WO2015096714A1 - 车载终端认证的方法及认证服务器 - Google Patents

车载终端认证的方法及认证服务器 Download PDF

Info

Publication number
WO2015096714A1
WO2015096714A1 PCT/CN2014/094731 CN2014094731W WO2015096714A1 WO 2015096714 A1 WO2015096714 A1 WO 2015096714A1 CN 2014094731 W CN2014094731 W CN 2014094731W WO 2015096714 A1 WO2015096714 A1 WO 2015096714A1
Authority
WO
WIPO (PCT)
Prior art keywords
authentication
vehicle terminal
server
access
token
Prior art date
Application number
PCT/CN2014/094731
Other languages
English (en)
French (fr)
Inventor
胡琨
Original Assignee
胡琨
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 胡琨 filed Critical 胡琨
Publication of WO2015096714A1 publication Critical patent/WO2015096714A1/zh

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0807—Network architectures or network communication protocols for network security for authentication of entities using tickets, e.g. Kerberos
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/12—Protocols specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks

Definitions

  • the present invention relates to the field of in-vehicle terminal authentication technologies, and in particular, to a method and an authentication server for in-vehicle terminal authentication.
  • the access authentication of the smart vehicle terminal to the background is usually performed in a server that needs to be accessed. After the server passes the authentication of the smart vehicle terminal, the smart vehicle terminal can directly access the server. When you do not need to access, you can quit the server and re-authenticate it the next time you visit. In this way, when the number of users increases and the number of concurrent requests increases, the concurrent processing and stability of the server may cause problems.
  • the main object of the present invention is to provide a method for in-vehicle terminal authentication, which improves the concurrent processing capability and stability of the server.
  • the invention provides a method for vehicle terminal authentication, comprising:
  • the authentication server receives the authentication request of the in-vehicle terminal, and determines whether the authentication is passed;
  • the token When passing the authentication, the token is transmitted to the in-vehicle terminal, so that the in-vehicle terminal obtains the authority to access the information collecting server, and notifies the information collecting server to allow access by the in-vehicle terminal.
  • the method further comprises:
  • the authentication server encrypts the access information of the in-vehicle terminal using a preset key and transmits it to the central server.
  • the authentication server caches the authentication data and retains a certain time when authenticating the in-vehicle terminal; the authentication data includes at least the token.
  • the in-vehicle terminal caches the token and keeps for a certain time.
  • the invention also provides an authentication server for vehicle terminal authentication, comprising:
  • the authentication judging module is configured to receive an authentication request of the in-vehicle terminal, and determine whether the authentication is passed;
  • the authentication processing module is configured to send a token to the in-vehicle terminal when the authentication is passed, so that the in-vehicle terminal obtains the right to access the information collection server, and notifies the information collection server to allow the in-vehicle terminal to access.
  • the authentication server further includes:
  • the information transmission module is configured to encrypt the access information of the vehicle terminal by using the preset key and transmit the information to the central server.
  • the authentication server caches the authentication data and retains a certain time when authenticating the in-vehicle terminal; the authentication data includes at least the token.
  • the in-vehicle terminal caches the token and keeps for a certain time.
  • the invention can separately perform authentication and access, and at the same time, the two-layer cache mechanism of the middle layer and the bottom layer can greatly facilitate the access of the vehicle-mounted terminal to the information collection server, thereby saving A large amount of network resources, which facilitates concurrent access by a large number of users.
  • FIG. 1 is a schematic flow chart of steps in an embodiment of a method for authenticating an in-vehicle terminal according to the present invention
  • FIG. 2 is a schematic diagram of a three-layer structure in an embodiment of the present invention.
  • FIG. 3 is a schematic flow chart of steps in another embodiment of a method for authenticating an in-vehicle terminal according to the present invention.
  • FIG. 4 is a schematic structural diagram of an embodiment of an authentication server for authenticating an in-vehicle terminal according to the present invention
  • FIG. 5 is a schematic structural diagram of another embodiment of an authentication server for authentication of an in-vehicle terminal of the present invention.
  • the method can include:
  • Step S11 The authentication server receives the authentication request of the in-vehicle terminal, and determines whether the authentication is passed.
  • Step S12 When the authentication is passed, the token is sent to the in-vehicle terminal, so that the in-vehicle terminal obtains the authority to access the information collecting server, and notifies the information collecting server to allow the in-vehicle terminal to access.
  • the method for authenticating the vehicle-mounted terminal can be applied to a data processing system of a three-layer structure.
  • the data processing system of the three-layer structure may include at least a central server 21, a plurality of authentication servers 22, a plurality of information collection servers 23, and an in-vehicle terminal 24.
  • the central server 21 can be an upper layer, and the plurality of authentication servers 22 and the plurality of information collecting servers 23 can be an intermediate layer, and the in-vehicle terminal 24 can be an underlying layer.
  • the upper layer central server 21 can be the center of the entire distributed system, and the overall data processing, service management, resource allocation, and the like in the system.
  • the intermediate layer is connected to the in-vehicle terminal 24 of the bottom layer, and provides services such as authentication, access, and information push to the in-vehicle terminal 24, and data collection and the like can be performed on the in-vehicle terminal 24 and fed back to the upper center server 21.
  • the in-vehicle terminal 24 may be an in-vehicle intelligent electronic device, such as an in-vehicle computer or a smart car interior mirror, and has at least a communication function and a data processing function.
  • authentication and access are separated by providing an authentication server 22 and an information collecting server 23, respectively.
  • the authentication request may be first transmitted, and the authentication request of the in-vehicle terminal 24 is authenticated by the authentication server 22.
  • the authentication request includes at least identity information of the in-vehicle terminal 24, such as an ID number assigned by the system.
  • the authentication server 22 can verify the in-vehicle terminal 24 according to the information stored by itself or the information acquired by the central server 21, and can terminate the access of the in-vehicle terminal 24 if the verification fails; if the verification is passed, the accessed token can be sent to the
  • the in-vehicle terminal 24 notifies the above-described information collecting server 23 of the access of the in-vehicle terminal 24. Thereby, the in-vehicle terminal 24 can smoothly access the information collecting server 23 through the token.
  • the authentication data is cached and retained for a certain period of time (which may be set according to actual conditions, such as 12 hours or one day, etc.); the authentication data may include at least the token.
  • the token can also be cached and retained for a certain period of time.
  • the token can be set to be valid for a certain period of time, and the in-vehicle terminal 24 can access the information collection server 23 within the valid time by the token, and does not need to be authenticated by the authentication server 22 again.
  • the two-layer cache mechanism of the middle layer and the bottom layer can greatly facilitate the access of the in-vehicle terminal 24 to the information collection server 23, thereby saving a large amount of network resources, thereby facilitating concurrent access by a large number of users.
  • the method for authenticating the in-vehicle terminal 24 may further include at least:
  • Step S13 The authentication server 22 encrypts the access information of the in-vehicle terminal 24 using the preset key and transmits it to the center server 21.
  • the access information may include at least data such as identity information, access time, and number of accesses of the in-vehicle terminal 24.
  • the above-mentioned underlying vehicle-mounted terminal 24 and the intermediate layer authentication server 22 and the information collection server 23, the intermediate layer authentication server 22 and the information collection server 23 and the upper-level central server 21 can perform encrypted communication to secure data. Accuracy and system security and stability.
  • the above intermediate layer authenticates the underlying vehicle terminal 24, and can use the password authentication and key exchange system to provide strong mutual authentication between the underlying vehicle terminal 24 and the middle layer server, and can simultaneously resist active attacks and passive attacks from the network.
  • asymmetric authentication algorithms can be mainly used; for devices with high authentication strength (such as government equipment, etc.), asymmetric algorithm authentication similar to RSA is adopted; for flat business models, SRP6 algorithm authentication is adopted, and devices retain corresponding Salt variable (slat).
  • the authentication server 22 of the intermediate layer and the central server 21 of the upper layer can communicate using a preset key pair to enhance the security of communication.
  • the specific encryption protocol used can be determined according to the actual situation.
  • IP Internet
  • the message server 25 may be disposed in the above three-layer structure, and between the vehicle-mounted terminal 24 and the information collection server 23, when the vehicle-mounted terminal 24 needs to acquire a certain message, the message customization request may be sent to the information collection server 23, and the information collection is performed.
  • the server 23 receives the message customization request of the in-vehicle terminal 24, establishes a message customization queue based on the message customization request, and customizes the message to the message server 25 that provides the message required by the in-vehicle terminal 24.
  • the message customization request may include at least basic information of the in-vehicle terminal 24 (such as address information of the terminal, etc.) and content information of the customized message (such as information such as the name, type, quantity, or priority of the message).
  • the information collection server 23 and the in-vehicle terminal 24 may have a one-to-many relationship; the message customization queue in the information collection server 23 and the in-vehicle terminal 24 may have a one-to-one relationship (one-to-one correspondence).
  • the information collecting server 23 receives the customized message of the in-vehicle terminal 24 sent by the message server 25, and stores the customized message in the message customization queue corresponding to the in-vehicle terminal 24.
  • the customized message will remain in the message customization queue until the customized message is successfully sent to the vehicle terminal 24. Thereby, the reliability of the message transmission is solved, and the message loss is not easily caused. Meanwhile, when the vehicle terminal 24 needs to acquire the message, even if the message server 25 fails, the vehicle terminal 24 can still be in the message customization queue of the information collection server 23. Get the message and improve the stability of message acquisition.
  • the above-described information collection server 23 Upon receiving the message acquisition request from the in-vehicle terminal 24, the above-described information collection server 23 transmits a customized message in the message customization queue to the in-vehicle terminal 24.
  • the information collection server 23 may sequentially send a plurality of customized messages to the in-vehicle terminal 24 according to the priority of the customized message.
  • the priority may be the priority of the customized message itself, or may be customized by the in-vehicle terminal 24 at the time of customization.
  • the above-mentioned custom message transmission can be in the form of an IP message. If a data packet is destroyed during transmission, only the data packet needs to be retransmitted instead of the entire message; and it is not necessary to wait for a long time before transmitting the message.
  • the authentication server 22 may include an authentication determination module 221 and an authentication processing module 222.
  • the authentication determination module 221 is configured to receive an authentication request of the in-vehicle terminal 24 to determine whether the authentication is passed.
  • the authentication processing module 222 is configured to pass the authentication.
  • the token is transmitted to the in-vehicle terminal 24, so that the in-vehicle terminal 24 obtains the authority to access the information collecting server 23, and notifies the information collecting server 23 of the access of the in-vehicle terminal 24.
  • the above-mentioned authentication server 22 can be applied to a data processing system of a three-layer structure.
  • the data processing system of the three-layer structure may include at least a central server 21, a plurality of authentication servers 22, a plurality of information collection servers 23, and an in-vehicle terminal 24.
  • the central server 21 can be an upper layer, and the plurality of authentication servers 22 and the plurality of information collecting servers 23 can be an intermediate layer, and the in-vehicle terminal 24 can be an underlying layer.
  • the upper layer central server 21 can be the center of the entire distributed system, and the overall data processing, service management, resource allocation, and the like in the system.
  • the intermediate layer is connected to the in-vehicle terminal 24 of the bottom layer, and provides services such as authentication, access, and information push to the in-vehicle terminal 24, and data collection and the like can be performed on the in-vehicle terminal 24 and fed back to the upper center server 21.
  • the in-vehicle terminal 24 may be an in-vehicle intelligent electronic device, such as an in-vehicle computer or a smart car interior mirror, and has at least a communication function and a data processing function.
  • authentication and access are separated by providing an authentication server 22 and an information collecting server 23, respectively.
  • the authentication request may be first transmitted, and the authentication request of the in-vehicle terminal 24 is authenticated by the authentication server 22.
  • the authentication request includes at least identity information of the in-vehicle terminal 24, such as an ID number assigned by the system.
  • the authentication server 22 can verify the in-vehicle terminal 24 according to the information stored by itself or the information acquired by the central server 21, and can terminate the access of the in-vehicle terminal 24 if the verification fails; if the verification is passed, the accessed token can be sent to the
  • the in-vehicle terminal 24 notifies the above-described information collecting server 23 of the access of the in-vehicle terminal 24. Thereby, the in-vehicle terminal 24 can smoothly access the information collecting server 23 through the token.
  • the authentication data is cached and retained for a certain period of time; the authentication data may include at least the token.
  • the token can also be cached and retained for a certain period of time.
  • the token can be set to be valid for a certain period of time, and the in-vehicle terminal 24 can access the information collection server 23 within the valid time by the token, and does not need to be authenticated by the authentication server 22 again.
  • the two-layer cache mechanism of the middle layer and the bottom layer can greatly facilitate the access of the in-vehicle terminal 24 to the information collection server 23, thereby saving a large amount of network resources, thereby facilitating concurrent access by a large number of users.
  • the authentication server 22 may further include: an information transmission module 223, configured to encrypt the access information of the in-vehicle terminal 24 using a preset key and transmit the information to the central server 21.
  • the access information may include at least data such as identity information, access time, and number of accesses of the in-vehicle terminal 24.
  • the above-mentioned underlying vehicle-mounted terminal 24 and the intermediate layer authentication server 22 and the information collection server 23, the intermediate layer authentication server 22 and the information collection server 23 and the upper-level central server 21 can perform encrypted communication to secure data. Accuracy and system security and stability.
  • the above intermediate layer authenticates the underlying vehicle terminal 24, and can use the password authentication and key exchange system to provide strong mutual authentication between the underlying vehicle terminal 24 and the middle layer server, and can simultaneously resist active attacks and passive attacks from the network.
  • asymmetric authentication algorithms can be mainly used; for devices with high authentication strength (such as government equipment, etc.), asymmetric algorithm authentication similar to RSA is adopted; for flat business models, SRP6 algorithm authentication is adopted, and devices retain corresponding Salt variable (slat).
  • the authentication server 22 of the intermediate layer and the central server 21 of the upper layer can communicate using a preset key pair to enhance the security of communication.
  • the specific encryption protocol used can be determined according to the actual situation.
  • IP Internet
  • the message server 25 may be disposed in the above three-layer structure, and between the vehicle-mounted terminal 24 and the information collection server 23, when the vehicle-mounted terminal 24 needs to acquire a certain message, the message customization request may be sent to the information collection server 23, and the information collection is performed.
  • the server 23 receives the message customization request of the in-vehicle terminal 24, establishes a message customization queue based on the message customization request, and customizes the message to the message server 25 that provides the message required by the in-vehicle terminal 24.
  • the message customization request may include at least basic information of the in-vehicle terminal 24 (such as address information of the terminal, etc.) and content information of the customized message (such as information such as the name, type, quantity, or priority of the message).
  • the information collection server 23 and the in-vehicle terminal 24 may have a one-to-many relationship; the message customization queue in the information collection server 23 and the in-vehicle terminal 24 may have a one-to-one relationship (one-to-one correspondence).
  • the information collecting server 23 receives the customized message of the in-vehicle terminal 24 sent by the message server 25, and stores the customized message in the message customization queue corresponding to the in-vehicle terminal 24.
  • the customized message will remain in the message customization queue until the customized message is successfully sent to the vehicle terminal 24. Thereby, the reliability of the message transmission is solved, and the message loss is not easily caused. Meanwhile, when the vehicle terminal 24 needs to acquire the message, even if the message server 25 fails, the vehicle terminal 24 can still be in the message customization queue of the information collection server 23. Get the message and improve the stability of message acquisition.
  • the above-described information collection server 23 Upon receiving the message acquisition request from the in-vehicle terminal 24, the above-described information collection server 23 transmits a customized message in the message customization queue to the in-vehicle terminal 24.
  • the information collection server 23 may sequentially send a plurality of customized messages to the in-vehicle terminal 24 according to the priority of the customized message.
  • the priority may be the priority of the customized message itself, or may be customized by the in-vehicle terminal 24 at the time of customization.
  • the above-mentioned custom message transmission can be in the form of an IP message. If a data packet is destroyed during transmission, only the data packet needs to be retransmitted instead of the entire message; and it is not necessary to wait for a long time before transmitting the message.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • Computer Security & Cryptography (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本发明揭示了一种车载终端认证的方法及认证服务器。该方法可包括：认证服务器接收车载终端的认证请求，判断是否通过认证；在通过认证时，向车载终端发送令牌，使车载终端获得访问信息采集服务器的权限，并通知所述信息采集服务器允许所述车载终端的访问。本发明可给车载终端对信息采集服务器的访问带来极大便利，节约了大量网络资源，从而有利于大量用户的并发访问。

Description

车载终端认证的方法及认证服务器 技术领域
本发明涉及到车载终端认证技术领域，特别是涉及到一种车载终端认证的方法及认证服务器。
背景技术
现有技术中，智能车载终端对后台的访问认证，通常就在需要访问的服务器中进行。当服务器对该智能车载终端的认证通过后，该智能车载终端即可直接访问该服务器。不需要访问时，退出该服务器即可，待下次访问时再次认证。如此，当用户量增大、并发请求增多时，服务器的并发处理及稳定性都可能出现问题。
发明内容
本发明的主要目的为提供一种车载终端认证的方法，提升了服务器的并发处理能力及稳定性。
本发明提出一种车载终端认证的方法，包括：
认证服务器接收车载终端的认证请求，判断是否通过认证；
在通过认证时，向车载终端发送令牌，使车载终端获得访问信息采集服务器的权限，并通知所述信息采集服务器允许所述车载终端的访问。
优选地，所述方法之后还包括：
所述认证服务器使用预设密钥加密车载终端的访问信息并传送至中心服务器。
优选地，所述认证服务器在认证车载终端时，对认证数据进行缓存并保留一定时间；所述认证数据至少包括所述令牌。
优选地，所述车载终端接收所述令牌后，对所述令牌进行缓存并保留一定时间。
本发明还提出一种车载终端认证的认证服务器，包括：
认证判断模块，用于接收车载终端的认证请求，判断是否通过认证；
认证处理模块，用于在通过认证时，向车载终端发送令牌，使车载终端获得访问信息采集服务器的权限，并通知所述信息采集服务器允许所述车载终端的访问。
优选地，所述认证服务器还包括：
信息传送模块，用于使用预设密钥加密车载终端的访问信息并传送至中心服务器。
优选地，所述认证服务器在认证车载终端时，对认证数据进行缓存并保留一定时间；所述认证数据至少包括所述令牌。
优选地，所述车载终端接收所述令牌后，对所述令牌进行缓存并保留一定时间。
本发明通过设置认证服务器与信息采集服务器，由此可将认证与访问分开进行，同时由于中间层与底层的两层缓存机制，可给车载终端对信息采集服务器的访问带来极大便利，节约了大量网络资源，从而有利于大量用户的并发访问。
附图说明
图1 是本发明车载终端认证的方法的一实施例中的步骤流程示意图；
图2 是本发明实施例中的三层结构示意图；
图3 是本发明车载终端认证的方法的另一实施例中的步骤流程示意图；
图4 是本发明车载终端认证的认证服务器的一实施例中的结构示意图；
图5 是本发明车载终端认证的认证服务器的另一实施例中的结构示意图。
本发明目的的实现、功能特点及优点将结合实施例，参照附图做进一步说明。
具体实施方式
应当理解，此处所描述的具体实施例仅仅用以解释本发明，并不用于限定本发明。
参照图1，提出本发明一种车载终端认证的方法的一实施例。该方法可包括：
步骤S11、认证服务器接收车载终端的认证请求，判断是否通过认证；
步骤S12、在通过认证时，向车载终端发送令牌，使车载终端获得访问信息采集服务器的权限，并通知所述信息采集服务器允许所述车载终端的访问。
参照图2，本实施例中，上述车载终端认证的方法可应用于三层结构的数据处理系统中。该三层结构的数据处理系统至少可包括：中心服务器21、多个认证服务器22、多个信息采集服务器23以及车载终端24。该中心服务器21可为上层，该多个认证服务器22和多个信息采集服务器23可为中间层，该车载终端24可为底层。该上层的中心服务器21可为整个分布式系统的中心，整体对系统中数据处理、业务管理以及资源分配等。该中间层与底层的车载终端24之间连接，为车载终端24提供认证、访问、信息推送等服务，同时可对车载终端24进行数据采集等并反馈给上层的中心服务器21。上述车载终端24可为车载智能电子设备，比如车载电脑或者智能车内后视镜等，至少具有通信功能及数据处理功能等。
本实施例中，通过分别设置有认证服务器22及信息采集服务器23，将认证与访问分离。当车载终端24需要访问信息采集服务器23时，可首先发送认证请求，通过认证服务器22对车载终端24的认证请求进行认证。
该认证请求中至少包括该车载终端24的身份信息，比如系统分配的ID号码等。该认证服务器22可根据自身存储的信息或向中心服务器21获取的信息验证该车载终端24，如果验证不通过即可终止该车载终端24的访问；如果验证通过即可发送访问的令牌给该车载终端24，并通知上述信息采集服务器23允许该车载终端24的访问。由此，该车载终端24即可通过该令牌顺利访问该信息采集服务器23。
上述认证服务器22在认证车载终端24时，对认证数据进行缓存并保留一定时间（可根据实际情况设定，比如12小时或一天等）；该认证数据至少可包括所述令牌。该车载终端24接收所述令牌后，同样可对该令牌进行缓存并保留一定时间。并且，可设定该令牌在一定时间内有效，该车载终端24即可凭该令牌在该有效的时间内访问该信息采集服务器23，无需再次通过认证服务器22认证。上述中间层与底层的两层缓存机制，可给车载终端24对信息采集服务器23的访问带来极大便利，节约了大量网络资源，从而有利于大量用户的并发访问。
参照图3，在本发明的另一实施例中，上述车载终端24认证的方法还至少可包括：
步骤S13、所述认证服务器22使用预设密钥加密车载终端24的访问信息并传送至中心服务器21。
本实施例中，上述访问信息至少可包括车载终端24的身份信息、访问时间、访问次数等数据。
上述底层的车载终端24与中间层的认证服务器22和信息采集服务器23之间，中间层的认证服务器22和信息采集服务器23与上层的中心服务器21之间，都可进行加密通信，以保障数据的准确性以及系统安全和稳定性。
上述中间层对底层车载终端24的认证，可使用口令认证和密钥交换体制，提供底层车载终端24与中层服务器之间的强相互认证，能同时抵制来自网络的主动攻击和被动攻击。其中，可主要采用非对称的认证算法；对于认证强度高的设备（比如政府使用设备等），采用类似RSA的非对称算法认证；对于平通商务机型，采用SRP6算法认证，设备保留相应的盐变量（slat）。
上述中间层的认证服务器22与上层的中心服务器21之间，可使用预设的密钥对进行通信，增强通信的安全性。其具体使用的加密协议可根据实际情况而定。
上述的三层结构中可采用IP（Internet Protocol）通信机制。比如，上述三层结构中还可设置消息服务器25，车载终端24与信息采集服务器23之间，当车载终端24需要获取某消息时，即可发送消息定制请求至信息采集服务器23，该信息采集服务器23接收车载终端24的消息定制请求，根据所述消息定制请求建立消息定制队列，并向提供车载终端24所需消息的消息服务器25定制所述消息。该消息定制请求至少可包括车载终端24的基本信息（比如终端的地址信息等）以及定制消息的内容信息（比如消息的名称、类型、数量或优先级等信息）。上述信息采集服务器23与车载终端24之间可以是一对多的关系；上述信息采集服务器23中的消息定制队列与车载终端24之间可以是一对一的关系（一一对应）。
上述信息采集服务器23接收消息服务器25发送的车载终端24定制消息，并将该定制消息存储至该车载终端24对应的消息定制队列中。该定制消息会在该消息定制队列中一直保留，直到该定制消息被成功发送至车载终端24。由此，解决了消息传送的可靠性，不容易造成消息丢失；同时，在车载终端24需要获取消息时，即使消息服务器25出现故障，车载终端24依然可以从信息采集服务器23的消息定制队列中获取消息，提升了消息获取的稳定性。
上述信息采集服务器23在接收到车载终端24的消息获取请求时，将消息定制队列中的定制消息发送给车载终端24。当消息定制队列存储的定制消息有多个时，该信息采集服务器23可以根据定制消息的优先级依次将多个定制消息发送至车载终端24。该优先级可以为定制消息本身自带的优先级，也可以车载终端24在定制时自定义的优先级。
上述定制消息的传送可以使用IP消息形式，如果某个数据包在传输过程中被破坏，只需要重发该数据包，而不是整个消息；并且在传输消息之前，不需要长时间等待。
参照图4，提出本发明一种车载终端24认证的认证服务器22的一实施例。该认证服务器22可包括：认证判断模块221以及认证处理模块222；该认证判断模块221，用于接收车载终端24的认证请求，判断是否通过认证；该认证处理模块222，用于在通过认证时，向车载终端24发送令牌，使车载终端24获得访问信息采集服务器23的权限，并通知所述信息采集服务器23允许所述车载终端24的访问。
参照图2，本实施例中，上述认证服务器22可应用于三层结构的数据处理系统中。该三层结构的数据处理系统至少可包括：中心服务器21、多个认证服务器22、多个信息采集服务器23以及车载终端24。该中心服务器21可为上层，该多个认证服务器22和多个信息采集服务器23可为中间层，该车载终端24可为底层。该上层的中心服务器21可为整个分布式系统的中心，整体对系统中数据处理、业务管理以及资源分配等。该中间层与底层的车载终端24之间连接，为车载终端24提供认证、访问、信息推送等服务，同时可对车载终端24进行数据采集等并反馈给上层的中心服务器21。上述车载终端24可为车载智能电子设备，比如车载电脑或者智能车内后视镜等，至少具有通信功能及数据处理功能等。
本实施例中，通过分别设置有认证服务器22及信息采集服务器23，将认证与访问分离。当车载终端24需要访问信息采集服务器23时，可首先发送认证请求，通过认证服务器22对车载终端24的认证请求进行认证。
该认证请求中至少包括该车载终端24的身份信息，比如系统分配的ID号码等。该认证服务器22可根据自身存储的信息或向中心服务器21获取的信息验证该车载终端24，如果验证不通过即可终止该车载终端24的访问；如果验证通过即可发送访问的令牌给该车载终端24，并通知上述信息采集服务器23允许该车载终端24的访问。由此，该车载终端24即可通过该令牌顺利访问该信息采集服务器23。
上述认证服务器22在认证车载终端24时，对认证数据进行缓存并保留一定时间；该认证数据至少可包括所述令牌。该车载终端24接收所述令牌后，同样可对该令牌进行缓存并保留一定时间。并且，可设定该令牌在一定时间内有效，该车载终端24即可凭该令牌在该有效的时间内访问该信息采集服务器23，无需再次通过认证服务器22认证。上述中间层与底层的两层缓存机制，可给车载终端24对信息采集服务器23的访问带来极大便利，节约了大量网络资源，从而有利于大量用户的并发访问。
参照图5，在本发明另一实施例中，上述认证服务器22还可包括：信息传送模块223，用于使用预设密钥加密车载终端24的访问信息并传送至中心服务器21。
本实施例中，上述访问信息至少可包括车载终端24的身份信息、访问时间、访问次数等数据。
上述底层的车载终端24与中间层的认证服务器22和信息采集服务器23之间，中间层的认证服务器22和信息采集服务器23与上层的中心服务器21之间，都可进行加密通信，以保障数据的准确性以及系统安全和稳定性。
上述中间层对底层车载终端24的认证，可使用口令认证和密钥交换体制，提供底层车载终端24与中层服务器之间的强相互认证，能同时抵制来自网络的主动攻击和被动攻击。其中，可主要采用非对称的认证算法；对于认证强度高的设备（比如政府使用设备等），采用类似RSA的非对称算法认证；对于平通商务机型，采用SRP6算法认证，设备保留相应的盐变量（slat）。
上述中间层的认证服务器22与上层的中心服务器21之间，可使用预设的密钥对进行通信，增强通信的安全性。其具体使用的加密协议可根据实际情况而定。
上述的三层结构中可采用IP（Internet Protocol）通信机制。比如，上述三层结构中还可设置消息服务器25，车载终端24与信息采集服务器23之间，当车载终端24需要获取某消息时，即可发送消息定制请求至信息采集服务器23，该信息采集服务器23接收车载终端24的消息定制请求，根据所述消息定制请求建立消息定制队列，并向提供车载终端24所需消息的消息服务器25定制所述消息。该消息定制请求至少可包括车载终端24的基本信息（比如终端的地址信息等）以及定制消息的内容信息（比如消息的名称、类型、数量或优先级等信息）。上述信息采集服务器23与车载终端24之间可以是一对多的关系；上述信息采集服务器23中的消息定制队列与车载终端24之间可以是一对一的关系（一一对应）。
上述信息采集服务器23接收消息服务器25发送的车载终端24定制消息，并将该定制消息存储至该车载终端24对应的消息定制队列中。该定制消息会在该消息定制队列中一直保留，直到该定制消息被成功发送至车载终端24。由此，解决了消息传送的可靠性，不容易造成消息丢失；同时，在车载终端24需要获取消息时，即使消息服务器25出现故障，车载终端24依然可以从信息采集服务器23的消息定制队列中获取消息，提升了消息获取的稳定性。
上述信息采集服务器23在接收到车载终端24的消息获取请求时，将消息定制队列中的定制消息发送给车载终端24。当消息定制队列存储的定制消息有多个时，该信息采集服务器23可以根据定制消息的优先级依次将多个定制消息发送至车载终端24。该优先级可以为定制消息本身自带的优先级，也可以车载终端24在定制时自定义的优先级。
上述定制消息的传送可以使用IP消息形式，如果某个数据包在传输过程中被破坏，只需要重发该数据包，而不是整个消息；并且在传输消息之前，不需要长时间等待。
以上所述仅为本发明的优选实施例，并非因此限制本发明的专利范围，凡是利用本发明说明书及附图内容所作的等效结构或等效流程变换，或直接或间接运用在其他相关的技术领域，均同理包括在本发明的专利保护范围内。

Claims (8)

  1. 一种车载终端认证的方法，其特征在于，包括：
    认证服务器接收车载终端的认证请求，判断是否通过认证；
    在通过认证时，向车载终端发送令牌，使车载终端获得访问信息采集服务器的权限，并通知所述信息采集服务器允许所述车载终端的访问。
  2. 根据权利要求1所述的车载终端认证的方法，其特征在于，所述方法之后还包括：
    所述认证服务器使用预设密钥加密车载终端的访问信息并传送至中心服务器。
  3. 根据权利要求1或2所述的车载终端认证的方法，其特征在于，所述认证服务器在认证车载终端时，对认证数据进行缓存并保留一定时间；所述认证数据至少包括所述令牌。
  4. 根据权利要求3所述的车载终端认证的方法，其特征在于，所述车载终端接收所述令牌后，对所述令牌进行缓存并保留一定时间。
  5. 一种车载终端认证的认证服务器，其特征在于，包括：
    认证判断模块，用于接收车载终端的认证请求，判断是否通过认证；
    认证处理模块，用于在通过认证时，向车载终端发送令牌，使车载终端获得访问信息采集服务器的权限，并通知所述信息采集服务器允许所述车载终端的访问。
  6. 根据权利要求5所述的车载终端认证的认证服务器，其特征在于，所述认证服务器还包括：
    信息传送模块，用于使用预设密钥加密车载终端的访问信息并传送至中心服务器。
  7. 根据权利要求5或6所述的车载终端认证的认证服务器，其特征在于，所述认证服务器在认证车载终端时，对认证数据进行缓存并保留一定时间；所述认证数据至少包括所述令牌。
  8. 根据权利要求7所述的车载终端认证的认证服务器，其特征在于，所述车载终端接收所述令牌后，对所述令牌进行缓存并保留一定时间。
PCT/CN2014/094731 2013-12-24 2014-12-23 车载终端认证的方法及认证服务器 WO2015096714A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201310722700.7 2013-12-24
CN201310722700.7A CN103746969A (zh) 2013-12-24 2013-12-24 车载终端认证的方法及认证服务器

Publications (1)

Publication Number Publication Date
WO2015096714A1 true WO2015096714A1 (zh) 2015-07-02

Family

ID=50503956

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2014/094731 WO2015096714A1 (zh) 2013-12-24 2014-12-23 车载终端认证的方法及认证服务器

Country Status (2)

Country Link
CN (1) CN103746969A (zh)
WO (1) WO2015096714A1 (zh)

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106713264A (zh) * 2016-11-18 2017-05-24 郑州信大捷安信息技术股份有限公司 一种用于车辆安全远程控制与诊断的方法及系统
CN111033503A (zh) * 2017-08-14 2020-04-17 Kddi株式会社 车辆保安系统以及车辆保安方法
CN111508110A (zh) * 2020-04-12 2020-08-07 广州通达汽车电气股份有限公司 一种实现车辆远程锁定的方法及装置
CN112565251A (zh) * 2020-12-02 2021-03-26 北京梧桐车联科技有限责任公司 车载应用的访问认证方法、装置及系统

Families Citing this family (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103747051A (zh) * 2013-12-24 2014-04-23 深圳市领华卫通数码科技有限公司 车载终端的服务平台
CN103746969A (zh) * 2013-12-24 2014-04-23 深圳市领华卫通数码科技有限公司 车载终端认证的方法及认证服务器
FR3031268B1 (fr) * 2014-12-30 2017-01-13 Valeo Comfort & Driving Assistance Procede d’inscription d’un utilisateur a un service de commande d’une fonctionnalite d’un vehicule au moyen d’un terminal utilisateur
CN106101111B (zh) * 2016-06-24 2019-10-25 郑州信大捷安信息技术股份有限公司 车载电子安全通信系统及通信方法
CN106453269B (zh) * 2016-09-21 2021-06-25 东软集团股份有限公司 车联网安全通信方法、车载终端、服务器及系统
CN106375469A (zh) * 2016-09-29 2017-02-01 未来汽车科技（深圳）有限公司 一种通知推送方法及其装置
US10691779B2 (en) * 2017-07-24 2020-06-23 Otis Elevator Company Service tool credential management
CN109756336B (zh) * 2017-11-03 2021-09-10 中国移动通信有限公司研究院 一种认证方法、v2x计算系统及v2x计算节点
CN109756897B (zh) * 2018-06-13 2021-11-05 云控智行科技有限公司 一种车联网的认证授权机制及系统
CN109862036A (zh) * 2019-03-20 2019-06-07 上海博泰悦臻网络技术服务有限公司 一种协同认证鉴权方法和终端

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP2159653A1 (de) * 2008-09-02 2010-03-03 Siemens Aktiengesellschaft Verfahren zur Einräumung einer Zugriffsberechtigung auf ein rechnerbasiertes Objekt in einem Automatisierungssystem, Computerprogramm und Automatisierungssystem
CN201910918U (zh) * 2010-12-30 2011-07-27 上海博泰悦臻电子设备制造有限公司 业务系统及车载终端
CN102209096A (zh) * 2010-03-31 2011-10-05 上海博泰悦臻电子设备制造有限公司 车载终端访问管理系统及管理方法
CN103746969A (zh) * 2013-12-24 2014-04-23 深圳市领华卫通数码科技有限公司 车载终端认证的方法及认证服务器

Family Cites Families (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102208979B (zh) * 2010-03-31 2014-07-16 上海博泰悦臻网络技术服务有限公司 用户访问管理系统及管理方法
CN202617170U (zh) * 2012-05-14 2012-12-19 重庆桴之科科技发展有限公司 车载终端系统
CN102833250B (zh) * 2012-08-28 2016-04-13 华南理工大学 一种用于车载移动互联的安全管理方法和系统

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP2159653A1 (de) * 2008-09-02 2010-03-03 Siemens Aktiengesellschaft Verfahren zur Einräumung einer Zugriffsberechtigung auf ein rechnerbasiertes Objekt in einem Automatisierungssystem, Computerprogramm und Automatisierungssystem
CN102209096A (zh) * 2010-03-31 2011-10-05 上海博泰悦臻电子设备制造有限公司 车载终端访问管理系统及管理方法
CN201910918U (zh) * 2010-12-30 2011-07-27 上海博泰悦臻电子设备制造有限公司 业务系统及车载终端
CN103746969A (zh) * 2013-12-24 2014-04-23 深圳市领华卫通数码科技有限公司 车载终端认证的方法及认证服务器

Cited By (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106713264A (zh) * 2016-11-18 2017-05-24 郑州信大捷安信息技术股份有限公司 一种用于车辆安全远程控制与诊断的方法及系统
CN106713264B (zh) * 2016-11-18 2019-06-21 郑州信大捷安信息技术股份有限公司 一种用于车辆安全远程控制与诊断的方法及系统
CN111033503A (zh) * 2017-08-14 2020-04-17 Kddi株式会社 车辆保安系统以及车辆保安方法
CN111508110A (zh) * 2020-04-12 2020-08-07 广州通达汽车电气股份有限公司 一种实现车辆远程锁定的方法及装置
CN111508110B (zh) * 2020-04-12 2022-12-27 广州通达汽车电气股份有限公司 一种实现车辆远程锁定的方法及装置
CN112565251A (zh) * 2020-12-02 2021-03-26 北京梧桐车联科技有限责任公司 车载应用的访问认证方法、装置及系统

Also Published As

Publication number Publication date
CN103746969A (zh) 2014-04-23

Similar Documents

Publication Publication Date Title
WO2015096714A1 (zh) 车载终端认证的方法及认证服务器
CN110915183B (zh) 经由硬/软令牌验证的区块链认证
US7032110B1 (en) PKI-based client/server authentication
US8621206B2 (en) Authority-neutral certification for multiple-authority PKI environments
CN101027676B (zh) 用于可控认证的个人符记和方法
US20180077149A1 (en) Distributing an authentication key to an application installation
KR102254499B1 (ko) 블록체인 기반의 권한 인증 방법, 단말 및 이를 이용한 서버
CN100520795C (zh) 基于硬件的凭证管理
WO2017020452A1 (zh) 认证方法和认证系统
JP2023541599A (ja) サービス通信方法、システム、装置及び電子機器
US11277404B2 (en) System and data processing method
WO2015096713A1 (zh) 车载终端的服务平台
JP6572750B2 (ja) 認証制御プログラム、認証制御装置、及び認証制御方法
KR20170106515A (ko) 다중 팩터 인증 기관
KR102410006B1 (ko) 사용자 권한 관리가 가능한 did 생성 방법 및 이를 이용한 사용자 권한 관리 시스템
CN107493291A (zh) 一种基于安全元件se的身份认证方法和装置
KR20120055728A (ko) 신뢰성있는 인증 및 로그온을 위한 방법 및 장치
JP2007534085A (ja) 個人情報を開示することのない信頼性のないゲートウェイの認証
CN110730077A (zh) 一种微服务身份认证和接口鉴权的方法及其系统
KR101974062B1 (ko) 클라우드 하드웨어 모듈 기반 전자 서명 방법
CN109981680B (zh) 一种访问控制实现方法、装置、计算机设备及存储介质
JP2007293760A (ja) 個別認証を用いたシングルサインオン連携方法およびシステム
JP7212169B2 (ja) ブラウザのウェブストレージを利用した簡易認証方法及びシステム
KR20160113248A (ko) 기기 증명서 제공 장치, 기기 증명서 제공 시스템 및 기기 증명서 제공 프로그램을 기록한 컴퓨터 판독 가능한 비 일시적 기록 매체
JP2015194879A (ja) 認証システム、方法、及び提供装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 14875437

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 14875437

Country of ref document: EP

Kind code of ref document: A1