.
The method according to claim 1, wherein before the deflection encryption unit obtains the expected metric value, the method further comprises:

Determining, by the deflection encryption unit, the expected metric value with no local prefabrication;

The deflection encryption unit requests the server to obtain the expected metric value;

The obtaining of the expected metric value by the deflection encryption unit includes: the deflection encryption unit receiving the expected metric value returned by the server.
The method according to claim 1, wherein before the deflection encryption unit obtains the expected metric value, the method further comprises:

The deflection encryption unit determines that the expected metric value prefabricated locally;

Obtaining the expected metric value by the deflection encryption unit includes: the deflection encryption unit obtaining the locally pre-made expected metric value.
The method according to claim 4 or 5, wherein after the deflection encryption unit obtains the expected metric value, the method further comprises:

The deflection encryption unit requests to call the credibility measurement unit to execute the third credibility measurement;

The credibility measurement unit executes the third credibility metric to generate an initial metric value;

Determining, by the deflection encryption unit, that the expected metric value is not equal to the initial metric value;

The deflection encryption unit turns off the data operation function or alarms.
The method according to any one of claims 1 to 6, wherein the deflection encryption unit compares the expected metric value and the operating metric value to verify the safety of performing data operations in the vehicle comprises:

The deflection encryption unit determines that the expected metric value is equal to the operating metric value;

The deflection encryption unit performs the data operation.
The method according to any one of claims 1 to 6, wherein the deflection encryption unit compares the expected metric value and the operating metric value to verify the security of performing data operations in the vehicle comprises:

Determining, by the deflection encryption unit, that the expected metric value is not equal to the operating metric value;

The deflection encryption unit turns off the data operation function or alarms.
The method according to any one of claims 1-8, wherein the execution of the first credibility metric by the credibility measurement unit to generate a running metric value comprises:

The trusted measurement unit generates the operating measurement value by performing hash calculation on a predefined program module and operating environment.
A vehicle-mounted computing device, characterized by comprising a deflection encryption unit and a trusted measurement unit, the deflection encryption unit and the trusted measurement unit operating in a trusted execution environment;

The deflection encryption unit is used to obtain an expected metric value, and request to call the credibility metric unit to execute the first credibility metric;

The credibility measurement unit is configured to execute the first credibility metric, generate an operating metric value, and feed back the operating metric value to the deflection encryption unit;

The deflection encryption unit is also used to verify the safety of data operations performed in the vehicle by comparing the expected metric value and the operating metric value.
The device according to claim 10, wherein:

The deflection encryption unit is further configured to determine the expected metric value that is not prefabricated locally before obtaining the expected metric value, and request to call the trusted metric module to execute the second trusted metric;

The credibility measurement unit is further configured to execute the second credibility metric to generate an initial metric value;

The obtaining of the expected metric value by the deflection encryption unit includes: the deflection encryption unit obtaining the initial metric value.
The apparatus according to claim 11, wherein the trustworthiness measurement unit executes the second trustworthiness metric, and generating an initial metric value comprises:

The trusted measurement unit generates the initial measurement value by performing hash calculation on a predefined program module and operating environment.
The device according to claim 10, wherein:

The deflection encryption unit is further configured to determine the expected metric value that is not prefabricated locally before obtaining the expected metric value, and request the server to obtain the expected metric value;

The obtaining of the expected metric value by the deflection encryption unit includes: the deflection encryption unit receiving the expected metric value returned by the server.
The device according to claim 10, wherein:

The deflection encryption unit is further configured to determine that there is a pre-made expected metric value locally before obtaining the expected metric value;

Obtaining the expected metric value by the deflection encryption unit includes: the deflection encryption unit obtaining the locally pre-made expected metric value.
The device according to claim 13 or 14, characterized in that:

The deflection encryption unit is further configured to request to call the credibility metric module to execute the third credibility metric after obtaining the expected metric value;

The credibility measurement unit is further configured to execute the third credibility metric to generate an initial metric value;

The deflection encryption unit is also used to determine that the expected metric value is not equal to the initial metric value, and then close the data operation function or give an alarm.
The device according to any one of claims 10-15, wherein the deflection encryption unit is further configured to verify the safety of performing data operations in the vehicle by comparing the expected metric value and the operating metric value include:

The deflection encryption unit is also used to determine that the expected metric value is equal to the operating metric value, and to execute the data operation.
The device according to any one of claims 10-15, wherein the deflection encryption unit is further configured to verify the safety of performing data operations in the vehicle by comparing the expected metric value and the operating metric value include:

The deflection encryption unit is also used to determine that the expected metric value is not equal to the operating metric value, and to close the data operation function, or to give an alarm.
The apparatus according to any one of claims 10-17, wherein the credibility measurement unit is configured to execute the first credibility metric, and generating a running metric value comprises:

The trusted measurement unit is used to generate the operating measurement value by performing hash calculation on a predefined program module and operating environment.
A vehicle-mounted computing device, characterized by comprising a memory and a processor, the memory storing computer program instructions, and the processor running the computer program instructions to perform the operation of any one of claims 1-9.
A computer storage medium, which is characterized by comprising computer instructions, which implement the method according to any one of claims 1-9 when the computer instructions are executed by a processor.
A computer program product, characterized in that, when the computer program product runs on a processor, the method according to any one of claims 1-9 is implemented.
A data processing system, characterized by comprising a server and the vehicle-mounted computing device according to any one of claims 10-19.
A smart car, comprising a vehicle-mounted communication device and the vehicle-mounted computing device according to any one of claims 10-19.