WO2021120931A1 - 通信方法、终端设备、路侧单元、服务器、系统及介质 - Google Patents

通信方法、终端设备、路侧单元、服务器、系统及介质 Download PDF

Info

Publication number
WO2021120931A1
WO2021120931A1 PCT/CN2020/128288 CN2020128288W WO2021120931A1 WO 2021120931 A1 WO2021120931 A1 WO 2021120931A1 CN 2020128288 W CN2020128288 W CN 2020128288W WO 2021120931 A1 WO2021120931 A1 WO 2021120931A1
Authority
WO
WIPO (PCT)
Prior art keywords
communication
information
key
communication key
encrypted
Prior art date
Application number
PCT/CN2020/128288
Other languages
English (en)
French (fr)
Inventor
潘凯
陈璟
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to EP20902228.4A priority Critical patent/EP4064608A4/en
Publication of WO2021120931A1 publication Critical patent/WO2021120931A1/zh
Priority to US17/842,388 priority patent/US20220311602A1/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0823—Network architectures or network communication protocols for network security for authentication of entities using certificates
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3247—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving digital signatures
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0819—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s)
    • H04L9/0825—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H04L63/0442—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/108—Network architectures or network communication protocols for network security for controlling access to devices or network resources when the policy decisions are valid for a limited amount of time
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0819—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s)
    • H04L9/083—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
    • H04L9/0872—Generation of secret information including derivation or calculation of cryptographic keys or passwords using geo-location information, e.g. location data, time, relative position or proximity to other entities
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0891—Revocation or update of secret information, e.g. encryption key update or rekeying
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3263—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3263—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements
    • H04L9/3268—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/03—Protecting confidentiality, e.g. by encryption
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H04W12/069—Authentication using certificates or pre-shared keys
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/60—Context-dependent security
    • H04W12/61—Time-dependent
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W4/00—Services specially adapted for wireless communication networks; Facilities therefor
    • H04W4/30—Services specially adapted for particular environments, situations or purposes
    • H04W4/40—Services specially adapted for particular environments, situations or purposes for vehicles, e.g. vehicle-to-pedestrians [V2P]
    • H04W4/44—Services specially adapted for particular environments, situations or purposes for vehicles, e.g. vehicle-to-pedestrians [V2P] for communication between vehicles and infrastructures, e.g. vehicle-to-cloud [V2C] or vehicle-to-home [V2H]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2209/00—Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
    • H04L2209/84—Vehicles
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2463/00—Additional details relating to network architectures or network communication protocols for network security covered by H04L63/00
    • H04L2463/102—Additional details relating to network architectures or network communication protocols for network security covered by H04L63/00 applying security measure for e-commerce
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/043—Key management, e.g. using generic bootstrapping architecture [GBA] using a trusted network node as an anchor
    • H04W12/0433—Key management protocols

Definitions

  • the embodiments of the present application relate to communication technologies, and in particular, to a communication method, terminal device, roadside unit, server, system, and medium.
  • OBU Onboard Unit
  • RSU Road Side Unit
  • Information exchange may also be carried out through user equipment (User Equipment, UE for short) to exchange information with the RSU.
  • User Equipment User Equipment
  • RSU is only deployed at the Electronic Toll Collection (ETC) at high-speed entrances and exits. It is mainly used to realize vehicle identification, and the way that RSU releases information to the outside world is in the form of broadcast, that is, all Vehicles can receive the information broadcasted by RSU, and it is impossible to achieve the purpose that only vehicles with specific targets can receive the information broadcasted by RSU.
  • ETC Electronic Toll Collection
  • the present application provides a communication method, terminal equipment, roadside unit, server, system, and medium, which are used to solve the problem that the RSU cannot be used to push relevant information for vehicles with specific attributes in the prior art.
  • the present application provides a communication method, including: receiving a trigger instruction when it is located at a preset node position on a road section;
  • the certificate request information includes the identity information of the terminal device; receive the communication key sent by the certificate authority CA server; receive the encrypted information sent by the roadside unit RSU, the encrypted information is the information encrypted by the communication key; The communication key decrypts the encrypted information.
  • the CA server determines the authority of the terminal device through the identity information in the certificate request sent by the terminal device, and when the authority of the terminal device meets the preset authority requirement, it issues the communication key to the terminal device so that only Terminal devices with preset authority requirements can use the communication key to decrypt the encrypted information sent by the RSU, where the RSU uses the communication key sent by the CA server to encrypt the information sent out, so that only those that meet the specific attribute requirements Only the vehicle can decrypt the received information to receive the push of related information, so as to achieve the purpose of providing differentiated services for vehicles with different characteristics.
  • the encrypted information is encrypted broadcast information
  • the encrypted broadcast information includes a broadcast identifier
  • the OBU after the OBU receives the information, it can determine that the information sent by the RSU is encrypted broadcast information by identifying the broadcast identifier, so that the encrypted broadcast information can be decrypted by the communication key, so that it can be received Among the vehicles that broadcast information, only those vehicles that also meet the specific attribute requirements can decrypt the received encrypted broadcast information.
  • the method before sending the certificate request information, the method further includes: generating a first key pair, where the first key pair includes a first private key and a first public key, and the certificate request information includes the first public key.
  • the CA server after the CA server receives the certificate request information including the first public key sent by the OBU, it can sign the certificate request information according to the CA private key to generate a communication certificate.
  • the first public key is used to encrypt the communication key.
  • the first public key is used to encrypt the communication key, and the communication key is decrypted after the OBU receives the communication key, thereby ensuring the transmission security of the communication key.
  • receiving the communication key sent by the CA server includes: receiving the communication certificate sent by the CA server; establishing a secure transmission channel between the terminal device and the CA server according to the communication certificate; receiving the CA through the secure transmission channel The communication key sent by the server.
  • the transmission security of the communication key is ensured.
  • the method further includes: encrypting the certificate request information, and the sent certificate request information is encrypted certificate request information.
  • the certificate request information is encrypted to ensure the security of the certificate request information during transmission.
  • encrypting the certificate request information includes: encrypting the certificate request information according to a preset CA server public key.
  • the certificate request information is encrypted by using the CA server public key to ensure the security of the certificate request information during the transmission process.
  • encrypting the certificate request information includes: generating a symmetric key, and encrypting the certificate request information according to the symmetric key; encrypting the symmetric key according to the preset CA server public key, and sending it The encrypted symmetric key.
  • the certificate request information is encrypted by using the symmetric key, and the symmetric key is encrypted by the CA server public key, and then sent, thereby ensuring the security of the certificate request information sent by the OBU to the CA server.
  • it can also improve the efficiency of OBU's encryption of the certificate request information and the CA server's decryption of the certificate request information.
  • the method before decrypting the encrypted information according to the communication key, the method further includes: determining the communication key currently used to decrypt the information according to a preset rule.
  • the communication key currently used for decrypting information in the OBU is determined by setting a preset rule, so as to realize the synchronization of the communication key currently used by the OBU and the RSU.
  • determining the current communication key used to decrypt information according to preset rules includes: receiving the encrypted first communication key sent by the RSU; receiving the second communication sent by the CA server according to the preset rule Key; decrypt the encrypted first communication key according to the second communication key.
  • the OBU receives the encrypted first communication key sent by the RSU according to a preset rule, and decrypts the encrypted first communication key according to the second communication key sent by the CA server, so that the RSU has the right
  • the management function of the first communication key used to encrypt broadcast information
  • the preset rule is the time rule.
  • the preset rule is set as the time rule, so that the OBU and the RSU synchronize the currently used communication key according to the time rule.
  • the time rule is a preset fixed time period or a preset fixed time node.
  • after sending the certificate request information it further includes: within the validity period of the communication key, resending the certificate request information according to the time rule to update the communication key used to decrypt the information.
  • the OBU re-sends the certificate request information before the expiration of the communication key to update the communication key used to decrypt the information, thereby avoiding the interruption of information services when the communication key is updated.
  • determining the current communication key used to decrypt information according to a preset rule includes: receiving a first communication key sequence, where the first communication key sequence includes multiple communication keys, and the first communication key sequence includes multiple communication keys. The total duration of validity of all communication keys in the communication key sequence is greater than the preset duration; according to the time rule, a communication key in the first communication key sequence is determined as the current communication key used to decrypt information.
  • the CA server sends a sufficient number of communication keys to the OBU, so that the OBU does not need to apply for a communication key from the CA server within the preset time period, and it can also ensure that the OBU is in the preset time period information. Continuity of service.
  • the method before decrypting the encrypted information according to the communication key, the method further includes: verifying the encrypted information according to the preset RSU public key.
  • the OBU verifies the encrypted information according to the preset RSU public key, and if the verification is passed, Kc is used for decryption to process the encrypted and then signed information to obtain the push information.
  • the method further includes: verifying the decrypted information according to the preset RSU public key.
  • the OBU first uses Kc to decrypt, and then verifies the decrypted information according to the preset RSU public key, so as to process the signed and then encrypted information to obtain the push information.
  • after receiving the trigger instruction it further includes: sending identity information and payment status. If the payment status corresponds to the successful payment status, the authority of the terminal device meets the preset authority requirement.
  • the CA server uses terminal device payment information to determine whether the authority of the terminal device meets the preset authority requirements, thereby determining whether to issue a communication key to the terminal device, so that only paid terminal devices can use the communication secret.
  • the key decrypts the encrypted information sent by the RSU to receive the push of relevant information, thereby achieving the purpose of providing information value-added services to the vehicle.
  • the terminal device is an on-board unit OBU or user equipment UE.
  • this application also provides a communication method, including: receiving a communication key sent by a CA server, the communication key being used to encrypt information sent out; and sending encrypted information.
  • the CA server determines the authority of the terminal device through the identity information in the certificate request sent by the terminal device, and when the authority of the terminal device meets the preset authority requirement, it issues the communication key to the terminal device so that only Terminal devices with preset authority requirements can use the communication key to decrypt the encrypted information sent by the RSU, where the RSU uses the communication key sent by the CA server to encrypt the information sent out, so that only those that meet the specific attribute requirements Only the vehicle can decrypt the received information to receive the push of related information, so as to achieve the purpose of providing differentiated services for vehicles with different characteristics.
  • the encrypted information is encrypted broadcast information
  • the encrypted broadcast information includes a broadcast identifier
  • the OBU after the OBU receives the information, it can determine that the information sent by the RSU is encrypted broadcast information by identifying the broadcast identifier, so that the encrypted broadcast information can be decrypted by the communication key, so that it can be received Among the vehicles that broadcast information, only those vehicles that also meet the specific attribute requirements can decrypt the received encrypted broadcast information.
  • before sending the encrypted information it also includes: encrypting only the outgoing information that meets the requirements of the preset service type.
  • only outgoing information that meets the requirements of the preset service type is encrypted, so that the authorized RSU can obtain the information corresponding to the preset service type.
  • the encrypted broadcast information before sending the encrypted broadcast information, it further includes: determining the current communication key used to encrypt the information according to a preset rule.
  • the RSU determines the currently used communication key according to a preset rule, thereby realizing the management of multiple communication keys by the RSU, and ensuring that the communication key currently used by the OBU and the RSU are the same or correspond first.
  • the method further includes: encrypting the first communication key according to the second communication key, and the first communication key is used for Encrypt the broadcast information; send the encrypted first communication key according to a preset rule.
  • the OBU receives the encrypted first communication key sent by the RSU according to a preset rule, and decrypts the encrypted first communication key according to the second communication key sent by the CA server, so that the RSU has the right
  • the management function of the first communication key used to encrypt broadcast information
  • the preset rule is the time rule.
  • the preset rule is set as the time rule, so that the OBU and the RSU synchronize the currently used communication key according to the time rule.
  • the time rule is a preset fixed time period or a preset fixed time node.
  • the encrypted information before sending the encrypted information, it further includes: receiving a second communication key sequence, where the second communication key sequence includes a plurality of communication keys; and sequentially selecting the second communication key sequence according to the time rule
  • the communication key of is used as the communication key for encrypting information.
  • the CA server delivers multiple communication keys to the RSU, so that the RSU maintains multiple communication keys according to time rules, thereby ensuring the continuity of information services provided by the RSU.
  • before sending the encrypted information it further includes: signing the broadcast information according to the RSU private key of the roadside unit; encrypting the broadcast information according to the communication key; and sending the encrypted broadcast information.
  • the RSU first signs the broadcast information according to the RSU private key, and then encrypts the broadcast information according to the communication key, so as to ensure the transmission security of the broadcast information.
  • before sending the encrypted information it further includes: encrypting the broadcast information according to the communication key; and signing the encrypted broadcast information according to the RSU private key of the roadside unit.
  • the RSU first encrypts the broadcast information according to the communication key, and then signs the encrypted broadcast information according to the RSU private key of the roadside unit, so as to ensure the transmission security of the broadcast information.
  • the encrypted information before sending the encrypted information, it also includes: receiving identity information and payment information, the identity information is used to characterize the identity of the vehicle-mounted unit terminal device, and the payment information is used to determine the payment status of the terminal device; sending the identity information And the payment status.
  • the CA server uses terminal device payment information to determine whether the authority of the terminal device meets the preset authority requirements, thereby determining whether to issue a communication key to the terminal device, so that only paid terminal devices can use the communication secret.
  • the key decrypts the encrypted broadcast information sent by the RSU to receive the push of relevant information, so as to achieve the purpose of providing information value-added services to the vehicle.
  • this application also provides a communication method, including: receiving certificate request information, the certificate request information including the identity information of the vehicle-mounted unit terminal device; determining the authority of the terminal device according to the identity information; if the authority meets the preset authority requirement, then Sending sends a communication key to the terminal device; sending a communication key to the roadside unit RSU according to a preset rule, and the communication key is used to encrypt information sent by the roadside unit RSU.
  • the CA server determines the authority of the terminal device through the identity information in the certificate request sent by the terminal device, and when the authority of the terminal device meets the preset authority requirement, it issues the communication key to the terminal device so that only Terminal devices with preset authority requirements can use the communication key to decrypt the encrypted information sent by the RSU, where the RSU uses the communication key sent by the CA server to encrypt the information sent out, so that only those that meet the specific attribute requirements Only the vehicle can decrypt the received information to receive the push of related information, so as to achieve the purpose of providing differentiated services for vehicles with different characteristics.
  • the terminal device before sending the communication key to the terminal device, it further includes: signing the certificate request information according to the CA server private key to generate a communication certificate, where the certificate request information includes the first public key, and sending Communication certificate, which is used to establish the transmission channel between the terminal device and the CA server.
  • the CA server after the CA server receives the certificate request information including the first public key sent by the OBU, it can sign the certificate request information according to the CA private key to generate a communication certificate, and use the generated communication certificate to establish The transmission channel between the terminal equipment and the CA server.
  • the method before sending the communication key to the terminal device, the method further includes: encrypting the communication key according to the first public key.
  • the first public key is used to encrypt the communication key, and the communication key is decrypted after the OBU receives the communication key, thereby ensuring the transmission security of the communication key.
  • the method before sending the communication key to the terminal device, the method further includes: establishing a secure transmission channel with the terminal device according to the communication certificate; and sending the communication key through the secure transmission channel.
  • the transmission security of the communication key is ensured.
  • the method before sending the communication key to the terminal device, the method further includes: receiving the encrypted certificate request information; and decrypting the encrypted certificate request information.
  • the certificate request information is encrypted to ensure the security of the certificate request information during transmission.
  • receiving the encrypted certificate request information includes: receiving the certificate request information encrypted according to the CA server public key; or, receiving the certificate request information encrypted according to the symmetric key and according to the CA server public key The encrypted symmetric key.
  • the certificate request information is encrypted by using the symmetric key, and the symmetric key is encrypted by the CA server public key, and then sent, thereby ensuring the security of the certificate request information sent by the OBU to the CA server.
  • it can also improve the efficiency of OBU's encryption of the certificate request information and the CA server's decryption of the certificate request information.
  • sending the communication key according to the preset rule includes: sending the second communication key according to the preset rule, the communication key includes the second communication key, and the second communication key is used to encrypt the first communication key.
  • the communication key, the first communication key is used to encrypt the broadcast information of the RSU.
  • the OBU receives the encrypted first communication key sent by the RSU according to a preset rule, and decrypts the encrypted first communication key according to the second communication key sent by the CA server, so that the RSU has the right
  • the management function of the first communication key used to encrypt broadcast information
  • the preset rule is the time rule.
  • the preset rule is set as the time rule, so that the OBU and the RSU synchronize the currently used communication key according to the time rule.
  • the time rule is a preset fixed time period or a preset fixed time node.
  • after receiving the certificate request information it further includes: within the validity period of the communication key, re-receiving the certificate request information according to the time rule to update the communication key.
  • the OBU re-sends the certificate request information before the expiration of the communication key to update the communication key used to decrypt the information, thereby avoiding the interruption of information services when the communication key is updated.
  • sending the communication key to the terminal device includes: sending a first communication key sequence, the first communication key sequence includes multiple communication keys, and all communication keys in the first communication key sequence The total duration of the validity period of the key is greater than the preset duration, which is determined according to the parameters of the road section where the RSU is located.
  • the CA server sends a sufficient number of communication keys to the OBU, so that the OBU does not need to apply for a communication key from the CA server within the preset time period, and it can also ensure that the OBU is in the preset time period information. Continuity of service.
  • determining the authority of the terminal device according to the identity information includes:
  • the identity information and the payment status are received, and if the payment status corresponds to the successful payment status, the authority meets the preset authority requirement.
  • the CA server determines whether the authority of the terminal device meets the preset authority requirement through the payment information of the terminal device, it determines whether to issue the communication key containing the communication key to the terminal device, so that only the terminal that has paid
  • the device can use the communication key to decrypt the encrypted broadcast information sent by the RSU to receive the push of related information, thereby achieving the purpose of providing information value-added services to the vehicle.
  • the terminal device before sending the communication key to the terminal device, it further includes: determining the sent communication key according to the geographic area where the RSU is located.
  • the CA server sends different communication keys to RSUs located in different geographic areas to realize separate management of broadcast information push in different geographic areas.
  • this application also provides a terminal device, including: a receiving module, used to receive a trigger instruction when located at a preset node position on a road section; a sending module, used to send certificate request information, the certificate request information including the identity of the terminal device Information; receiving module, used to receive the communication key sent by the certificate authority CA server; receiving module, also used to receive the encrypted information sent by the roadside unit RSU, the encrypted information is information encrypted with the communication key; processing module, Used to decrypt encrypted information according to the communication key.
  • the encrypted information is encrypted broadcast information
  • the encrypted broadcast information includes a broadcast identifier
  • the processing module is further configured to generate a first key pair, the first key pair includes a first private key and a first public key, and the certificate request information includes the first public key.
  • the first public key is used to encrypt the communication key.
  • the receiving module is specifically used to: receive the communication certificate sent by the CA server; establish a secure transmission channel between the terminal device and the CA server according to the communication certificate; receive the communication secret sent by the CA server through the secure transmission channel key.
  • the processing module is also used to encrypt the certificate request information, and the sent certificate request information is encrypted certificate request information.
  • the processing module is specifically used to: encrypt the certificate request information according to the preset CA server public key; or, generate a symmetric key, and encrypt the certificate request information according to the symmetric key;
  • the preset CA server public key encrypts the symmetric key and sends the encrypted symmetric key.
  • the processing module is also used to determine the communication key currently used to decrypt information according to a preset rule.
  • the processing module is specifically configured to: receive the encrypted first communication key sent by the RSU; receive the second communication key sent by the CA server according to a preset rule; decrypt according to the second communication key The encrypted first communication key.
  • the preset rule is the time rule.
  • the time rule is a preset fixed time period or a preset fixed time node.
  • the sending module is also used to resend the certificate request information according to the time rule within the validity period of the communication key to update the communication key used to decrypt the information.
  • the processing module is specifically configured to: receive a first communication key sequence, where the first communication key sequence includes multiple communication keys, and all communication keys in the first communication key sequence The total duration of the effective period is greater than the preset duration; a communication key in the first communication key sequence is determined according to the time rule as the current communication key used to decrypt information.
  • the processing module is also used to verify the encrypted broadcast information according to the preset RSU public key.
  • the processing module is also used to verify the decrypted broadcast information according to the preset RSU public key.
  • the sending module is also used to send identity information and payment status. If the payment status corresponds to the successful payment status, the authority of the terminal device presets permission requirements.
  • the present application also provides a roadside unit, including: a receiving module for receiving a communication key sent by the CA server, the communication key is used for encrypting externally sent information; a sending module for sending encrypted information .
  • the encrypted information is encrypted broadcast information
  • the encrypted broadcast information includes a broadcast identifier
  • the roadside unit further includes a processing module for encrypting only outgoing information that meets the requirements of the preset service type.
  • the roadside unit further includes: a processing module, configured to determine the communication key currently used for encrypting information according to a preset rule.
  • the processing module is further configured to encrypt the first communication key according to the second communication key, and the first communication key is used to encrypt broadcast information;
  • the sending module is also used to send the encrypted first communication key according to a preset rule.
  • the preset rule is the time rule.
  • the time rule is a preset fixed time period or a preset fixed time node.
  • the receiving module is also used to receive a second communication key sequence, the second communication key sequence includes a plurality of communication keys; the processing module is also used to select the second communication keys in sequence according to the time rule The communication key in the key sequence is used as the communication key for encrypting information.
  • the processing module is also used to sign the broadcast information according to the RSU private key; the processing module is also used to encrypt the broadcast information according to the communication key; the sending module is also used to send Encrypt information.
  • the processing module is also used to encrypt the broadcast information according to the communication key; the processing module is also used to sign the encrypted broadcast information according to the RSU private key of the roadside unit.
  • the receiving module is also used to receive identity information and payment information, the identity information is used to characterize the identity of the on-board unit OBU, and the payment information is used to determine the payment status of the OBU; the sending module is also used to send the identity Information and payment status.
  • this application also provides a server, including: a receiving module for receiving certificate request information, the certificate request information including the identity information of the terminal device; a processing module for determining the authority of the terminal device according to the identity information; a sending module , Is used to send the communication key to the terminal device; the sending module is also used to send the communication key to the roadside unit RSU according to a preset rule, and the communication key is used to encrypt the information sent by the RSU.
  • a server including: a receiving module for receiving certificate request information, the certificate request information including the identity information of the terminal device; a processing module for determining the authority of the terminal device according to the identity information; a sending module , Is used to send the communication key to the terminal device; the sending module is also used to send the communication key to the roadside unit RSU according to a preset rule, and the communication key is used to encrypt the information sent by the RSU.
  • the processing module is also used to sign the certificate request information according to the CA server private key to generate a communication certificate, where the certificate request information includes the first public key; the sending module is also used to send the communication Certificates, communication certificates are used to establish a transmission channel between the terminal device and the CA server.
  • the processing module is further configured to encrypt the communication key according to the first public key.
  • the processing module is also used to establish a secure transmission channel with the terminal device according to the communication certificate; the sending module is also used to send the communication key through the secure transmission channel.
  • the receiving module is also used to receive encrypted certificate request information; the processing module is also used to decrypt encrypted certificate request information.
  • the receiving module is specifically used to: receive the certificate request information encrypted according to the CA server public key; or, receive the certificate request information encrypted according to the symmetric key and the certificate request information encrypted according to the CA server public key. Symmetric key.
  • the sending module is specifically configured to: send the second communication key according to a preset rule, the communication key includes the second communication key, and the second communication key is used to encrypt the first communication key, The first communication key is used to encrypt the broadcast information of the RSU.
  • the preset rule is the time rule.
  • the time rule is a preset fixed time period or a preset fixed time node.
  • the receiving module is also used to re-receive the certificate request information according to the time rule within the validity period of the communication key to update the communication key.
  • the sending module is specifically configured to: send a first communication key sequence, the first communication key sequence includes multiple communication keys, and all communication keys in the first communication key sequence are valid
  • the total duration of the deadline is greater than the preset duration, and the preset duration is determined according to the parameters of the road section where the RSU is located.
  • the receiving module is also used to receive identity information and payment status. If the payment status corresponds to the successful payment status, the authority meets the preset authority requirement.
  • the processing module is also used to determine the sent communication key according to the geographic area where the RSU is located.
  • the terminal device of the fourth aspect provided above is used to execute any of the possible communication methods provided in the first aspect
  • the roadside unit of the fifth aspect provided above is used to execute any of the communication methods provided in the second aspect.
  • the server of the sixth aspect provided above is used to execute any of the possible communication methods provided in the third aspect. Therefore, the beneficial effects that can be achieved can refer to the corresponding provided above The beneficial effects of the method will not be repeated here.
  • this application also provides a terminal device, including: a processor and a memory; the memory is used to store programs and data, and the processor calls the programs stored in the memory to execute any possible communication provided in the first aspect. method.
  • this application also provides a roadside unit, including: a processor and a memory; the memory is used to store programs and data, and the processor calls the programs stored in the memory to execute any of the possibilities provided in the second aspect. Communication method.
  • this application also provides a server, including: a processor and a memory; the memory is used to store programs and data, and the processor calls the programs stored in the memory to execute any of the possible communication methods provided in the third aspect .
  • the present application also provides a computer-readable storage medium.
  • the computer-readable storage medium includes a program.
  • the program is used to execute any possible communication method provided in the first aspect when the program is executed by the processor.
  • the present application also provides a computer-readable storage medium.
  • the computer-readable storage medium includes a program.
  • the program is used to execute any possible communication method provided in the second aspect when the program is executed by the processor.
  • the present application also provides a computer-readable storage medium.
  • the computer-readable storage medium includes a program. When the program is executed by a processor, it is used to execute any of the possible communication methods provided in the third aspect.
  • the terminal device of the seventh aspect provided above and the computer-readable storage medium of the tenth aspect are used to execute any possible communication method provided in the first aspect, and the roadside unit of the eighth aspect provided above And the computer-readable storage medium of the eleventh aspect is used to execute any of the possible communication methods provided in the second aspect, and the server of the ninth aspect and the computer-readable storage medium of the twelfth aspect provided above are used to execute
  • the beneficial effects that can be achieved can refer to the beneficial effects in the corresponding methods provided above, which will not be repeated here.
  • Figure 1 is a schematic diagram of an application scenario of the communication method provided by this application.
  • FIG. 2 is a schematic diagram of the information interaction relationship of the communication method provided by this application.
  • FIG. 3 is a flowchart of an exemplary communication method provided by an embodiment of the application.
  • FIG. 4 is a flowchart of another exemplary communication method provided by an embodiment of the application.
  • FIG. 5 is a flowchart of another exemplary communication method provided by an embodiment of this application.
  • FIG. 6 is a structural diagram of an exemplary terminal device provided by an embodiment of the application.
  • FIG. 7 is a structural diagram of an exemplary roadside unit provided by an embodiment of the application.
  • FIG. 8 is a structural diagram of an exemplary server provided by an embodiment of the application.
  • FIG. 9 is a structural diagram of another exemplary terminal device provided by an embodiment of the application.
  • FIG. 10 is a structural diagram of another exemplary roadside unit provided by an embodiment of this application.
  • FIG. 11 is a structural diagram of another exemplary server provided by an embodiment of the application.
  • FIG. 1 is a schematic diagram of the application scenario of the communication method provided by this application
  • FIG. 2 is a schematic diagram of the information interaction relationship of the communication method provided by this application.
  • the communication method provided in this embodiment is applied to a road traffic scene, for example, it can be applied to a highway scene.
  • the ETC system 100 is usually set at the entrance and exit of the expressway.
  • the RSU200 is usually deployed in the ETC system 100.
  • the terminal device on the vehicle is triggered.
  • the certificate request information is sent to a certificate authority (Certificate Authority, CA for short) server 400.
  • the terminal device may be an OBU or a UE, and the OBU 300 may be selected as the terminal device for illustration.
  • the aforementioned certificate request information includes identity information, and the identity information may be a character string used to identify the OBU 300, and the certificate request information may be used to determine the authority of the OBU 300.
  • the authority of the OBU300 can be determined by the identity information preset in the OBU300, where the authority of the OBU300 can be used to characterize specific attributes, such as: expense attribute, geographic attribute, vehicle brand attribute, vehicle model attribute, and vehicle attribution location Attributes, etc.
  • the cost attribute can be selected as a specific attribute for illustration.
  • the ETC system 100 can obtain the identity information in the OBU300, and the ETC system 100 can also send a trigger instruction to the OBU300 to trigger the OBU300 to send a certificate to the CA server 400 Request information, where the certificate request information includes the identity information of the OBU300; or it can also be that the identity information in the OBU300 is first sent to the expense back-end server, and then forwarded to the CA server 400 through the expense back-end server; or just to The expense back-end server stores; or, after the OBU300 completes the payment in the ETC system 100, it is sent to the CA server 400 through the RSU200; or the RSU200 first sends the identity information in the OBU300 to the expense back-end server, and then passes the expense back-end server. The server forwards it to the CA server 400; or the RSU200 just sends it to the expense back-end server for storage.
  • the fee can be paid by purchasing the corresponding service.
  • the corresponding vehicle can be purchased for 1 day, 1 week, 1 month,
  • the status information corresponding to the authority corresponding to the identity information of the OBU 300 will be stored in the back-end server or the CA server 400 in advance.
  • the status information of the non-compliance with the authority corresponding to the identity information of the OBU 300 will be stored in the fee backend server or the CA server 400 in advance.
  • the status information corresponding to the identity information of the OBU 300 will be modified in the fee backend server or the CA server 400 The status is in compliance with the permissions. However, if the vehicle passes through the ETC system 100, if the value-added fee for obtaining value-added information is not paid, the status information corresponding to the identity information of the OBU 300 will be modified in the fee back-end server or the CA server 400 to be non-compliant. The status of the permission.
  • the CA server 400 can directly obtain it, or obtain the authority of the OBU 300 from the expense back-end server, and then determine whether to issue the communication key to the OBU 300 according to the obtained authority.
  • the OBU300 can use the communication key to decrypt the received encrypted broadcast information. It is worth noting that after decrypting the encrypted broadcast information by the communication key, the push information can be obtained directly, or another communication key and the information encrypted by another communication key can be obtained, and then the information can be obtained through another communication key. Decryption to obtain the pushed information, or alternatively, obtain another communication key or information encrypted by the communication key, and then decrypt with another communication key to obtain the pushed information.
  • the CA server 400 may also issue a communication key to the RSU 200. It is worth noting that the behavior of the CA server 400 to issue a communication key to the RSU 200 is not affected by the interaction between the CA server 400 and the OBU 300.
  • the CA server 400 may issue the communication key to the OBU 300 according to a preset rule.
  • it may issue a communication key according to a time rule, such as according to a preset fixed time period or at a preset fixed time node.
  • the OBU300 can use the received communication key to encrypt the externally broadcast information.
  • the information that OBU300 broadcasts to the outside world can be information that is separately encrypted by a communication key to push information, or it can be information that is encrypted by a communication key and another communication key together, or it can be It is information that is separately encrypted with another communication key by the communication key.
  • OBU300 in order for OBU300 to use the received communication key to decrypt the encrypted broadcast information broadcast by OBU300, it is necessary to ensure that the communication key used for decryption in OBU300 and the communication key used for encryption in OBU300 are at the same time. It is the same key or a paired key. Specifically, it can be implemented through the above-mentioned preset rules, and the form of the preset rules is not specifically limited in this embodiment. It is only necessary to ensure that the OBU300 can be used in the OBU300 according to the unified preset rules. The decrypted communication key and the communication key used for encryption by the OBU300 can be the same key or a paired key.
  • the OBU310 whose authority meets the preset authority requirement can decrypt the received encrypted broadcast information to obtain the corresponding Information push, and for OBU320 whose authority does not meet the preset authority requirements, it does not have a communication key and cannot decrypt the received encrypted broadcast information. This achieves the effect that only vehicles with specific attributes can receive relevant information pushes.
  • Fig. 3 is a flowchart of an exemplary communication method provided by an embodiment of the application. As shown in Figure 3, the communication method provided in this embodiment includes:
  • the CA server may send a communication key to the RSU according to a preset rule, where the communication key may be used to encrypt information sent by the roadside unit RSU.
  • the CA server may send the communication key to the RSU according to a preset time rule, for example, it may send the communication key to the RSU according to a preset fixed time period or according to a preset fixed time node.
  • the CA server may periodically send the communication key to the RSU as an example.
  • the above-mentioned preset fixed time period may be hours, minutes, or even days, which is not specifically limited in this embodiment.
  • the CA server can also issue the same communication key to all RSUs in each cycle, or issue different communication keys, or issue the corresponding communication secret according to the geographic area where the RSU is located.
  • the X communication key is issued to the RSU located on the Beijing-Shanghai Expressway
  • the Y communication key is issued to the RSU located on the Shanghai-Shanxi Expressway, so that the communication keys in different areas cannot be used universally. Regions carry out separate tariff management.
  • the RSU can also maintain multiple communication keys at the same time.
  • the RSU can receive a second communication key sequence sent by the CA server.
  • the second communication key sequence includes multiple communication keys.
  • the rule sequentially selects the communication keys in the second communication key sequence as the communication keys for encrypting information.
  • the RSU can maintain two communication keys at the same time, which are the currently used communication key and the communication key that needs to be used in the next time period.
  • the RSU receives the communication key issued by the CA server, it can immediately update the currently used communication key, or update it at a certain time or at a certain time.
  • the time point can be synchronized with the CA server through the aforementioned preset rules.
  • the ETC system 100 is usually set at the entrances and exits of the expressway. Among them, the RSU is usually deployed in the ETC system. When the vehicle passes through the ETC system, the RSU will send a trigger instruction to the OBU to trigger the terminal equipment on the vehicle (such as OBU or UE). ) Send the certificate request information to the CA server. It is worth noting that the OBU is selected as the terminal device in the following steps for illustration.
  • the certificate request information includes identity information
  • the identity information may be a character string used to identify the OBU
  • the certificate request information may be used to determine the authority of the OBU.
  • the OBU can trigger the sending of certificate request information to the CA server when the vehicle passes the ETC system, or it can be the OBU after confirming that it has the corresponding authority. For example, the vehicle passes the ETC system. The act of sending the certificate request information to the CA server when obtaining the value-added cost of the value-added information.
  • S103 Determine the authority of the terminal device according to the identity information.
  • the authority of the OBU may be determined by the identity information preset in the OBU, where the authority of the OBU may be used to characterize a specific attribute, such as a cost situation.
  • the ETC system can obtain the identity information in the OBU, and then send the identity information in the OBU to the CA server, or it can also send the identity information in the OBU to the expense back-end server first, and then pass
  • the fee backend server is forwarded to the CA server, or it is just sent to the fee backend server for storage, or it can be sent to the CA server through the RSU after the OBU completes the payment in the ETC system, or the RSU first sends the identity in the OBU
  • the information is sent to the expense back-end server, and then forwarded to the CA server through the expense back-end server, or the RSU is just sent to the expense back-end server for storage.
  • the fee can be paid by purchasing the corresponding service, for example, the corresponding vehicle has been purchased for 1 day, 1 week, 1 month, 1 year or other
  • the status information that matches the authority corresponding to the identity information of the OBU will be stored in the back-end server or the CA server in advance.
  • the status information of the non-compliant authority corresponding to the identity information of the OBU will be stored in the fee backend server or CA server in advance.
  • the identity information of the OBU and the payment status can be sent. If the payment status corresponds to the successful payment status, the authority meets the preset permission requirements. Among them, it can be OBU directly to the CA server
  • the status information corresponding to the identity information of the OBU will be modified in the fee backend server or CA server to a state that complies with the authority.
  • the status information corresponding to the OBU's identity information will be modified in the fee back-end server or CA server to not comply with the authority. status.
  • the CA server After the CA server receives the certificate request information sent by the OBU, the CA server can directly obtain it, or obtain the OBU authority from the expense back-end server, and then determine whether to issue the communication key to the OBU according to the obtained authority. Among them, the OBU can use the communication key to decrypt the received encrypted broadcast information. It is worth noting that after decrypting the encrypted broadcast information by the communication key, the push information can be obtained directly, or another communication key and the information encrypted by another communication key can be obtained, and then the information can be obtained through another communication key. Decryption to obtain the pushed information, or alternatively, obtain another communication key or information encrypted by the communication key, and then decrypt with another communication key to obtain the pushed information.
  • the CA server may encrypt the communication key when subsequently issuing the communication key, and the above encryption method may be symmetric encryption or It may be asymmetric encryption, and the specific encryption method is not limited in this embodiment.
  • the first key pair may also be generated, where the first key pair includes the first private key and the first public key.
  • the OBU then includes the first public key in the certificate request information and sends it to the CA server together.
  • the CA server can use the received first public key of the OBU to encrypt the communication key, and then distribute the encrypted communication key To the OBU, so that the OBU decrypts the encrypted communication key through the first private key, thereby obtaining the communication key.
  • the CA server may also sign the certificate request information according to a preset CA private key to generate a communication certificate.
  • the CA server first issues the generated communication certificate to the OBU.
  • the OBU can verify the communication certificate through the CA public key, and then use the received communication certificate to establish a secure transmission channel between the CA servers, and then send it through the secure transmission channel Communication key.
  • the OBU can also encrypt the certificate request information before sending the certificate request information
  • the sent certificate request information is encrypted certificate request information, where the encryption method may be symmetric encryption or asymmetric encryption, and the specific encryption method is not limited in this embodiment.
  • the certificate request information can be encrypted according to the preset CA public key, so that after receiving the encrypted certificate request information, the CA server can perform the certificate request information according to the CA private key. Decrypted.
  • the amount of data processing is more and the processing speed is slower, and the method of using symmetric keys is compared with the method of asymmetric encryption for encryption and decryption.
  • the amount of data processing is less and the processing speed is faster. Therefore, when the certificate request information data is large, in order to ensure the security of the certificate request information sent by the OBU to the CA server, the efficiency of the OBU's encryption of the certificate request information and the CA server's decryption of the certificate request information can also be improved.
  • the information includes the encrypted symmetric key.
  • S105 Encrypt information according to the communication key.
  • the RSU After the RSU receives the communication key sent by the CA server, it can use the communication key to encrypt its outgoing information.
  • the aforementioned encrypted information may be encrypted broadcast information, where the encrypted broadcast information includes a broadcast identifier.
  • the OBU After the OBU receives the information, it can be determined as broadcast information by identifying the broadcast identifier.
  • the encryption is sent Before broadcasting the information, the current communication key used to encrypt the information can also be determined according to preset rules.
  • the communication key used for decryption in the OBU and the communication key used for encryption by the RSU are The same key or a paired key. Therefore, it can be implemented through a preset rule agreed upon with the CA server, for example, it may be a time rule, and the form of the preset rule is not specifically limited in this embodiment, and only needs to be guaranteed based on a unified
  • the preset rule can realize that the communication key used for decryption in the OBU and the communication key used for encryption in the OBU are the same key or a paired key.
  • the RSU uses the communication key to encrypt its outgoing information, and it can also determine whether the current outgoing information meets the preset service type requirements. For example: if the type of information currently outgoing is a non-value-added service type, RSU does not need to encrypt it, so that all vehicles receiving the information can obtain the relevant information. However, if the information currently outgoing is If the type is a service type of value-added service, the RSU uses the communication key to encrypt its outgoing information, so that only the vehicle that has purchased the value-added service can decrypt and obtain the relevant information.
  • the OBU whose authority meets the preset authority requirement can decrypt the received encrypted broadcast information to obtain the corresponding information Push, and for OBUs whose authority does not meet the preset authority requirements, they do not have a communication key and cannot decrypt the received encrypted broadcast information.
  • the above-mentioned preset authority requirements can be set according to specific requirements. For example, they can be set as charging requirements, geographic requirements, vehicle brand requirements, vehicle model requirements, and vehicle ownership requirements, etc. In this embodiment, It does not limit the specific form of the preset permission requirements.
  • the CA server determines the authority of the terminal device through the identity information in the certificate request sent by the terminal device, and when the authority of the terminal device meets the preset authority requirement, it issues the communication key to the terminal device so that only Terminal devices with preset authority requirements can use the communication key to decrypt the encrypted information sent by the RSU, where the RSU uses the communication key sent by the CA server to encrypt the information sent out, so that only those that meet the specific attribute requirements Only the vehicle can decrypt the received information to receive the push of related information, so as to achieve the purpose of providing differentiated services for vehicles with different characteristics.
  • Fig. 4 is a flowchart of another exemplary communication method provided by an embodiment of the application. As shown in Figure 4, the communication method provided in this embodiment includes:
  • the CA server and the RSU may interact periodically, that is, the CA server may periodically send the communication key to the RSU for illustration, for example, it may be hours, minutes, or even days as the unit mentioned above. Cycle time.
  • the communication key periodically issued by the CA server to the RSU may be Kc, where Kc is the key used by the RSU to encrypt broadcast information.
  • the CA server may also issue the same Kc to all RSUs in each cycle, or may issue different Kc, or may issue the corresponding Kc according to the geographic area where the RSU is located.
  • S202 Determine a communication key currently used for encrypting information according to a preset rule.
  • the RSU can also maintain multiple Kc at the same time, where the RSU can receive the second communication key sequence sent by the CA server, the second communication key sequence includes multiple Kc, and then select the second communication in sequence according to the time rule Kc in the key sequence is used as a communication key for encrypting information.
  • the RSU can maintain two Kc at the same time, which are the currently used Kc and the Kc that needs to be used in the next time period.
  • the RSU After the RSU receives the Kc issued by the CA server, it can immediately update the currently used Kc, or update it at a certain time or at a certain time, and for a certain time or at a certain time, it can be Synchronize with the CA server through the above-mentioned preset rules.
  • the RSU may send the instruction request information when the RSU at the high-speed intersection senses that the vehicle is entering.
  • the instruction request information is used to instruct the terminal device to send the certificate request information. It is worth noting that when a vehicle is at a high-speed intersection, ETC payment is usually required, and the corresponding RSU will be triggered, so that the RSU will send instruction request information to the OBU.
  • the above-mentioned certificate request information includes identity information, and the identity information may be a character string used to identify the OBU, and the certificate request information may be used to determine the authority of the OBU.
  • the OBU can trigger the sending of certificate request information to the CA server when the vehicle passes the ETC system, or it can be the OBU after confirming that it has the corresponding authority. For example, the vehicle passes the ETC system. The act of sending the certificate request information to the CA server when obtaining the value-added cost of the value-added information.
  • the OBU Before the OBU sends the certificate request information to the CA server, it may also generate a first key pair, where the first key pair includes a first private key and a first public key. The OBU then includes the first public key in the certificate request information and sends it to the CA server together.
  • the CA server can use the received first public key of the OBU to encrypt Kc, and then send the encrypted Kc to the OBU to The OBU decrypts the encrypted Kc through the first private key, so that the OBU obtains the Kc.
  • the request information includes the encrypted symmetric key.
  • S205 Determine the authority of the OBU according to the identity information.
  • the authority of the OBU may be determined by the identity information preset in the OBU, where the authority of the OBU may be used to characterize a specific attribute, such as a cost situation.
  • the ETC system can obtain the identity information in the OBU, and then send the identity information in the OBU to the CA server, or it can also send the identity information in the OBU to the expense back-end server first, and then pass
  • the fee backend server is forwarded to the CA server, or it is just sent to the fee backend server for storage, or it can be sent to the CA server through the RSU after the OBU completes the payment in the ETC system, or the RSU first sends the identity in the OBU
  • the information is sent to the expense back-end server, and then forwarded to the CA server through the expense back-end server, or the RSU is just sent to the expense back-end server for storage.
  • the fee can be paid by purchasing the corresponding service, for example, the corresponding vehicle has been purchased for 1 day, 1 week, 1 month, 1 year or other
  • the status information that matches the authority corresponding to the identity information of the OBU will be stored in the back-end server or the CA server in advance.
  • the status information of the non-compliance with the authority corresponding to the identity information of the OBU will be stored in the fee backend server or the CA server in advance.
  • the identity information of the OBU and the payment status can be sent. If the payment status corresponds to the successful payment status, the authority meets the preset permission requirements. Among them, it can be OBU directly to the CA server
  • the status information corresponding to the identity information of the OBU will be modified in the fee backend server or CA server to a state that complies with the authority.
  • the status information corresponding to the OBU's identity information will be modified in the fee back-end server or CA server to not comply with the authority. status.
  • the CA server After the CA server receives the certificate request information sent by the OBU, the CA server can directly obtain it, or obtain the OBU authority from the expense back-end server, and then determine whether to issue the communication key to the OBU according to the obtained authority.
  • the encrypted Kc is decrypted according to the first private key, so that the OBU can use the Kc to decrypt the received encrypted broadcast information.
  • the CA server may sign the certificate request information according to the CA private key, thereby generating a communication certificate.
  • the CA server first issues the generated communication certificate to the OBU.
  • the OBU can verify the communication certificate through the CA public key, and then use the received communication certificate to establish a secure transmission channel between the CA servers, and then send it through the secure transmission channel Kc, so that the OBU can use Kc to decrypt the received encrypted broadcast information.
  • the Kc used for decryption in the OBU and the Kc used for encryption by the RSU are the same key or a paired secret. key. Therefore, it can be achieved through a preset rule agreed with the CA server, for example, it can be a time rule, for example: it can be updated according to a fixed period, or it can be set with a fixed period of use for each Kc, thus Realize that the Kc being used by OBU and RSU at each time point is the same or corresponding.
  • the RSU After the RSU receives the Kc sent by the CA server, it can use the Kc to encrypt the information sent out by the broadcast.
  • S210 Decrypt the encrypted broadcast information according to the communication key.
  • the CA server When the vehicle enters the high speed and is driving on the high speed, because the CA server has sent Kc to the OBU that purchases the value-added service, the OBU that purchases the value-added service can decrypt the received encrypted broadcast information to obtain the corresponding information push , And for OBUs that have not purchased value-added services, there is no Kc and cannot decrypt the received encrypted broadcast information.
  • the OBU can process according to the sequence of encryption and signature to obtain the push information, where the sequence of encryption and signature for the broadcast information can be preset.
  • the details are as follows: If the encrypted broadcast information is first encrypted and then signed, the OBU will verify the encrypted broadcast information according to the preset RSU public key. If the verification is passed, Kc will be used for decryption; however, if the encrypted broadcast information is first encrypted After the signature is encrypted, Kc can be used for decryption first, and then the decrypted broadcast information can be verified according to the preset RSU public key.
  • the OBU can also resend the certificate request information according to the time rule within the validity period of the communication key to update the Kc used to decrypt the information, so that the The information service was interrupted due to the update of Kc.
  • the RSU before updating the Kc, the RSU encrypts the Kc that needs to be used in the next time period through the currently used Kc, and broadcasts it, so that the OBU can obtain the Kc that needs to be used in the next time period.
  • the first communication key sequence can also be directly issued, where the first communication key sequence includes multiple Kc, and all Kc in the first communication key sequence are valid.
  • the total duration of the deadline is greater than the preset duration.
  • each Kc in the first communication key sequence corresponds to a fixed effective time period, and the information of each time period is recorded in the CA server, and the CA server can be based on the effective time period of each Kc
  • the Kc is issued to the RSU so that the RSU can determine the Kc currently used for encryption according to the effective time of each Kc.
  • the aforementioned preset duration can be determined according to the longest time that the vehicle normally travels on each road section.
  • the CA server decrypts the encrypted certificate request information sent by the received OBU to determine the authority of the terminal device according to the identity information in the certificate request, and when the authority of the terminal device meets the preset authority requirement , To issue the encrypted communication key to the terminal device so that the OBU can decrypt it to obtain the communication key, so as to ensure the security of the communication key transmission, but also enable only the terminal devices with preset authority requirements to be able to Use the communication key to decrypt the encrypted broadcast information sent by the RSU, where the RSU uses the communication key sent by the CA server to encrypt the information sent out so that only vehicles that meet the requirements of specific attributes can decrypt the received information Decryption is performed to receive the push of relevant information, thereby achieving the purpose of providing differentiated services for vehicles with different characteristics.
  • Fig. 5 is a flowchart of yet another exemplary communication method provided by an embodiment of the application. As shown in Figure 5, the communication method provided in this embodiment includes:
  • the CA server and the RSU may interact periodically, that is, the CA server may periodically send the second communication key Ke to the RSU for illustration, for example, it may be hours, minutes, or even days.
  • the second communication key periodically issued by the CA server to the RSU may be Ke.
  • the RSU may use Ke to pair the first communication key Kc, where Kc is used by the RSU to broadcast information The key used for encryption.
  • the CA server may also issue the same Ke to all RSUs in each cycle, or may issue different Ke, or may issue corresponding Ke according to the geographic area where the RSU is located.
  • S302 Determine a second communication key currently used for encrypting information according to a preset rule.
  • the RSU can also maintain multiple Kes at the same time, where the RSU can receive the second communication key sequence sent by the CA server, the second communication key sequence includes multiple Ke, and then select the second communication in sequence according to the time rule Ke in the key sequence is used as a communication key for encrypting information.
  • the RSU can maintain two Kes at the same time, namely the currently used Ke and the Ke that needs to be used in the next time period.
  • the RSU can immediately update the currently used Ke, or it can be updated at a certain time or at a certain point in time, and for a certain time or at a certain point in time, it can be Synchronize with the CA server through the above-mentioned preset rules.
  • S305 Determine the authority of the OBU according to the identity information.
  • the CA server After the CA server receives the certificate request information sent by the OBU, the CA server can directly obtain it, or obtain the OBU authority from the expense back-end server, and then determine whether to issue Ke to the OBU according to the obtained authority.
  • the encrypted Ke is decrypted according to the first private key, so that the OBU can use Ke to decrypt the received encrypted broadcast information.
  • the CA server may sign the certificate request information according to the CA private key, thereby generating a communication certificate.
  • the CA server first issues the generated communication certificate to the OBU.
  • the OBU can verify the communication certificate through the CA public key, and then use the received communication certificate to establish a secure transmission channel between the CA servers, and then send it through the secure transmission channel Ke, so that the OBU can use Ke to decrypt the received encrypted Kc, thereby obtaining Kc, and then use Kc to decrypt the encrypted broadcast information.
  • the OBU In order for the OBU to use the received Ke to decrypt the encrypted Kc broadcast by the RSU, it is necessary to ensure that the Ke used for decryption in the OBU and the Ke used for encryption in the RSU are the same key or a paired key at the same time. . Therefore, it can be achieved through preset rules agreed with the CA server, for example, it can be a time rule, for example: it can be updated according to a fixed period, or it can be set with a fixed period of use for each Ke, thus Realize that the Ke being used by OBU and RSU at each time point is the same or corresponding.
  • S308 Encrypt the first communication key according to the second communication key.
  • the RSU After the RSU receives the Ke sent by the CA server, it can use the Ke to encrypt the Kc, and then broadcast the encrypted Kc. It is worth noting that the encrypted Kc can be broadcast and sent separately, or it can be sent together when other information is broadcast.
  • S310 Decrypt the encrypted first communication key according to the second communication key.
  • the OBU purchasing the value-added service can decrypt the received encrypted Kc to obtain the Kc , And for OBUs that have not purchased value-added services, Kc cannot be decrypted.
  • the OBU may process according to the order of encryption and signature to obtain Kc, where the order of encryption and signature for Kc may be preset.
  • the details are as follows: If the encrypted Kc is first encrypted and then signed, the OBU will verify the encrypted Kc according to the preset RSU public key. If the verification is passed, the Kc will be used for decryption; however, if the encrypted Kc is Kc is first signed and then encrypted, then the encrypted Kc can be used for decryption, and then the decrypted Kc can be verified according to the preset RSU public key.
  • S311 Perform information encryption according to the first communication key.
  • RSU can use Kc to encrypt the information it broadcasts, so that Kc is completely managed by RSU.
  • the RSU can re-broadcast the encrypted Kc.
  • S313 Decrypt the encrypted broadcast information according to the first communication key.
  • the OBU that purchased the value-added service can decrypt the received encrypted Kc to obtain Kc, and then decrypt the encrypted broadcast information based on the Kc. Get the corresponding value-added information push.
  • the OBU can also resend the certificate request information according to the time rule within the validity period of the communication key to update the Ke used to decrypt the information, so that the The information service was interrupted due to Ke's update.
  • the RSU before updating Kc, the RSU encrypts the Ke that needs to be used in the next time period through the currently used Ke, and broadcasts it, so that the OBU can obtain the Ke that needs to be used in the next time period.
  • the first communication key sequence can also be directly issued.
  • the first communication key sequence includes multiple Ke, and all Ke in the first communication key sequence are valid.
  • the total duration of the deadline is greater than the preset duration.
  • each Ke in the first communication key sequence corresponds to a fixed effective time period, and the information of each time period is recorded in the CA server, and the CA server can be based on the effective time period of each Ke Send Ke to the RSU so that the RSU can determine the Ke currently used for encryption according to the effective time of each Ke.
  • the aforementioned preset duration can be determined according to the longest time that the vehicle normally travels on each road section.
  • the CA server decrypts the encrypted certificate request information sent by the received OBU to determine the authority of the terminal device according to the identity information in the certificate request, and when the authority of the terminal device meets the preset authority requirement , To issue the encrypted second communication key to the terminal device, so that the OBU decrypts it to obtain the second communication key, so that while ensuring the security of the second communication key transmission, it can also make only the preset
  • the terminal device with permission requirements can use the second communication key to decrypt the first communication key sent by the RSU, and then use the first communication key to decrypt the encrypted broadcast information, where the RSU uses the first communication sent by the CA server
  • the key encrypts the information sent out so that only vehicles that meet the requirements of specific attributes can decrypt the received information to receive the push of relevant information, thus realizing the differentiated service of vehicles with different characteristics purpose.
  • Fig. 6 is a structural diagram of an exemplary terminal device provided by an embodiment of the application. As shown in FIG. 6, the terminal device 400 provided in this embodiment includes:
  • the receiving module 403 is used to receive a trigger instruction when it is located at a preset node position on a road section;
  • the sending module 401 is configured to send certificate request information, where the certificate request information includes the identity information of the terminal device;
  • the receiving module 403 is used to receive the communication key sent by the CA server of the certification authority;
  • the receiving module 403 is also used to receive encrypted information sent by the roadside unit RSU, where the encrypted information is information encrypted using a communication key;
  • the processing module 402 is used to decrypt the encrypted information according to the communication key.
  • the encrypted information is encrypted broadcast information
  • the encrypted broadcast information includes a broadcast identifier
  • the processing module 402 is further configured to generate a first key pair.
  • the first key pair includes a first private key and a first public key
  • the certificate request information includes the first public key
  • the first public key is used to encrypt the communication key.
  • the receiving module 403 is specifically used for:
  • the processing module 402 is also used to encrypt the certificate request information, and the sent certificate request information is encrypted certificate request information.
  • processing module 402 is specifically used for:
  • the processing module 402 is further configured to determine the communication key currently used to decrypt information according to a preset rule.
  • processing module 402 is specifically used for:
  • the encrypted first communication key is decrypted according to the second communication key.
  • the preset rule is the time rule.
  • the time rule is a preset fixed time period or a preset fixed time node.
  • the sending module 401 is also used to resend the certificate request information according to the time rule within the validity period of the communication key to update the communication key used to decrypt the information.
  • processing module 402 is specifically used for:
  • a communication key in the first communication key sequence is determined as the current communication key used to decrypt information.
  • the processing module 402 is also used to verify the encrypted broadcast information according to the preset RSU public key.
  • the processing module 402 is also used to verify the decrypted broadcast information according to the preset RSU public key.
  • the sending module 401 is also used to send the identity information and the payment status. If the payment status corresponds to the successful payment status, the authority of the terminal device presets permission requirements.
  • terminal device provided in this embodiment can be used to execute the steps on the terminal device side in any of the foregoing method embodiments.
  • the specific implementation manner and technical effect are similar, and details are not described herein again.
  • Fig. 7 is a structural diagram of an exemplary roadside unit provided by an embodiment of the application.
  • the roadside unit 500 provided in this embodiment includes:
  • the receiving module 503 is used to receive the communication key sent by the CA server, and the communication key is used to encrypt the information sent out;
  • the sending module 501 is used to send encrypted information.
  • the encrypted information is encrypted broadcast information
  • the encrypted broadcast information includes a broadcast identifier
  • the roadside unit also includes:
  • the processing module 502 is configured to encrypt only the outgoing information that meets the requirements of the preset service type.
  • the roadside unit also includes:
  • the processing module 502 is configured to determine the communication key currently used for encrypting information according to a preset rule.
  • the processing module 502 is further configured to encrypt the first communication key according to the second communication key, and the first communication key is used to encrypt broadcast information;
  • the sending module 501 is further configured to send the encrypted first communication key according to a preset rule.
  • the preset rule is the time rule.
  • the time rule is a preset fixed time period or a preset fixed time node.
  • the receiving module 503 is further configured to receive a second communication key sequence, and the second communication key sequence includes multiple communication keys;
  • the processing module 502 is further configured to sequentially select the communication keys in the second communication key sequence as the communication keys for encrypting information according to the time rule.
  • the processing module 502 is also used to sign the broadcast information according to the RSU private key of the roadside unit;
  • the processing module 502 is further configured to encrypt broadcast information according to the communication key
  • the sending module 501 is also used to send encrypted information.
  • the processing module 502 is also used to encrypt the broadcast information according to the communication key;
  • the processing module 502 is also used to sign the encrypted broadcast information according to the RSU private key of the roadside unit.
  • the receiving module 503 is also used to receive identity information and payment information, the identity information is used to characterize the identity of the on-board unit OBU, and the payment information is used to determine the payment status of the OBU;
  • the sending module 501 is also used to send identity information and payment status.
  • roadside unit provided in this embodiment can be used to execute the steps on the roadside unit side in any of the foregoing method embodiments.
  • the specific implementation and technical effects are similar, and details are not repeated here.
  • Fig. 8 is a structural diagram of an exemplary server provided by an embodiment of the application. As shown in FIG. 8, the server 600 provided in this embodiment includes:
  • the receiving module 603 is configured to receive certificate request information, where the certificate request information includes the identity information of the terminal device;
  • the processing module 602 is used to determine the authority of the terminal device according to the identity information
  • the sending module 601 is used to send the communication key to the terminal device
  • the sending module 601 is also used to send a communication key to the roadside unit RSU according to a preset rule, and the communication key is used to encrypt information sent by the RSU.
  • the processing module 602 is further configured to sign the certificate request information according to the CA server private key to generate a communication certificate, where the certificate request information includes the first public key;
  • the sending module 601 is also used to send a communication certificate, which is used to establish a transmission channel between the terminal device and the CA server.
  • the processing module 602 is further configured to encrypt the communication key according to the first public key.
  • the processing module 602 is also used to establish a secure transmission channel with the terminal device according to the communication certificate;
  • the sending module 601 is also used to send the communication key through the secure transmission channel.
  • the receiving module 603 is also used to receive encrypted certificate request information
  • the processing module 602 is also used to decrypt the encrypted certificate request information.
  • the receiving module 603 is specifically used for:
  • the sending module 601 is specifically used for:
  • the second communication key is sent according to a preset rule, the communication key includes the second communication key, the second communication key is used to encrypt the first communication key, and the first communication key is used to encrypt the broadcast information of the RSU.
  • the preset rule is the time rule.
  • the time rule is a preset fixed time period or a preset fixed time node.
  • the receiving module 603 is also configured to re-receive the certificate request information according to the time rule within the validity period of the communication key to update the communication key.
  • the sending module 601 is specifically used for:
  • the first communication key sequence includes multiple communication keys.
  • the total validity period of all communication keys in the first communication key sequence is greater than the preset time length.
  • the preset time length is based on where the RSU is located.
  • the parameters of the road section are determined.
  • the receiving module 603 is also used to receive identity information and payment status. If the payment status corresponds to the successful payment status, the authority meets the preset authority requirement.
  • the processing module 602 is also used to determine the sent communication key according to the geographic area where the RSU is located.
  • server provided in this embodiment can be used to execute the steps on the server side in any of the foregoing method embodiments.
  • the specific implementation manner and technical effect are similar, and details are not described herein again.
  • FIG. 9 is a structural diagram of another exemplary terminal device provided by an embodiment of the application.
  • the terminal device 700 provided in this embodiment includes: a processor 701, a memory 702, a communication interface 703, and a bus 704.
  • the processor 701, the memory 702, and the communication interface 703 are connected through a bus 704 and communicate with each other.
  • the memory 702 is used to store computer execution instructions.
  • the processor 701 executes the computer execution instructions in the memory 702. Use the hardware resources in the device to execute the steps on the terminal device side in the communication method corresponding to FIGS. 3 to 5.
  • FIG. 10 is a structural diagram of another exemplary roadside unit provided by an embodiment of the application.
  • the roadside unit 800 provided in this embodiment includes a processor 801, a memory 802, a communication interface 803, and a bus 804.
  • the processor 801, the memory 802, and the communication interface 803 are connected through a bus 804 to complete mutual communication.
  • the memory 802 is used to store computer execution instructions.
  • the processor 801 executes the computer execution instructions in the memory 802. Use the hardware resources in the device to execute the steps on the roadside unit side in the communication method corresponding to Figs. 3 to 5.
  • FIG. 11 is a structural diagram of another exemplary server provided by an embodiment of the application.
  • the server 900 provided in this embodiment includes: a processor 901, a memory 902, a communication interface 903, and a bus 904.
  • the processor 901, the memory 902, and the communication interface 903 are connected through a bus 904 to complete mutual communication.
  • the memory 902 is used to store computer execution instructions.
  • the processor 901 executes the computer execution instructions in the memory 902. Use the hardware resources in the device to execute the steps on the server side in the communication method corresponding to Figures 3 to 5.
  • a communication system including the terminal device shown in FIG. 9, the roadside unit shown in FIG. 10, and the server shown in FIG. 11.
  • a computer-readable medium stores instructions, which when run on a computer, cause the computer to execute the terminal device side of the communication method corresponding to FIGS. 3 to 5. A step of.
  • a computer-readable medium stores instructions, which when run on a computer, cause the computer to execute the communication method corresponding to Figs. 3 to 5 on the roadside unit side. A step of.
  • a computer-readable medium stores instructions, which when running on a computer, cause the computer to execute the server-side communication method corresponding to FIGS. 3 to 5 step.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Mobile Radio Communication Systems (AREA)
  • Telephonic Communication Services (AREA)

Abstract

本申请提供一种通信方法、终端设备、路侧单元、服务器、系统及介质。该方法包括：终端设备向服务器发送证书请求信息，然后，接收服务器发送的通信密钥，再接收路侧单元发送的加密广播信息，最后，根据通信密钥对加密广播信息进行解密。本申请提供的通信方法、终端设备、路侧单元、服务器、系统及介质，实现对不同特性的终端设备进行差异化服务的目的。

Description

通信方法、终端设备、路侧单元、服务器、系统及介质
本申请要求于2019年12月18日提交中国专利局、申请号为201911310826.7、申请名称为“通信方法、终端设备、路侧单元、服务器、系统及介质”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请实施例涉及通信技术，尤其涉及一种通信方法、终端设备、路侧单元、服务器、系统及介质。
背景技术
随着车联网技术的发展，在越来越多的车辆上配置有具备通信功能的车载单元(On board Unit，简称OBU)，车辆可以直接通过OBU与路侧单元(Road Side Unit，简称RSU)进行信息交互，或者还可以是通过用户设备(User Equipment，简称UE)与RSU进行信息交互。
目前，当车辆行驶在高速上时，驾驶员一般都是通过电子显示屏或者收音广播的方式获取相关信息，例如前方道路信息、增值服务资讯等，但是，电子显示屏或者收音广播的信息发布形式对于接收车辆是无差别对待。而RSU目前也只在高速出入口的不停车电子收费系统(Electronic Toll Collection，简称ETC)处进行部署，主要用于实现车辆身份识别，并且RSU对外发布信息的方式是通过广播的形式进行，即所有车辆均可接收RSU广播的信息，无法实现只有特定目标的车辆才能接收到RSU所广播的信息的目的。
因此，如何实现只有具备了特定属性的车辆才能接收到相关信息推送是当前亟需解决的问题。
发明内容
本申请提供一种通信方法、终端设备、路侧单元、服务器、系统及介质，用于解决现有技术中无法利用RSU针对特定属性的车辆进行相关信息推送的问题。
为达到上述目的，本申请采用如下技术方案：
第一方面，本申请提供一种通信方法，包括：位于路段预设节点位置时，接收触发指令；
发送证书请求信息，证书请求信息包括终端设备的身份信息；接收证书颁发机构CA服务器发送的通信密钥；接收路侧单元RSU发送的加密信息，加密信息为利用通信密钥进行加密的信息；根据通信密钥对加密信息进行解密。
在本实施例中，CA服务器通过终端设备所发送证书请求中的身份信息确定终端设 备的权限，并在终端设备的权限符合预设权限要求时，向终端设备下发通信密钥，以使只有预设权限要求的终端设备可以利用通信密钥对RSU发送的加密信息进行解密，其中，RSU利用CA服务器所发送的通信密钥对向外发送的信息进行加密，以使得只有满足特定属性要求的车辆才能对接收到的信息进行解密，以接收到相关信息的推送，从而实现对不同特性的车辆进行差异化服务的目的。
在一种可能的设计中，加密信息为加密广播信息，加密广播信息包括广播标识。
在本实施例中，当OBU接收到该信息之后，可以通过识别出广播标识的方式确定RSU发送的信息为加密广播信息，从而利用通信密钥对加密广播信息进行解密，以使得在能够接收到广播信息的车辆中，同时还满足了特定属性要求的车辆，才能对接收到的加密广播信息进行解密。
在一种可能的设计中，在发送证书请求信息之前，还包括：生成第一密钥对，第一密钥对包括第一私钥以及第一公钥，证书请求信息包括第一公钥。
在本实施例中，在CA服务器接收到OBU发送的包括有第一公钥的证书请求信息之后，可以根据CA私钥对证书请求信息进行签名，以生成通信证书。
在一种可能的设计中，所述第一公钥用于对所述通信密钥进行加密。
在本实施例中，在通信密钥的传输过程中，利用第一公钥对通信密钥进行加密，在OBU接收通信密钥后再进行解密，从而确保了通信密钥的传输安全性。
在一种可能的设计中，接收接收CA服务器发送的通信密钥，包括：接收CA服务器发送的通信证书；根据通信证书建立终端设备与CA服务器之间的安全传输通道；通过安全传输通道接收CA服务器发送的通信密钥。
在本实施例中，通过先根据通信证书建立安全传输通道，再利用建立的安全传输通道传输通信密钥，从而确保了通信密钥的传输安全性。
在一种可能的设计中，在生成第一密钥对之后，还包括：对证书请求信息加密，所发送的证书请求信息为加密后的证书请求信息。
在本实施例中，通过对证书请求信息加密，以确保证书请求信息在传输过程中的安全性。
在一种可能的设计中，对证书请求信息加密，包括：根据预设的CA服务器公钥对证书请求信息进行加密。
在本实施例中，通过利用CA服务器公钥对证书请求信息进行加密，以确保证书请求信息在传输过程中的安全性。
在一种可能的设计中，对证书请求信息加密，包括：生成对称密钥，并根据对称密钥对证书请求信息进行加密；根据预设的CA服务器公钥对对称密钥进行加密，并发送加密后的对称密钥。
在本实施例中，通过利用对称密钥对证书请求信息进行加密，以及CA服务器公钥对对称密钥进行加密，再进行发送，从而在保证OBU向CA服务器所发送证书请求信息的安全性的同时，还能够提高OBU对于证书请求信息加密以及CA服务器对于证书请求信息解密的效率。
在一种可能的设计中，在根据通信密钥对加密信息进行解密之前，还包括：根据预设规则确定当前用于解密信息的通信密钥。
在本实施例中，通过设定预设规则确定OBU中当前用于解密信息的通信密钥，以实现OBU与RSU当前使用的通信密钥的同步。
在一种可能的设计中，根据预设规则确定当前用于解密信息的通信密钥，包括：接收RSU发送的加密后的第一通信密钥；根据预设规则接收CA服务器发送的第二通信密钥；根据第二通信密钥解密加密后的第一通信密钥。
在本实施例中，OBU通过根据预设规则接收RSU发送的加密后的第一通信密钥，根据CA服务器发送的第二通信密钥解密加密后的第一通信密钥，从而使得RSU具备对于用于加密广播信息的第一通信密钥的管理功能。
在一种可能的设计中，预设规则为时间规则。
在本实施例中，通过将预设规则设置为时间规则，从而使得OBU与RSU根据时间规则同步当前使用的通信密钥。
在一种可能的设计中，时间规则为预设固定时间周期或预设固定时间节点。
在一种可能的设计中，在发送证书请求信息之后，还包括：在通信密钥的有效期限内，根据时间规则重新发送证书请求信息，以更新用于解密信息的通信密钥。
在本实施例中，OBU通过在通信密钥有效期到期之前，重新发送证书请求信息，以更新用于解密信息的通信密钥，从而避免了在更新通信密钥时出现信息服务中断的情况。
在一种可能的设计中，根据预设规则确定当前用于解密信息的通信密钥，包括：接收第一通信密钥序列，其中，第一通信密钥序列包括多个通信密钥，第一通信密钥序列中的所有通信密钥的有效期限总时长大于预设时长；根据时间规则确定第一通信密钥序列中的一个通信密钥作为当前用于解密信息的通信密钥。
在本实施例中，通过CA服务器通过向OBU下发数量足够的通信密钥，以使得OBU在预设时长内无需再向CA服务器申请通信密钥，并且，还能够保证OBU在预设时长信息服务的连续性。
在一种可能的设计中，在根据通信密钥对加密信息进行解密之前，还包括：根据预设的RSU公钥对加密信息进行验证。
在本实施例中，OBU通过根据预设的RSU公钥对加密信息进行验证，如果验证通过，再使用Kc进行解密，以对先加密后签名的信息进行处理，从而获得推送信息。
在一种可能的设计中，在根据通信密钥对加密信息进行解密之后，还包括：根据预设的RSU公钥对解密信息进行验证。
在本实施例中，OBU通过先使用Kc进行解密，再根据预设的RSU公钥对解密信息进行验证，以对先签名后加密的信息进行处理，从而获得推送信息。
在一种可能的设计中，在接收触发指令之后，还包括：发送身份信息以及付费状态，若付费状态对应成功付费状态，则终端设备的权限符合预设权限要求。
在本实施例中，CA服务器通过终端设备付费信息来确定终端设备的权限是否符合预设权限要求时，从而确定是否向终端设备下发通信密钥，以使只有付费的终端设备可以利用通信密钥对RSU发送的加密信息进行解密，以接收到相关信息的推送，从而实现对于车辆进行信息增值服务的目的。
在一种可能的设计中，终端设备为车载单元OBU或者用户设备UE。
第二方面，本申请还提供一种通信方法，包括：接收CA服务器发送的通信密钥，通信密钥用于对外发的信息进行加密；发送加密信息。
在本实施例中，CA服务器通过终端设备所发送证书请求中的身份信息确定终端设备的权限，并在终端设备的权限符合预设权限要求时，向终端设备下发通信密钥，以使只有预设权限要求的终端设备可以利用通信密钥对RSU发送的加密信息进行解密，其中，RSU利用CA服务器所发送的通信密钥对向外发送的信息进行加密，以使得只有满足特定属性要求的车辆才能对接收到的信息进行解密，以接收到相关信息的推送，从而实现对不同特性的车辆进行差异化服务的目的。
在一种可能的设计中，加密信息为加密广播信息，加密广播信息包括广播标识。
在本实施例中，当OBU接收到该信息之后，可以通过识别出广播标识的方式确定RSU发送的信息为加密广播信息，从而利用通信密钥对加密广播信息进行解密，以使得在能够接收到广播信息的车辆中，同时还满足了特定属性要求的车辆，才能对接收到的加密广播信息进行解密。
在一种可能的设计中，在发送加密信息之前，还包括：只对符合预设业务类型要求的外发信息进行加密。
在本实施例中，通过只对符合预设业务类型要求的外发信息进行加密，以使具有权限的RSU才能获取到预设业务类型对应的信息。
在一种可能的设计中，在发送加密广播信息之前，还包括：根据预设规则确定当前用于加密信息的通信密钥。
在本实施例中，RSU通过根据预设规则确定当前使用的通信密钥，从而实现RSU对于多个通信密钥的管理，并且保证OBU与RSU当前使用的通信密钥相同或先对应。
在一种可能的设计中，在根据预设规则确定当前用于加密信息的通信密钥之后，还包括：根据第二通信密钥对第一通信密钥进行加密，第一通信密钥用于对广播信息进行加密；根据预设规则发送加密后的第一通信密钥。
在本实施例中，OBU通过根据预设规则接收RSU发送的加密后的第一通信密钥，根据CA服务器发送的第二通信密钥解密加密后的第一通信密钥，从而使得RSU具备对于用于加密广播信息的第一通信密钥的管理功能。
在一种可能的设计中，预设规则为时间规则。
在本实施例中，通过将预设规则设置为时间规则，从而使得OBU与RSU根据时间规则同步当前使用的通信密钥。
在一种可能的设计中，时间规则为预设固定时间周期或预设固定时间节点。
在一种可能的设计中，在发送加密信息之前，还包括：接收第二通信密钥序列，第二通信密钥序列包括多个通信密钥；根据时间规则依次选取第二通信密钥序列中的通信密钥作为用于加密信息的通信密钥。
在本实施例中，通过CA服务器通过向RSU下发多个通信密钥，以使得RSU根据时间规则维护多个通信密钥，从而保证RSU提供信息服务的连续性。
在一种可能的设计中，在发送加密信息之前，还包括：根据路侧单元RSU私钥对广播信息进行签名；根据通信密钥对广播信息进行加密；发送加密广播信息。
在本实施例中，RSU先根据RSU私钥对广播信息进行签名，再根据通信密钥对广 播信息进行加密，从而确保广播信息的传输安全性。
在一种可能的设计中，在发送加密信息之前，还包括：根据通信密钥对广播信息进行加密；根据路侧单元RSU私钥对加密广播信息进行签名。
在本实施例中，RSU先根据通信密钥对广播信息进行加密，再根据路侧单元RSU私钥对加密广播信息进行签名，从而确保广播信息的传输安全性。
在一种可能的设计中，在发送加密信息之前，还包括：接收身份信息以及付费信息，身份信息用于表征车载单元终端设备的身份，付费信息用于确定终端设备的付费状态；发送身份信息以及付费状态。
在本实施例中，CA服务器通过终端设备付费信息来确定终端设备的权限是否符合预设权限要求时，从而确定是否向终端设备下发通信密钥，以使只有付费的终端设备可以利用通信密钥对RSU发送的加密广播信息进行解密，以接收到相关信息的推送，从而实现对于车辆进行信息增值服务的目的。
第三方面，本申请还提供一种通信方法，包括：接收证书请求信息，证书请求信息包括车载单元终端设备的身份信息；根据身份信息确定终端设备的权限；若权限符合预设权限要求，则发送向所述终端设备发送通信密钥；根据预设规则向路侧单元RSU发送通信密钥，通信密钥用于对路侧单元RSU外发的信息进行加密。
在本实施例中，CA服务器通过终端设备所发送证书请求中的身份信息确定终端设备的权限，并在终端设备的权限符合预设权限要求时，向终端设备下发通信密钥，以使只有预设权限要求的终端设备可以利用通信密钥对RSU发送的加密信息进行解密，其中，RSU利用CA服务器所发送的通信密钥对向外发送的信息进行加密，以使得只有满足特定属性要求的车辆才能对接收到的信息进行解密，以接收到相关信息的推送，从而实现对不同特性的车辆进行差异化服务的目的。
在一种可能的设计中，在向终端设备发送通信密钥之前，还包括：根据CA服务器私钥对证书请求信息进行签名，以生成通信证书，其中，证书请求信息包括第一公钥，发送通信证书，通信证书用于建立终端设备与CA服务器之间的传输通道。
在本实施例中，在CA服务器接收到OBU发送的包括有第一公钥的证书请求信息之后，可以根据CA私钥对证书请求信息进行签名，以生成通信证书，以利用生成的通信证书建立终端设备与CA服务器之间的传输通道。
在一种可能的设计中，在向终端设备发送通信密钥之前，还包括：根据第一公钥对通信密钥进行加密。
在本实施例中，在通信密钥的传输过程中，利用第一公钥对通信密钥进行加密，在OBU接收通信密钥后再进行解密，从而确保了通信密钥的传输安全性。
在一种可能的设计中，在向所述终端设备发送通信密钥之前，还包括：根据通信证书建立与终端设备之间的安全传输通道；通过安全传输通道发送通信密钥。
在本实施例中，通过先根据通信证书建立安全传输通道，再利用建立的安全传输通道传输通信密钥，从而确保了通信密钥的传输安全性。
在一种可能的设计中，在向所述终端设备发送通信密钥之前，还包括：接收加密后的证书请求信息；解密加密后的证书请求信息。
在本实施例中，通过对证书请求信息加密，以确保证书请求信息在传输过程中的 安全性。
在一种可能的设计中，接收加密后的证书请求信息，包括：接收根据CA服务器公钥加密后的证书请求信息；或者，接收根据对称密钥加密后的证书请求信息以及根据CA服务器公钥加密后的对称密钥。
在本实施例中，通过利用对称密钥对证书请求信息进行加密，以及CA服务器公钥对对称密钥进行加密，再进行发送，从而在保证OBU向CA服务器所发送证书请求信息的安全性的同时，还能够提高OBU对于证书请求信息加密以及CA服务器对于证书请求信息解密的效率。
在一种可能的设计中，根据预设规则发送通信密钥，包括：根据预设规则发送第二通信密钥，通信密钥包括第二通信密钥，第二通信密钥用于加密第一通信密钥，第一通信密钥用于对RSU的广播信息进行加密。
在本实施例中，OBU通过根据预设规则接收RSU发送的加密后的第一通信密钥，根据CA服务器发送的第二通信密钥解密加密后的第一通信密钥，从而使得RSU具备对于用于加密广播信息的第一通信密钥的管理功能。
在一种可能的设计中，预设规则为时间规则。
在本实施例中，通过将预设规则设置为时间规则，从而使得OBU与RSU根据时间规则同步当前使用的通信密钥。
在一种可能的设计中，时间规则为预设固定时间周期或预设固定时间节点。
在一种可能的设计中，在接收证书请求信息之后，还包括：在通信密钥的有效期限内，根据时间规则重新接收证书请求信息，以更新通信密钥。
在本实施例中，OBU通过在通信密钥有效期到期之前，重新发送证书请求信息，以更新用于解密信息的通信密钥，从而避免了在更新通信密钥时出现信息服务中断的情况。
在一种可能的设计中，向终端设备发送通信密钥，包括：发送第一通信密钥序列，第一通信密钥序列包括多个通信密钥，第一通信密钥序列中的所有通信密钥的有效期限总时长大于预设时长，预设时长根据RSU所处的路段参数进行确定。
在本实施例中，通过CA服务器通过向OBU下发数量足够的通信密钥，以使得OBU在预设时长内无需再向CA服务器申请通信密钥，并且，还能够保证OBU在预设时长信息服务的连续性。
在一种可能的设计中，根据身份信息确定终端设备的权限，包括：
接收身份信息以及付费状态，若付费状态对应成功付费状态，则权限符合预设权限要求。
在本实施例中，CA服务器通过终端设备付费信息来确定终端设备的权限是否符合预设权限要求时，从而确定是否向终端设备下发包含有通信密钥的通信密钥，以使只有付费的终端设备可以利用通信密钥对RSU发送的加密广播信息进行解密，以接收到相关信息的推送，从而实现对于车辆进行信息增值服务的目的。
在一种可能的设计中，在向终端设备发送通信密钥之前，还包括：根据RSU所处的地理区域确定所发送的通信密钥。
在本实施例中，CA服务器通过向处于不同地理区域的RSU发送不同的通信密钥， 以实现对于不同地理区域广播信息推送的单独管理。
第四方面，本申请还提供一种终端设备，包括：接收模块，用于位于路段预设节点位置时，接收触发指令；发送模块，用于发送证书请求信息，证书请求信息包括终端设备的身份信息；接收模块，用于接收证书颁发机构CA服务器发送的通信密钥；接收模块，还用于接收路侧单元RSU发送的加密信息，加密信息为利用通信密钥进行加密的信息；处理模块，用于根据通信密钥对加密信息进行解密。
在一种可能的设计中，加密信息为加密广播信息，加密广播信息包括广播标识。
在一种可能的设计中，处理模块，还用于生成第一密钥对，第一密钥对包括第一私钥以及第一公钥，证书请求信息包括第一公钥。
在一种可能的设计中，第一公钥用于对通信密钥进行加密。
在一种可能的设计中，接收模块，具体用于：接收CA服务器发送的通信证书；根据通信证书建立终端设备与CA服务器之间的安全传输通道；通过安全传输通道接收CA服务器发送的通信密钥。
在一种可能的设计中，处理模块，还用于对证书请求信息加密，所发送的证书请求信息为加密后的证书请求信息。
在一种可能的设计中，处理模块，具体用于：根据预设的CA服务器公钥对证书请求信息进行加密；或者，生成对称密钥，并根据对称密钥对证书请求信息进行加密；根据预设的CA服务器公钥对对称密钥进行加密，并发送加密后的对称密钥。
在一种可能的设计中，处理模块，还用于根据预设规则确定当前用于解密信息的通信密钥。
在一种可能的设计中，处理模块，具体用于：接收RSU发送的加密后的第一通信密钥；根据预设规则接收CA服务器发送的第二通信密钥；根据第二通信密钥解密加密后的第一通信密钥。
在一种可能的设计中，预设规则为时间规则。
在一种可能的设计中，时间规则为预设固定时间周期或预设固定时间节点。
在一种可能的设计中，发送模块，还用于在通信密钥的有效期限内，根据时间规则重新发送证书请求信息，以更新用于解密信息的通信密钥。
在一种可能的设计中，处理模块，具体用于：接收第一通信密钥序列，其中，第一通信密钥序列包括多个通信密钥，第一通信密钥序列中的所有通信密钥的有效期限总时长大于预设时长；根据时间规则确定第一通信密钥序列中的一个通信密钥作为当前用于解密信息的通信密钥。
在一种可能的设计中，处理模块，还用于根据预设的RSU公钥对加密广播信息进行验证。
在一种可能的设计中，处理模块，还用于根据预设的RSU公钥对解密广播信息进行验证。
在一种可能的设计中，发送模块，还用于发送身份信息以及付费状态，若付费状态对应成功付费状态，则终端设备的权限预设权限要求。
第五方面，本申请还提供一种路侧单元，包括：接收模块，用于接收CA服务器发送的通信密钥，通信密钥用于对外发的信息进行加密；发送模块，用于发送加密信息。
在一种可能的设计中，加密信息为加密广播信息，加密广播信息包括广播标识。
在一种可能的设计中，路侧单元，还包括：处理模块，用于只对符合预设业务类型要求的外发信息进行加密。
在一种可能的设计中，路侧单元，还包括：处理模块，用于根据预设规则确定当前用于加密信息的通信密钥。
在一种可能的设计中，处理模块，还用于根据第二通信密钥对第一通信密钥进行加密，第一通信密钥用于对广播信息进行加密；
发送模块，还用于根据预设规则发送加密后的第一通信密钥。
在一种可能的设计中，预设规则为时间规则。
在一种可能的设计中，时间规则为预设固定时间周期或预设固定时间节点。
在一种可能的设计中，接收模块，还用于接收第二通信密钥序列，第二通信密钥序列包括多个通信密钥；处理模块，还用于根据时间规则依次选取第二通信密钥序列中的通信密钥作为用于加密信息的通信密钥。
在一种可能的设计中，处理模块，还用于根据路侧单元RSU私钥对广播信息进行签名；处理模块，还用于根据通信密钥对广播信息进行加密；发送模块，还用于发送加密信息。
在一种可能的设计中，处理模块，还用于根据通信密钥对广播信息进行加密；处理模块，还用于根据路侧单元RSU私钥对加密广播信息进行签名。
在一种可能的设计中，接收模块，还用于接收身份信息以及付费信息，身份信息用于表征车载单元OBU的身份，付费信息用于确定OBU的付费状态；发送模块，还用于发送身份信息以及付费状态。
第六方面，本申请还提供一种服务器，包括：接收模块，用于接收证书请求信息，证书请求信息包括终端设备的身份信息；处理模块，用于根据身份信息确定终端设备的权限；发送模块，用于向终端设备发送通信密钥；发送模块，还用于根据预设规则向路侧单元RSU发送通信密钥，通信密钥用于对RSU外发的信息进行加密。
在一种可能的设计中，处理模块，还用于根据CA服务器私钥对证书请求信息进行签名，以生成通信证书，其中，证书请求信息包括第一公钥；发送模块，还用于发送通信证书，通信证书用于建立终端设备与CA服务器之间的传输通道。
在一种可能的设计中，处理模块，还用于根据第一公钥对通信密钥进行加密。
在一种可能的设计中，处理模块，还用于根据通信证书建立与终端设备之间的安全传输通道；发送模块，还用于通过安全传输通道发送通信密钥。
在一种可能的设计中，接收模块，还用于接收加密后的证书请求信息；处理模块，还用于解密加密后的证书请求信息。
在一种可能的设计中，接收模块，具体用于：接收根据CA服务器公钥加密后的证书请求信息；或者，接收根据对称密钥加密后的证书请求信息以及根据CA服务器公钥加密后的对称密钥。
在一种可能的设计中，发送模块，具体用于：根据预设规则发送第二通信密钥，通信密钥包括第二通信密钥，第二通信密钥用于加密第一通信密钥，第一通信密钥用于对RSU的广播信息进行加密。
在一种可能的设计中，预设规则为时间规则。
在一种可能的设计中，时间规则为预设固定时间周期或预设固定时间节点。
在一种可能的设计中，接收模块，还用于在通信密钥的有效期限内，根据时间规则重新接收证书请求信息，以更新通信密钥。
在一种可能的设计中，发送模块，具体用于：发送第一通信密钥序列，第一通信密钥序列包括多个通信密钥，第一通信密钥序列中的所有通信密钥的有效期限总时长大于预设时长，预设时长根据RSU所处的路段参数进行确定。
在一种可能的设计中，接收模块，还用于接收身份信息以及付费状态，若付费状态对应成功付费状态，则权限符合预设权限要求。
在一种可能的设计中，处理模块，还用于根据RSU所处的地理区域确定所发送的通信密钥。
可以理解地，上述提供的第四方面的终端设备用于执行第一方面中提供的任一种可能的通信方法，上述提供的第五方面的路侧单元用于执行第二方面中提供的任一种可能的通信方法，上述提供的第六方面的服务器用于执行第三方面中提供的任一种可能的通信方法，因此，其所能达到的有益效果可参考上文所提供的对应的方法中的有益效果，此处不再赘述。
第七方面，本申请还提供一种终端设备，包括：处理器、存储器；存储器用于存储程序和数据，处理器调用存储器存储的程序，以执行第一方面中提供的任一种可能的通信方法。
第八方面，本申请还提供一种路侧单元，包括：处理器、存储器；存储器用于存储程序和数据，处理器调用存储器存储的程序，以执行第二方面中提供的任一种可能的通信方法。
第九方面，本申请还提供一种服务器，包括：处理器、存储器；存储器用于存储程序和数据，处理器调用存储器存储的程序，以执行第三方面中提供的任一种可能的通信方法。
第十方面，本申请还提供一种计算机可读存储介质，计算机可读存储介质包括程序，程序在被处理器执行时用于执行第一方面中提供的任一种可能的通信方法。
第十一方面，本申请还提供一种计算机可读存储介质，计算机可读存储介质包括程序，程序在被处理器执行时用于执行第二方面中提供的任一种可能的通信方法。
第十二方面，本申请还提供一种计算机可读存储介质，计算机可读存储介质包括程序，程序在被处理器执行时用于执行第三方面中提供的任一种可能的通信方法。
可以理解地，上述提供的第七方面的终端设备以及第十方面的计算机可读存储介质用于执行第一方面中提供的任一种可能的通信方法，上述提供的第八方面的路侧单元以及第十一方面的计算机可读存储介质用于执行第二方面中提供的任一种可能的通信方法，上述提供的第九方面的服务器以及第十二方面的计算机可读存储介质用于执行第三方面中提供的任一种可能的通信方法，因此，其所能达到的有益效果可参考上文所提供的对应的方法中的有益效果，此处不再赘述。
附图说明
图1为本申请提供的通信方法的应用场景示意图；
图2为本申请提供的通信方法的信息交互关系示意图；
图3为本申请实施例提供的一种示例性的通信方法的流程图；
图4为本申请实施例提供的另一种示例性的通信方法的流程图；
图5为本申请实施例提供的又一种示例性的通信方法的流程图；
图6为本申请实施例提供的一种示例性的终端设备的结构图；
图7为本申请实施例提供的一种示例性的路侧单元的结构图；
图8为本申请实施例提供的一种示例性的服务器的结构图；
图9为本申请实施例提供的另一种示例性的终端设备的结构图；
图10为本申请实施例提供的另一种示例性的路侧单元的结构图；
图11为本申请实施例提供的另一种示例性的服务器的结构图。
具体实施方式
图1为本申请提供的通信方法的应用场景示意图，图2为本申请提供的通信方法的信息交互关系示意图。如图1-图2所示，本实施例提供的通信方法应用于道路交通场景，例如，可以应用于高速公路场景。
下面将高速公路作为示例性的场景进行说明，在高速公路出入口出通常设置有ETC系统100，其中，在ETC系统100中通常部署有RSU200，当车辆通过ETC系统100时，触发车辆上的终端设备向证书颁发机构(Certificate Authority，简称CA)服务器400发送证书请求信息，终端设备可以为OBU或者UE，其中，可以选取OBU300作为终端设备进行举例说明。上述的证书请求信息包括身份信息，而身份信息可以是用于标识OBU300的字符串，并且，证书请求信息可以用于确定OBU300的权限。
而对于OBU300的权限可以是通过预设在OBU300中的身份信息进行确定，其中，OBU300的权限可以用于表征特定属性，例如：费用属性、地域属性、车辆品牌属性、车辆型号属性以及车辆归属地属性等。
可以选取费用属性作为特定属性进行举例说明。在车辆经过位于路段预设节点位置上的ETC系统100时，ETC系统100可以获取到OBU300中的身份信息，并且，ETC系统100还可向OBU300发送触发指令，以触发OBU300向CA服务器400发送证书请求信息，其中，证书请求信息中包括了OBU300的身份信息；又或者还可以是先将OBU300中的身份信息发送至费用后台服务器，再通过费用后台服务器转发至CA服务器400；又或者只是发送至费用后台服务器进行存储；又或者还可以是OBU300在ETC系统100中完成付费之后，通过RSU200发送至CA服务器400；又或者是RSU200先将OBU300中的身份信息发送至费用后台服务器，再通过费用后台服务器转发至CA服务器400；又或者RSU200只是发送至费用后台服务器进行存储。
可选的，当车辆事先就已经缴纳了用于获取增值信息的增值费用，例如：可以通过购买相应服务的形式进行缴费，具体的，相应车辆可以购买了1天、1周、1个月、1年或者其他时长范围的增值服务，则在费用后台服务器或者CA服务器400中就会事先保存OBU300的身份信息所对应的符合权限的状态信息。但是，若车辆事先就未缴纳了用于获取增值信息的增值费用，则在费用后台服务器或者CA服务器400中就会事先 保存OBU300的身份信息所对应的不符合权限的状态信息。
又或者，还可以是当车辆通过ETC系统100时，如果缴纳了用于获取增值信息的增值费用时，则在费用后台服务器或者CA服务器400中就会将OBU300的身份信息所对应的状态信息修改为符合权限的状态。但是，若当车辆通过ETC系统100时，如果未缴纳用于获取增值信息的增值费用时，则在费用后台服务器或者CA服务器400中就会将OBU300的身份信息所对应的状态信息修改为不符合权限的状态。
在CA服务器400接收到OBU300发送的证书请求信息之后，CA服务器400就可以直接获取，或者从费用后台服务器中获取OBU300的权限，然后根据获取到的权限，确定是否向OBU300下发通信密钥。其中，OBU300可以利用该通信密钥可以用于对接收到的加密广播信息进行解密。值得说明的，通过通信密钥对加密广播信息进行解密后可以是直接获得推送信息，也可以是获得另一个通信密钥和利用另一个通信密钥加密的信息，再通过另一个通信密钥进行解密以获取推送的信息，又或者还可以是获得另一个通信密钥或者通信密钥加密的信息，再通过另一个通信密钥进行解密以获取推送的信息。
此外，CA服务器400还可以向RSU200下发通信密钥，值得说明的，CA服务器400向RSU200下发通信密钥的行为并不受CA服务器400与OBU300之间的交互关系所影响。例如，CA服务器400可以是根据预设的规则向OBU300下发通信密钥，可选的，可以是根据时间规则，如根据预设固定时间周期或者在预设固定时间节点将通信密钥下发至OBU300中。然后，OBU300可以通过接收到的通信密钥对向外广播的信息进行加密。值得说明的，OBU300对向外广播的信息可以是通过通信密钥对推送信息单独进行加密的信息，也可以是通过通信密钥对推送信息以及另一个通信密钥一起进行加密的信息，还可以是通过通信密钥对另一个通信密钥单独进行加密的信息。
值得说明的，为了使得OBU300可以利用接收到的通信密钥对OBU300广播的加密广播信息进行解密，需要保证在同一时刻下，OBU300中用于解密的通信密钥与OBU300用于加密的通信密钥为同一密钥或者为相配对的密钥。具体的，可以是通过上述的预设的规则进行实现，而对于预设的规则的形式，在本实施例中并不作具体的限定，只需保证根据统一的预设规则能够实现OBU300中用于解密的通信密钥与OBU300用于加密的通信密钥为同一密钥或者为相配对的密钥即可。
在车辆进入高速之后，由于CA服务器400已经向权限符合预设权限要求的OBU310发送了通信密钥，因此，权限符合预设权限要求的OBU310就可以对接收到的加密广播信息进行解密以获取相应信息推送，而对于权限不符合预设权限要求的OBU320则没有通信密钥而无法对接收到的加密广播信息进行解密。从而实现了只有具备了特定属性的车辆才能接收到相关信息推送的效果。
图3为本申请实施例提供的一种示例性的通信方法的流程图。如图3所示，本实施例提供的通信方法，包括：
S101、发送通信密钥。
CA服务器可以根据预设规则向RSU发送通信密钥，其中，通信密钥可以用于对路侧单元RSU外发的信息进行加密。
可选的，CA服务器可以根据预设的时间规则向RSU发送通信密钥，例如，可以是 按照预设固定时间周期或按照预设固定时间节点向RSU发送通信密钥。
其中，可以以CA服务器周期性地向RSU发送通信密钥进行举例说明，上述的预设固定时间周期可以为小时、分钟，甚至还可以以天为单位，在本实施例中不作具体限定。
此外，CA服务器还可以根据在每个周期中向所有的RSU下发相同的通信密钥，也可以是下发不同的通信密钥，还可以根据RSU所处的地理区域下发对应的通信密钥，例如，对位于京沪高速上的RSU下发X通信密钥，而对位于沪陕高速上的RSU下发Y通信密钥，从而使得不同区域范围的通信密钥不可通用，以便对于各个区域进行单独的资费管理。
此外，RSU还可以在同一时间维护多个通信密钥，其中，RSU可以接收CA服务器发送的第二通信密钥序列，第二通信密钥序列包括多个通信密钥，然后，根据所述时间规则依次选取第二通信密钥序列中的通信密钥作为用于加密信息的通信密钥。例如，RSU可以在同一时间维护两个通信密钥，分别为当前使用的通信密钥，和在下一时间段需要使用的通信密钥。而当RSU接收到CA服务器下发的通信密钥之后，可以立即更新当前所使用的通信密钥，也可以隔一定时间或者在某个时间点再进行更新，而对于隔一定时间或者在某个时间点可以是通过上述的预设规则与CA服务器进行同步。
S102、发送证书请求信息。
在高速公路出入口出通常设置有ETC系统100，其中，在ETC系统中通常部署有RSU，当车辆通过ETC系统时，RSU会向OBU发送触发指令，以触发车辆上的终端设备(例如OBU或UE)向CA服务器发送证书请求信息。值得说明的，下面各个步骤中选取OBU作为终端设备进行举例说明。
其中，证书请求信息包括身份信息，而身份信息可以是用于标识OBU的字符串，并且，证书请求信息可以用于确定OBU的权限。值得说明的，OBU可以是在车辆通过ETC系统时，均触发向CA服务器发送证书请求信息的行为，也可以是OBU在确定具备了相应权限之后，例如，车辆通过ETC系统，如果缴纳了用于获取增值信息的增值费用时，再向CA服务器发送证书请求信息的行为。
S103、根据身份信息确定终端设备的权限。
具体的，对OBU的权限可以是通过预设在OBU中的身份信息进行确定，其中，OBU的权限可以用于表征特定属性，例如费用情况。在车辆经过ETC系统时，ETC系统可以获取到OBU中的身份信息，然后将OBU中的身份信息发送至CA服务器，又或者还可以是先将OBU中的身份信息发送至费用后台服务器，再通过费用后台服务器转发至CA服务器，又或者只是发送至费用后台服务器进行存储，又或者还可以是OBU在ETC系统中完成付费之后，通过RSU发送至CA服务器，又或者是RSU先将OBU中的身份信息发送至费用后台服务器，再通过费用后台服务器转发至CA服务器，又或者RSU只是发送至费用后台服务器进行存储。
可选的，当车辆事先就已经缴纳了用于获取增值信息的增值费用，可以通过购买相应服务的形式进行缴费，例如，相应车辆购买了1天、1周、1个月、1年或者其他时长范围的增值服务，则在费用后台服务器或者CA服务器中就会事先保存OBU的身份信息所对应的符合权限的状态信息。但是，若车辆事先就未缴纳了用于获取增值信息 的增值费用，则在费用后台服务器或者CA服务器中就会事先保存OBU的身份信息所对应的不符合权限的状态信息。
又或者，为了确定OBU的权限，在OBU向CA服务器发送证书请求信息之前，可以发送OBU自身的身份信息以及付费状态，若付费状态对应成功付费状态，则权限符合预设权限要求。其中，可以是OBU直接向CA服务器
例如，当车辆通过ETC系统时，如果缴纳了用于获取增值信息的增值费用时，则在费用后台服务器或者CA服务器中就会将OBU的身份信息所对应的状态信息修改为符合权限的状态。但是，若当车辆通过ETC系统时，如果未缴纳用于获取增值信息的增值费用时，则在费用后台服务器或者CA服务器中就会将OBU的身份信息所对应的状态信息修改为不符合权限的状态。
S104、发送通信密钥。
在CA服务器接收到OBU发送的证书请求信息之后，CA服务器就可以直接获取，或者从费用后台服务器中获取OBU的权限，然后根据获取到的权限，确定是否向OBU下发通信密钥。其中，OBU可以利用该通信密钥对接收到的加密广播信息进行解密。值得说明的，通过通信密钥对加密广播信息进行解密后可以是直接获得推送信息，也可以是获得另一个通信密钥和利用另一个通信密钥加密的信息，再通过另一个通信密钥进行解密以获取推送的信息，又或者还可以是获得另一个通信密钥或者通信密钥加密的信息，再通过另一个通信密钥进行解密以获取推送的信息。
此外，为了保证CA服务器下发至OBU中的通信密钥的安全性，CA服务器在后续下发通信密钥时，可以对通信密钥进行加密，而对于上述加密的方式可以为对称加密，也可以为非对称加密，在本实施例中不对具体的加密方式进行限定。
可选的，在OBU向CA服务器发送证书请求信息之前，还可以生成第一密钥对，其中，第一密钥对包括第一私钥以及第一公钥。OBU再将第一公钥包含于证书请求信息，一起发送至CA服务器。
相应的，在CA服务器接收到包含第一公钥的证书请求信息之后，CA服务器则可以利用收到的OBU的第一公钥对通信密钥进行加密，从而再将加密的通信密钥下发至OBU，以使OBU通过第一私钥对加密的通信密钥进行解密，从而获取通信密钥。
而在另一种可能的实现方式中，CA服务器还可以根据预设的CA私钥对证书请求信息进行签名，以生成通信证书。CA服务器先将生成的通信证书下发至OBU，然后，OBU可以通过CA公钥对通信证书进行验证，再利用收到的通信证书建立CA服务器之间的安全传输通道，再通过安全传输通道发送通信密钥。
除了需要保证CA服务器下发至OBU中的通信密钥的安全性之外，为了提高OBU向CA服务器所发送证书请求信息的安全性，OBU在发送证书请求信息之前，还可以对证书请求信息加密，所发送的证书请求信息为加密后的证书请求信息，其中，加密的方式可以为对称加密，也可以为非对称加密，在本实施例中不对具体的加密方式进行限定。
在一种可能的加密方式中，可以是根据预设的CA公钥对证书请求信息进行加密，以使得CA服务器在接收到加密后的证书请求信息之后，可以根据CA私钥对证书请求信息进行解密。
考虑到利用公私钥对的非对称加密的方式进行加密以及解密所处的数据处理量较多、处理速度也较慢，而采用对称密钥的方式相对于非对称加密的方式进行加密以及解密所处的数据处理量较少、处理速度也较快。因此，而当证书请求信息数据较大时，为了在保证OBU向CA服务器所发送证书请求信息的安全性的同时，还能够提高OBU对于证书请求信息加密以及CA服务器对于证书请求信息解密的效率。还可以在OBU发送证书请求信息之前，再生成对称密钥，并根据对称密钥对证书请求信息进行加密，以及根据预设的CA公钥对对称密钥进行加密，其中，加密后的证书请求信息包括加密后的对称密钥。
S105、根据通信密钥进行信息加密。
S106、发送加密信息。
RSU在接收到CA服务器发送的通信密钥之后，可以利用通信密钥对其外发的信息进行加密。可选的，上述的加密信息可以为加密广播信息，其中，加密广播信息包括广播标识，当OBU接收到该信息之后，可以通过识别出广播标识的方式确定其为广播信息。
可选的，当通信密钥需要进行动态更新时，为了保证OBU中用于解密的通信密钥与RSU用于加密的通信密钥为同一密钥或者为相配对的密钥，则在发送加密广播信息之前，还可以先根据预设规则确定当前用于加密信息的通信密钥。
具体的，为了使得OBU可以利用接收到的通信密钥对RSU广播的加密广播信息进行解密，需要保证在同一时刻下，OBU中用于解密的通信密钥与RSU用于加密的通信密钥为同一密钥或者为相配对的密钥。因此，可以是通过与CA服务器所约定的预设规则进行实现，例如，可以为时间规则，而对于预设的规则的形式，在本实施例中并不作具体的限定，只需保证根据统一的预设规则能够实现OBU中用于解密的通信密钥与OBU用于加密的通信密钥为同一密钥或者为相配对的密钥即可。
此外，在RSU利用通信密钥对其外发的信息进行加密，还可以判断当前外发的信息是否符合预设业务类型要求。例如：如果当前外发的信息的类型为非增值服务的业务类型，则RSU无需对其进行加密，从而使得所有接收信息的车辆都可以获取到相关的信息，但是，如果当前外发的信息的类型为增值服务的业务类型，则RSU利用通信密钥对其外发的信息进行加密，从而使得只有购买了增值服务的车辆才可以进行解密，从而获取到相关的信息。
S107、根据通信密钥对加密广播信息进行解密。
在车辆进入高速之后，由于CA服务器已经向权限符合预设权限要求的OBU发送了通信密钥，因此，权限符合预设权限要求的OBU就可以对接收到的加密广播信息进行解密以获取相应信息推送，而对于权限不符合预设权限要求的OBU则没有通信密钥而无法对接收到的加密广播信息进行解密。值得说明的，上述的预设权限要求可以根据具体的需求进行设定，例如，可以设定为收费要求、地域要求、车辆品牌要求、车辆型号要求以及车辆归属要求等，在本实施例中，并不对预设权限要求的具体形式进行限定。
在本实施例中，CA服务器通过终端设备所发送证书请求中的身份信息确定终端设备的权限，并在终端设备的权限符合预设权限要求时，向终端设备下发通信密钥，以 使只有预设权限要求的终端设备可以利用通信密钥对RSU发送的加密信息进行解密，其中，RSU利用CA服务器所发送的通信密钥对向外发送的信息进行加密，以使得只有满足特定属性要求的车辆才能对接收到的信息进行解密，以接收到相关信息的推送，从而实现对不同特性的车辆进行差异化服务的目的。
图4为本申请实施例提供的另一种示例性的通信方法的流程图。如图4所示，本实施例提供的通信方法，包括：
S201、发送通信密钥。
具体的，CA服务器与RSU可以是进行周期性地交互，即CA服务器可以是周期性地向RSU发送通信密钥进行举例说明，例如可以为小时、分钟，甚至还可以以天为单位作为上述的周期时长。在本实施例中，CA服务器向RSU周期性下发的通信密钥可以为Kc，其中，Kc即为RSU用于对广播信息进行加密的密钥。
此外，CA服务器还可以根据在每个周期中向所有的RSU下发相同的Kc，也可以是下发不同的Kc，还可以根据RSU所处的地理区域下发对应的Kc。
S202、根据预设规则确定当前用于加密信息的通信密钥。
RSU还可以在同一时间维护多个Kc，其中，RSU可以接收CA服务器发送的第二通信密钥序列，第二通信密钥序列包括多个Kc，然后，根据所述时间规则依次选取第二通信密钥序列中的Kc作为用于加密信息的通信密钥。例如，RSU可以在同一时间维护两个Kc，分别为当前使用的Kc，和在下一时间段需要使用的Kc。而当RSU接收到CA服务器下发的Kc之后，可以立即更新当前所使用的Kc，也可以隔一定时间或者在某个时间点再进行更新，而对于隔一定时间或者在某个时间点可以是通过上述的预设规则与CA服务器进行同步。
S203、发送指示请求信息。
为了在车辆进入高速时，能够触发车辆向CA服务器发送指示请求信息，可以在位于高速路口的RSU感应到车辆驶入时，由该RSU发送指示请求信息。其中，该指示请求信息用于指示终端设备发送证书请求信息。值得说明的，当车辆在高速路口时，通常需要进行ETC缴费，就会触发相应的RSU，以使该RSU向OBU发送指示请求信息。
S204、发送证书请求信息。
在本步骤中，上述的证书请求信息包括身份信息，而身份信息可以是用于标识OBU的字符串，并且，证书请求信息可以用于确定OBU的权限。值得说明的，OBU可以是在车辆通过ETC系统时，均触发向CA服务器发送证书请求信息的行为，也可以是OBU在确定具备了相应权限之后，例如，车辆通过ETC系统，如果缴纳了用于获取增值信息的增值费用时，再向CA服务器发送证书请求信息的行为。
在OBU向CA服务器发送证书请求信息之前，还可以生成第一密钥对，其中，第一密钥对包括第一私钥以及第一公钥。OBU再将第一公钥包含于证书请求信息，一起发送至CA服务器。
相应的，在CA服务器接收到包含第一公钥的证书请求信息之后，CA服务器则可以利用收到的OBU的第一公钥对Kc进行加密，从而再将加密的Kc下发至OBU，以使OBU通过第一私钥对加密的Kc进行解密，从而使得OBU获取Kc。
此外，在另一种可能的加密方式中，考虑到利用公私钥对的非对称加密的方式进 行加密以及解密所处的数据处理量较多、处理速度也较慢，而采用对称密钥的方式相对于非对称加密的方式进行加密以及解密所处的数据处理量较少、处理速度也较快。因此，当证书请求信息数据较大时，为了在保证OBU向CA服务器所发送证书请求信息的安全性的同时，还能够提高OBU对于证书请求信息加密以及CA服务器对于证书请求信息解密的效率。还可以在OBU发送证书请求信息之前，再生成一个对称密钥，并根据对称密钥对证书请求信息进行加密，以及根据预设的CA公钥对对称密钥进行加密，其中，加密后的证书请求信息包括加密后的对称密钥。
S205、根据身份信息确定OBU的权限。
具体的，对OBU的权限可以是通过预设在OBU中的身份信息进行确定，其中，OBU的权限可以用于表征特定属性，例如费用情况。在车辆经过ETC系统时，ETC系统可以获取到OBU中的身份信息，然后将OBU中的身份信息发送至CA服务器，又或者还可以是先将OBU中的身份信息发送至费用后台服务器，再通过费用后台服务器转发至CA服务器，又或者只是发送至费用后台服务器进行存储，又或者还可以是OBU在ETC系统中完成付费之后，通过RSU发送至CA服务器，又或者是RSU先将OBU中的身份信息发送至费用后台服务器，再通过费用后台服务器转发至CA服务器，又或者RSU只是发送至费用后台服务器进行存储。
可选的，当车辆事先就已经缴纳了用于获取增值信息的增值费用，可以通过购买相应服务的形式进行缴费，例如，相应车辆购买了1天、1周、1个月、1年或者其他时长范围的增值服务，则在费用后台服务器或者CA服务器中就会事先保存OBU的身份信息所对应的符合权限的状态信息。但是，若车辆事先就未缴纳了用于获取增值信息的增值费用，则在费用后台服务器或者CA服务器中就会事先保存OBU的身份信息所对应的不符合权限的状态信息。
又或者，为了确定OBU的权限，在OBU向CA服务器发送证书请求信息之前，可以发送OBU自身的身份信息以及付费状态，若付费状态对应成功付费状态，则权限符合预设权限要求。其中，可以是OBU直接向CA服务器
例如，当车辆通过ETC系统时，如果缴纳了用于获取增值信息的增值费用时，则在费用后台服务器或者CA服务器中就会将OBU的身份信息所对应的状态信息修改为符合权限的状态。但是，若当车辆通过ETC系统时，如果未缴纳用于获取增值信息的增值费用时，则在费用后台服务器或者CA服务器中就会将OBU的身份信息所对应的状态信息修改为不符合权限的状态。
S206、发送通信密钥。
在CA服务器接收到OBU发送的证书请求信息之后，CA服务器就可以直接获取，或者从费用后台服务器中获取OBU的权限，然后根据获取到的权限，确定是否向OBU下发通信密钥。
然后，根据第一私钥对加密后的Kc进行解密，从而使得OBU可以利用Kc对接收到的加密广播信息进行解密。
又或者，在CA服务器接收到OBU发送的包括有第一公钥的证书请求信息之后，可以根据CA私钥对证书请求信息进行签名，从而生成通信证书。CA服务器先将生成的通信证书下发至OBU，然后，OBU可以通过CA公钥对通信证书进行验证，再利用收到 的通信证书建立CA服务器之间的安全传输通道，再通过安全传输通道发送Kc，从而使得OBU可以利用Kc对接收到的加密广播信息进行解密。
S207、确定用于解密信息的通信密钥。
为了使得OBU可以利用接收到的Kc对RSU广播的加密广播信息进行解密，需要保证在同一时刻下，OBU中用于解密的Kc与RSU用于加密的Kc为同一密钥或者为相配对的密钥。因此，可以是通过与CA服务器所约定的预设规则进行实现，例如，可以为时间规则，例如：可以根据固定周期进行更新，也可以是对每个Kc都设置有一个固定的使用时段，从而实现OBU与RSU在每个时间点上正在使用的Kc为相同或者相对应的。
S208、根据通信密钥进行信息加密。
S209、发送加密广播信息。
RSU在接收到CA服务器发送的Kc之后，可以利用Kc对其进行广播外发的信息进行加密。
S210、根据通信密钥对加密广播信息进行解密。
而当车辆进入高速后，在高速上行驶时，由于CA服务器已经向购买增值服务的OBU发送了Kc，因此，购买增值服务的OBU就可以对接收到的加密广播信息进行解密以获取相应信息推送，而对于未购买增值服务的OBU则没有Kc而无法对接收到的加密广播信息进行解密。
可选的，当OBU收到加密广播信息后，可以根据加密和签名的顺序进行处理，以获得推送信息，其中，对于广播信息的加密和签名顺序可以是预设的。具体如下：如果该加密广播信息是先加密后签名的，则OBU根据预设的RSU公钥对加密广播信息进行验证，如果验证通过，再使用Kc进行解密；但是，如果该加密广播信息是先签名后加密的，则可以先使用Kc进行解密，再根据预设的RSU公钥对解密广播信息进行验证。
此外，在发送证书请求信息之后，OBU还可以在通信密钥的有效期限内，根据时间规则重新发送证书请求信息，以更新用于解密信息的Kc，从而使得在车辆的行驶过程中，不会因Kc的更新而出现信息服务中断的情况。
又或者，还可以是在对Kc进行更新之前，RSU通过当前使用的Kc对下个时段需要使用的Kc进行加密，并进行广播，以使得OBU能够获得下个时段需要进行使用的Kc。
而除了CA服务器频繁地对Kc进行更新之外，还可以直接下发第一通信密钥序列，其中，第一通信密钥序列包括多个Kc，第一通信密钥序列中的所有Kc的有效期限总时长大于预设时长。值得理解的，第一通信密钥序列中的每个Kc均对应有固定的有效时间段，而每个时间段信息在CA服务器中均有记录，而CA服务器可以根据每个Kc的有效时间段向RSU下发Kc，以使RSU可以根据每个Kc的有效时间进行当前用于加密的Kc确定。此外，对于上述的预设时长可以根据车辆在每个路段正常行驶的最长时间进行确定。
在本实施例中，CA服务器对接收到的OBU所发送加密后的证书请求信息进行解密，以根据证书请求中的身份信息确定终端设备的权限，并在终端设备的权限符合预设权限要求时，向终端设备下发加密后的通信密钥，以使OBU对其进行解密后获得通信密钥，从而在保证通信密钥传递安全性的同时，还可以使得只有预设权限要求的终端设 备可以利用通信密钥对RSU发送的加密广播信息进行解密，其中，RSU利用CA服务器所发送的通信密钥对向外发送的信息进行加密，以使得只有满足特定属性要求的车辆才能对接收到的信息进行解密，以接收到相关信息的推送，从而实现了对不同特性的车辆进行差异化服务的目的。
图5为本申请实施例提供的又一种示例性的通信方法的流程图。如图5所示，本实施例提供的通信方法，包括：
S301、发送第二通信密钥。
具体的，CA服务器与RSU可以是进行周期性地交互，即CA服务器可以是周期性地向RSU发送第二通信密钥Ke进行举例说明，例如可以为小时、分钟，甚至还可以以天为单位作为上述的周期时长。在本实施例中，CA服务器向RSU周期性下发的第二通信密钥可以为Ke，值得理解的，RSU可以利用Ke对第一通信密钥Kc，其中，Kc为RSU用于对广播信息进行加密的密钥。
此外，CA服务器还可以在每个周期中向所有的RSU下发相同的Ke，也可以是下发不同的Ke，还可以根据RSU所处的地理区域下发对应的Ke。
S302、根据预设规则确定当前用于加密信息的第二通信密钥。
RSU还可以在同一时间维护多个Ke，其中，RSU可以接收CA服务器发送的第二通信密钥序列，第二通信密钥序列包括多个Ke，然后，根据所述时间规则依次选取第二通信密钥序列中的Ke作为用于加密信息的通信密钥。例如，RSU可以在同一时间维护两个Ke，分别为当前使用的Ke，和在下一时间段需要使用的Ke。而当RSU接收到CA服务器下发的Ke之后，可以立即更新当前所使用的Ke，也可以隔一定时间或者在某个时间点再进行更新，而对于隔一定时间或者在某个时间点可以是通过上述的预设规则与CA服务器进行同步。
S303、发送指示请求信息。
S304、发送证书请求信息。
S305、根据身份信息确定OBU的权限。
值得说明的，本实施例中S303-S305与图4所示实施例中S203-S205的实现方式方式类似，此处不再进行赘述。
S306、发送第二通信密钥。
在CA服务器接收到OBU发送的证书请求信息之后，CA服务器就可以直接获取，或者从费用后台服务器中获取OBU的权限，然后根据获取到的权限，确定是否向OBU下发Ke。
然后，根据第一私钥对加密后的Ke进行解密，从而使得OBU可以利用Ke对接收到的加密广播信息进行解密。
又或者，在CA服务器接收到OBU发送的包括有第一公钥的证书请求信息之后，可以根据CA私钥对证书请求信息进行签名，从而生成通信证书。CA服务器先将生成的通信证书下发至OBU，然后，OBU可以通过CA公钥对通信证书进行验证，再利用收到的通信证书建立CA服务器之间的安全传输通道，再通过安全传输通道发送Ke，从而使得OBU可以利用Ke对接收到加密Kc进行解密，从而获取Kc，再利用Kc对加密广播信息进行解密。
S307、确定用于解密信息的第二通信密钥。
为了使得OBU可以利用接收到的Ke对RSU广播的加密Kc进行解密，需要保证在同一时刻下，OBU中用于解密的Ke与RSU用于加密的Ke为同一密钥或者为相配对的密钥。因此，可以是通过与CA服务器所约定的预设规则进行实现，例如，可以为时间规则，例如：可以根据固定周期进行更新，也可以是对每个Ke都设置有一个固定的使用时段，从而实现OBU与RSU在每个时间点上正在使用的Ke为相同或者相对应的。
S308、根据第二通信密钥对第一通信密钥进行加密。
S309、发送加密后的第一通信密钥。
RSU在接收到CA服务器发送的Ke之后，可以利用Ke对Kc进行进行加密，然后将加密后的Kc进行广播发送。值得说明的，加密后的Kc可以进行单独广播发送，也可以是在广播其他信息时，一起进行发送。
S310、根据第二通信密钥对加密后的第一通信密钥进行解密。
而当车辆进入高速后，在高速上行驶时，由于CA服务器已经向购买增值服务的OBU发送了Ke，因此，购买增值服务的OBU就可以对接收到的加密后的Kc进行解密，以获得Kc，而对于未购买增值服务的OBU则无法解密获得Kc。
可选的，当OBU收到加密后的Kc后，可以根据加密和签名的顺序进行处理，以获得Kc，其中，对于Kc的加密和签名顺序可以是预设的。具体如下：如果该加密后的Kc是先加密后签名的，则OBU根据预设的RSU公钥对加密后的Kc进行验证，如果验证通过，再使用Kc进行解密；但是，如果该加密后的Kc是先签名后加密的，则可以先使用加密后的Kc进行解密，再根据预设的RSU公钥对解密后的Kc进行验证。
S311、根据第一通信密钥进行信息加密。
S312、发送加密广播信息。
RSU可以利用Kc对其进行广播外发的信息进行加密，从而使得Kc完全由RSU进行管理。当RSU需要对Kc进行更新时，可由RSU重新广播加密后的Kc即可。
S313、根据第一通信密钥对加密广播信息进行解密。
由于CA服务器已经向购买增值服务的OBU发送了Ke，因此，购买增值服务的OBU就可以对接收到的加密后的Kc进行解密，以获得Kc，进而可以根据Kc对加密广播信息进行解密，以获取相应的增值信息推送。
此外，在发送证书请求信息之后，OBU还可以在通信密钥的有效期限内，根据时间规则重新发送证书请求信息，以更新用于解密信息的Ke，从而使得在车辆的行驶过程中，不会因Ke的更新而出现信息服务中断的情况。
又或者，还可以是在对Kc进行更新之前，RSU通过当前使用的Ke对下个时段需要使用的Ke进行加密，并进行广播，以使得OBU能够获得下个时段需要进行使用的Ke。
而除了CA服务器频繁地对Ke进行更新之外，还可以直接下发第一通信密钥序列，其中，第一通信密钥序列包括多个Ke，第一通信密钥序列中的所有Ke的有效期限总时长大于预设时长。值得理解的，第一通信密钥序列中的每个Ke均对应有固定的有效时间段，而每个时间段信息在CA服务器中均有记录，而CA服务器可以根据每个Ke的有效时间段向RSU下发Ke，以使RSU可以根据每个Ke的有效时间进行当前用于加 密的Ke确定。此外，对于上述的预设时长可以根据车辆在每个路段正常行驶的最长时间进行确定。
在本实施例中，CA服务器对接收到的OBU所发送加密后的证书请求信息进行解密，以根据证书请求中的身份信息确定终端设备的权限，并在终端设备的权限符合预设权限要求时，向终端设备下发加密后的第二通信密钥，以使OBU对其进行解密后获得第二通信密钥，从而在保证第二通信密钥传递安全性的同时，还可以使得只有预设权限要求的终端设备可以利用第二通信密钥对RSU发送的第一通信密钥进行解密，再利用第一通信密钥对加密广播信息进行解密，其中，RSU利用CA服务器所发送的第一通信密钥对向外发送的信息进行加密，以使得只有满足特定属性要求的车辆才能对接收到的信息进行解密，以接收到相关信息的推送，从而实现了对不同特性的车辆进行差异化服务的目的。
图6为本申请实施例提供的一种示例性的终端设备的结构图。如图6所示，本实施例提供的终端设备400，包括：
接收模块403，用于位于路段预设节点位置时，接收触发指令；
发送模块401，用于发送证书请求信息，证书请求信息包括终端设备的身份信息；
接收模块403，用于接收证书颁发机构CA服务器发送的通信密钥；
接收模块403，还用于接收路侧单元RSU发送的加密信息，加密信息为利用通信密钥进行加密的信息；
处理模块402，用于根据通信密钥对加密信息进行解密。
在一种可能的设计中，加密信息为加密广播信息，加密广播信息包括广播标识。
在一种可能的设计中，处理模块402，还用于生成第一密钥对，第一密钥对包括第一私钥以及第一公钥，证书请求信息包括第一公钥。
在一种可能的设计中，第一公钥用于对通信密钥进行加密。
在一种可能的设计中，接收模块403，具体用于：
接收CA服务器发送的通信证书；
根据通信证书建立终端设备与CA服务器之间的安全传输通道；
通过安全传输通道接收CA服务器发送的通信密钥。
在一种可能的设计中，处理模块402，还用于对证书请求信息加密，所发送的证书请求信息为加密后的证书请求信息。
在一种可能的设计中，处理模块402，具体用于：
根据预设的CA服务器公钥对证书请求信息进行加密；
或者，
生成对称密钥，并根据对称密钥对证书请求信息进行加密；
根据预设的CA服务器公钥对对称密钥进行加密，并发送加密后的对称密钥。
在一种可能的设计中，处理模块402，还用于根据预设规则确定当前用于解密信息的通信密钥。
在一种可能的设计中，处理模块402，具体用于：
接收RSU发送的加密后的第一通信密钥；
根据预设规则接收CA服务器发送的第二通信密钥；
根据第二通信密钥解密加密后的第一通信密钥。
在一种可能的设计中，预设规则为时间规则。
在一种可能的设计中，时间规则为预设固定时间周期或预设固定时间节点。
在一种可能的设计中，发送模块401，还用于在通信密钥的有效期限内，根据时间规则重新发送证书请求信息，以更新用于解密信息的通信密钥。
在一种可能的设计中，处理模块402，具体用于：
接收第一通信密钥序列，其中，第一通信密钥序列包括多个通信密钥，第一通信密钥序列中的所有通信密钥的有效期限总时长大于预设时长；
根据时间规则确定第一通信密钥序列中的一个通信密钥作为当前用于解密信息的通信密钥。
在一种可能的设计中，处理模块402，还用于根据预设的RSU公钥对加密广播信息进行验证。
在一种可能的设计中，处理模块402，还用于根据预设的RSU公钥对解密广播信息进行验证。
在一种可能的设计中，发送模块401，还用于发送身份信息以及付费状态，若付费状态对应成功付费状态，则终端设备的权限预设权限要求。
值得说明的，本实施例提供的终端设备，可用于执行上述任一方法实施例中终端设备侧的步骤，具体实现方式和技术效果类似，这里不再赘述。
图7为本申请实施例提供的一种示例性的路侧单元的结构图。如图7所示，本实施例提供的路侧单元500，包括：
接收模块503，用于接收CA服务器发送的通信密钥，通信密钥用于对外发的信息进行加密；
发送模块501，用于发送加密信息。
在一种可能的设计中，加密信息为加密广播信息，加密广播信息包括广播标识。
在一种可能的设计中，路侧单元，还包括：
处理模块502，用于只对符合预设业务类型要求的外发信息进行加密。
在一种可能的设计中，路侧单元，还包括：
处理模块502，用于根据预设规则确定当前用于加密信息的通信密钥。
在一种可能的设计中，处理模块502，还用于根据第二通信密钥对第一通信密钥进行加密，第一通信密钥用于对广播信息进行加密；
发送模块501，还用于根据预设规则发送加密后的第一通信密钥。
在一种可能的设计中，预设规则为时间规则。
在一种可能的设计中，时间规则为预设固定时间周期或预设固定时间节点。
在一种可能的设计中，接收模块503，还用于接收第二通信密钥序列，第二通信密钥序列包括多个通信密钥；
处理模块502，还用于根据时间规则依次选取第二通信密钥序列中的通信密钥作为用于加密信息的通信密钥。
在一种可能的设计中，处理模块502，还用于根据路侧单元RSU私钥对广播信息进行签名；
处理模块502，还用于根据通信密钥对广播信息进行加密；
发送模块501，还用于发送加密信息。
在一种可能的设计中，处理模块502，还用于根据通信密钥对广播信息进行加密；
处理模块502，还用于根据路侧单元RSU私钥对加密广播信息进行签名。
在一种可能的设计中，接收模块503，还用于接收身份信息以及付费信息，身份信息用于表征车载单元OBU的身份，付费信息用于确定OBU的付费状态；
发送模块501，还用于发送身份信息以及付费状态。
值得说明的，本实施例提供的路侧单元，可用于执行上述任一方法实施例中路侧单元侧的步骤，具体实现方式和技术效果类似，这里不再赘述。
图8为本申请实施例提供的一种示例性的服务器的结构图。如图8所示，本实施例提供的服务器600，包括：
接收模块603，用于接收证书请求信息，证书请求信息包括终端设备的身份信息；
处理模块602，用于根据身份信息确定终端设备的权限；
发送模块601，用于向终端设备发送通信密钥；
发送模块601，还用于根据预设规则向路侧单元RSU发送通信密钥，通信密钥用于对RSU外发的信息进行加密。
在一种可能的设计中，处理模块602，还用于根据CA服务器私钥对证书请求信息进行签名，以生成通信证书，其中，证书请求信息包括第一公钥；
发送模块601，还用于发送通信证书，通信证书用于建立终端设备与CA服务器之间的传输通道。
在一种可能的设计中，处理模块602，还用于根据第一公钥对通信密钥进行加密。
在一种可能的设计中，处理模块602，还用于根据通信证书建立与终端设备之间的安全传输通道；
发送模块601，还用于通过安全传输通道发送通信密钥。
在一种可能的设计中，接收模块603，还用于接收加密后的证书请求信息；
处理模块602，还用于解密加密后的证书请求信息。
在一种可能的设计中，接收模块603，具体用于：
接收根据CA服务器公钥加密后的证书请求信息；
或者，
接收根据对称密钥加密后的证书请求信息以及根据CA服务器公钥加密后的对称密钥。
在一种可能的设计中，发送模块601，具体用于：
根据预设规则发送第二通信密钥，通信密钥包括第二通信密钥，第二通信密钥用于加密第一通信密钥，第一通信密钥用于对RSU的广播信息进行加密。
在一种可能的设计中，预设规则为时间规则。
在一种可能的设计中，时间规则为预设固定时间周期或预设固定时间节点。
在一种可能的设计中，接收模块603，还用于在通信密钥的有效期限内，根据时间规则重新接收证书请求信息，以更新通信密钥。
在一种可能的设计中，发送模块601，具体用于：
发送第一通信密钥序列，第一通信密钥序列包括多个通信密钥，第一通信密钥序列中的所有通信密钥的有效期限总时长大于预设时长，预设时长根据RSU所处的路段参数进行确定。
在一种可能的设计中，接收模块603，还用于接收身份信息以及付费状态，若付费状态对应成功付费状态，则权限符合预设权限要求。
在一种可能的设计中，处理模块602，还用于根据RSU所处的地理区域确定所发送的通信密钥。
值得说明的，本实施例提供的服务器，可用于执行上述任一方法实施例中服务器侧的步骤，具体实现方式和技术效果类似，这里不再赘述。
图9为本申请实施例提供的另一种示例性的终端设备的结构图。如图9所示，本实施例提供的终端设备700包括：处理器701、存储器702、通信接口703以及总线704。
其中，处理器701、存储器702和通信接口703之间通过总线704连接并完成相互间的通信，存储器702中用于存储计算机执行指令，设备运行时，处理器701执行存储器702中的计算机执行指令以利用设备中的硬件资源执行图3-图5对应的通信方法中终端设备侧的步骤。
图10为本申请实施例提供的另一种示例性的路侧单元的结构图。如图10所示，本实施例提供的路侧单元800包括：处理器801、存储器802、通信接口803以及总线804。
其中，处理器801、存储器802和通信接口803之间通过总线804连接并完成相互间的通信，存储器802中用于存储计算机执行指令，设备运行时，处理器801执行存储器802中的计算机执行指令以利用设备中的硬件资源执行图3-图5对应的通信方法中路侧单元侧的步骤。
图11为本申请实施例提供的另一种示例性的服务器的结构图。如图11所示，本实施例提供的服务器900包括：处理器901、存储器902、通信接口903以及总线904。
其中，处理器901、存储器902和通信接口903之间通过总线904连接并完成相互间的通信，存储器902中用于存储计算机执行指令，设备运行时，处理器901执行存储器902中的计算机执行指令以利用设备中的硬件资源执行图3-图5对应的通信方法中服务器侧的步骤。
本申请实施例再一方面还提供一种通信系统，包括图9所示的终端设备、图10所示的路侧单元，以及图11所示的服务器。
本申请实施例再一方面还提供一种计算机可读介质，计算机可读存储介质中存储有指令，当其在计算机上运行时，使得计算机执行图3-图5对应的通信方法中终端设备侧的步骤。
本申请实施例再一方面还提供一种计算机可读介质，计算机可读存储介质中存储有指令，当其在计算机上运行时，使得计算机执行图3-图5对应的通信方法中路侧单元侧的步骤。
本申请实施例再一方面还提供一种计算机可读介质，计算机可读存储介质中存储有指令，当其在计算机上运行时，使得计算机执行图3-图5对应的通信方法中服务器 侧的步骤。
以上所述，仅为本发明的具体实施方式，但本发明的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本发明揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本发明的保护范围之内。因此，本发明的保护范围应以所述权利要求的保护范围为准。

Claims (88)

  1. 一种通信方法，其特征在于，包括：
    位于路段预设节点位置时，接收触发指令；
    发送证书请求信息，所述证书请求信息包括终端设备的身份信息；
    接收证书颁发机构CA服务器发送的通信密钥；
    接收路侧单元RSU发送的加密信息，所述加密信息为利用所述通信密钥进行加密的信息；
    根据所述通信密钥对所述加密信息进行解密。
  2. 根据权利要求1所述的通信方法，其特征在于，所述加密信息为加密广播信息，所述加密广播信息包括广播标识。
  3. 根据权利要求1或2所述的通信方法，其特征在于，在所述发送证书请求信息之前，还包括：
    生成第一密钥对，所述第一密钥对包括第一私钥以及第一公钥，所述证书请求信息包括所述第一公钥。
  4. 根据权利要求3所述的通信方法，其特征在于，所述第一公钥用于对所述通信密钥进行加密。
  5. 根据权利要求3或4所述的通信方法，其特征在于，所述接收CA服务器发送的通信密钥，包括：
    接收所述CA服务器发送的通信证书；
    根据所述通信证书建立所述终端设备与所述CA服务器之间的安全传输通道；
    通过所述安全传输通道接收所述CA服务器发送的所述通信密钥。
  6. 根据权利要求3-5中任意一项所述的通信方法，其特征在于，在所述生成第一密钥对之后，还包括：
    对所述证书请求信息加密，所发送的所述证书请求信息为加密后的证书请求信息。
  7. 根据权利要求6所述的通信方法，其特征在于，所述对所述证书请求信息加密，包括：
    根据预设的CA服务器公钥对所述证书请求信息进行加密；
    或者，
    生成对称密钥，并根据所述对称密钥对所述证书请求信息进行加密；
    根据预设的CA服务器公钥对所述对称密钥进行加密，并发送加密后的对称密钥。
  8. 根据权利要求1-7中任意一项所述的通信方法，其特征在于，在所述根据所述通信密钥对所述加密信息进行解密之前，还包括：
    根据预设规则确定当前用于解密信息的通信密钥。
  9. 根据权利要求8所述的通信方法，其特征在于，所述根据预设规则确定当前用于解密信息的通信密钥，包括：
    接收所述RSU发送的加密后的第一通信密钥；
    根据所述预设规则接收所述CA服务器发送的第二通信密钥；
    根据第二通信密钥解密所述加密后的第一通信密钥。
  10. 根据权利要求8或9所述的通信方法，其特征在于，所述预设规则为时间规则。
  11. 根据权利要求10所述的通信方法，其特征在于，所述时间规则为预设固定时间周期或预设固定时间节点。
  12. 根据权利要求10或11所述的通信方法，其特征在于，在所述发送证书请求信息之后，还包括：
    在所述通信密钥的有效期限内，根据所述时间规则重新发送所述证书请求信息，以更新用于解密信息的通信密钥。
  13. 根据权利要求10或11所述的通信方法，其特征在于，所述根据预设规则确定当前用于解密信息的通信密钥，包括：
    接收第一通信密钥序列，其中，所述第一通信密钥序列包括多个通信密钥，所述第一通信密钥序列中的所有通信密钥的有效期限总时长大于预设时长；
    根据所述时间规则确定所述第一通信密钥序列中的一个通信密钥作为当前用于解密信息的通信密钥。
  14. 根据权利要求1-13中任意一项所述的通信方法，其特征在于，在所述根据所述通信密钥对所述加密信息进行解密之前，还包括：
    根据预设的RSU公钥对所述加密信息进行验证。
  15. 根据权利要求1-13中任意一项所述的通信方法，其特征在于，在所述根据所述通信密钥对所述加密信息进行解密之后，还包括：
    根据预设的RSU公钥对解密信息进行验证。
  16. 根据权利要求1-15中任意一项所述的通信方法，其特征在于，在所述接收触发指令之后，还包括：
    发送所述身份信息以及付费状态，若所述付费状态对应成功付费状态，则所述终端设备的权限符合预设权限要求。
  17. 根据权利要求1-16中任意一项所述的通信方法，其特征在于，所述终端设备为车载单元OBU或者用户设备UE。
  18. 一种通信方法，其特征在于，包括：
    接收CA服务器发送的通信密钥，所述通信密钥用于对外发的信息进行加密；
    发送加密信息。
  19. 根据权利要求18所述的通信方法，其特征在于，所述加密信息为加密广播信息，所述加密广播信息包括广播标识。
  20. 根据权利要求18或19所述的通信方法，其特征在于，在所述发送加密信息之前，还包括：
    只对符合预设业务类型要求的外发信息进行加密。
  21. 根据权利要求18所述的通信方法，其特征在于，在所述发送加密信息之前，还包括：
    根据预设规则确定当前用于加密信息的通信密钥。
  22. 根据权利要求21所述的通信方法，其特征在于，在所述根据预设规则确定当前用于加密信息的通信密钥之后，还包括：
    根据第二通信密钥对第一通信密钥进行加密，所述第一通信密钥用于对广播信息进行加密；
    根据所述预设规则发送加密后的第一通信密钥。
  23. 根据权利要求21或22所述的通信方法，其特征在于，所述预设规则为时间规则。
  24. 根据权利要求23所述的通信方法，其特征在于，所述时间规则为预设固定时间周期或预设固定时间节点。
  25. 根据权利要求23或24所述的通信方法，其特征在于，在所述发送加密信息之前，还包括：
    接收第二通信密钥序列，所述第二通信密钥序列包括多个通信密钥；
    根据所述时间规则依次选取所述第二通信密钥序列中的通信密钥作为用于加密信息的通信密钥。
  26. 根据权利要求18-24中任意一项所述的通信方法，其特征在于，在所述发送加密信息之前，还包括：
    根据路侧单元RSU私钥对广播信息进行签名；
    根据所述通信密钥对所述广播信息进行加密；
    发送所述加密信息。
  27. 根据权利要求18-24中任意一项所述的通信方法，其特征在于，在所述发送加密信息之前，还包括：
    根据所述通信密钥对广播信息进行加密；
    根据路侧单元RSU私钥对所述加密信息进行签名。
  28. 根据权利要求18-27中任意一项所述的通信方法，其特征在于，在所述发送加密信息之前，还包括：
    接收身份信息以及付费信息，所述身份信息用于表征终端设备的身份，所述付费信息用于确定所述终端设备的付费状态；
    发送所述身份信息以及所述付费状态。
  29. 一种通信方法，其特征在于，包括：
    接收证书请求信息，所述证书请求信息包括终端设备的身份信息；
    根据所述身份信息确定所述终端设备的权限；
    若所述权限符合预设权限要求，则向所述终端设备发送通信密钥；
    根据预设规则向路侧单元RSU发送所述通信密钥，所述通信密钥用于对所述RSU外发的信息进行加密。
  30. 根据权利要求29所述的通信方法，其特征在于，在所述向所述终端设备发送通信密钥之前，还包括：
    根据CA服务器私钥对所述证书请求信息进行签名，以生成通信证书，其中，所述证书请求信息包括第一公钥；
    发送所述通信证书，所述通信证书用于建立所述终端设备与所述CA服务器之间的传输通道。
  31. 根据权利要求30所述的通信方法，其特征在于，在所述向所述终端设备发送 通信密钥之前，还包括：
    根据所述第一公钥对所述通信密钥进行加密。
  32. 根据权利要求30所述的通信方法，其特征在于，所述向所述终端设备发送通信密钥，还包括：
    根据所述通信证书建立与所述终端设备之间的安全传输通道；
    通过所述安全传输通道发送所述通信密钥。
  33. 根据权利要求30-32中任意一项所述的通信方法，其特征在于，在所述向所述终端设备发送通信密钥之前，还包括：
    接收加密后的证书请求信息；
    解密所述加密后的证书请求信息。
  34. 根据权利要求33所述的通信方法，其特征在于，所述接收加密后的证书请求信息，包括：
    接收根据CA服务器公钥加密后的证书请求信息；
    或者，
    接收根据对称密钥加密后的证书请求信息以及根据CA服务器公钥加密后的对称密钥。
  35. 根据权利要求29-34中任意一项所述的通信方法，其特征在于，所述根据预设规则发送所述通信密钥，包括：
    根据所述预设规则发送第二通信密钥，所述通信密钥包括所述第二通信密钥，所述第二通信密钥用于加密第一通信密钥，所述第一通信密钥用于对所述RSU的广播信息进行加密。
  36. 根据权利要求29-35中任意一项所述的通信方法，其特征在于，所述预设规则为时间规则。
  37. 根据权利要求36所述的通信方法，其特征在于，所述时间规则为预设固定时间周期或预设固定时间节点。
  38. 根据权利要求36或37所述的通信方法，其特征在于，在所述接收证书请求信息之后，还包括：
    在所述通信密钥的有效期限内，根据所述时间规则重新接收证书请求信息，以更新所述通信密钥。
  39. 根据权利要求36或37所述的通信方法，其特征在于，所述向所述终端设备发送通信密钥，包括：
    发送第一通信密钥序列，所述第一通信密钥序列包括多个通信密钥，所述第一通信密钥序列中的所有通信密钥的有效期限总时长大于预设时长，所述预设时长根据所述RSU所处的路段参数进行确定。
  40. 根据权利要求29-39中任意一项所述的通信方法，其特征在于，所述根据所述身份信息确定所述终端设备的权限，包括：
    接收所述身份信息以及付费状态，若所述付费状态对应成功付费状态，则所述权限符合所述预设权限要求。
  41. 根据权利要求29-40中任意一项所述的通信方法，其特征在于，在所述向所 述终端设备发送通信密钥之前，还包括：
    根据所述RSU所处的地理区域确定所发送的所述通信密钥。
  42. 一种终端设备，其特征在于，包括：
    接收模块，用于位于路段预设节点位置时，接收触发指令；
    发送模块，用于发送证书请求信息，所述证书请求信息包括终端设备的身份信息；
    所述接收模块，用于接收证书颁发机构CA服务器发送的通信密钥；
    所述接收模块，还用于接收路侧单元RSU发送的加密信息，所述加密信息为利用所述通信密钥进行加密的信息；
    处理模块，用于根据所述通信密钥对所述加密信息进行解密。
  43. 根据权利要求42所述的终端设备，其特征在于，所述加密信息为加密广播信息，所述加密广播信息包括广播标识。
  44. 根据权利要求42或43所述的终端设备，其特征在于，所述处理模块，还用于生成第一密钥对，所述第一密钥对包括第一私钥以及第一公钥，所述证书请求信息包括所述第一公钥。
  45. 根据权利要求44所述的终端设备，其特征在于，所述第一公钥用于对所述通信密钥进行加密。
  46. 根据权利要求44或45所述的终端设备，其特征在于，所述接收模块，具体用于：
    接收所述CA服务器发送的所述通信证书；
    根据所述通信证书建立所述终端设备与所述CA服务器之间的安全传输通道；
    通过所述安全传输通道接收所述CA服务器发送的所述通信密钥。
  47. 根据权利要求44-46中任意一项所述的终端设备，其特征在于，所述处理模块，还用于对所述证书请求信息加密，所发送的所述证书请求信息为加密后的证书请求信息。
  48. 根据权利要求46所述的终端设备，其特征在于，所述处理模块，具体用于：
    根据预设的CA服务器公钥对所述证书请求信息进行加密；
    或者，
    生成对称密钥，并根据所述对称密钥对所述证书请求信息进行加密；
    根据预设的CA服务器公钥对所述对称密钥进行加密，并发送加密后的对称密钥。
  49. 根据权利要求42-48中任意一项所述的终端设备，其特征在于，所述处理模块，还用于根据预设规则确定当前用于解密信息的通信密钥。
  50. 根据权利要求49所述的终端设备，其特征在于，所述处理模块，具体用于：
    接收所述RSU发送的加密后的第一通信密钥；
    根据所述预设规则接收所述CA服务器发送的第二通信密钥；
    根据第二通信密钥解密所述加密后的第一通信密钥。
  51. 根据权利要求49或50所述的终端设备，其特征在于，所述预设规则为时间规则。
  52. 根据权利要求51所述的终端设备，其特征在于，所述时间规则为预设固定时间周期或预设固定时间节点。
  53. 根据权利要求51或52所述的终端设备，其特征在于，所述发送模块，还用于在所述通信密钥的有效期限内，根据所述时间规则重新发送所述证书请求信息，以更新用于解密信息的通信密钥。
  54. 根据权利要求51或52所述的终端设备，其特征在于，所述处理模块，具体用于：
    接收第一通信密钥序列，其中，所述第一通信密钥序列包括多个通信密钥，所述第一通信密钥序列中的所有通信密钥的有效期限总时长大于预设时长；
    根据所述时间规则确定所述第一通信密钥序列中的一个通信密钥作为当前用于解密信息的通信密钥。
  55. 根据权利要求42-54中任意一项所述的终端设备，其特征在于，所述处理模块，还用于根据预设的RSU公钥对所述加密广播信息进行验证。
  56. 根据权利要求42-54中任意一项所述的终端设备，其特征在于，所述处理模块，还用于根据预设的RSU公钥对解密广播信息进行验证。
  57. 根据权利要求42-56中任意一项所述的终端设备，其特征在于，所述发送模块，还用于发送所述身份信息以及付费状态，若所述付费状态对应成功付费状态，则所述终端设备的权限预设权限要求。
  58. 一种路侧单元，其特征在于，包括：
    接收模块，用于接收CA服务器发送的通信密钥，所述通信密钥用于对外发的信息进行加密；
    发送模块，用于发送加密信息。
  59. 根据权利要求58所述的路侧单元，其特征在于，所述加密信息为加密广播信息，所述加密广播信息包括广播标识。
  60. 根据权利要求58或59所述的路侧单元，其特征在于，还包括：
    处理模块，用于只对符合预设业务类型要求的外发信息进行加密。
  61. 根据权利要求58所述的路侧单元，其特征在于，还包括：
    处理模块，用于根据预设规则确定当前用于加密信息的通信密钥。
  62. 根据权利要求61所述的路侧单元，其特征在于，所述处理模块，还用于根据第二通信密钥对第一通信密钥进行加密，所述第一通信密钥用于对广播信息进行加密；
    所述发送模块，还用于根据所述预设规则发送加密后的第一通信密钥。
  63. 根据权利要求61或62所述的路侧单元，其特征在于，所述预设规则为时间规则。
  64. 根据权利要求63所述的路侧单元，其特征在于，所述时间规则为预设固定时间周期或预设固定时间节点。
  65. 根据权利要求63或64所述的路侧单元，其特征在于，所述接收模块，还用于接收第二通信密钥序列，所述第二通信密钥序列包括多个通信密钥；
    所述处理模块，还用于根据所述时间规则依次选取所述第二通信密钥序列中的通信密钥作为用于加密信息的通信密钥。
  66. 根据权利要求60-64中任意一项所述的路侧单元，其特征在于，所述处理模块，还用于根据路侧单元RSU私钥对广播信息进行签名；
    所述处理模块，还用于根据所述通信密钥对所述广播信息进行加密；
    所述发送模块，还用于发送所述加密信息。
  67. 根据权利要求60-64中任意一项所述的路侧单元，其特征在于，所述处理模块，还用于根据所述通信密钥对广播信息进行加密；
    所述处理模块，还用于根据路侧单元RSU私钥对所述加密广播信息进行签名。
  68. 根据权利要求58-67中任意一项所述的路侧单元，其特征在于，所述接收模块，还用于接收身份信息以及付费信息，所述身份信息用于表征车载单元OBU的身份，所述付费信息用于确定所述OBU的付费状态；
    所述发送模块，还用于发送所述身份信息以及所述付费状态。
  69. 一种服务器，其特征在于，包括：
    接收模块，用于接收证书请求信息，所述证书请求信息包括终端设备的身份信息；
    处理模块，用于根据所述身份信息确定所述终端设备的权限；
    发送模块，用于向所述终端设备发送通信密钥；
    所述发送模块，还用于根据预设规则向路侧单元RSU发送所述通信密钥，所述通信密钥用于对所述RSU外发的信息进行加密。
  70. 根据权利要求69所述的服务器，其特征在于，所述处理模块，还用于根据CA服务器私钥对所述证书请求信息进行签名，以生成所述通信证书，其中，所述证书请求信息包括第一公钥；
    所述发送模块，还用于发送所述通信证书，所述通信证书用于建立所述终端设备与所述CA服务器之间的传输通道。
  71. 根据权利要求70所述的服务器，其特征在于，所述处理模块，还用于根据所述第一公钥对所述通信密钥进行加密。
  72. 根据权利要求70所述的服务器，其特征在于，所述处理模块，还用于根据所述通信证书建立与所述终端设备之间的安全传输通道；
    所述发送模块，还用于通过所述安全传输通道发送所述通信密钥。
  73. 根据权利要求70-72中任意一项所述的服务器，其特征在于，所述接收模块，还用于接收加密后的证书请求信息；
    所述处理模块，还用于解密所述加密后的证书请求信息。
  74. 根据权利要求73所述的服务器，其特征在于，所述接收模块，具体用于：
    接收根据CA服务器公钥加密后的证书请求信息；
    或者，
    接收根据对称密钥加密后的证书请求信息以及根据CA服务器公钥加密后的对称密钥。
  75. 根据权利要求69-74中任意一项所述的服务器，其特征在于，所述发送模块，具体用于：
    根据所述预设规则发送第二通信密钥，所述通信密钥包括所述第二通信密钥，所述第二通信密钥用于加密第一通信密钥，所述第一通信密钥用于对所述RSU的广播信息进行加密。
  76. 根据权利要求69-75中任意一项所述的服务器，其特征在于，所述预设规则 为时间规则。
  77. 根据权利要求76所述的服务器，其特征在于，所述时间规则为预设固定时间周期或预设固定时间节点。
  78. 根据权利要求76或77所述的服务器，其特征在于，所述接收模块，还用于在所述通信密钥的有效期限内，根据所述时间规则重新接收证书请求信息，以更新所述通信密钥。
  79. 根据权利要求76或77所述的服务器，其特征在于，所述发送模块，具体用于：
    发送第一通信密钥序列，所述第一通信密钥序列包括多个通信密钥，所述第一通信密钥序列中的所有通信密钥的有效期限总时长大于预设时长，所述预设时长根据所述RSU所处的路段参数进行确定。
  80. 根据权利要求69-79中任意一项所述的服务器，其特征在于，所述接收模块，还用于接收所述身份信息以及付费状态，若所述付费状态对应成功付费状态，则所述权限符合所述预设权限要求。
  81. 根据权利要求69-80中任意一项所述的服务器，其特征在于，所述处理模块，还用于根据所述RSU所处的地理区域确定所发送的所述通信密钥。
  82. 一种终端设备，其特征在于，包括：
    处理器、存储器；
    存储器用于存储程序和数据，所述处理器调用存储器存储的程序，以执行权利要求1至17任一项所述的通信方法。
  83. 一种路侧单元，其特征在于，包括：
    处理器、存储器；
    存储器用于存储程序和数据，所述处理器调用存储器存储的程序，以执行权利要求18至28任一项所述的通信方法。
  84. 一种服务器，其特征在于，包括：
    处理器、存储器；
    存储器用于存储程序和数据，所述处理器调用存储器存储的程序，以执行权利要求29至41任一项所述的通信方法。
  85. 一种通信系统，其特征在于，包括：权利要求82所述的终端设备、权利要求83所述的路侧单元以及权利要求84所述的服务器。
  86. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质包括程序，所述程序在被处理器执行时用于执行权利要求1至17任一项所述的通信方法。
  87. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质包括程序，所述程序在被处理器执行时用于执行权利要求18至28任一项所述的通信方法。
  88. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质包括程序，所述程序在被处理器执行时用于执行权利要求29至41任一项所述的通信方法。
PCT/CN2020/128288 2019-12-18 2020-11-12 通信方法、终端设备、路侧单元、服务器、系统及介质 WO2021120931A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP20902228.4A EP4064608A4 (en) 2019-12-18 2020-11-12 COMMUNICATION PROCESS, TERMINAL EQUIPMENT, ROADSIDE UNIT, SERVER, SYSTEM AND SUPPORT
US17/842,388 US20220311602A1 (en) 2019-12-18 2022-06-16 Communication method, terminal device, road side unit, server, system, and medium

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201911310826.7 2019-12-18
CN201911310826.7A CN113079013B (zh) 2019-12-18 2019-12-18 通信方法、终端设备、路侧单元、服务器、系统及介质

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US17/842,388 Continuation US20220311602A1 (en) 2019-12-18 2022-06-16 Communication method, terminal device, road side unit, server, system, and medium

Publications (1)

Publication Number Publication Date
WO2021120931A1 true WO2021120931A1 (zh) 2021-06-24

Family

ID=76478844

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/128288 WO2021120931A1 (zh) 2019-12-18 2020-11-12 通信方法、终端设备、路侧单元、服务器、系统及介质

Country Status (4)

Country Link
US (1) US20220311602A1 (zh)
EP (1) EP4064608A4 (zh)
CN (1) CN113079013B (zh)
WO (1) WO2021120931A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113507698A (zh) * 2021-07-23 2021-10-15 北京天融信网络安全技术有限公司 车联网通信方法与装置、电子设备及存储介质

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP4344128A1 (en) * 2021-06-11 2024-03-27 Huawei Technologies Co., Ltd. Method for updating vehicle-to-everything (v2x) communication key, and communication apparatus
CN115988486A (zh) * 2022-12-28 2023-04-18 北京网路智联科技有限公司 用于信息发布的处理方法以及相关装置

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20080204278A1 (en) * 2007-02-28 2008-08-28 Denso Corporation Electronic toll collection system, on-board unit, and terminal unit
CN102624917A (zh) * 2012-03-29 2012-08-01 杨涛 一种基于广播和属性加密技术的隐私保护系统
CN110519345A (zh) * 2019-08-14 2019-11-29 杭州师范大学 基于多协助车辆自主选择的车联网信息安全协作下载方法
CN110544138A (zh) * 2019-08-30 2019-12-06 天地融科技股份有限公司 一种获取不停车收费发票的方法、系统及车载单元

Family Cites Families (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8595486B2 (en) * 2008-07-15 2013-11-26 Industrial Technology Research Institute Systems and methods for authorization and data transmission for multicast broadcast services
US8973129B2 (en) * 2009-08-31 2015-03-03 Tt Government Solutions, Inc. System and method for detecting and evicting malicious vehicles in a vehicle communications network
CN106027233A (zh) * 2016-04-28 2016-10-12 江苏大学 一种车载网群组协商通信协议设计方法
CN107623912B (zh) * 2016-07-15 2020-12-11 中兴通讯股份有限公司 一种车联网终端之间安全通信的方法及装置
CN108243181A (zh) * 2017-10-09 2018-07-03 北京车和家信息技术有限公司 一种车联网终端、数据加密方法及车联网服务器
SG11202005973PA (en) * 2017-12-28 2020-07-29 Paxgrid Cdn Inc System for authenticating and authorizing access to and accounting for wireless access vehicular environment consumption by client devices
CN108668258B (zh) * 2018-05-09 2021-05-25 中国信息通信研究院 V2x通信快速身份认证系统及方法

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20080204278A1 (en) * 2007-02-28 2008-08-28 Denso Corporation Electronic toll collection system, on-board unit, and terminal unit
CN102624917A (zh) * 2012-03-29 2012-08-01 杨涛 一种基于广播和属性加密技术的隐私保护系统
CN110519345A (zh) * 2019-08-14 2019-11-29 杭州师范大学 基于多协助车辆自主选择的车联网信息安全协作下载方法
CN110544138A (zh) * 2019-08-30 2019-12-06 天地融科技股份有限公司 一种获取不停车收费发票的方法、系统及车载单元

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP4064608A4

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113507698A (zh) * 2021-07-23 2021-10-15 北京天融信网络安全技术有限公司 车联网通信方法与装置、电子设备及存储介质

Also Published As

Publication number Publication date
EP4064608A1 (en) 2022-09-28
EP4064608A4 (en) 2022-12-21
CN113079013B (zh) 2023-04-18
US20220311602A1 (en) 2022-09-29
CN113079013A (zh) 2021-07-06

Similar Documents

Publication Publication Date Title
WO2021120931A1 (zh) 通信方法、终端设备、路侧单元、服务器、系统及介质
CN111372248B (zh) 一种车联网环境下高效匿名身份认证方法
US9021256B2 (en) System and methods to perform public key infrastructure (PKI) operations in vehicle networks using one-way communications infrastructure
Lin et al. TSVC: Timed efficient and secure vehicular communications with privacy preserving
KR101837338B1 (ko) Vanet을 위한 클라우드 지원 조건부 프라이버시를 보호하는 인증 방법 및 시스템
US9742569B2 (en) System and method for filtering digital certificates
JP2020517144A (ja) Ｖ２ｘ通信装置、及びそのデータ通信方法
Ying et al. Privacy preserving broadcast message authentication protocol for VANETs
CN110381145B (zh) 电动汽车与电网间的交互方法及系统
Khodaei et al. Scalable & resilient vehicle-centric certificate revocation list distribution in vehicular communication systems
Khodaei et al. Evaluating on-demand pseudonym acquisition policies in vehicular communication systems
JP2007088737A (ja) 路車間通信システム、車載端末、及び路車間通信方法
CN107888377A (zh) 基于随机加密周期的VANETs位置隐私保护的系统及方法
WO2014121708A2 (zh) 一种消息证书的申请方法、设备及系统
JP5590953B2 (ja) 鍵生成装置及びデータ提供装置及び端末装置及びプログラム
JP2012227672A (ja) 車車／路車間通信システム
CN104053149A (zh) 一种实现车联网设备的安全机制的方法及系统
CN112673590A (zh) 一种在车联网设备之间进行数据传输的方法及设备
CN111724494B (zh) 交通信息的处理方法、装置、电子设备及存储介质
KR20190056661A (ko) 차량 네트워크에서 기지국 기반 보안 통신 방법
CN111768189A (zh) 基于区块链的充电桩运营方法、装置及系统
Shin et al. A practical security framework for a VANET-based entertainment service
CN113992388A (zh) 一种基于rsu实现车辆身份条件隐私保护的方法
CN115706929A (zh) 一种车路信息交互方法、系统及相关设备
Chim et al. Spcs: Secure and privacy-preserving charging-station searching using vanet

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20902228

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2020902228

Country of ref document: EP

Effective date: 20220621

NENP Non-entry into the national phase

Ref country code: DE