WO2019042154A1 - 消息处理方法及相关设备 - Google Patents

消息处理方法及相关设备 Download PDF

Info

Publication number
WO2019042154A1
WO2019042154A1 PCT/CN2018/100975 CN2018100975W WO2019042154A1 WO 2019042154 A1 WO2019042154 A1 WO 2019042154A1 CN 2018100975 W CN2018100975 W CN 2018100975W WO 2019042154 A1 WO2019042154 A1 WO 2019042154A1
Authority
WO
WIPO (PCT)
Prior art keywords
certificate
message
signature
lightweight
terminal
Prior art date
Application number
PCT/CN2018/100975
Other languages
English (en)
French (fr)
Inventor
肖飞龙
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2019042154A1 publication Critical patent/WO2019042154A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3247—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving digital signatures
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3263—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements
    • H04L9/3268—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]

Definitions

  • the present application relates to the field of communications technologies, and in particular, to a message processing method and related devices.
  • the Internet of Vehicles uses information such as wireless communication or sensor detection to collect information on vehicles, roads, and the environment.
  • Vehicle-to-Vehicle V2V
  • Vehicle-to-Infrastructure V2I
  • vehicles - The interaction and sharing between people Vehicle-to-Pedestrian, V2P
  • the network is an extension of the Internet of Things technology in the field of intelligent transportation systems.
  • the existing certificate authentication method is: using a private key of the sending terminal to sign a V2X (Vehicle-to-Everything) message, and carrying a certificate (for example, X.509) in the V2X message; when the receiving terminal receives the V2X message Use the public key in the Certificate Authority (CA) to verify the certificate. If the result of the verification is a legal certificate, use the public key in the certificate to verify the signature of the V2X message. If the signature is valid, the packet is processed. Otherwise, it is discarded.
  • V2X Vehicle-to-Everything
  • CA Certificate Authority
  • the large overhead means that the system capacity is greatly reduced compared with the case of no signature.
  • the message has large error rate, slow transmission speed and large interference.
  • the present application provides a message processing method and related equipment, where a sender's message carries a lightweight certificate, and the receiving terminal completes the certificate and signature of the sender message through the certificate signature and the message signature verification information in the lightweight certificate. It is verified that the lightweight certificate occupies less than the CA certificate, which reduces the overhead of the communication system, thereby improving system capacity and message transmission quality.
  • the first aspect of the present application provides a message processing method, including:
  • the sending terminal acquires the encoded message
  • the sending terminal performs signature processing on the encoded message to obtain a message signature
  • the sending terminal generates a sender message according to the lightweight certificate, the message signature, and the encoded message, where the lightweight certificate includes message signature verification information and a certificate signature, and the message signature verification information is used to verify the location.
  • the legality of the message signature includes message signature verification information and a certificate signature, and the message signature verification information is used to verify the location.
  • a message transmission between a terminal and a terminal In a communication system in which a wireless air interface frequently exchanges messages, a message transmission between a terminal and a terminal generally adopts a broadcast mode.
  • a broadcast mode For example, in a communication system of a car network, the interaction and sharing between V2V, V2I, and V2P is a broadcast mode.
  • the RSU and the vehicle identity are easily spoofed, so it is necessary to pass the certificate to ensure the validity of the sender's identity.
  • the certificate is obtained from the CA in the communication system.
  • the sending terminal obtains the message to be sent, the message to be sent according to the preset encoding rule is encoded to obtain an encoded message, and the transmitting terminal needs to ensure the integrity of the encoded message during the transmission process and the identity authentication of the sender.
  • the receiving terminal may be one or more. After the receiving terminal obtains the sending end message, the receiving terminal verifies the certificate signature according to the preset certificate verification information to determine whether the lightweight certificate is legal.
  • the preset certificate verification information is also issued by the CA to inform the receiving terminal in advance, and the lightweight certificate is legal.
  • the receiving terminal verifies whether the message signature is legal according to the message signature verification information in the lightweight certificate, and when the message signature is also legal, it indicates that the sender of the sender message passes the authentication, and the encoded message is guaranteed to be complete during transmission.
  • Sex. The sender message of the sending terminal carries a lightweight certificate, and the receiving terminal can complete the certificate and signature verification of the sender message through the certificate signature and the message signature verification information in the lightweight certificate, because the lightweight certificate only includes Message signature verification information and certificate signature.
  • the lightweight certificate occupies less than the CA certificate.
  • the size of the X.509 certificate is greater than 1000 bytes, and the size of the lightweight certificate. It can be 200 bytes or less, which reduces the overhead of the communication system, thereby improving system capacity and message transmission quality.
  • the sending terminal performs signature processing on the encoded message to obtain a message signature, including:
  • the sending terminal performs signature processing on the message digest according to the terminal private key to obtain a message signature.
  • the signature processing of the message is mainly divided into two steps.
  • the first step is to extract the digest information from the encoded message according to the preset hash function, thereby obtaining the message digest of the encoded message, because in the communication system with frequent message interaction in the wireless air interface
  • the message between the terminal and the terminal is generally broadcasted, and the asymmetric encryption method is used for signature processing.
  • the asymmetric encryption method is specifically configured with a private key and a public key, because the receiver needs to verify the identity of the sender.
  • the transmitting terminal performs signature processing on the message digest according to the terminal private key to obtain a message signature
  • the receiving terminal is a terminal public key known to correspond to the terminal private key, so the public key can be used to verify whether the message signature is legitimate.
  • the message signature verification information is a terminal public key corresponding to the terminal private key.
  • the message signature verification information is used to verify the validity of the message signature, and the message signature verification information is natural. It is the terminal public key corresponding to the terminal private key.
  • the lightweight certificate further includes validity period information
  • the sending terminal Before the sending terminal generates the sending end message according to the lightweight certificate, the message signature, and the encoded message, the sending terminal further includes:
  • the sending terminal sends a certificate request to the CA, so that the CA performs signature processing on the validity period information of the CA certificate and the terminal public key according to the preset certificate private key, and obtains a certificate signature, according to the validity period information, Transmitting a secret key and the certificate signature to generate a lightweight certificate, and sending the lightweight certificate to the sending terminal;
  • the sending terminal acquires the lightweight certificate sent by the CA.
  • the expiration date information may also be included in the lightweight certificate. Since the CA can set the expiration date for the certificate when the certificate is issued, and the expiration date specified in the validity period information, the lightweight certificate is legal, thereby increasing security.
  • the issuance of the lightweight certificate is performed by the CA.
  • the sending terminal sends a certificate request to the CA. After receiving the certificate request, the CA signs the validity period of the CA certificate and the terminal public key according to the private key of the preset certificate.
  • the certificate is signed, the lightweight certificate is generated according to the validity period information, the terminal public key and the certificate signature, and the lightweight certificate is sent to the sending terminal; the sending terminal acquires the lightweight certificate sent by the CA.
  • the X.509 certificate includes three parts: TBSCertificate, signatureAlgorithm, and signatureValue, where TBSCertificate includes validity information (Validity), and message signature verification information (Subject Public Key Info). Extension field (Extension), etc., and the obtained certificate signature can be placed in the Extension.
  • the lightweight certificate includes only the validity period information, the terminal public key and the certificate signature, so it is lightweight.
  • the byte size of the certificate is significantly smaller than the byte size of the X.509 certificate.
  • the second aspect of the present application provides a message processing method, including:
  • the receiving terminal receives the sending end information sent by the sending terminal, where the sending end message includes a lightweight certificate, an encoded message, and a message signature of the encoded message, where the lightweight certificate includes message signature verification information and a certificate signature,
  • the message signature verification information is used to verify the validity of the message signature;
  • the receiving terminal verifies the certificate signature according to the preset certificate verification information, and determines whether the lightweight certificate is legal;
  • the receiving terminal verifies whether the message signature is legal according to the message signature verification information
  • the receiving terminal processes the encoded message.
  • a message transmission between a terminal and a terminal In a communication system in which a wireless air interface frequently exchanges messages, a message transmission between a terminal and a terminal generally adopts a broadcast mode.
  • the interaction and sharing between V2V, V2I, and V2P is a broadcast mode.
  • the RSU and the vehicle identity are easily spoofed, so it is necessary to pass the certificate to ensure the validity of the sender's identity.
  • the certificate is obtained from the CA in the communication system.
  • the receiving terminal receives the sending end information sent by the sending terminal, where the sending end message includes a lightweight certificate, an encoded message, and a message signature of the encoded message, the lightweight certificate includes message signature verification information and a certificate signature, and the message signature verification information is used to verify the message.
  • the legality of the signature the receiving terminal verifies the certificate signature according to the preset certificate verification information, and determines whether the lightweight certificate is legal.
  • the preset certificate verification information is also issued by the CA to notify the receiving terminal in advance; if the lightweight certificate is legal, the receiving terminal according to the The message signature verification information verifies whether the message signature is legal; if the message signature is legal, it means that the identity verification of the sender of the sender message passes, and the integrity of the encoded message transmission process is ensured, and the receiving terminal processes the encoded message.
  • the sender message of the sending terminal carries a lightweight certificate, and the receiving terminal can complete the certificate and signature verification of the sender message through the certificate signature and the message signature verification information in the lightweight certificate, because the lightweight certificate only includes Message signature verification information and certificate signature.
  • the lightweight certificate occupies less than the CA certificate.
  • the size of the X.509 certificate is greater than 1000 bytes, and the size of the lightweight certificate. It can be 200 bytes or less, which reduces the overhead of the communication system, thereby improving system capacity and message transmission quality.
  • the preset certificate verification information is a certificate public key of the CA
  • the receiving terminal Before the receiving terminal verifies the certificate signature according to the preset certificate verification information, and determines whether the lightweight certificate is legal, the receiving terminal further includes:
  • the receiving terminal receives the certificate public key of the CA feedback.
  • the asymmetric encryption method is used for signature processing, and the asymmetric encryption method is specifically configured with a private key and a public key, since the CA is based on the preset certificate private key pair. If the terminal public key in the CA certificate is signed and processed to obtain the certificate signature, then if the certificate signature is correct, the CA certificate public key needs to be known for verification. Therefore, the receiving terminal needs to send a certificate verification request to the CA first. And causing the CA to feed back the certificate public key to the receiving terminal according to the certificate verification request, and the receiving terminal receives the certificate public key of the CA feedback, so that the certificate public key is used as the preset certificate verification information to verify the certificate signature, thereby determining Is the lightweight certificate legal?
  • the receiving terminal verifies the certificate signature according to the preset certificate verification information, and determines whether the lightweight certificate is legal, including:
  • the receiving terminal verifies the certificate signature in the lightweight certificate according to the certificate public key, and determines whether the certificate signature is correct;
  • the receiving terminal determines that the lightweight certificate is legal
  • the receiving terminal determines that the lightweight certificate is illegal.
  • the receiving terminal knows that the preset certificate verification information is the certificate public key, and the certificate public key corresponds to the certificate private key used for the signature processing when the CA is signed by the certificate. Then, the receiving terminal can verify the certificate signature in the lightweight certificate according to the certificate public key, and determine whether the certificate signature is correct. If the certificate signature is correct, it can be determined that the lightweight certificate is legal; if the certificate signature is incorrect, then the light can be determined. The level certificate is illegal.
  • the lightweight certificate further includes validity period information
  • the method further includes:
  • the receiving terminal determines, according to the validity period information, whether the lightweight certificate is valid;
  • the receiving terminal determines that the lightweight certificate is legal
  • the receiving terminal determines that the lightweight certificate is illegal.
  • the lightweight certificate can also include the expiration date information. Since the CA can set the expiration date for the certificate when the certificate is issued, and the expiration date specified in the validity period information, the lightweight certificate is legal, thereby increasing security. Then, after verifying that the certificate signature is correct, before the receiving terminal determines that the lightweight certificate is legal, the receiving terminal also needs to determine whether the lightweight certificate at the current time is valid according to the validity period information. If the lightweight certificate is valid, the receiving terminal determines the location. The lightweight certificate is legal; if the lightweight certificate is invalid, the receiving terminal determines that the lightweight certificate is illegal.
  • the method further includes:
  • the receiving terminal discards the sender message.
  • the receiving terminal After the receiving terminal determines that the lightweight certificate is illegal, indicating that the sender identity of the received sender message is invalid, the receiving terminal does not process the encoded message in the sending end message, and adopts direct discarding. Sending a message.
  • the message signature verification information is a terminal public key
  • the receiving terminal verifies whether the message signature is legal according to the message signature verification information, and includes:
  • the receiving terminal generates a message digest from the encoded message in the sending end information according to a preset hash function
  • the receiving terminal verifies the message signature according to the terminal public key, and obtains a comparison summary
  • the receiving terminal compares the comparison digest with the message digest
  • the receiving terminal determines that the message signature is legal
  • the receiving terminal determines that the message signature is illegal.
  • the message transmission between the terminal and the terminal generally adopts a broadcast mode, and then the asymmetric encryption method is used for signature processing, and the asymmetric encryption method is specifically configured with a private key and public.
  • the secret key because the receiver needs to verify the identity of the sender, the sending terminal is a message signature obtained by signing the message digest according to the terminal private key, then the message signature verification information is the terminal public key, and the receiving terminal according to the preset
  • the function generates a message digest from the encoded message in the sender information, and the receiving terminal is a terminal public key that is known to correspond to the terminal private key. Therefore, the terminal public key can be used to verify the message signature, and a comparison summary is obtained. If the comparison digest is consistent with the message digest, it is determined that the message signature is legal; if the comparison digest is inconsistent with the message digest, the receiving terminal determines that the message signature is illegal.
  • the method further includes:
  • the receiving terminal discards the sending end information.
  • the receiving terminal After the receiving terminal determines that the lightweight certificate is legal and determines that the message signature is illegal, indicating that the sender identity of the received sender message is illegal, or the encoded message is changed during transmission, then receiving The terminal does not process the encoded message in the sender message, and processes the sender message in a direct discard manner.
  • the third aspect of the present application provides a sending terminal, including:
  • An obtaining module configured to obtain an encoded message
  • a signature module configured to perform signature processing on the encoded message to obtain a message signature
  • a processing module configured to generate a sender message according to the lightweight certificate, the message signature, and the encoded message, where the lightweight certificate includes message signature verification information and a certificate signature, where the message signature verification information is used for verification The legality of the message signature;
  • a sending module configured to send the sending end message to the receiving terminal, so that the receiving terminal verifies the certificate signature according to the preset certificate verification information, determining that the lightweight certificate is legal, and verifying according to the message signature verification information When the message signature is legal, the encoded message is processed.
  • a message transmission between a terminal and a terminal In a communication system in which a wireless air interface frequently exchanges messages, a message transmission between a terminal and a terminal generally adopts a broadcast mode.
  • the interaction and sharing between V2V, V2I, and V2P is a broadcast mode.
  • the RSU and the vehicle identity are easily spoofed, so it is necessary to pass the certificate to ensure the validity of the sender's identity.
  • the certificate is obtained from the CA in the communication system.
  • the sending terminal acquires the message to be sent, the acquiring module performs encoding processing on the message to be sent according to the preset encoding rule to obtain an encoded message, and the signature module ensures the integrity of the encoded message in the transmission process and the identity authentication of the sender.
  • the coded message needs to be signed and processed, and the message signature is obtained.
  • the processing module attaches the message signature to the encoded message, and then carries the lightweight certificate issued by the CA in the encoded message to obtain the sender message, and the sending module sends the message to the sender. It is transmitted to the receiving terminal by broadcast, and the receiving terminal may be one or more. After the receiving terminal obtains the sending end message, the receiving terminal verifies the certificate signature according to the preset certificate verification information to determine whether the lightweight certificate is legal.
  • the preset certificate verification information is also issued by the CA to inform the receiving terminal in advance, and the lightweight certificate is legal.
  • the receiving terminal verifies whether the message signature is legal according to the message signature verification information in the lightweight certificate, and when the message signature is also legal, it indicates that the sender of the sender message passes the authentication, and the encoded message is guaranteed to be complete during transmission.
  • Sex. The sender message of the sending terminal carries a lightweight certificate, and the receiving terminal can complete the certificate and signature verification of the sender message through the certificate signature and the message signature verification information in the lightweight certificate, because the lightweight certificate only includes Message signature verification information and certificate signature.
  • the lightweight certificate occupies less than the CA certificate.
  • the size of the X.509 certificate is greater than 1000 bytes, and the size of the lightweight certificate. It can be 200 bytes or less, which reduces the overhead of the communication system, thereby improving system capacity and message transmission quality.
  • the signing module is specifically configured to generate a message digest from the encoded message according to a preset hash function
  • the signing module is further configured to perform signature processing on the message digest according to the terminal private key to obtain a message signature.
  • the signature processing of the message by the signature module is mainly divided into two steps.
  • the first step is that the signature module extracts the digest information from the encoded message according to the preset hash function, thereby obtaining the message digest of the encoded message, due to frequent message interaction in the wireless air interface.
  • the message transmission between the terminal and the terminal generally adopts a broadcast mode
  • the signature module adopts an asymmetric encryption method for signature processing, and the asymmetric encryption method specifically sets a private key and a public key, because the receiver
  • the identity of the sender needs to be verified
  • the signature module performs signature processing on the message digest according to the terminal private key to obtain a message signature
  • the receiving terminal is a terminal public key known to correspond to the terminal private key, so the secret can be used.
  • the key is used to verify that the message signature is legal.
  • the message signature verification information is a terminal public key corresponding to the terminal private key.
  • the signature module since it is known that the signature module performs signature processing on the message digest according to the terminal private key, the message signature verification information is used to verify the validity of the message signature, and the message signature verification information is natural. It is the terminal public key corresponding to the terminal private key.
  • the lightweight certificate further includes validity period information
  • the sending module is further configured to send a certificate request to the CA, so that the CA performs signature processing on the validity period information of the CA certificate and the terminal public key according to the preset certificate private key, and obtains a certificate signature, according to the validity period.
  • the information, the terminal public key and the certificate signature generate a lightweight certificate, and send the lightweight certificate to the sending terminal;
  • the obtaining module is further configured to acquire the lightweight certificate sent by the CA.
  • the expiration date information may also be included in the lightweight certificate. Since the CA can set the expiration date for the certificate when the certificate is issued, and the expiration date specified in the validity period information, the lightweight certificate is legal, thereby increasing security.
  • the issuance of the lightweight certificate is performed by the CA.
  • the sending module sends a certificate request to the CA. After receiving the certificate request, the CA signs the validity period of the CA certificate and the terminal public key according to the private key of the preset certificate. The certificate is signed, the lightweight certificate is generated according to the validity period information, the terminal public key and the certificate signature, and the lightweight certificate is sent to the sending terminal; the obtaining module obtains the lightweight certificate sent by the CA.
  • the X.509 certificate includes three parts: TBSCertificate, signatureAlgorithm, and signatureValue.
  • the TBSCertificate includes the validity period information, the message signature verification information (that is, the terminal public key), the extension field, and the like, and the obtained certificate.
  • the signature can be placed in the extension field.
  • the lightweight certificate only includes the validity period information, the terminal public key and the certificate signature, so the byte size of the lightweight certificate is significantly smaller than the X.509 certificate. Byte size.
  • a fourth aspect of the present application provides a receiving terminal, including:
  • a receiving module configured to receive sending end information sent by the sending terminal, where the sending end message includes a lightweight certificate, an encoded message, and a message signature of the encoded message, where the lightweight certificate includes message signature verification information and a certificate signature
  • the message signature verification information is used to verify the validity of the message signature
  • a verification module configured to verify the certificate signature according to the preset certificate verification information, and determine whether the lightweight certificate is legal
  • the verification module is further configured to: when the lightweight certificate is legal, verify whether the message signature is legal according to the message signature verification information;
  • the processing module is further configured to process the encoded message when the message signature is legal.
  • a message transmission between a terminal and a terminal In a communication system in which a wireless air interface frequently exchanges messages, a message transmission between a terminal and a terminal generally adopts a broadcast mode.
  • the interaction and sharing between V2V, V2I, and V2P is a broadcast mode.
  • the RSU and the vehicle identity are easily spoofed, so it is necessary to pass the certificate to ensure the validity of the sender's identity.
  • the certificate is obtained from the CA in the communication system.
  • the receiving module receives the sending end information sent by the sending terminal, where the sending end message includes a lightweight certificate, an encoded message, and a message signature of the encoded message, the lightweight certificate includes message signature verification information and a certificate signature, and the message signature verification information is used to verify the message.
  • the verification module verifies the certificate signature according to the preset certificate verification information, determines whether the lightweight certificate is legal, and the preset certificate verification information is also issued by the CA to inform the receiving terminal; if the lightweight certificate is legal, the verification module is based on The message signature verification information verifies whether the message signature is legal; if the message signature is legal, it means that the identity of the sender of the sender message passes, and the integrity of the encoded message transmission process is ensured, and the processing module processes the encoded message.
  • the sender message of the sending terminal carries a lightweight certificate, and the receiving terminal can complete the certificate and signature verification of the sender message through the certificate signature and the message signature verification information in the lightweight certificate, because the lightweight certificate only includes Message signature verification information and certificate signature.
  • the lightweight certificate occupies less than the CA certificate.
  • the size of the X.509 certificate is greater than 1000 bytes, and the size of the lightweight certificate. It can be 200 bytes or less, which reduces the overhead of the communication system, thereby improving system capacity and message transmission quality.
  • the preset certificate verification information is a certificate public key of the CA
  • the receiving terminal further includes:
  • a sending module configured to send a certificate verification request to the CA, so that the CA feeds back a certificate public key to the receiving terminal according to the certificate verification request;
  • the receiving module is further configured to receive a certificate public key of the CA feedback.
  • the asymmetric encryption method is used for signature processing, and the asymmetric encryption method is specifically configured with a private key and a public key, since the CA is based on the preset certificate private key pair. If the terminal public key in the CA certificate is signed and processed to obtain the certificate signature, then if the certificate signature is correct, the CA certificate public key needs to be known for verification. Therefore, the sending module needs to send a certificate verification request to the CA first. And causing the CA to feed back the certificate public key to the receiving terminal according to the certificate verification request, and the receiving module receives the certificate public key fed back by the CA for subsequently using the certificate public key as the preset certificate verification information to verify the certificate signature, thereby determining Is the lightweight certificate legal?
  • the verification module is further configured to verify, according to the certificate public key, the certificate signature in the lightweight certificate, and determine whether the certificate signature is correct;
  • the verification module is further configured to: when the certificate signature is correct, determine that the lightweight certificate is legal;
  • the verification module is further configured to determine that the lightweight certificate is illegal when the certificate is signed incorrectly.
  • the receiving terminal knows that the preset certificate verification information is the certificate public key, and the certificate public key corresponds to the certificate private key used for signature processing when the CA obtains the certificate signature. Then, the verification module can verify the certificate signature in the lightweight certificate according to the certificate public key, and determine whether the certificate signature is correct. If the certificate signature is correct, the verification module can determine that the lightweight certificate is legal; if the certificate signature is incorrect, then the verification The module can determine that the lightweight certificate is illegal.
  • the lightweight certificate further includes validity period information
  • the verification module is further configured to determine, according to the validity period information, whether the lightweight certificate is valid when the certificate signature is correct;
  • the verification module is further configured to: when the lightweight certificate is valid, determine that the lightweight certificate is legal;
  • the verification module is further configured to determine that the lightweight certificate is illegal when the lightweight certificate is invalid.
  • the lightweight certificate can also include the expiration date information. Since the CA can set the expiration date for the certificate when the certificate is issued, and the expiration date specified in the validity period information, the lightweight certificate is legal, thereby increasing security. Then, when the verification module verifies that the certificate signature is correct, the verification module determines that the lightweight certificate is valid according to the validity period information, and if the lightweight certificate is valid, the verification module is valid. Determining that the lightweight certificate is legal; if the lightweight certificate is invalid, the verification module determines that the lightweight certificate is illegal.
  • the processing module is further configured to discard the sender message when the lightweight certificate is illegal.
  • the processing module After the verification module determines that the lightweight certificate is illegal, indicating that the sender identity of the received sender message is illegal, the processing module does not process the encoded message in the sender message, and directly processes the packet. Sending a message.
  • the message signature verification information is a terminal public key
  • the verification module is further configured to generate a message digest from the encoded message in the sending end information according to a preset hash function
  • the verification module is further configured to verify the message signature according to the terminal public key, and obtain a comparison summary;
  • the verification module is further configured to compare the comparison summary with the message digest
  • the verification module is further configured to: when the comparison digest is consistent with the message digest, determine that the message signature is legal;
  • the verification module is further configured to: when the comparison digest is inconsistent with the message digest, determine that the message signature is illegal.
  • the message transmission between the terminal and the terminal generally adopts a broadcast mode, and then the asymmetric encryption method is used for signature processing, and the asymmetric encryption method is specifically configured with a private key and public.
  • the secret key because the receiver needs to verify the identity of the sender, the sending terminal is a message signature obtained by signing the message digest according to the terminal private key, then the message signature verification information is the terminal public key, and the verification module according to the preset
  • the function generates a message digest from the encoded message in the sender information, and the verification module is a terminal public key that is known to correspond to the terminal private key, so the verification module can verify the message signature by using the terminal public key, and obtain a comparison.
  • Abstract if the comparison digest is consistent with the message digest, the verification module determines that the message signature is legal; if the comparison digest is inconsistent with the message digest, the verification module determines that the message signature is illegal.
  • the method further includes:
  • the processing module is further configured to discard the sender information when the message signature is illegal.
  • processing The module does not process the encoded message in the sender message, and processes the sender message in a direct discard manner.
  • a fifth aspect of the present disclosure provides a terminal device, including:
  • processors and transceiver a processor and a transceiver, the processor and the transceiver being connected;
  • the transceiver is configured to send, by the sending terminal, an encoded message
  • the processor is configured to perform signature processing on the encoded message to obtain a message signature
  • the processor is further configured to generate a sender message according to the lightweight certificate, the message signature, and the encoded message, where the lightweight certificate includes message signature verification information and a certificate signature, and the message signature verification information Used to verify the legality of the message signature;
  • the transceiver is further configured to send the sending end message to the receiving terminal, so that the receiving terminal verifies the certificate signature according to the preset certificate verification information, determining that the lightweight certificate is legal, and signing according to the message.
  • the verification information verifies that the message signature is legal, the encoded message is processed.
  • a message transmission between a terminal and a terminal In a communication system in which a wireless air interface frequently exchanges messages, a message transmission between a terminal and a terminal generally adopts a broadcast mode.
  • the interaction and sharing between V2V, V2I, and V2P is a broadcast mode.
  • the RSU and the vehicle identity are easily spoofed, so it is necessary to pass the certificate to ensure the validity of the sender's identity.
  • the certificate is obtained from the CA in the communication system.
  • the transceiver encodes the message to be sent according to the preset encoding rule to obtain the encoded message, and the processor ensures the integrity of the encoded message during the transmission process and the identity authentication of the sender.
  • the encoded message needs to be signed and processed, and the message signature is obtained.
  • the processor attaches the message signature to the encoded message, and then carries the lightweight certificate issued by the CA in the encoded message to obtain the sender message, and the transceiver sends the message to the sender. It is transmitted to the receiving terminal by broadcast, and the receiving terminal may be one or more.
  • the receiving terminal verifies the certificate signature according to the preset certificate verification information to determine whether the lightweight certificate is legal.
  • the preset certificate verification information is also issued by the CA to inform the receiving terminal in advance, and the lightweight certificate is legal.
  • the receiving terminal verifies whether the message signature is legal according to the message signature verification information in the lightweight certificate, and when the message signature is also legal, it indicates that the sender of the sender message passes the authentication, and the encoded message is guaranteed to be complete during transmission.
  • Sex. The sender message of the sending terminal carries a lightweight certificate, and the receiving terminal can complete the certificate and signature verification of the sender message through the certificate signature and the message signature verification information in the lightweight certificate, because the lightweight certificate only includes Message signature verification information and certificate signature.
  • the lightweight certificate occupies less than the CA certificate.
  • the size of the X.509 certificate is greater than 1000 bytes, and the size of the lightweight certificate. It can be 200 bytes or less, which reduces the overhead of the communication system, thereby improving system capacity and message transmission quality.
  • a terminal device comprising:
  • processors and transceiver a processor and a transceiver, the processor and the transceiver being connected;
  • the transceiver is configured to receive the sending end information sent by the sending terminal, where the sending end message includes a lightweight certificate, an encoded message, and a message signature of the encoded message, where the lightweight certificate includes message signature verification information and Certificate signature, the message signature verification information is used to verify the validity of the message signature;
  • the processor is configured to verify the certificate signature according to the preset certificate verification information, and determine whether the lightweight certificate is legal;
  • the processor is further configured to: when the lightweight certificate is legal, verify whether the message signature is legal according to the message signature verification information;
  • the processor is further configured to process the encoded message when the message signature is legal.
  • a message transmission between a terminal and a terminal In a communication system in which a wireless air interface frequently exchanges messages, a message transmission between a terminal and a terminal generally adopts a broadcast mode.
  • a broadcast mode For example, in a communication system of a car network, the interaction and sharing between V2V, V2I, and V2P is a broadcast mode.
  • the RSU and the vehicle identity are easily spoofed, so it is necessary to pass the certificate to ensure the validity of the sender's identity.
  • the certificate is obtained from the CA in the communication system.
  • the transceiver receives the sender information sent by the sending terminal, where the sender message includes a lightweight certificate, an encoded message, and a message signature of the encoded message, the lightweight certificate includes message signature verification information and a certificate signature, and the message signature verification information is used to verify the message.
  • the processor verifies the certificate signature according to the preset certificate verification information, determines whether the lightweight certificate is legal, and the preset certificate verification information is also issued by the CA to inform the receiving terminal; if the lightweight certificate is legal, the processor is based on The message signature verification information verifies whether the message signature is legal; if the message signature is legal, it means that the identity of the sender of the sender message passes, and the integrity of the coded message transmission is guaranteed, and the processor processes the coded message.
  • the sender message of the sending terminal carries a lightweight certificate, and the receiving terminal can complete the certificate and signature verification of the sender message through the certificate signature and the message signature verification information in the lightweight certificate, because the lightweight certificate only includes Message signature verification information and certificate signature.
  • the lightweight certificate occupies less than the CA certificate.
  • the size of the X.509 certificate is greater than 1000 bytes, and the size of the lightweight certificate. It can be 200 bytes or less, which reduces the overhead of the communication system, thereby improving system capacity and message transmission quality.
  • a seventh aspect of the present application provides a computer readable storage medium comprising instructions which, when executed on a computer, cause the computer to perform the message processing method described above.
  • An eighth aspect of the present application provides a computer program product comprising instructions which, when run on a computer, cause the computer to perform the message processing method described above.
  • FIG. 1 is a schematic diagram of interaction of a communication system for a vehicle network provided by the present application
  • FIG. 2 is a schematic diagram of message transmission of a scenario of a vehicle networking provided by the present application.
  • FIG. 3 is a schematic diagram of message transmission of another scenario of the vehicle networking provided by the present application.
  • FIG. 5 is a schematic diagram of signaling interaction of an embodiment of a message processing method provided by the present application.
  • FIG. 6 is a schematic flowchart of an embodiment of a receiving terminal side of a message processing method provided by the present application.
  • FIG. 7 is a schematic structural diagram of an embodiment of a sending terminal provided by the present application.
  • FIG. 8 is a schematic structural diagram of an embodiment of a receiving terminal provided by the present application.
  • FIG. 9 is a schematic structural diagram of another embodiment of a receiving terminal provided by the present application.
  • FIG. 10 is a schematic structural diagram of an embodiment of a terminal device at a transmitting end and a receiving end according to the present application.
  • the present application provides a message processing method and related equipment, where a sender's message carries a lightweight certificate, and the receiving terminal completes the certificate and signature of the sender message through the certificate signature and the message signature verification information in the lightweight certificate. It is verified that the lightweight certificate occupies less than the CA certificate, which reduces the overhead of the communication system, thereby improving system capacity and message transmission quality.
  • FIG. 1 shows a communication system framework of the vehicle network, and the vehicle network is a network in which the vehicle is connected with everything.
  • Vehicle to Everything (V2X) the Internet of Vehicles mainly includes four application scenarios: Vehicle-to-Network (V2N), V2V, V2I and V2P.
  • V2N Vehicle-to-Network
  • V2V Vehicle-to-Network
  • V2I Vehicle-to-Network
  • V2P Vehicle-to-Network
  • the message transmission between the terminal and the terminal is generally broadcast.
  • the asymmetric encryption method is used for signature processing.
  • the existing mode is as shown in FIG. 4, specifically: 1.
  • the V_UE A terminal that sends the V2X message signs the V2X message with the private key when the V2X message is sent, and attaches the CA certificate issued by the CA; 2.
  • Receive When receiving the V2X message, the V_UE B terminal of the V2X message verifies the CA certificate by using the public key of the CA certificate. If the result of the verification is a legitimate CA certificate, the signature of the message is verified by the public key in the CA certificate, if the signature is signed. If it is legal, it will be processed, otherwise it will be discarded.
  • the certificate based on the X.509 is more than 1000 bytes in size, and is generally applied to Internet user authentication.
  • the size of the certificate determines the overhead of the system.
  • the terminal's private key pair V2X message is used.
  • the typical frequency of the V2X message is 10 Hz, and the average length of the message is about 300 bytes.
  • a message processing method is introduced by using an embodiment to reduce the size of a certificate, thereby reducing the overhead of the communication system and improving the message transmission quality.
  • an embodiment of the present application provides a message processing method, including:
  • the sending terminal acquires an encoded message.
  • the transmitting terminal and the receiving terminal may be any one of a human-operated smart device, an RSU, or a vehicle device, and the transmitting terminal acquires to be sent.
  • the message to be sent according to the preset encoding rule is encoded to obtain an encoded message.
  • the sending terminal performs signature processing on the encoded message to obtain a message signature.
  • the transmitting terminal in order to ensure the integrity of the encoded message during the transmission process and the identity authentication of the sender, the transmitting terminal needs to perform signature processing on the encoded message to obtain a message signature.
  • the sending terminal generates, according to the lightweight certificate, the message signature, and the encoded message, a sender message, where the lightweight certificate includes message signature verification information and a certificate signature, and the message signature verification information is used to verify the validity of the message signature.
  • the lightweight certificate is pre-issued by the CA, the lightweight certificate only includes the message signature verification information and the certificate signature, and the message signature verification information is used to verify the validity of the message signature, because the certificate signature is performed by the CA. If the signature processing is obtained, the certificate verification information used to verify the certificate signature is inevitably advertised to all receiving terminals, the message signature is attached to the encoded message, and then the lightweight certificate is carried in the encoded message to obtain the sender message.
  • the sending terminal sends the sending end message to the receiving terminal, where the receiving terminal receives the sending end information sent by the sending terminal.
  • the sending terminal sends the sending end message by means of broadcast, and the receiving terminal receives the sending end message broadcast by the sending terminal by scanning.
  • the receiving terminal verifies the certificate signature according to the preset certificate verification information, determining whether the lightweight certificate is legal, and if yes, executing step 506;
  • the preset certificate verification information is that the CA informs the receiving terminal in advance, the preset certificate verification information is used to verify the certificate signature, and the receiving terminal verifies the certificate signature according to the preset certificate verification information, thereby determining whether the lightweight certificate is legal. If the lightweight certificate is a legitimate certificate, then step 506 is performed.
  • step 506 the receiving terminal verifies whether the message signature is legal according to the message signature verification information, and if yes, step 507 is performed;
  • the message signature verification information in the lightweight certificate is obtained. Since the message signature verification information is used to verify the validity of the message signature, the receiving terminal is configured according to The message signature verification information verifies whether the message signature is legal. If the message signature is legal, indicating that the identity of the transmitting terminal is legal, and the integrity of the encoded message during transmission is guaranteed, step 507 is performed.
  • the receiving terminal processes the encoded message.
  • the encoded message in the sending end message may be decoded and the like.
  • the receiving terminal can complete the certificate and signature verification of the sending end message by using the certificate signature and the message signature verification information in the lightweight certificate, because The lightweight certificate only contains the message signature verification information and the certificate signature.
  • the lightweight certificate occupies less than the CA certificate.
  • the size of the X.509 certificate is greater than 1000 bytes.
  • the size of the lightweight certificate can be less than 200 bytes, which reduces the overhead of the communication system, thereby improving system capacity and message transmission quality.
  • the message transmission between the terminal and the terminal generally adopts a broadcast mode, and then the asymmetric encryption method is used for signature processing, and the asymmetric encryption method is specifically configured with a private key and public.
  • the secret key because the receiver needs to verify the identity of the sender, the transmitting terminal performs signature processing on the message digest according to the terminal private key to obtain a message signature, and the receiving terminal is a terminal public key known to correspond to the terminal private key. , so you can use the public key to verify that the message signature is legal.
  • the signature processing of the asymmetric encryption method will be described below by way of an embodiment.
  • the message signature verification information is a terminal public key.
  • the sending terminal performs signature processing on the encoded message to obtain a message signature, including:
  • the sending terminal generates a message digest from the encoded message according to the preset hash function
  • the sending terminal performs signature processing on the message digest according to the terminal private key to obtain a message signature.
  • the receiving terminal verifies whether the message signature is legal according to the message signature verification information, including:
  • the receiving terminal generates a message digest from the encoded message in the sending end information according to the preset hash function
  • the receiving terminal verifies the message signature according to the public key of the terminal, and obtains a comparison summary
  • the receiving terminal compares the comparison summary with the message digest
  • the receiving terminal determines that the message signature is legal
  • the receiving terminal determines that the message signature is illegal.
  • the signature processing of the encoded message by the sending terminal is mainly divided into two steps.
  • the first step is to extract the digest information from the encoded message according to the preset hash function, thereby obtaining a message digest of the encoded message, because in the wireless
  • the message transmission between the terminal and the terminal generally adopts a broadcast mode, and then the asymmetric encryption method is used for signature processing, and the asymmetric encryption method is specifically configured with a private key and a public key.
  • the sending terminal Since the receiver needs to verify the identity of the sender, the sending terminal performs signature processing on the message digest according to the terminal private key to obtain a message signature, so that the public key can be used to verify whether the message signature is legal, then the message signature verification information is the terminal public.
  • a secret key the receiving terminal generates a message digest from the encoded message in the sending end information according to the preset hash function, and the receiving terminal is a terminal public key known to correspond to the terminal private key, so the terminal public key pair can be used.
  • Message signature verification get a comparison summary, if contrast If the digest is consistent with the message digest, it is determined that the message signature is legal; if the comparison digest is inconsistent with the message digest, the receiving terminal determines that the message signature is illegal.
  • the lightweight certificate further includes validity period information, and the preset certificate verification information is a certificate public key of the CA;
  • the sending terminal Before the sending terminal generates the sender message according to the lightweight certificate, the message signature, and the encoded message, the sending terminal further includes:
  • the sending terminal sends a certificate request to the CA, so that the CA performs signature processing on the validity period information of the CA certificate and the terminal public key according to the preset certificate private key, and obtains a certificate signature, and generates a lightweight according to the validity period information, the terminal public key and the certificate signature.
  • the sending terminal acquires a lightweight certificate sent by the CA;
  • the receiving terminal Before the receiving terminal verifies the certificate signature according to the preset certificate verification information and determines whether the lightweight certificate is legal, the receiving terminal further includes:
  • the receiving terminal sends a certificate verification request to the CA, so that the CA feeds back the certificate public key to the receiving terminal according to the certificate verification request;
  • the receiving terminal receives the certificate public key of the CA feedback.
  • the expiration date information may also be included in the lightweight certificate. Since the CA can set the expiration date for the certificate when the certificate is issued, the lightweight certificate is legal within the valid time specified in the validity period information. To increase security.
  • the issuance of the lightweight certificate is performed by the CA.
  • the sending terminal sends a certificate request to the CA. After receiving the certificate request, the CA signs the validity period of the CA certificate and the terminal public key according to the private key of the preset certificate.
  • the certificate is signed, the lightweight certificate is generated according to the validity period information, the terminal public key and the certificate signature, and the lightweight certificate is sent to the sending terminal; the sending terminal acquires the lightweight certificate sent by the CA.
  • the receiving terminal needs to send a certificate verification request to the CA first, so that the CA feeds back the certificate public key to the receiving terminal according to the certificate verification request, and the receiving terminal receives the certificate public key of the CA feedback for subsequent use of the certificate public key as a pre- Set the certificate verification information to verify the certificate signature to determine if the lightweight certificate is legal.
  • the X.509 certificate includes three parts: TBSCertificate, signatureAlgorithm, and signatureValue, where TBSCertificate includes validity information (Validity), and message signature verification information (Subject Public Key Info). Extension field (Extension), etc., and the obtained certificate signature can be placed in the Extension.
  • the lightweight certificate includes only the validity period information, the terminal public key and the certificate signature, so it is lightweight.
  • the byte size of the certificate is significantly smaller than the byte size of the X.509 certificate.
  • the receiving terminal performs one-side verification when verifying the lightweight certificate and the message signature, it is detailed by receiving the single-side flowchart of the terminal, as follows:
  • an embodiment of the present application provides a message processing method, including:
  • the receiving terminal receives the sending end information sent by the sending terminal, where the sending end message includes a lightweight certificate, an encoded message, and a message signature of the encoded message.
  • the receiving terminal receives the sending end message broadcasted by the sending terminal, and the sending end message includes a lightweight certificate, an encoded message, and a message signature of the encoded message.
  • the lightweight certificate includes the certificate signature, the validity period information, and the message signature verification.
  • the information is as described in the foregoing embodiment, wherein the message signature verification information is a terminal public key. It should be noted that the lightweight certificate may include other than the certificate signature, the validity period information, and the message signature verification information. Information is not limited.
  • the receiving terminal verifies the certificate signature in the lightweight certificate according to the certificate public key, and determines whether the certificate signature is correct. If yes, go to step 603; if it is wrong, go to step 605;
  • the certificate signature in the lightweight certificate is obtained by the CA using the certificate private key to sign the validity period information and the message signature verification information, and then according to the certificate.
  • the public key can verify the certificate signature to determine whether the certificate signature is correct. If the certificate signature is correct, it indicates that the lightweight certificate is legal, then step 603 is performed; if the certificate signature is incorrect, the lightweight certificate is indicated. If it is illegal, step 606 is performed.
  • the receiving terminal determines that the lightweight certificate is legal.
  • the receiving terminal determines that the lightweight certificate is legal.
  • the CA can set the expiration date for the certificate when the certificate is issued, and the validity period specified in the validity period information, the lightweight certificate is legal, thereby increasing security. Then, after verifying that the certificate signature is correct, before the receiving terminal determines that the lightweight certificate is legal, the receiving terminal also needs to determine whether the lightweight certificate at the current time is valid according to the validity period information. If the lightweight certificate is valid, the receiving terminal determines the location. The lightweight certificate is legal; if the lightweight certificate is invalid, the receiving terminal determines that the lightweight certificate is illegal.
  • the receiving terminal verifies whether the message signature is legal according to the message signature verification information, if the message signature is legal, step 605 is performed; if the message signature is illegal, step 606 is performed;
  • the receiving terminal obtains that the lightweight certificate is legal, and the receiving terminal obtains the message signature verification information (ie, the terminal public key) in the lightweight certificate, and verifies whether the message signature is legal according to the message signature verification information. If the message signature is legal, step 604 is performed; if the message signature is illegal, step 605 is performed.
  • the message signature verification information ie, the terminal public key
  • the receiving terminal processes the encoded message.
  • the encoded message in the sending end message may be decoded and the like.
  • the receiving terminal discards the sending end message.
  • the receiving terminal determines that the identity of the sending terminal is illegal or the encoded message is suspected of being falsified, and the receiving terminal directly discards the received sending end message to avoid performing unidentified sending.
  • the malicious indication of the terminal when the certificate signature is incorrect or the message signature is illegal, the receiving terminal determines that the identity of the sending terminal is illegal or the encoded message is suspected of being falsified, and the receiving terminal directly discards the received sending end message to avoid performing unidentified sending.
  • the malicious indication of the terminal is possible
  • the receiving terminal performs detailed verification of the lightweight certificate and the message signature, so that the receiving terminal and the sending terminal can implement message transmission while ensuring communication security.
  • the message processing method of the present application is introduced in the above embodiment, and the modular structure of the receiving terminal and the transmitting terminal is introduced below.
  • an embodiment of the present application provides a sending terminal, including:
  • the obtaining module 701 is configured to obtain an encoded message.
  • the signature module 702 is configured to perform signature processing on the encoded message to obtain a message signature.
  • the processing module 703 is configured to generate a sender message according to the lightweight certificate, the message signature, and the encoded message, where the lightweight certificate includes message signature verification information and a certificate signature, and the message signature verification information is used to verify the validity of the message signature.
  • the sending module 704 is configured to send the sending end message to the receiving terminal, so that the receiving terminal determines that the lightweight certificate is legal according to the preset certificate verification information verification certificate signature, and processes the encoded message when the message signature verification information verifies that the message signature is legal.
  • the sending terminal when the sending terminal obtains the message to be sent, the obtaining module 701 performs encoding processing on the message to be sent according to the preset encoding rule to obtain an encoded message, and the signature module 702 ensures the encoded message in the transmission process. Integrity and identity authentication of the sender, the encoded message needs to be signed and processed, and the message signature is obtained.
  • the processing module 703 attaches the message signature to the encoded message, and then carries the lightweight certificate issued by the CA in the encoded message to be sent.
  • the sending module 704 sends the sending end message to the receiving terminal by means of a broadcast, and the receiving terminal may be one or more.
  • the receiving terminal After the receiving terminal obtains the sending end message, the receiving terminal verifies the certificate signature according to the preset certificate verification information to determine whether the lightweight certificate is legal.
  • the preset certificate verification information is also issued by the CA to inform the receiving terminal in advance, and the lightweight certificate is legal. Then, the receiving terminal verifies whether the message signature is legal according to the message signature verification information in the lightweight certificate, and when the message signature is also legal, it indicates that the sender of the sender message passes the authentication, and the encoded message is guaranteed to be complete during transmission. Sex.
  • the sender message of the sending terminal carries a lightweight certificate, and the receiving terminal can complete the certificate and signature verification of the sender message through the certificate signature and the message signature verification information in the lightweight certificate, because the lightweight certificate only includes Message signature verification information and certificate signature.
  • the lightweight certificate occupies less than the CA certificate.
  • the size of the X.509 certificate is greater than 1000 bytes, and the size of the lightweight certificate. It can be 200 bytes or less, which reduces the overhead of the communication system, thereby improving system capacity and message transmission quality.
  • the signature module 702 is specifically configured to generate a message digest from the encoded message according to the preset hash function.
  • the signature module 702 is further configured to perform signature processing on the message digest according to the terminal private key to obtain a message signature.
  • the signature processing of the message by the signature module 702 is mainly divided into two steps.
  • the first step is that the signature module 702 extracts the digest information from the encoded message according to the preset hash function, thereby obtaining a message digest of the encoded message. Since the message transmission between the terminal and the terminal is generally in the broadcast mode in the communication system in which the wireless air interface exchanges frequently, the signature module 702 adopts an asymmetric encryption method for signature processing, and the asymmetric encryption method is specifically configured with a private secret.
  • the signature module 702 performs signature processing on the message digest according to the terminal private key to obtain a message signature, and the receiving terminal is a terminal known to correspond to the terminal private key.
  • the secret key is public, so the public key can be used to verify that the message signature is legal.
  • the message signature verification information is a terminal public key corresponding to the terminal private key.
  • the signature module 702 since the signature module 702 is known to perform signature processing on the message digest according to the terminal private key, the message signature verification information is used to verify the validity of the message signature, and the message signature verification information is naturally associated with the terminal.
  • the lightweight certificate further includes validity period information
  • the sending module 704 is further configured to send a certificate request to the CA, so that the CA performs signature processing on the validity period information of the CA certificate and the terminal public key according to the preset certificate private key, and obtains a certificate signature, according to the validity period information, the terminal public key, and The certificate signature generates a lightweight certificate and sends a lightweight certificate to the sending terminal;
  • the obtaining module 701 is further configured to obtain a lightweight certificate sent by the CA.
  • the expiration date information may also be included in the lightweight certificate. Since the CA can set the expiration date for the certificate when the certificate is issued, the lightweight certificate is legal within the valid time specified in the validity period information. To increase security.
  • the issuance of the lightweight certificate is performed by the CA.
  • the sending module 704 sends a certificate request to the CA. After receiving the certificate request, the CA signs the validity period of the CA certificate and the terminal public key according to the private key of the preset certificate. Processing, obtaining a certificate signature, generating a lightweight certificate according to the validity period information, the terminal public key and the certificate signature, and sending a lightweight certificate to the sending terminal; the obtaining module 701 acquires the lightweight certificate sent by the CA.
  • the X.509 certificate includes three parts: TBSCertificate, signatureAlgorithm, and signatureValue.
  • the TBSCertificate includes the validity period information, the message signature verification information (that is, the terminal public key), the extension field, and the like, and the obtained certificate.
  • the signature can be placed in the extension field.
  • the lightweight certificate only includes the validity period information, the terminal public key and the certificate signature, so the byte size of the lightweight certificate is significantly smaller than the X.509 certificate. Byte size.
  • an embodiment of the present application provides a receiving terminal, including:
  • the receiving module 801 is configured to receive the sending end information sent by the sending terminal, where the sending end message includes a lightweight certificate, an encoded message, and a message signature of the encoded message, where the lightweight certificate includes the message signature verification information and the certificate signature, and the message signature verification information Used to verify the legality of message signatures;
  • the verification module 802 is configured to verify the certificate signature according to the preset certificate verification information, and determine whether the lightweight certificate is legal;
  • the verification module 802 is further configured to verify, according to the message signature verification information, whether the signature of the message is legal when the lightweight certificate is legal;
  • the processing module 803 is further configured to process the encoded message when the message signature is legal.
  • the receiving module 801 receives the sending end information sent by the sending terminal, where the sending end message includes a lightweight certificate, an encoded message, and a message signature of the encoded message, and the lightweight certificate includes the message signature verification information and the certificate signature, and the message
  • the signature verification information is used to verify the validity of the message signature.
  • the verification module 802 verifies the certificate signature according to the preset certificate verification information, and determines whether the lightweight certificate is legal.
  • the preset certificate verification information is also issued by the CA to inform the receiving terminal in advance; If the level certificate is valid, the verification module 802 verifies whether the message signature is legal according to the message signature verification information; if the message signature is legal, it indicates that the sender of the sender message passes the authentication, and the integrity of the encoded message transmission process is processed. Module 803 processes the encoded message.
  • the sender message of the sending terminal carries a lightweight certificate, and the receiving terminal can complete the certificate and signature verification of the sender message through the certificate signature and the message signature verification information in the lightweight certificate, because the lightweight certificate only includes Message signature verification information and certificate signature.
  • the lightweight certificate occupies less than the CA certificate.
  • the size of the X.509 certificate is greater than 1000 bytes, and the size of the lightweight certificate. It can be 200 bytes or less, which reduces the overhead of the communication system, thereby improving system capacity and message transmission quality.
  • the preset certificate verification information is a certificate public key of the CA
  • the receiving terminal further includes:
  • the sending module 901 is configured to send a certificate verification request to the CA, so that the CA feeds back the certificate public key to the receiving terminal according to the certificate verification request;
  • the receiving module 801 is further configured to receive a certificate public key of the CA feedback.
  • the asymmetric encryption method is used for signature processing, and the asymmetric encryption method is specifically configured with a private key and a public key, since the CA is based on the pre- If the certificate private key is used to sign the terminal public key in the CA certificate and obtain the certificate signature, then if the certificate signature is verified to be correct, the CA certificate public key needs to be known for verification, so the sending module 901 needs First, the CA sends a certificate verification request to the CA, so that the CA feeds back the certificate public key to the receiving terminal according to the certificate verification request, and the receiving module 801 receives the certificate public key fed back by the CA for subsequent verification of the certificate public key as the preset certificate. Information to verify the certificate signature to determine if the lightweight certificate is legal.
  • the verification module 802 is further configured to verify the certificate signature in the lightweight certificate according to the certificate public key, and determine whether the certificate signature is correct;
  • the verification module 802 is further configured to determine that the lightweight certificate is legal when the certificate signature is correct;
  • the verification module 802 is further configured to determine that the lightweight certificate is illegal when the certificate is signed incorrectly.
  • the preset certificate verification information is the certificate public key
  • the certificate public key corresponds to the certificate private key used for the signature processing when the CA is signed by the certificate
  • the verification module 802 can be based on The certificate public key verifies the certificate signature in the lightweight certificate, and determines whether the certificate signature is correct. If the certificate signature is correct, the verification module 802 can determine that the lightweight certificate is legal; if the certificate signature is incorrect, the verification module can determine the light The level certificate is illegal.
  • the lightweight certificate further includes validity period information, where
  • the verification module 802 is further configured to determine, according to the validity period information, whether the lightweight certificate is valid when the certificate signature is correct;
  • the verification module 802 is further configured to determine that the lightweight certificate is legal when the lightweight certificate is valid;
  • the verification module 802 is further configured to determine that the lightweight certificate is illegal when the lightweight certificate is invalid.
  • the lightweight certificate may further include an expiration date information. Since the CA can set the expiration date for the certificate when the certificate is issued, and the expiration date specified in the validity period information, the lightweight certificate is legal. Thereby increasing security. Then, when the verification module 802 verifies that the certificate signature is correct, before the verification module 802 determines that the lightweight certificate is legal, the verification module 802 also needs to determine, according to the validity period information, whether the lightweight certificate at the current time is valid, and if the lightweight certificate is valid, The verification module 802 then determines that the lightweight certificate is legal; if the lightweight certificate is invalid, the verification module 802 determines that the lightweight certificate is illegal.
  • the processing module 803 is further configured to discard the sender message when the lightweight certificate is illegal.
  • the processing module 803 does not process the code in the sender message.
  • the message is processed in a direct discard manner.
  • the message signature verification information is a terminal public key
  • the verification module 802 is further configured to generate a message digest from the encoded message in the sending end information according to the preset hash function;
  • the verification module 802 is further configured to verify the message signature according to the public key of the terminal, and obtain a comparison summary;
  • the verification module 802 is further configured to compare the comparison summary with the message digest
  • the verification module 802 is further configured to: when the comparison digest is consistent with the message digest, determine that the message signature is legal;
  • the verification module 802 is further configured to determine that the message signature is illegal when the comparison digest is inconsistent with the message digest.
  • the message transmission between the terminal and the terminal generally adopts a broadcast mode, and then the asymmetric encryption method is used for signature processing, and the asymmetric encryption mode is specifically set.
  • the verification module 802 generates a message digest from the encoded message in the sender information according to the preset hash function, and the verification module is a terminal public key known to correspond to the terminal private key, so the verification module 802 can use the terminal public key.
  • the message signature is verified to obtain a comparison summary. If the comparison summary is consistent with the message digest, the verification module 802 determines that the message signature is legal; if the comparison digest is inconsistent with the message digest, the verification module 802 determines that the message signature is illegal.
  • the processing module 803 is further configured to discard the sender information when the message signature is illegal.
  • the processing module 803 does not process the encoded message in the sender message, and processes the sender message in a direct discard manner.
  • the embodiment of the present application provides a schematic diagram of signal interaction between a terminal device as a transmitting end and a terminal device as a receiving end, including:
  • the terminal device 11 at the transmitting end includes a processor 111 and a transceiver 112, and the processor 111 and the transceiver 112 are connected;
  • the transceiver 112 is configured to send, by the sending terminal, an encoded message.
  • the processor 111 is configured to perform signature processing on the encoded message to obtain a message signature.
  • the processor 111 is further configured to generate a sender message according to the lightweight certificate, the message signature, and the encoded message, where the lightweight certificate includes message signature verification information and a certificate signature, and the message signature verification information is used to verify the validity of the message signature;
  • the transceiver 112 is further configured to send the sender message to the receiving terminal, so that the receiving terminal determines that the lightweight certificate is legal according to the preset certificate verification information verification certificate signature, and processes the encoded message when the message signature verification information is verified according to the message signature verification information. ;
  • the terminal device 12 at the receiving end includes a processor 121 and a transceiver 122, and the processor 121 and the transceiver 122 are connected;
  • the transceiver 122 is configured to receive the sending end information sent by the sending terminal, where the sending end message includes a lightweight certificate, an encoded message, and a message signature of the encoded message, the lightweight certificate includes a message signature verification information and a certificate signature, and the message signature verification information Used to verify the legality of message signatures;
  • the processor 121 is configured to verify the certificate signature according to the preset certificate verification information, and determine whether the lightweight certificate is legal;
  • the processor 121 is further configured to: when the lightweight certificate is legal, verify that the message signature is legal according to the message signature verification information;
  • the processor 121 is further configured to process the encoded message when the message signature is legal.
  • the message transmission between the terminal device 11 at the transmitting end and the terminal device 12 at the receiving end is implemented by using various transceivers 112 and 122, and the sender message of the terminal device 11 carries a lightweight certificate.
  • the terminal device 12 can complete the certificate and signature verification of the sender message through the certificate signature and the message signature verification information in the lightweight certificate, because the lightweight certificate only contains the message signature verification information and the certificate signature, and the existing Compared with the CA certificate, the lightweight certificate occupies less than the CA certificate.
  • the size of the X.509 certificate is greater than 1000 bytes, and the size of the lightweight certificate can be less than 200 bytes, so that the communication system Reduced overhead, which increases system capacity and message transmission quality.
  • the present application also provides a computer readable storage medium having instructions stored therein that, when executed on a computer, cause the computer to perform the message processing methods described in the above embodiments.
  • the embodiment of the present application further provides a chip system, which includes a processor, and may further include a memory for implementing the message processing method described in the foregoing embodiments.
  • the memory may also be included in the processor.
  • the chip system can be composed of chips, and can also include chips and other discrete devices.
  • the memory includes a volatile memory, such as a random-access memory (RAM); the memory may also include a non-volatile memory, such as a fast A flash memory, a hard disk drive (HDD), or a solid-state drive (SSD); the memory may further include a combination of the above types of memories; the memory may further include any other device having a storage function. For example, a circuit, device, or software module.
  • the present application also provides a computer program product comprising instructions which, when executed on a computer, cause the computer to perform the message processing method described in the above embodiments.
  • the computer program product includes one or more computer instructions.
  • the computer can be a general purpose computer, a special purpose computer, a computer network, a terminal device, or other programmable device.
  • the computer instructions can be stored in a computer readable storage medium or transferred from one computer readable storage medium to another computer readable storage medium, for example, the computer instructions can be from a website site, computer, server or data center Transfer to another website site, computer, server, or data center by wire (eg, coaxial cable, fiber optic, digital subscriber line (DSL), or wireless (eg, infrared, wireless, microwave, etc.).
  • wire eg, coaxial cable, fiber optic, digital subscriber line (DSL), or wireless (eg, infrared, wireless, microwave, etc.).
  • the computer readable storage medium can be any available media that can be stored by a computer or a data storage device such as a server, data center, or the like that includes one or more available media.
  • the usable medium may be a magnetic medium (eg, a floppy disk, a hard disk, a magnetic tape), an optical medium (eg, a DVD), or a semiconductor medium (such as a solid state disk (SSD)).
  • the size of the sequence numbers of the foregoing processes does not mean the order of execution sequence, and the order of execution of each process should be determined by its function and internal logic, and should not be applied to the embodiment of the present application.
  • the implementation process constitutes any limitation.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本申请公开了消息处理方法及相关设备，用于减少通信系统的开销，从而提高了系统容量和消息传输质量。本申请实施例方法包括：发送终端获取编码消息；发送终端对编码消息进行签名处理，得到消息签名；发送终端根据轻量级证书、消息签名及编码消息，生成发送端消息，轻量级证书包括消息签名验证信息及证书签名，消息签名验证信息用于验证消息签名的合法性；发送终端将发送端消息发送至接收终端，使得接收终端根据预置证书验证信息验证证书签名确定轻量级证书合法，且根据消息签名验证信息验证消息签名合法时，处理编码消息。

Description

消息处理方法及相关设备
本申请要求于2017年8月31日提交中国专利局、申请号为201710772009.8、申请名称为“消息处理方法及相关设备”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及通信技术领域，具体涉及消息处理方法及相关设备。
背景技术
车联网是使用无线通信或者传感探测等技术收集车辆、道路及环境等信息，通过车-车(Vehicle-to-Vehicle，V2V)、车-道路设施(Vehicle-to-Infrastructure，V2I)及车-人(Vehicle-to-Pedestrian，V2P)之间的交互和共享，使车、人和基础设施之间智能协同与配合，从而实现智能交通管理控制、车辆智能化控制和智能动态信息服务的一体化网络，是物联网技术在智能交通系统领域的延伸。
车联网的通信系统中，消息一般采用广播发送，在广播场景下，路侧单元(Roadside Unit，RSU)和车辆的身份极易被仿冒。为了保证安全必须采用证书认证来保证身份的合法性，接收者通过证书来验证发送者消息签名来确保发送者身份的合法性。现有的证书认证方式为：使用发送终端的私钥对V2X(Vehicle-to-Everything)消息进行签名，并在V2X消息中携带证书(例如，X.509)；接收终端在接收到V2X消息时，用证书颁发中心(Certificate Authority，CA)中的公钥验证证书，如果验证的结果是合法证书，则用证书中的公钥进行V2X消息的签名验证，如果签名合法则处理，否则丢弃。
由于V2X消息的典型频率是10Hz，消息的平均长度是300字节左右，而X.509证书的大小为1000字节以上，那么证书签名的开销占V2X消息的1000/(1000+300)*100％＝76％，V2X消息增加了3.3倍，开销大意味着系统容量与没有签名情况相比大幅度下降，消息大就存在误包率高、发送速度慢及干扰大等问题。
发明内容
本申请提供消息处理方法及相关设备，发送终端的发送端消息中携带有轻量级证书，接收终端通过轻量级证书中的证书签名及消息签名验证信息即可完成发送端消息的证书和签名验证，轻量级证书占用的字节数小于CA证书，使得通信系统的开销减少，从而提高了系统容量和消息传输质量。
本申请第一方面提供一种消息处理方法，包括：
发送终端获取编码消息；
所述发送终端对所述编码消息进行签名处理，得到消息签名；
所述发送终端根据轻量级证书、所述消息签名及所述编码消息，生成发送端消息，所 述轻量级证书包括消息签名验证信息及证书签名，所述消息签名验证信息用于验证所述消息签名的合法性；
所述发送终端将所述发送端消息发送至接收终端，使得所述接收终端根据预置证书验证信息验证所述证书签名确定所述轻量级证书合法，且根据所述消息签名验证信息验证所述消息签名合法时，处理所述编码消息。
在无线空口频繁的消息交互的通信系统中，终端与终端之间的消息发送一般采用广播方式，例如车联网的通信系统中，V2V、V2I及V2P之间的交互和共享就是采用的广播方式，但是RSU和车辆身份极易被仿冒，因此需要通过证书来保证发送者身份的合法性，证书的获得渠道是从通信系统中的CA得到的。当发送终端获取到待发送的消息时，按照预置的编码规则对待发送的消息进行编码处理，得到编码消息，发送终端为了保证编码消息在传输过程中的完整性和发送者的身份认证，需要对编码消息进行签名处理，得到消息签名，在编码消息上附上消息签名，然后将CA颁布的轻量级证书携带于编码消息中，得到发送端消息，将发送端消息通过广播方式发送到接收终端，接收终端可以是一个或多个。使得接收终端在获取到发送端消息之后，根据预置证书验证信息验证证书签名确定轻量级证书是否合法，预置证书验证信息也是CA颁布预先告知接收终端的，在轻量级证书合法的情况下，接收终端再根据轻量级证书中的消息签名验证信息验证消息签名是否合法，消息签名也合法时，就表示发送端消息的发送方的身份验证通过，并且编码消息传输过程中保证了完整性。发送终端的发送端消息中携带有轻量级证书，接收终端通过轻量级证书中的证书签名及消息签名验证信息即可完成发送端消息的证书和签名验证，由于轻量级证书只包含了消息签名验证信息和证书签名，与现有的CA证书相比，轻量级证书占用的字节数小于CA证书，例如，X.509证书的大小大于1000字节，而轻量级证书的大小可以做到200字节以下，使得通信系统的开销减少，从而提高了系统容量和消息传输质量。
结合本申请第一方面，本申请第一方面第一实施方式中，所述发送终端对所述编码消息进行签名处理，得到消息签名，包括：
所述发送终端根据预置哈希函数从所述编码消息中生成消息摘要；
所述发送终端根据终端私有密钥对所述消息摘要进行签名处理，得到消息签名。
对消息的签名处理主要分为两步，第一步是根据预置哈希函数从编码消息中提取出摘要信息，从而得到编码消息的消息摘要，由于在无线空口频繁的消息交互的通信系统中，终端与终端之间的消息发送一般采用广播方式，那么采用的是非对称加密方式进行签名处理，非对称加密方式具体是设置有私有秘钥和公开秘钥，由于接收方需要验证发送方的身份，那么发送终端根据终端私有密钥对消息摘要进行签名处理，得到消息签名，而接收终端是已知与终端私有密钥对应的终端公开秘钥的，因此可以使用公开秘钥来验证消息签名是否合法。
结合本申请第一方面第一实施方式，本申请第一方面第二实施方式中，所述消息签名验证信息为所述终端私有密钥对应的终端公开密钥。
在上述第一方面第一实施方式中，由于已知了发送终端是根据终端私有密钥对消息摘要进行签名处理的，那么消息签名验证信息用于验证消息签名的合法性，消息签名验证信 息自然就是与终端私有密钥对应的终端公开密钥。
结合本申请第一方面第二实施方式，本申请第一方面第三实施方式中，所述轻量级证书还包括有效期信息，
所述发送终端根据轻量级证书、所述消息签名及所述编码消息，生成发送端消息之前，还包括：
所述发送终端向CA发送证书请求，使得所述CA根据预置证书私有秘钥对所述CA证书的有效期信息及终端公开秘钥进行签名处理，得到证书签名，根据所述有效期信息、所述终端公开秘钥及所述证书签名生成轻量级证书，并向所述发送终端发送所述轻量级证书；
所述发送终端获取所述CA发送的所述轻量级证书。
在轻量级证书中还可以包括有效期信息，由于CA在颁布证书的时候，可以为证书设置使用期限，有效期信息规定的有效时间之内，轻量级证书才是合法的，从而增加安全性。而轻量级证书的颁发是由CA执行的，发送终端向CA发送证书请求，CA在接收到证书请求之后，根据预置证书私有秘钥对CA证书的有效期信息及终端公开秘钥进行签名处理，得到证书签名，根据有效期信息、终端公开秘钥及证书签名生成轻量级证书，并向发送终端发送轻量级证书；发送终端获取CA发送的轻量级证书。以X.509证书为例，X.509证书中包括TBSCertificate、signatureAlgorithm、signatureValue三个部分，其中TBSCertificate包括有效期信息(Validity)、消息签名验证信息(即终端公开秘钥)(Subject Public Key Info)、扩展字段(Extension)等等，而得到的证书签名可以放入Extension中，与X.509证书相比，轻量级证书中只包括了有效期信息、终端公开秘钥和证书签名，因此轻量级证书的字节大小明显小于X.509证书的字节大小。
本申请第二方面提供一种消息处理方法，包括：
接收终端接收发送终端发送的发送端信息，所述发送端消息包括轻量级证书、编码消息及所述编码消息的消息签名，所述轻量级证书包括消息签名验证信息及证书签名，所述消息签名验证信息用于验证所述消息签名的合法性；
所述接收终端根据预置证书验证信息验证所述证书签名，确定所述轻量级证书是否合法；
若所述轻量级证书合法，则所述接收终端根据所述消息签名验证信息验证所述消息签名是否合法；
若所述消息签名合法，则所述接收终端处理所述编码消息。
在无线空口频繁的消息交互的通信系统中，终端与终端之间的消息发送一般采用广播方式，例如车联网的通信系统中，V2V、V2I及V2P之间的交互和共享就是采用的广播方式，但是RSU和车辆身份极易被仿冒，因此需要通过证书来保证发送者身份的合法性，证书的获得渠道是从通信系统中的CA得到的。接收终端接收发送终端发送的发送端信息，发送端消息包括轻量级证书、编码消息及编码消息的消息签名，轻量级证书包括消息签名验证信息及证书签名，消息签名验证信息用于验证消息签名的合法性，接收终端根据预置证书验证信息验证证书签名，确定轻量级证书是否合法，预置证书验证信息也是CA颁布预先告知接收终端的；如果轻量级证书合法，则接收终端根据消息签名验证信息验证消息签名是否 合法；若消息签名合法，就表示发送端消息的发送方的身份验证通过，并且编码消息传输过程中保证了完整性，则接收终端处理编码消息。发送终端的发送端消息中携带有轻量级证书，接收终端通过轻量级证书中的证书签名及消息签名验证信息即可完成发送端消息的证书和签名验证，由于轻量级证书只包含了消息签名验证信息和证书签名，与现有的CA证书相比，轻量级证书占用的字节数小于CA证书，例如，X.509证书的大小大于1000字节，而轻量级证书的大小可以做到200字节以下，使得通信系统的开销减少，从而提高了系统容量和消息传输质量。
结合本申请第二方面，本申请第二方面第一实施方式中，所述预置证书验证信息为CA的证书公开秘钥，
所述接收终端根据预置证书验证信息验证所述证书签名，确定所述轻量级证书是否合法之前，还包括：
所述接收终端向所述CA发送证书验证请求，使得所述CA根据所述证书验证请求向所述接收终端反馈证书公开秘钥；
所述接收终端接收所述CA反馈的证书公开秘钥。
由于在无线空口频繁的消息交互的通信系统中，采用的是非对称加密方式进行签名处理，非对称加密方式具体是设置有私有秘钥和公开秘钥，由于CA是根据预置证书私有秘钥对CA证书中的终端公开秘钥进行签名处理，得到证书签名的，那么要验证证书签名是否正确的话，就需要知道CA的证书公开秘钥来进行验证，因此接收终端需要先向CA发送证书验证请求，使得CA根据证书验证请求向接收终端反馈证书公开秘钥，接收终端接收到CA反馈的证书公开秘钥，以用于后续将证书公开秘钥作为预置证书验证信息来验证证书签名，从而确定轻量级证书是否合法。
结合本申请第二方面第一实施方式，本申请第二方面第二实施方式中，所述接收终端根据预置证书验证信息验证所述证书签名，确定所述轻量级证书是否合法，包括：
所述接收终端根据证书公开秘钥对所述轻量级证书中的所述证书签名进行验证，判断所述证书签名是否正确；
若所述证书签名正确，则所述接收终端确定所述轻量级证书合法；
若所述证书签名错误，则所述接收终端确定所述轻量级证书非法。
上述第二方面第一实施方式中，接收终端已知了预置证书验证信息就是证书公开秘钥，而且证书公开秘钥与CA得到证书签名时进行签名处理采用的证书私有秘钥是对应的，那么接收终端可以根据证书公开秘钥对轻量级证书中的证书签名进行验证，判断证书签名是否正确，如果证书签名正确，那么可以确定轻量级证书合法；如果证书签名错误，那么可以确定轻量级证书非法。
结合本申请第二方面第二实施方式，本申请第二方面第三实施方式中，所述轻量级证书还包括有效期信息，
所述接收终端确定所述轻量级证书合法之前，还包括：
当所述证书签名正确时，所述接收终端根据所述有效期信息判断所述轻量级证书是否有效；
若所述轻量级证书有效，则所述接收终端确定所述轻量级证书合法；
若所述轻量级证书无效，则所述接收终端确定所述轻量级证书非法。
轻量级证书中还可以包括有效期信息，由于CA在颁布证书的时候，可以为证书设置使用期限，有效期信息规定的有效时间之内，轻量级证书才是合法的，从而增加安全性。那么在验证了证书签名正确时，接收终端确定轻量级证书合法之前，还需要接收终端根据有效期信息判断处于当前时间的轻量级证书是否有效，如果轻量级证书有效，那么接收终端确定所述轻量级证书合法；如果轻量级证书无效，那么接收终端确定所述轻量级证书非法。
结合本申请第二方面第三实施方式，本申请第二方面第四实施方式中，所述接收终端确定所述轻量级证书非法之后，还包括：
所述接收终端丢弃所述发送端消息。
在接收终端确定了轻量级证书是非法的之后，表明接收到的发送端消息的发送者身份是不合法的，那么接收终端不会处理发送端消息中的编码消息，采用直接丢弃的方式处理发送端消息。
结合本申请第二方面、第二方面第一实施方式、第二方面第二实施方式、第二方面第三实施方式或第二方面第四实施方式，本申请第二方面第五实施方式中，所述消息签名验证信息为终端公开秘钥；
所述接收终端根据所述消息签名验证信息验证所述消息签名是否合法，包括：
所述接收终端根据预置哈希函数从所述发送端信息中的所述编码消息中生成消息摘要；
所述接收终端根据所述终端公开密钥对所述消息签名进行验证，得到对比摘要；
所述接收终端将所述对比摘要与所述消息摘要进行比对；
若所述对比摘要与所述消息摘要一致，则所述接收终端确定所述消息签名合法；
若所述对比摘要与所述消息摘要不一致，则所述接收终端确定所述消息签名非法。
由于在无线空口频繁的消息交互的通信系统中，终端与终端之间的消息发送一般采用广播方式，那么采用的是非对称加密方式进行签名处理，非对称加密方式具体是设置有私有秘钥和公开秘钥，由于接收方需要验证发送方的身份，那么发送终端是根据终端私有密钥对消息摘要进行签名处理得到的消息签名，那么消息签名验证信息为终端公开秘钥，接收终端根据预置哈希函数从发送端信息中的编码消息中生成消息摘要,接收终端是已知与终端私有密钥对应的终端公开秘钥的，因此可以使用终端公开密钥对消息签名进行验证，得到对比摘要，如果对比摘要与消息摘要一致，则确定消息签名合法；如果对比摘要与消息摘要不一致，则接收终端确定消息签名非法。
结合本申请第二方面第五实施方式，本申请第二方面第六实施方式中，所述接收终端确定所述消息签名非法之后，还包括：
所述接收终端丢弃所述发送端信息。
在接收终端确定了轻量级证书是合法的，并且确定消息签名是非法的之后，表明接收到的发送端消息的发送者身份是不合法的，或者编码消息在传输过程中改变了，那么接收终端不会处理发送端消息中的编码消息，采用直接丢弃的方式处理发送端消息。
本申请第三方面提供一种发送终端，包括：
获取模块，用于获取编码消息；
签名模块，用于对所述编码消息进行签名处理，得到消息签名；
处理模块，用于根据轻量级证书、所述消息签名及所述编码消息，生成发送端消息，所述轻量级证书包括消息签名验证信息及证书签名，所述消息签名验证信息用于验证所述消息签名的合法性；
发送模块，用于将所述发送端消息发送至接收终端，使得所述接收终端根据预置证书验证信息验证所述证书签名确定所述轻量级证书合法，且根据所述消息签名验证信息验证所述消息签名合法时，处理所述编码消息。
在无线空口频繁的消息交互的通信系统中，终端与终端之间的消息发送一般采用广播方式，例如车联网的通信系统中，V2V、V2I及V2P之间的交互和共享就是采用的广播方式，但是RSU和车辆身份极易被仿冒，因此需要通过证书来保证发送者身份的合法性，证书的获得渠道是从通信系统中的CA得到的。当发送终端获取到待发送的消息时，获取模块按照预置的编码规则对待发送的消息进行编码处理，得到编码消息，签名模块为了保证编码消息在传输过程中的完整性和发送者的身份认证，需要对编码消息进行签名处理，得到消息签名，处理模块在编码消息上附上消息签名，然后将CA颁布的轻量级证书携带于编码消息中，得到发送端消息，发送模块将发送端消息通过广播方式发送到接收终端，接收终端可以是一个或多个。使得接收终端在获取到发送端消息之后，根据预置证书验证信息验证证书签名确定轻量级证书是否合法，预置证书验证信息也是CA颁布预先告知接收终端的，在轻量级证书合法的情况下，接收终端再根据轻量级证书中的消息签名验证信息验证消息签名是否合法，消息签名也合法时，就表示发送端消息的发送方的身份验证通过，并且编码消息传输过程中保证了完整性。发送终端的发送端消息中携带有轻量级证书，接收终端通过轻量级证书中的证书签名及消息签名验证信息即可完成发送端消息的证书和签名验证，由于轻量级证书只包含了消息签名验证信息和证书签名，与现有的CA证书相比，轻量级证书占用的字节数小于CA证书，例如，X.509证书的大小大于1000字节，而轻量级证书的大小可以做到200字节以下，使得通信系统的开销减少，从而提高了系统容量和消息传输质量。
结合本申请第三方面，本申请第三方面第一实施方式中，
所述签名模块，具体用于根据预置哈希函数从所述编码消息中生成消息摘要；
所述签名模块，还用于根据终端私有密钥对所述消息摘要进行签名处理，得到消息签名。
签名模块对消息的签名处理主要分为两步，第一步是签名模块根据预置哈希函数从编码消息中提取出摘要信息，从而得到编码消息的消息摘要，由于在无线空口频繁的消息交互的通信系统中，终端与终端之间的消息发送一般采用广播方式，那么签名模块采用的是非对称加密方式进行签名处理，非对称加密方式具体是设置有私有秘钥和公开秘钥，由于接收方需要验证发送方的身份，那么签名模块根据终端私有密钥对消息摘要进行签名处理，得到消息签名，而接收终端是已知与终端私有密钥对应的终端公开秘钥的，因此可以使用 公开秘钥来验证消息签名是否合法。
结合本申请第三方面第一实施方式，本申请第三方面第二实施方式中，所述消息签名验证信息为所述终端私有密钥对应的终端公开密钥。
在上述第三方面第一实施方式中，由于已知了签名模块是根据终端私有密钥对消息摘要进行签名处理的，那么消息签名验证信息用于验证消息签名的合法性，消息签名验证信息自然就是与终端私有密钥对应的终端公开密钥。
结合本申请第三方面第二实施方式，本申请第三方面第三实施方式中，所述轻量级证书还包括有效期信息，
所述发送模块，还用于向CA发送证书请求，使得所述CA根据预置证书私有秘钥对所述CA证书的有效期信息及终端公开秘钥进行签名处理，得到证书签名，根据所述有效期信息、所述终端公开秘钥及所述证书签名生成轻量级证书，并向所述发送终端发送所述轻量级证书；
所述获取模块，还用于获取所述CA发送的所述轻量级证书。
在轻量级证书中还可以包括有效期信息，由于CA在颁布证书的时候，可以为证书设置使用期限，有效期信息规定的有效时间之内，轻量级证书才是合法的，从而增加安全性。而轻量级证书的颁发是由CA执行的，发送模块向CA发送证书请求，CA在接收到证书请求之后，根据预置证书私有秘钥对CA证书的有效期信息及终端公开秘钥进行签名处理，得到证书签名，根据有效期信息、终端公开秘钥及证书签名生成轻量级证书，并向发送终端发送轻量级证书；获取模块获取CA发送的轻量级证书。以X.509证书为例，X.509证书中包括TBSCertificate、signatureAlgorithm、signatureValue三个部分，其中TBSCertificate包括有效期信息、消息签名验证信息(即终端公开秘钥)、扩展字段等等，而得到的证书签名可以放入扩展字段中，与X.509证书相比，轻量级证书中只包括了有效期信息、终端公开秘钥和证书签名，因此轻量级证书的字节大小明显小于X.509证书的字节大小。
本申请第四方面提供一种接收终端，包括：
接收模块，用于接收发送终端发送的发送端信息，所述发送端消息包括轻量级证书、编码消息及所述编码消息的消息签名，所述轻量级证书包括消息签名验证信息及证书签名，所述消息签名验证信息用于验证所述消息签名的合法性；
验证模块，用于根据预置证书验证信息验证所述证书签名，确定所述轻量级证书是否合法；
所述验证模块，还用于当所述轻量级证书合法时，根据所述消息签名验证信息验证所述消息签名是否合法；
处理模块，还用于当所述消息签名合法时，处理所述编码消息。
在无线空口频繁的消息交互的通信系统中，终端与终端之间的消息发送一般采用广播方式，例如车联网的通信系统中，V2V、V2I及V2P之间的交互和共享就是采用的广播方式，但是RSU和车辆身份极易被仿冒，因此需要通过证书来保证发送者身份的合法性，证书的获得渠道是从通信系统中的CA得到的。接收模块接收发送终端发送的发送端信息，发送端消息包括轻量级证书、编码消息及编码消息的消息签名，轻量级证书包括消息签名验证信 息及证书签名，消息签名验证信息用于验证消息签名的合法性，验证模块根据预置证书验证信息验证证书签名，确定轻量级证书是否合法，预置证书验证信息也是CA颁布预先告知接收终端的；如果轻量级证书合法，则验证模块根据消息签名验证信息验证消息签名是否合法；若消息签名合法，就表示发送端消息的发送方的身份验证通过，并且编码消息传输过程中保证了完整性，则处理模块处理编码消息。发送终端的发送端消息中携带有轻量级证书，接收终端通过轻量级证书中的证书签名及消息签名验证信息即可完成发送端消息的证书和签名验证，由于轻量级证书只包含了消息签名验证信息和证书签名，与现有的CA证书相比，轻量级证书占用的字节数小于CA证书，例如，X.509证书的大小大于1000字节，而轻量级证书的大小可以做到200字节以下，使得通信系统的开销减少，从而提高了系统容量和消息传输质量。
结合本申请第四方面，本申请第四方面第一实施方式中，所述预置证书验证信息为CA的证书公开秘钥，所述接收终端还包括：
发送模块，用于向所述CA发送证书验证请求，使得所述CA根据所述证书验证请求向所述接收终端反馈证书公开秘钥；
所述接收模块，还用于接收所述CA反馈的证书公开秘钥。
由于在无线空口频繁的消息交互的通信系统中，采用的是非对称加密方式进行签名处理，非对称加密方式具体是设置有私有秘钥和公开秘钥，由于CA是根据预置证书私有秘钥对CA证书中的终端公开秘钥进行签名处理，得到证书签名的，那么要验证证书签名是否正确的话，就需要知道CA的证书公开秘钥来进行验证，因此发送模块需要先向CA发送证书验证请求，使得CA根据证书验证请求向接收终端反馈证书公开秘钥，接收模块接收到CA反馈的证书公开秘钥，以用于后续将证书公开秘钥作为预置证书验证信息来验证证书签名，从而确定轻量级证书是否合法。
结合本申请第四方面第一实施方式，本申请第四方面第二实施方式中，
所述验证模块，还用于根据证书公开秘钥对所述轻量级证书中的所述证书签名进行验证，判断所述证书签名是否正确；
所述验证模块，还用于当所述证书签名正确时，确定所述轻量级证书合法；
所述验证模块，还用于当所述证书签名错误时，确定所述轻量级证书非法。
上述第四方面第一实施方式中，接收终端已知了预置证书验证信息就是证书公开秘钥，而且证书公开秘钥与CA得到证书签名时进行签名处理采用的证书私有秘钥是对应的，那么验证模块可以根据证书公开秘钥对轻量级证书中的证书签名进行验证，判断证书签名是否正确，如果证书签名正确，那么验证模块可以确定轻量级证书合法；如果证书签名错误，那么验证模块可以确定轻量级证书非法。
结合本申请第四方面第二实施方式，本申请第四方面第三实施方式中，所述轻量级证书还包括有效期信息，
所述验证模块，还用于当所述证书签名正确时，根据所述有效期信息判断所述轻量级证书是否有效；
所述验证模块，还用于当所述轻量级证书有效时，确定所述轻量级证书合法；
所述验证模块，还用于当所述轻量级证书无效时，确定所述轻量级证书非法。
轻量级证书中还可以包括有效期信息，由于CA在颁布证书的时候，可以为证书设置使用期限，有效期信息规定的有效时间之内，轻量级证书才是合法的，从而增加安全性。那么在验证模块验证了证书签名正确时，验证模块确定轻量级证书合法之前，还需要验证模块根据有效期信息判断处于当前时间的轻量级证书是否有效，如果轻量级证书有效，那么验证模块确定所述轻量级证书合法；如果轻量级证书无效，那么验证模块确定所述轻量级证书非法。
结合本申请第四方面第三实施方式，本申请第四方面第四实施方式中，
所述处理模块，还用于当所述轻量级证书非法时，丢弃所述发送端消息。
在验证模块确定了轻量级证书是非法的之后，表明接收到的发送端消息的发送者身份是不合法的，那么处理模块不会处理发送端消息中的编码消息，采用直接丢弃的方式处理发送端消息。
结合本申请第四方面、第四方面第一实施方式、第四方面第二实施方式、第四方面第三实施方式或第四方面第四实施方式，本申请第四方面第五实施方式中，所述消息签名验证信息为终端公开秘钥；
所述验证模块，还用于根据预置哈希函数从所述发送端信息中的所述编码消息中生成消息摘要；
所述验证模块，还用于根据所述终端公开密钥对所述消息签名进行验证，得到对比摘要；
所述验证模块，还用于将所述对比摘要与所述消息摘要进行比对；
所述验证模块，还用于当所述对比摘要与所述消息摘要一致时，确定所述消息签名合法；
所述验证模块，还用于当所述对比摘要与所述消息摘要不一致时，确定所述消息签名非法。
由于在无线空口频繁的消息交互的通信系统中，终端与终端之间的消息发送一般采用广播方式，那么采用的是非对称加密方式进行签名处理，非对称加密方式具体是设置有私有秘钥和公开秘钥，由于接收方需要验证发送方的身份，那么发送终端是根据终端私有密钥对消息摘要进行签名处理得到的消息签名，那么消息签名验证信息为终端公开秘钥，验证模块根据预置哈希函数从发送端信息中的编码消息中生成消息摘要,验证模块是已知与终端私有密钥对应的终端公开秘钥的，因此验证模块可以使用终端公开密钥对消息签名进行验证，得到对比摘要，如果对比摘要与消息摘要一致，则验证模块确定消息签名合法；如果对比摘要与消息摘要不一致，则验证模块确定消息签名非法。
结合本申请第四方面第五实施方式，本申请第四方面第六实施方式中，所述接收终端确定所述消息签名非法之后，还包括：
所述处理模块，还用于当所述消息签名非法时，丢弃所述发送端信息。
在验证模块确定了轻量级证书是合法的，并且确定消息签名是非法的之后，表明接收到的发送端消息的发送者身份是不合法的，或者编码消息在传输过程中改变了，那么处理 模块不会处理发送端消息中的编码消息，采用直接丢弃的方式处理发送端消息。
本申请第五方面提供一种终端设备，其特征在于，包括：
处理器和收发器，所述处理器和所述收发器相连接；
所述收发器，用于发送终端获取编码消息；
所述处理器，用于对所述编码消息进行签名处理，得到消息签名；
所述处理器，还用于根据轻量级证书、所述消息签名及所述编码消息，生成发送端消息，所述轻量级证书包括消息签名验证信息及证书签名，所述消息签名验证信息用于验证所述消息签名的合法性；
所述收发器，还用于将所述发送端消息发送至接收终端，使得所述接收终端根据预置证书验证信息验证所述证书签名确定所述轻量级证书合法，且根据所述消息签名验证信息验证所述消息签名合法时，处理所述编码消息。
在无线空口频繁的消息交互的通信系统中，终端与终端之间的消息发送一般采用广播方式，例如车联网的通信系统中，V2V、V2I及V2P之间的交互和共享就是采用的广播方式，但是RSU和车辆身份极易被仿冒，因此需要通过证书来保证发送者身份的合法性，证书的获得渠道是从通信系统中的CA得到的。当发送终端获取到待发送的消息时，收发器按照预置的编码规则对待发送的消息进行编码处理，得到编码消息，处理器为了保证编码消息在传输过程中的完整性和发送者的身份认证，需要对编码消息进行签名处理，得到消息签名，处理器在编码消息上附上消息签名，然后将CA颁布的轻量级证书携带于编码消息中，得到发送端消息，收发器将发送端消息通过广播方式发送到接收终端，接收终端可以是一个或多个。使得接收终端在获取到发送端消息之后，根据预置证书验证信息验证证书签名确定轻量级证书是否合法，预置证书验证信息也是CA颁布预先告知接收终端的，在轻量级证书合法的情况下，接收终端再根据轻量级证书中的消息签名验证信息验证消息签名是否合法，消息签名也合法时，就表示发送端消息的发送方的身份验证通过，并且编码消息传输过程中保证了完整性。发送终端的发送端消息中携带有轻量级证书，接收终端通过轻量级证书中的证书签名及消息签名验证信息即可完成发送端消息的证书和签名验证，由于轻量级证书只包含了消息签名验证信息和证书签名，与现有的CA证书相比，轻量级证书占用的字节数小于CA证书，例如，X.509证书的大小大于1000字节，而轻量级证书的大小可以做到200字节以下，使得通信系统的开销减少，从而提高了系统容量和消息传输质量。
本申请第六方面一种终端设备，其特征在于，包括：
处理器和收发器，所述处理器和所述收发器相连接；
所述收发器，用于接收发送终端发送的发送端信息，所述发送端消息包括轻量级证书、编码消息及所述编码消息的消息签名，所述轻量级证书包括消息签名验证信息及证书签名，所述消息签名验证信息用于验证所述消息签名的合法性；
所述处理器，用于根据预置证书验证信息验证所述证书签名，确定所述轻量级证书是否合法；
所述处理器，还用于当所述轻量级证书合法时，根据所述消息签名验证信息验证所述消息签名是否合法；
所述处理器，还用于当所述消息签名合法时，处理所述编码消息。
在无线空口频繁的消息交互的通信系统中，终端与终端之间的消息发送一般采用广播方式，例如车联网的通信系统中，V2V、V2I及V2P之间的交互和共享就是采用的广播方式，但是RSU和车辆身份极易被仿冒，因此需要通过证书来保证发送者身份的合法性，证书的获得渠道是从通信系统中的CA得到的。收发器接收发送终端发送的发送端信息，发送端消息包括轻量级证书、编码消息及编码消息的消息签名，轻量级证书包括消息签名验证信息及证书签名，消息签名验证信息用于验证消息签名的合法性，处理器根据预置证书验证信息验证证书签名，确定轻量级证书是否合法，预置证书验证信息也是CA颁布预先告知接收终端的；如果轻量级证书合法，则处理器根据消息签名验证信息验证消息签名是否合法；若消息签名合法，就表示发送端消息的发送方的身份验证通过，并且编码消息传输过程中保证了完整性，则处理器处理编码消息。发送终端的发送端消息中携带有轻量级证书，接收终端通过轻量级证书中的证书签名及消息签名验证信息即可完成发送端消息的证书和签名验证，由于轻量级证书只包含了消息签名验证信息和证书签名，与现有的CA证书相比，轻量级证书占用的字节数小于CA证书，例如，X.509证书的大小大于1000字节，而轻量级证书的大小可以做到200字节以下，使得通信系统的开销减少，从而提高了系统容量和消息传输质量。
本申请第七方面提供一种计算机可读存储介质，包括指令，当其在计算机上运行时，使得计算机执行上述的消息处理方法。
本申请第八方面提供一种包含指令的计算机程序产品，当其在计算机上运行时，使得计算机执行上述的消息处理方法。
附图说明
图1为本申请提供的车联网的通信系统的交互示意图；
图2为本申请提供的车联网的一种场景的消息传输示意图；
图3为本申请提供的车联网的另一种场景的消息传输示意图；
图4为本申请提供的车联网的又一种场景的消息传输示意图；
图5为本申请提供的消息处理方法的一个实施例信令交互示意图；
图6为本申请提供的消息处理方法的接收终端侧的实施例流程示意图；
图7为本申请提供的发送终端的一个实施例结构示意图；
图8为本申请提供的接收终端的一个实施例结构示意图；
图9为本申请提供的接收终端的另一个实施例结构示意图；
图10为本申请提供的发送端和接收端的终端设备的实施例结构示意图。
具体实施方式
本申请提供消息处理方法及相关设备，发送终端的发送端消息中携带有轻量级证书，接收终端通过轻量级证书中的证书签名及消息签名验证信息即可完成发送端消息的证书和 签名验证，轻量级证书占用的字节数小于CA证书，使得通信系统的开销减少，从而提高了系统容量和消息传输质量。
下面将结合本申请实施例中的附图，对本申请实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例仅仅是本申请一部分实施例，而不是全部的实施例。基于本申请中的实施例，本领域技术人员在没有作出创造性劳动前提下所获取的所有其他实施例，都属于本申请保护的范围。
在无线空口频繁的消息交互的通信系统中，终端与终端之间的消息发送一般采用广播方式，例如图1所示为车联网的通信系统框架，车联网是车与一切事物相联的网络(Vehicle to Everything，V2X)，车联网主要包括4个应用场景：车-互联网互连(Vehicle-to-Network，V2N)、V2V、V2I及V2P。通过V2V、V2I及V2P之间的交互和共享，使车、人和基础设施之间智能协同与配合，从而实现智能交通管理控制、车辆智能化控制和智能动态信息服务的一体化网络，是物联网技术在智能交通系统领域的延伸。
车联网的通信系统中，消息一般采用广播发送，在广播场景下，路侧单元(Roadside Unit，RSU)和车辆的身份极易被仿冒。如图2所示，恶意用户假冒RSU，向所有车辆的终端(V_UE)和行人的终端上广播“前方绿灯，可通行”的信息，而实际情况是红灯，那么就会照成交通事故。如图3所示，恶意用户假冒其他车辆，向周围的车辆发送“前车急刹车”信息，会引发交通问题。从图2和图3所示的例子可知为了保证通信安全必须采用证书认证来保证身份的合法性，由于在无线空口频繁的消息交互的通信系统中，终端与终端之间的消息发送一般采用广播方式，那么采用的是非对称加密方式进行签名处理。现有的方式如图4所示，具体为：1、发送V2X消息的V_UE A终端在发送V2X消息时，用私有密钥对V2X消息进行签名，并附上CA颁布的CA证书；2、接收V2X消息的V_UE B终端在接收到V2X消息时，用CA证书的公开秘钥验证CA证书，如果验证的结果是合法CA证书，则用CA证书中的公开秘钥进行消息的签名验证，如果签名合法则处理，否则丢弃。
以上的方法虽然保证了身份的合法性，但是现有的CA证书所占用的字节一般比较大，例如，基于X.509的证书，大小1000字节以上，一般应用于Internet用户认证是没有问题的，但是如果应用于频繁发送的消息签名必定添加开销，特别是当应用于空口的消息签名和验证，证书的大小决定了系统的开销，例如，对于车联网，使用终端的私钥对V2X消息进行签名，需要在每一个消息中携带证书，V2X消息的典型频率是10Hz，消息的平均长度是300字节左右。使用现有的X.509证书方式，消息增加了3.3倍(1300/300-1＝3.3)，由于消息的增大，车联网的通信系统的开销增大，意味着整个系统容量大幅度下降，消息大就存在误包率高、发送速度慢、干扰大等问题，严重影响了消息传输质量。
基于以上的描述，下面通过实施例介绍一种消息处理方法用于减小证书的大小，从而降低通信系统的开销，提高消息传输质量。
请参阅图5，本申请实施例提供一种消息处理方法，包括：
501、发送终端获取编码消息；
本实施例中，以图5所示的车联网的通信系统为例，发送终端和接收终端可以是人操作的智能设备、RSU或者车辆设备中的任一一种，当发送终端获取到待发送的消息时，按 照预置的编码规则对待发送的消息进行编码处理，得到编码消息。
502、发送终端对编码消息进行签名处理，得到消息签名；
本实施例中，发送终端为了保证编码消息在传输过程中的完整性和发送者的身份认证，需要对编码消息进行签名处理，得到消息签名。
503、发送终端根据轻量级证书、消息签名及所述编码消息，生成发送端消息，轻量级证书包括消息签名验证信息及证书签名，消息签名验证信息用于验证消息签名的合法性；
本实施例中，轻量级证书是CA预先颁发的，轻量级证书只包含了消息签名验证信息和证书签名，消息签名验证信息用于验证消息签名的合法性，由于证书签名是由CA进行签名处理得到的，那么用于验证证书签名的证书验证信息必然会公布给所有的接收终端，在编码消息上附上消息签名，然后将轻量级证书携带于编码消息中，得到发送端消息。
504、发送终端将发送端消息发送至接收终端，接收终端接收发送终端发送的发送端信息；
本实施例中，发送终端通过广播方式发送发送端消息，接收终端通过扫描的方式接收到发送终端广播的发送端消息。
505、接收终端根据预置证书验证信息验证证书签名，确定轻量级证书是否合法，若是，则执行步骤506；
本实施例中，预置证书验证信息即是CA预先告知接收终端的，预置证书验证信息用于验证证书签名，接收终端根据预置证书验证信息验证证书签名，从而确定轻量级证书是否合法，如果轻量级证书是合法证书，那么执行步骤506。
506、接收终端根据消息签名验证信息验证消息签名是否合法，若是，则执行步骤507；
本实施例中，接收终端确定轻量级证书是合法证书后，得到轻量级证书中的消息签名验证信息，由于消息签名验证信息是用于验证消息签名的的合法性的，那么接收终端根据消息签名验证信息验证消息签名是否合法，如果消息签名是合法的，表示发送终端的身份是合法的，并且编码消息在传输过程中的完整性有保证，那么执行步骤507。
507、接收终端处理编码消息。
本实施例中，接收终端确定了消息签名是合法的，那么就可以对发送端消息中的编码消息进行解码等处理。
本申请实施例中，由于发送终端的发送端消息中携带有轻量级证书，接收终端通过轻量级证书中的证书签名及消息签名验证信息即可完成发送端消息的证书和签名验证，由于轻量级证书只包含了消息签名验证信息和证书签名，与现有的CA证书相比，轻量级证书占用的字节数小于CA证书，例如，X.509证书的大小大于1000字节，而轻量级证书的大小可以做到200字节以下，使得通信系统的开销减少，从而提高了系统容量和消息传输质量。
由于在无线空口频繁的消息交互的通信系统中，终端与终端之间的消息发送一般采用广播方式，那么采用的是非对称加密方式进行签名处理，非对称加密方式具体是设置有私有秘钥和公开秘钥，由于接收方需要验证发送方的身份，那么发送终端根据终端私有密钥对消息摘要进行签名处理，得到消息签名，而接收终端是已知与终端私有密钥对应的终端公开秘钥的，因此可以使用公开秘钥来验证消息签名是否合法。下面通过实施例对非对称 加密方式的签名处理进行说明。
可选的，本申请的一些实施例中，消息签名验证信息为终端公开秘钥，
发送终端对编码消息进行签名处理，得到消息签名，包括：
发送终端根据预置哈希函数从编码消息中生成消息摘要；
发送终端根据终端私有密钥对消息摘要进行签名处理，得到消息签名；
接收终端根据消息签名验证信息验证消息签名是否合法，包括：
接收终端根据预置哈希函数从发送端信息中的编码消息中生成消息摘要；
接收终端根据终端公开密钥对消息签名进行验证，得到对比摘要；
接收终端将对比摘要与消息摘要进行比对；
若对比摘要与消息摘要一致，则接收终端确定消息签名合法；
若对比摘要与消息摘要不一致，则接收终端确定消息签名非法。
本申请实施例中，发送终端对编码消息的签名处理主要分为两步，第一步是根据预置哈希函数从编码消息中提取出摘要信息，从而得到编码消息的消息摘要，由于在无线空口频繁的消息交互的通信系统中，终端与终端之间的消息发送一般采用广播方式，那么采用的是非对称加密方式进行签名处理，非对称加密方式具体是设置有私有秘钥和公开秘钥，由于接收方需要验证发送方的身份，那么发送终端根据终端私有密钥对消息摘要进行签名处理，得到消息签名，因此可以使用公开秘钥来验证消息签名是否合法，那么消息签名验证信息就是终端公开秘钥，接收终端根据预置哈希函数从发送端信息中的编码消息中生成消息摘要,接收终端是已知与终端私有密钥对应的终端公开秘钥的，因此可以使用终端公开密钥对消息签名进行验证，得到对比摘要，如果对比摘要与消息摘要一致，则确定消息签名合法；如果对比摘要与消息摘要不一致，则接收终端确定消息签名非法。
可选的，本申请的一些实施例中，轻量级证书还包括有效期信息，预置证书验证信息为CA的证书公开秘钥；
发送终端根据轻量级证书、消息签名及编码消息，生成发送端消息之前，还包括：
发送终端向CA发送证书请求，使得CA根据预置证书私有秘钥对CA证书的有效期信息及终端公开秘钥进行签名处理，得到证书签名，根据有效期信息、终端公开秘钥及证书签名生成轻量级证书，并向发送终端发送轻量级证书；
发送终端获取CA发送的轻量级证书；
接收终端根据预置证书验证信息验证证书签名，确定轻量级证书是否合法之前，还包括：
接收终端向CA发送证书验证请求，使得CA根据证书验证请求向接收终端反馈证书公开秘钥；
接收终端接收CA反馈的证书公开秘钥。
本申请实施例中，在轻量级证书中还可以包括有效期信息，由于CA在颁布证书的时候，可以为证书设置使用期限，有效期信息规定的有效时间之内，轻量级证书才是合法的，从而增加安全性。而轻量级证书的颁发是由CA执行的，发送终端向CA发送证书请求，CA在接收到证书请求之后，根据预置证书私有秘钥对CA证书的有效期信息及终端公开秘钥进行 签名处理，得到证书签名，根据有效期信息、终端公开秘钥及证书签名生成轻量级证书，并向发送终端发送轻量级证书；发送终端获取CA发送的轻量级证书。由于CA是根据预置证书私有秘钥对CA证书中的终端公开秘钥进行签名处理，得到证书签名的，那么要验证证书签名是否正确的话，就需要知道CA的证书公开秘钥来进行验证，因此接收终端需要先向CA发送证书验证请求，使得CA根据证书验证请求向接收终端反馈证书公开秘钥，接收终端接收到CA反馈的证书公开秘钥，以用于后续将证书公开秘钥作为预置证书验证信息来验证证书签名，从而确定轻量级证书是否合法。以X.509证书为例，X.509证书中包括TBSCertificate、signatureAlgorithm、signatureValue三个部分，其中TBSCertificate包括有效期信息(Validity)、消息签名验证信息(即终端公开秘钥)(Subject Public Key Info)、扩展字段(Extension)等等，而得到的证书签名可以放入Extension中，与X.509证书相比，轻量级证书中只包括了有效期信息、终端公开秘钥和证书签名，因此轻量级证书的字节大小明显小于X.509证书的字节大小。
由于接收终端在验证轻量级证书和消息签名时都是单侧在执行的，那么通过接收终端单侧流程图的方式进行详细，具体如下：
请参阅图6，本申请实施例提供一种消息处理方法，包括：
601、接收终端接收发送终端发送的发送端信息，发送端消息包括轻量级证书、编码消息及编码消息的消息签名；
本实施例中接收终端接收发送终端广播发送的发送端消息，发送端消息中包括轻量级证书、编码消息及编码消息的消息签名，轻量级证书包括了证书签名、有效期信息以及消息签名验证信息，根据以上的实施例的描述，其中消息签名验证信息即为终端公开秘钥，需要说明的是，轻量级证书中除了证书签名、有效期信息以及消息签名验证信息之外，还可以包括其他信息，具体不做限定。
602、接收终端根据证书公开秘钥对轻量级证书中的证书签名进行验证,判断证书签名是否正确，若正确，执行步骤603；若错误，执行步骤605；
本实施例中，接收终端接收到的发送端消息中，轻量级证书中的证书签名，是由CA采用证书私有秘钥对有效期信息和消息签名验证信息进行签名处理后得到的，那么根据证书公开秘钥就能对证书签名进行验证，从而判断证书签名是否正确，如果证书签名正确，那么表示轻量级证书是合法的，则执行步骤603；如果证书签名不正确，那么表示轻量级证书非法，则执行步骤606。
603、接收终端确定轻量级证书合法；
本实施例中，当证书签名正确时，接收终端确定轻量级证书合法。
需要说明的是，在由于CA在颁布证书的时候，可以为证书设置使用期限，有效期信息规定的有效时间之内，轻量级证书才是合法的，从而增加安全性。那么在验证了证书签名正确时，接收终端确定轻量级证书合法之前，还需要接收终端根据有效期信息判断处于当前时间的轻量级证书是否有效，如果轻量级证书有效，那么接收终端确定所述轻量级证书合法；如果轻量级证书无效，那么接收终端确定所述轻量级证书非法。
604、接收终端根据消息签名验证信息验证消息签名是否合法，若消息签名合法，则执 行步骤605；若消息签名非法，则执行步骤606；
本实施例中，接收终端得出轻量级证书是合法的，那么接收终端获取到轻量级证书中的消息签名验证信息(即终端公开秘钥)，根据消息签名验证信息验证消息签名是否合法，如果消息签名合法，则执行步骤604；如果消息签名非法，则执行步骤605。
605、接收终端处理编码消息；
本实施例中，接收终端确定了消息签名是合法的，那么就可以对发送端消息中的编码消息进行解码等处理。
606、接收终端丢弃发送端消息。
本实施例中，当证书签名错误或者消息签名非法时，接收终端确定了发送终端的身份不合法或者编码消息存在篡改嫌疑，那么接收终端直接丢弃接收到的发送端消息，避免执行不明身份的发送终端的恶意指示。
本申请实施例中，对接收终端如何进行轻量级证书及消息签名的验证进行详细说明，使得接收终端与发送终端之间能够实现消息传输的同时保证通信安全性。
以上实施例中介绍本申请的消息处理方法，下面对接收终端和发送终端的模块化结构进行介绍。
请参阅图7，本申请实施例提供一种发送终端，包括：
获取模块701，用于获取编码消息；
签名模块702，用于对编码消息进行签名处理，得到消息签名；
处理模块703，用于根据轻量级证书、消息签名及编码消息，生成发送端消息，轻量级证书包括消息签名验证信息及证书签名，消息签名验证信息用于验证消息签名的合法性；
发送模块704，用于将发送端消息发送至接收终端，使得接收终端根据预置证书验证信息验证证书签名确定轻量级证书合法，且根据消息签名验证信息验证消息签名合法时，处理编码消息。
本申请实施例中，当发送终端获取到待发送的消息时，获取模块701按照预置的编码规则对待发送的消息进行编码处理，得到编码消息，签名模块702为了保证编码消息在传输过程中的完整性和发送者的身份认证，需要对编码消息进行签名处理，得到消息签名，处理模块703在编码消息上附上消息签名，然后将CA颁布的轻量级证书携带于编码消息中，得到发送端消息，发送模块704将发送端消息通过广播方式发送到接收终端，接收终端可以是一个或多个。使得接收终端在获取到发送端消息之后，根据预置证书验证信息验证证书签名确定轻量级证书是否合法，预置证书验证信息也是CA颁布预先告知接收终端的，在轻量级证书合法的情况下，接收终端再根据轻量级证书中的消息签名验证信息验证消息签名是否合法，消息签名也合法时，就表示发送端消息的发送方的身份验证通过，并且编码消息传输过程中保证了完整性。发送终端的发送端消息中携带有轻量级证书，接收终端通过轻量级证书中的证书签名及消息签名验证信息即可完成发送端消息的证书和签名验证，由于轻量级证书只包含了消息签名验证信息和证书签名，与现有的CA证书相比，轻量级证书占用的字节数小于CA证书，例如，X.509证书的大小大于1000字节，而轻量级证书的 大小可以做到200字节以下，使得通信系统的开销减少，从而提高了系统容量和消息传输质量。
可选的，本申请的一些实施例中，
签名模块702，具体用于根据预置哈希函数从编码消息中生成消息摘要；
签名模块702，还用于根据终端私有密钥对消息摘要进行签名处理，得到消息签名。
本申请实施例中，签名模块702对消息的签名处理主要分为两步，第一步是签名模块702根据预置哈希函数从编码消息中提取出摘要信息，从而得到编码消息的消息摘要，由于在无线空口频繁的消息交互的通信系统中，终端与终端之间的消息发送一般采用广播方式，那么签名模块702采用的是非对称加密方式进行签名处理，非对称加密方式具体是设置有私有秘钥和公开秘钥，由于接收方需要验证发送方的身份，那么签名模块702根据终端私有密钥对消息摘要进行签名处理，得到消息签名，而接收终端是已知与终端私有密钥对应的终端公开秘钥的，因此可以使用公开秘钥来验证消息签名是否合法。
可选的，本申请的一些实施例中，消息签名验证信息为终端私有密钥对应的终端公开密钥。
本申请实施例中，由于已知了签名模块702是根据终端私有密钥对消息摘要进行签名处理的，那么消息签名验证信息用于验证消息签名的合法性，消息签名验证信息自然就是与终端私有密钥对应的终端公开密钥。
可选的，本申请的一些实施例中，轻量级证书还包括有效期信息，
发送模块704，还用于向CA发送证书请求，使得CA根据预置证书私有秘钥对CA证书的有效期信息及终端公开秘钥进行签名处理，得到证书签名，根据有效期信息、终端公开秘钥及证书签名生成轻量级证书，并向发送终端发送轻量级证书；
获取模块701，还用于获取CA发送的轻量级证书。
本申请实施例中，在轻量级证书中还可以包括有效期信息，由于CA在颁布证书的时候，可以为证书设置使用期限，有效期信息规定的有效时间之内，轻量级证书才是合法的，从而增加安全性。而轻量级证书的颁发是由CA执行的，发送模块704向CA发送证书请求，CA在接收到证书请求之后，根据预置证书私有秘钥对CA证书的有效期信息及终端公开秘钥进行签名处理，得到证书签名，根据有效期信息、终端公开秘钥及证书签名生成轻量级证书，并向发送终端发送轻量级证书；获取模块701获取CA发送的轻量级证书。以X.509证书为例，X.509证书中包括TBSCertificate、signatureAlgorithm、signatureValue三个部分，其中TBSCertificate包括有效期信息、消息签名验证信息(即终端公开秘钥)、扩展字段等等，而得到的证书签名可以放入扩展字段中，与X.509证书相比，轻量级证书中只包括了有效期信息、终端公开秘钥和证书签名，因此轻量级证书的字节大小明显小于X.509证书的字节大小。
请参阅图8，本申请实施例提供一种接收终端，包括：
接收模块801，用于接收发送终端发送的发送端信息，发送端消息包括轻量级证书、编码消息及编码消息的消息签名，轻量级证书包括消息签名验证信息及证书签名，消息签名验证信息用于验证消息签名的合法性；
验证模块802，用于根据预置证书验证信息验证证书签名，确定轻量级证书是否合法；
验证模块802，还用于当轻量级证书合法时，根据消息签名验证信息验证消息签名是否合法；
处理模块803，还用于当消息签名合法时，处理编码消息。
本申请实施例中，接收模块801接收发送终端发送的发送端信息，发送端消息包括轻量级证书、编码消息及编码消息的消息签名，轻量级证书包括消息签名验证信息及证书签名，消息签名验证信息用于验证消息签名的合法性，验证模块802根据预置证书验证信息验证证书签名，确定轻量级证书是否合法，预置证书验证信息也是CA颁布预先告知接收终端的；如果轻量级证书合法，则验证模块802根据消息签名验证信息验证消息签名是否合法；若消息签名合法，就表示发送端消息的发送方的身份验证通过，并且编码消息传输过程中保证了完整性，则处理模块803处理编码消息。发送终端的发送端消息中携带有轻量级证书，接收终端通过轻量级证书中的证书签名及消息签名验证信息即可完成发送端消息的证书和签名验证，由于轻量级证书只包含了消息签名验证信息和证书签名，与现有的CA证书相比，轻量级证书占用的字节数小于CA证书，例如，X.509证书的大小大于1000字节，而轻量级证书的大小可以做到200字节以下，使得通信系统的开销减少，从而提高了系统容量和消息传输质量。
可选的，如图9所示，本申请的一些实施例中，预置证书验证信息为CA的证书公开秘钥，接收终端还包括：
发送模块901，用于向CA发送证书验证请求，使得CA根据证书验证请求向接收终端反馈证书公开秘钥；
接收模块801，还用于接收CA反馈的证书公开秘钥。
本申请实施例中，由于在无线空口频繁的消息交互的通信系统中，采用的是非对称加密方式进行签名处理，非对称加密方式具体是设置有私有秘钥和公开秘钥，由于CA是根据预置证书私有秘钥对CA证书中的终端公开秘钥进行签名处理，得到证书签名的，那么要验证证书签名是否正确的话，就需要知道CA的证书公开秘钥来进行验证，因此发送模块901需要先向CA发送证书验证请求，使得CA根据证书验证请求向接收终端反馈证书公开秘钥，接收模块801接收到CA反馈的证书公开秘钥，以用于后续将证书公开秘钥作为预置证书验证信息来验证证书签名，从而确定轻量级证书是否合法。
可选的，如图9所示，本申请的一些实施例中，
验证模块802，还用于根据证书公开秘钥对轻量级证书中的证书签名进行验证，判断证书签名是否正确；
验证模块802，还用于当证书签名正确时，确定轻量级证书合法；
验证模块802，还用于当证书签名错误时，确定轻量级证书非法。
本申请实施例中，已知了预置证书验证信息就是证书公开秘钥，而且证书公开秘钥与CA得到证书签名时进行签名处理采用的证书私有秘钥是对应的，那么验证模块802可以根据证书公开秘钥对轻量级证书中的证书签名进行验证，判断证书签名是否正确，如果证书签名正确，那么验证模块802可以确定轻量级证书合法；如果证书签名错误，那么验证模 块可以确定轻量级证书非法。
可选的，如图9所示，本申请的一些实施例中，轻量级证书还包括有效期信息，
验证模块802，还用于当证书签名正确时，根据有效期信息判断轻量级证书是否有效；
验证模块802，还用于当轻量级证书有效时，确定轻量级证书合法；
验证模块802，还用于当轻量级证书无效时，确定轻量级证书非法。
本申请实施例中，轻量级证书中还可以包括有效期信息，由于CA在颁布证书的时候，可以为证书设置使用期限，有效期信息规定的有效时间之内，轻量级证书才是合法的，从而增加安全性。那么在验证模块802验证了证书签名正确时，验证模块802确定轻量级证书合法之前，还需要验证模块802根据有效期信息判断处于当前时间的轻量级证书是否有效，如果轻量级证书有效，那么验证模块802确定轻量级证书合法；如果轻量级证书无效，那么验证模块802确定轻量级证书非法。
可选的，如图9所示，本申请的一些实施例中，
处理模块803，还用于当轻量级证书非法时，丢弃发送端消息。
本申请实施例中，在验证模块802确定了轻量级证书是非法的之后，表明接收到的发送端消息的发送者身份是不合法的，那么处理模块803不会处理发送端消息中的编码消息，采用直接丢弃的方式处理发送端消息。
可选的，如图9所示，本申请的一些实施例中，消息签名验证信息为终端公开秘钥；
验证模块802，还用于根据预置哈希函数从发送端信息中的编码消息中生成消息摘要；
验证模块802，还用于根据终端公开密钥对消息签名进行验证，得到对比摘要；
验证模块802，还用于将对比摘要与消息摘要进行比对；
验证模块802，还用于当对比摘要与消息摘要一致时，确定消息签名合法；
验证模块802，还用于当对比摘要与消息摘要不一致时，确定消息签名非法。
本申请实施例中，由于在无线空口频繁的消息交互的通信系统中，终端与终端之间的消息发送一般采用广播方式，那么采用的是非对称加密方式进行签名处理，非对称加密方式具体是设置有私有秘钥和公开秘钥，由于接收方需要验证发送方的身份，那么发送终端是根据终端私有密钥对消息摘要进行签名处理得到的消息签名，那么消息签名验证信息为终端公开秘钥，验证模块802根据预置哈希函数从发送端信息中的编码消息中生成消息摘要,验证模块是已知与终端私有密钥对应的终端公开秘钥的，因此验证模块802可以使用终端公开密钥对消息签名进行验证，得到对比摘要，如果对比摘要与消息摘要一致，则验证模块802确定消息签名合法；如果对比摘要与消息摘要不一致，则验证模块802确定消息签名非法。
可选的，如图9所示，本申请的一些实施例中，
处理模块803，还用于当消息签名非法时，丢弃发送端信息。
本申请实施例中，在验证模块802确定了轻量级证书是合法的，并且确定消息签名是非法的之后，表明接收到的发送端消息的发送者身份是不合法的，或者编码消息在传输过程中改变了，那么处理模块803不会处理发送端消息中的编码消息，采用直接丢弃的方式处理发送端消息。
请参阅图10，本申请实施例提供作为发送端的终端设备和作为接收端的终端设备之间的信号交互的示意图，包括：
发送端的终端设备11包括处理器111和收发器112，处理器111和收发器112相连接；
收发器112，用于发送终端获取编码消息；
处理器111，用于对编码消息进行签名处理，得到消息签名；
处理器111，还用于根据轻量级证书、消息签名及编码消息，生成发送端消息，轻量级证书包括消息签名验证信息及证书签名，消息签名验证信息用于验证消息签名的合法性；
收发器112，还用于将发送端消息发送至接收终端，使得接收终端根据预置证书验证信息验证证书签名确定轻量级证书合法，且根据消息签名验证信息验证消息签名合法时，处理编码消息；
接收端的终端设备12包括处理器121和收发器122，处理器121和收发器122相连接；
收发器122，用于接收发送终端发送的发送端信息，发送端消息包括轻量级证书、编码消息及编码消息的消息签名，轻量级证书包括消息签名验证信息及证书签名，消息签名验证信息用于验证消息签名的合法性；
处理器121，用于根据预置证书验证信息验证证书签名，确定轻量级证书是否合法；
处理器121，还用于当轻量级证书合法时，根据消息签名验证信息验证消息签名是否合法；
处理器121，还用于当消息签名合法时，处理编码消息。
本申请实施例中，发送端的终端设备11和接收端的终端设备12之间的消息传输是通过各种的收发器112和122来实现的，终端设备11的发送端消息中携带有轻量级证书，终端设备12通过轻量级证书中的证书签名及消息签名验证信息即可完成发送端消息的证书和签名验证，由于轻量级证书只包含了消息签名验证信息和证书签名，与现有的CA证书相比，轻量级证书占用的字节数小于CA证书，例如，X.509证书的大小大于1000字节，而轻量级证书的大小可以做到200字节以下，使得通信系统的开销减少，从而提高了系统容量和消息传输质量。
本申请还提供了一种计算机可读存储介质，计算机可读存储介质中存储有指令，当其在计算机上运行时，使得计算机执行以上实施例所描述的消息处理方法。
本申请实施例还提供了一种芯片系统，该芯片系统中包括处理器，还可以包括存储器，用于实现以上实施例所描述的消息处理方法。其中，存储器还可以包括于处理器中。芯片系统可以由芯片构成，也可以包括芯片和其他分立器件。在本申请实施例中，存储器包括易失性存储器(volatile memory)，例如随机存取存储器(random-access memory，RAM)；存储器也可以包括非易失性存储器(non-volatile memory)，例如快闪存储器(flash memory)，硬盘(hard disk drive，HDD)或固态硬盘(solid-state drive，SSD)；存储器还可以包括上述种类的存储器的组合；存储器还可以包括其它任何具有存储功能的装置，例如电路、器件或软件模块。
本申请还提供了一种包含指令的计算机程序产品，当其在计算机上运行时，使得计算机执行以上实施例所描述的消息处理方法。
在上述实施例中，可以全部或部分地通过软件、硬件、固件或者其任意组合来实现。当使用软件实现时，可以全部或部分地以计算机程序产品的形式实现。
所述计算机程序产品包括一个或多个计算机指令。在计算机上加载和执行所述计算机程序指令时，全部或部分地产生按照本申请实施例所述的流程或功能。所述计算机可以是通用计算机、专用计算机、计算机网络、终端设备或者其他可编程装置。所述计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一计算机可读存储介质传输，例如，所述计算机指令可以从一个网站站点、计算机、服务器或数据中心通过有线(例如同轴电缆、光纤、数字用户线(DSL))或无线(例如红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。所述计算机可读存储介质可以是计算机能够存储的任何可用介质或者是包含一个或多个可用介质集成的服务器、数据中心等数据存储设备。所述可用介质可以是磁性介质，(例如，软盘、硬盘、磁带)、光介质(例如，DVD)、或者半导体介质(例如固态硬盘Solid State Disk(SSD))等。
应理解，在本申请的各种实施例中，上述各过程的序号的大小并不意味着执行顺序的先后，各过程的执行顺序应以其功能和内在逻辑确定，而不应对本申请实施例的实施过程构成任何限定。
以上所述，以上实施例仅用以说明本申请的技术方案，而非对其限制；尽管参照前述实施例对本申请进行了详细的说明，本领域的普通技术人员应当理解：其依然可以对前述各实施例所记载的技术方案进行修改，或者对其中部分技术特征进行等同替换；而这些修改或者替换，并不使相应技术方案的本质脱离本申请各实施例技术方案的范围。

Claims (28)

  1. 一种消息处理方法，其特征在于，包括：
    发送终端获取编码消息；
    所述发送终端对所述编码消息进行签名处理，得到消息签名；
    所述发送终端根据轻量级证书、所述消息签名及所述编码消息，生成发送端消息，所述轻量级证书包括消息签名验证信息及证书签名，所述消息签名验证信息用于验证所述消息签名的合法性；
    所述发送终端将所述发送端消息发送至接收终端，使得所述接收终端根据预置证书验证信息验证所述证书签名确定所述轻量级证书合法，且根据所述消息签名验证信息验证所述消息签名合法时，处理所述编码消息。
  2. 根据权利要求1所述的消息处理方法，其特征在于，所述发送终端对所述编码消息进行签名处理，得到消息签名，包括：
    所述发送终端根据预置哈希函数从所述编码消息中生成消息摘要；
    所述发送终端根据终端私有密钥对所述消息摘要进行签名处理，得到消息签名。
  3. 根据权利要求2所述的消息处理方法，其特征在于，所述消息签名验证信息为所述终端私有密钥对应的终端公开密钥。
  4. 根据权利要求3所述的消息处理方法，其特征在于，所述轻量级证书还包括有效期信息，
    所述发送终端根据轻量级证书、所述消息签名及所述编码消息，生成发送端消息之前，还包括：
    所述发送终端向证书颁布中心CA发送证书请求，使得所述CA根据预置证书私有秘钥对所述CA证书的有效期信息及终端公开秘钥进行签名处理，得到证书签名，根据所述有效期信息、所述终端公开秘钥及所述证书签名生成轻量级证书，并向所述发送终端发送所述轻量级证书；
    所述发送终端获取所述CA发送的所述轻量级证书。
  5. 一种消息处理方法，其特征在于，包括：
    接收终端接收发送终端发送的发送端信息，所述发送端消息包括轻量级证书、编码消息及所述编码消息的消息签名，所述轻量级证书包括消息签名验证信息及证书签名，所述消息签名验证信息用于验证所述消息签名的合法性；
    所述接收终端根据预置证书验证信息验证所述证书签名，确定所述轻量级证书是否合法；
    若所述轻量级证书合法，则所述接收终端根据所述消息签名验证信息验证所述消息签名是否合法；
    若所述消息签名合法，则所述接收终端处理所述编码消息。
  6. 根据权利要求5所述的消息处理方法，其特征在于，所述预置证书验证信息为证书颁布中心CA的证书公开秘钥，
    所述接收终端根据预置证书验证信息验证所述证书签名，确定所述轻量级证书是否合 法之前，还包括：
    所述接收终端向所述CA发送证书验证请求，使得所述CA根据所述证书验证请求向所述接收终端反馈证书公开秘钥；
    所述接收终端接收所述CA反馈的证书公开秘钥。
  7. 根据权利要求6所述的消息处理方法，其特征在于，所述接收终端根据预置证书验证信息验证所述证书签名，确定所述轻量级证书是否合法，包括：
    所述接收终端根据证书公开秘钥对所述轻量级证书中的所述证书签名进行验证，判断所述证书签名是否正确；
    若所述证书签名正确，则所述接收终端确定所述轻量级证书合法；
    若所述证书签名错误，则所述接收终端确定所述轻量级证书非法。
  8. 根据权利要求7所述的消息处理方法，其特征在于，所述轻量级证书还包括有效期信息，
    所述接收终端确定所述轻量级证书合法之前，还包括：
    当所述证书签名正确时，所述接收终端根据所述有效期信息判断所述轻量级证书是否有效；
    若所述轻量级证书有效，则所述接收终端确定所述轻量级证书合法；
    若所述轻量级证书无效，则所述接收终端确定所述轻量级证书非法。
  9. 根据权利要求8所述的消息处理方法，其特征在于，所述接收终端确定所述轻量级证书非法之后，还包括：
    所述接收终端丢弃所述发送端消息。
  10. 根据权利要求5至9中任一项所述的消息处理方法，其特征在于，所述消息签名验证信息为终端公开秘钥；
    所述接收终端根据所述消息签名验证信息验证所述消息签名是否合法，包括：
    所述接收终端根据预置哈希函数从所述发送端信息中的所述编码消息中生成消息摘要；
    所述接收终端根据所述终端公开密钥对所述消息签名进行验证，得到对比摘要；
    所述接收终端将所述对比摘要与所述消息摘要进行比对；
    若所述对比摘要与所述消息摘要一致，则所述接收终端确定所述消息签名合法；
    若所述对比摘要与所述消息摘要不一致，则所述接收终端确定所述消息签名非法。
  11. 根据权利要求10所述的消息处理方法，其特征在于，所述接收终端确定所述消息签名非法之后，还包括：
    所述接收终端丢弃所述发送端信息。
  12. 一种发送终端，其特征在于，包括：
    获取模块，用于获取编码消息；
    签名模块，用于对所述编码消息进行签名处理，得到消息签名；
    处理模块，用于根据轻量级证书、所述消息签名及所述编码消息，生成发送端消息，所述轻量级证书包括消息签名验证信息及证书签名，所述消息签名验证信息用于验证所述 消息签名的合法性；
    发送模块，用于将所述发送端消息发送至接收终端，使得所述接收终端根据预置证书验证信息验证所述证书签名确定所述轻量级证书合法，且根据所述消息签名验证信息验证所述消息签名合法时，处理所述编码消息。
  13. 根据权利要求12所述的发送终端，其特征在于，
    所述签名模块，具体用于根据预置哈希函数从所述编码消息中生成消息摘要；
    所述签名模块，还用于根据终端私有密钥对所述消息摘要进行签名处理，得到消息签名。
  14. 根据权利要求13所述的发送终端，其特征在于，所述消息签名验证信息为所述终端私有密钥对应的终端公开密钥。
  15. 根据权利要求14所述的发送终端，其特征在于，所述轻量级证书还包括有效期信息，
    所述发送模块，还用于向证书颁布中心CA发送证书请求，使得所述CA根据预置证书私有秘钥对所述CA证书的有效期信息及终端公开秘钥进行签名处理，得到证书签名，根据所述有效期信息、所述终端公开秘钥及所述证书签名生成轻量级证书，并向所述发送终端发送所述轻量级证书；
    所述获取模块，还用于获取所述CA发送的所述轻量级证书。
  16. 一种接收终端，其特征在于，包括：
    接收模块，用于接收发送终端发送的发送端信息，所述发送端消息包括轻量级证书、编码消息及所述编码消息的消息签名，所述轻量级证书包括消息签名验证信息及证书签名，所述消息签名验证信息用于验证所述消息签名的合法性；
    验证模块，用于根据预置证书验证信息验证所述证书签名，确定所述轻量级证书是否合法；
    所述验证模块，还用于当所述轻量级证书合法时，根据所述消息签名验证信息验证所述消息签名是否合法；
    处理模块，还用于当所述消息签名合法时，处理所述编码消息。
  17. 根据权利要求16所述的接收终端，其特征在于，所述预置证书验证信息为证书颁布中心CA的证书公开秘钥，所述接收终端还包括：
    发送模块，用于向所述CA发送证书验证请求，使得所述CA根据所述证书验证请求向所述接收终端反馈证书公开秘钥；
    所述接收模块，还用于接收所述CA反馈的证书公开秘钥。
  18. 根据权利要求17所述的接收终端，其特征在于，
    所述验证模块，还用于根据证书公开秘钥对所述轻量级证书中的所述证书签名进行验证，判断所述证书签名是否正确；
    所述验证模块，还用于当所述证书签名正确时，确定所述轻量级证书合法；
    所述验证模块，还用于当所述证书签名错误时，确定所述轻量级证书非法。
  19. 根据权利要求18所述的接收终端，其特征在于，所述轻量级证书还包括有效期信 息，
    所述验证模块，还用于当所述证书签名正确时，根据所述有效期信息判断所述轻量级证书是否有效；
    所述验证模块，还用于当所述轻量级证书有效时，确定所述轻量级证书合法；
    所述验证模块，还用于当所述轻量级证书无效时，确定所述轻量级证书非法。
  20. 根据权利要求19所述的接收终端，其特征在于，
    所述处理模块，还用于当所述轻量级证书非法时，丢弃所述发送端消息。
  21. 根据权利要求16至20中任一项所述的接收终端，其特征在于，所述消息签名验证信息为终端公开秘钥；
    所述验证模块，还用于根据预置哈希函数从所述发送端信息中的所述编码消息中生成消息摘要；
    所述验证模块，还用于根据所述终端公开密钥对所述消息签名进行验证，得到对比摘要；
    所述验证模块，还用于将所述对比摘要与所述消息摘要进行比对；
    所述验证模块，还用于当所述对比摘要与所述消息摘要一致时，确定所述消息签名合法；
    所述验证模块，还用于当所述对比摘要与所述消息摘要不一致时，确定所述消息签名非法。
  22. 根据权利要求21所述的接收终端，其特征在于，
    所述处理模块，还用于当所述消息签名非法时，丢弃所述发送端信息。
  23. 一种终端设备，其特征在于，包括：
    处理器和收发器，所述处理器和所述收发器相连接；
    所述收发器，用于发送终端获取编码消息；
    所述处理器，用于对所述编码消息进行签名处理，得到消息签名；
    所述处理器，还用于根据轻量级证书、所述消息签名及所述编码消息，生成发送端消息，所述轻量级证书包括消息签名验证信息及证书签名，所述消息签名验证信息用于验证所述消息签名的合法性；
    所述收发器，还用于将所述发送端消息发送至接收终端，使得所述接收终端根据预置证书验证信息验证所述证书签名确定所述轻量级证书合法，且根据所述消息签名验证信息验证所述消息签名合法时，处理所述编码消息。
  24. 一种终端设备，其特征在于，包括：
    处理器和收发器，所述处理器和所述收发器相连接；
    所述收发器，用于接收发送终端发送的发送端信息，所述发送端消息包括轻量级证书、编码消息及所述编码消息的消息签名，所述轻量级证书包括消息签名验证信息及证书签名，所述消息签名验证信息用于验证所述消息签名的合法性；
    所述处理器，用于根据预置证书验证信息验证所述证书签名，确定所述轻量级证书是否合法；
    所述处理器，还用于当所述轻量级证书合法时，根据所述消息签名验证信息验证所述消息签名是否合法；
    所述处理器，还用于当所述消息签名合法时，处理所述编码消息。
  25. 一种装置，用于实现权利要求1至11任一项所述的方法。
  26. 一种装置，包括处理器和存储器，所述存储器中存储有指令，所述处理器调用并执行所述指令时，使所述装置执行权利要求1至11任一项所述的方法。
  27. 一种计算机可读存储介质，包括指令，当其在计算机上运行时，使得计算机执行权利要求1至11任一项所述的方法。
  28. 一种通信系统，包括权利要求12至15任一项所述的发送终端和权利要求16至22任一项所述的接收终端，或者包括权利要求23所述的终端设备和权利要求24所述的终端设备。
PCT/CN2018/100975 2017-08-31 2018-08-17 消息处理方法及相关设备 WO2019042154A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201710772009.8 2017-08-31
CN201710772009.8A CN107682859B (zh) 2017-08-31 2017-08-31 消息处理方法及相关设备

Publications (1)

Publication Number Publication Date
WO2019042154A1 true WO2019042154A1 (zh) 2019-03-07

Family

ID=61135506

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2018/100975 WO2019042154A1 (zh) 2017-08-31 2018-08-17 消息处理方法及相关设备

Country Status (2)

Country Link
CN (1) CN107682859B (zh)
WO (1) WO2019042154A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112491549A (zh) * 2020-12-08 2021-03-12 平安国际智慧城市科技股份有限公司 数据信息加密校验方法、系统及计算机可读存储介质

Families Citing this family (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107682859B (zh) * 2017-08-31 2020-07-14 上海华为技术有限公司 消息处理方法及相关设备
CN108833445B (zh) * 2018-07-31 2021-04-16 中国银联股份有限公司 一种适用于物联网系统的认证方法及装置
DE102018219961A1 (de) * 2018-11-21 2020-05-28 Continental Teves Ag & Co. Ohg Fahrzeugsystem und Verfahren zur Fahrzeug-zu-X Kommunikation
CN111462515A (zh) * 2020-03-31 2020-07-28 中国联合网络通信集团有限公司 车路协同管理方法、mec服务器、终端和系统
CN111951420A (zh) * 2020-08-27 2020-11-17 深圳成谷智能科技有限公司 一种etc广播消息的安全传输的方法及装置
CN114697905A (zh) * 2020-12-31 2022-07-01 华为技术有限公司 一种基于车联网的信息传输方法及其相关设备
CN114143012A (zh) * 2021-11-26 2022-03-04 北京声智科技有限公司 消息队列管理方法、装置、设备及计算机可读存储介质
CN115022820B (zh) * 2022-05-31 2023-11-14 微位（深圳）网络科技有限公司 5g消息的验证方法、终端及系统

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2010045985A1 (en) * 2008-10-24 2010-04-29 Nokia Siemens Networks Gmbh & Co. Kg Lightweight authentication framework for inter-network hand-over coordination in untrustworthy heterogeneous network en-vironments
CN102833748A (zh) * 2012-09-20 2012-12-19 北京邮电大学 一种基于数字证书的无线网络轻量级认证密钥协商协议
CN106060807A (zh) * 2016-05-24 2016-10-26 中国科学院信息工程研究所 一种适用于电路域加密通信的消息传输方法
CN106411528A (zh) * 2016-10-17 2017-02-15 重庆邮电大学 一种基于隐式证书的轻量级认证密钥协商方法
CN107682859A (zh) * 2017-08-31 2018-02-09 上海华为技术有限公司 消息处理方法及相关设备

Family Cites Families (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101388767A (zh) * 2008-10-14 2009-03-18 苏盛辉 基于轻量级数字签名方案的证书防伪方法
EP2582085A1 (en) * 2011-10-10 2013-04-17 Certicom Corp. Generating implicit certificates
US20140075186A1 (en) * 2012-09-13 2014-03-13 Texas Instruments Incorporated Multiple Access Key Fob
US9906372B2 (en) * 2013-06-03 2018-02-27 Intel Deutschland Gmbh Authentication devices, key generator devices, methods for controlling an authentication device, and methods for controlling a key generator
CN105763330A (zh) * 2014-12-18 2016-07-13 中国科学院信息工程研究所 一种适用于电路域加密通信的轻量级证书及加密通信方法
CN104702418B (zh) * 2015-04-07 2018-04-27 江苏大学 一种均分rsu计算量的车辆身份认证方法
CN106789087B (zh) * 2017-01-26 2020-01-07 数安时代科技股份有限公司 确定消息的数据摘要、基于多方的数字签名的方法及系统

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2010045985A1 (en) * 2008-10-24 2010-04-29 Nokia Siemens Networks Gmbh & Co. Kg Lightweight authentication framework for inter-network hand-over coordination in untrustworthy heterogeneous network en-vironments
CN102833748A (zh) * 2012-09-20 2012-12-19 北京邮电大学 一种基于数字证书的无线网络轻量级认证密钥协商协议
CN106060807A (zh) * 2016-05-24 2016-10-26 中国科学院信息工程研究所 一种适用于电路域加密通信的消息传输方法
CN106411528A (zh) * 2016-10-17 2017-02-15 重庆邮电大学 一种基于隐式证书的轻量级认证密钥协商方法
CN107682859A (zh) * 2017-08-31 2018-02-09 上海华为技术有限公司 消息处理方法及相关设备

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112491549A (zh) * 2020-12-08 2021-03-12 平安国际智慧城市科技股份有限公司 数据信息加密校验方法、系统及计算机可读存储介质

Also Published As

Publication number Publication date
CN107682859B (zh) 2020-07-14
CN107682859A (zh) 2018-02-09

Similar Documents

Publication Publication Date Title
WO2019042154A1 (zh) 消息处理方法及相关设备
CN111213339B (zh) 带有客户端密钥的认证令牌
WO2020224621A1 (zh) 一种申请数字证书的方法
US9601016B2 (en) Communication system, vehicle-mounted terminal, roadside device
KR101508497B1 (ko) 차량용 데이터의 인증 및 획득 방법
WO2018076377A1 (zh) 一种数据传输方法、终端、节点设备以及系统
JP5587239B2 (ja) 車車／路車間通信システム
JP5399404B2 (ja) 一方向アクセス認証の方法
JP6348019B2 (ja) 通信システム、通信装置、自動車および通信方法
CN112435028B (zh) 一种基于区块链的物联网数据共享方法及装置
US8274401B2 (en) Secure data transfer in a communication system including portable meters
US20150318996A1 (en) System and method for filtering digital certificates
JP6279821B2 (ja) ワイヤレス通信においてメッセージを認証すること
CN111182497A (zh) V2x匿名认证方法、设备及存储介质
Bruni et al. Formal security analysis of the MaCAN protocol
CN112383897B (zh) 基于智能网联的信息传输方法、装置、介质和电子设备
KR20180086934A (ko) 차량의 인증서 생성 방법 및 장치
JP7367032B2 (ja) 識別確認方法および装置
CN109391473B (zh) 一种电子签章的方法、装置及存储介质
WO2017008223A1 (zh) 邻近服务通信的验证方法、用户设备及邻近服务功能实体
WO2022206107A1 (zh) V2x验签方法、装置、电子设备及可读存储介质
CN111601396B (zh) 一种使用5g通信系统传输区块链相关信息的方法及系统
CN116074061A (zh) 轨道交通的数据处理方法、装置、电子设备和存储介质
CN110519708B (zh) 一种基于pc5接口点到多点的通信方法和装置
CN106576245B (zh) 用户设备邻近请求认证

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 18850586

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 18850586

Country of ref document: EP

Kind code of ref document: A1