WO2022155803A1 - Procédé de chiffrement de données, procédé de transmission de données, appareils associés et dispositif - Google Patents

Procédé de chiffrement de données, procédé de transmission de données, appareils associés et dispositif Download PDF

Info

Publication number
WO2022155803A1
WO2022155803A1 PCT/CN2021/072808 CN2021072808W WO2022155803A1 WO 2022155803 A1 WO2022155803 A1 WO 2022155803A1 CN 2021072808 W CN2021072808 W CN 2021072808W WO 2022155803 A1 WO2022155803 A1 WO 2022155803A1
Authority
WO
WIPO (PCT)
Prior art keywords
data transmission
data
vehicle service
transmission node
service data
Prior art date
Application number
PCT/CN2021/072808
Other languages
English (en)
Chinese (zh)
Inventor
耿峰
李江琪
李民
李�泳
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to PCT/CN2021/072808 priority Critical patent/WO2022155803A1/fr
Priority to CN202180000112.5A priority patent/CN115088232A/zh
Publication of WO2022155803A1 publication Critical patent/WO2022155803A1/fr

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/12—Protocols specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3263—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/03—Protecting confidentiality, e.g. by encryption
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2209/00—Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
    • H04L2209/84—Vehicles
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2463/00—Additional details relating to network architectures or network communication protocols for network security covered by H04L63/00
    • H04L2463/062—Additional details relating to network architectures or network communication protocols for network security covered by H04L63/00 applying encryption of the keys

Definitions

  • the embodiments of the present application relate to the field of communication technologies, and in particular, to a data encryption method, a data transmission method, related apparatuses, and devices.
  • a category label can be added to the user's vehicle service data to identify the category of the vehicle service data, and then the electronic control unit (Electronic control unit, ECU) runs a program that processes the vehicle service data. After processing the relevant data, the label carried in the data packet is detected at the data outlet to determine the type of vehicle service data sent by the program.
  • ECU Electronic control unit
  • Embodiments of the present application provide a method for data encryption, a method for data transmission, and related apparatuses and devices, which are used to encrypt data transmitted between multiple nodes and improve the security of data transmission between multiple nodes.
  • the present application provides a method for data encryption, and the method is applied to a target vehicle.
  • vehicle service data of the target vehicle is obtained first, and then N data transmission nodes that transmit the vehicle service data are obtained, Then, use the data transmission key of the nth data transmission node to encrypt the N-nth encrypted vehicle service data to obtain the N-n+1th encrypted vehicle service data, and the nth data transmission node is the nth transmission order of the N data transmission nodes.
  • the data transmission node, the transmission order is the order in which the N data transmission nodes transmit the vehicle service data, the 0th encrypted vehicle service data is the vehicle service data, and the N-1th encrypted vehicle service data is encrypted using the data transmission key of the first data transmission node.
  • the data is encrypted to obtain the Nth encrypted vehicle service data, and the Nth encrypted vehicle service data is sent to the first data transmission node, where N ⁇ 2 and N ⁇ n ⁇ 1.
  • N ⁇ 2 and N ⁇ n ⁇ 1 may be symmetric or asymmetric, which is not specifically limited here.
  • the data transmitted between multiple data transmission nodes is encrypted in sequence, the data transmission key corresponding to the data transmission node is used for each encryption, and each encryption is performed after the previous encryption. based on the obtained results, thereby improving the security of the vehicle service data, thereby improving the security of the data transmission of the vehicle service data among multiple data transmission nodes.
  • the communication credential of the nth data transmission node indicates the transmission conditions of the N-nth encrypted vehicle service data at the nth data transmission node.
  • the communication credential of the data transmission node also needs to be encrypted, because the communication credential of the nth data transmission node indicates the transmission condition of the N-nth encrypted vehicle service data at the nth data transmission node, and the vehicle service data is The data transmission of the vehicle service data is performed only when the transmission conditions of the data transmission node are met, and the conditions for data transmission between multiple data transmission nodes are controlled according to the communication credentials, thereby improving the data transmission of vehicle service data among multiple nodes. security.
  • the nth data transmission node is a transmission node outside the vehicle
  • the first data transmission node is a transmission node inside the vehicle.
  • the encryption of the data transmitted between the transmission node inside the vehicle and the transmission node outside the vehicle is realized, so as to ensure that the vehicle service data transmitted to the transmission node outside the vehicle is encrypted, so as to improve the target value of the vehicle service data. Security of data transmission inside the vehicle and outside the target vehicle.
  • the present application provides a method for data transmission, and the method is applied to a data transmission node.
  • the data transmission node receives encrypted vehicle service data, and then obtains decrypted encrypted vehicle service data.
  • the decrypted encrypted vehicle service data is obtained by decrypting the encrypted vehicle service data using the data transmission key of the data transmission node, and the decrypted encrypted vehicle service data is encrypted using the data transmission key of the next data transmission node.
  • the encrypted vehicle service data obtained later, or the decrypted encrypted vehicle service data is the vehicle service data.
  • the received encrypted vehicle service data is obtained by sequentially encrypting the data transmitted between multiple data transmission nodes, the security of the encrypted vehicle service data is high, thereby improving the data Transmission security.
  • the decrypted encrypted vehicle service data can be the vehicle service data that provides the service, or the data that needs to be further decrypted. Therefore, at the next data transmission node, it is also necessary to use the data transmission key of the next data transmission node to decrypt The encrypted vehicle service data is decrypted, thereby further improving the security of data transmission.
  • the decrypted encrypted vehicle service data and the communication credential of the data transmission node are obtained, and the decrypted encrypted vehicle service data and the communication credential of the data transmission node are obtained by using the data transmission key of the data transmission node Obtained after decrypting the encrypted vehicle service data, the communication credential of the data transmission node indicates the transmission conditions of the decrypted encrypted vehicle service data in the data transmission node.
  • the data transmission node will send the decrypted encrypted vehicle service data to the next data transmission node.
  • the decrypted encrypted vehicle service data is sent to the next data transmission node only when the transmission conditions of the decrypted encrypted vehicle service data in the data transmission node are satisfied, and the data transmission between the data transmission nodes is controlled according to the communication credential. conditions for data transmission between, thereby improving the security of data transmission.
  • the data transmission node when the data transmission node is a high computing power node, that is, when the data transmission node has the decryption capability required by the technical solution provided by the present application, the data transmission node needs to receive the data transmission key of the data transmission node , and decrypt the encrypted vehicle service data by using the data transmission key of the data transmission node, so as to obtain the decrypted encrypted vehicle service data and the communication certificate of the data transmission node.
  • the encrypted vehicle service data is decrypted at the data transmission node using the data transmission key of the data transmission node, so that the decryption process can be performed directly at the data transmission node, and the efficiency of the decryption process is improved, thereby improving the data transmission efficiency.
  • the data transmission node when the data transmission node is a low computing power node, that is, the data transmission node does not have the decryption capability required by the technical solution provided by this application, the data transmission node needs to send encrypted vehicle service data to the decryption module , the decryption module decrypts the encrypted vehicle service data using the data transmission key of the data transmission node, and obtains the decrypted encrypted vehicle service data and the communication certificate of the data transmission node, and then the data transmission node receives the decrypted encrypted data sent by the decryption module.
  • Vehicle service data and communication credentials for data transfer nodes when the data transmission node is a low computing power node, that is, the data transmission node does not have the decryption capability required by the technical solution provided by this application.
  • the data transmission node does not perform the decryption operation.
  • the decryption process is performed in the decryption module.
  • the communication credential is used to obtain the decryption result, thereby improving the feasibility of this scheme.
  • a data encryption device is provided, and the data encryption device is applied to a target vehicle.
  • the data encryption apparatus has some or all of the functions of implementing the first aspect and any possible implementation manner of the first aspect.
  • the function of the data encryption apparatus may have the function of independently implementing any one of the embodiments in this application.
  • the functions can be implemented by hardware, or can be implemented by hardware executing corresponding software.
  • the hardware or software includes one or more units or modules corresponding to the above functions.
  • the data encryption device includes:
  • the acquisition module is used to acquire the vehicle service data of the target vehicle
  • the acquisition module is also used to acquire N data transmission nodes that transmit vehicle service data, where N ⁇ 2;
  • the encryption module is used to encrypt the N-nth encrypted vehicle service data by using the data transmission key of the nth data transmission node to obtain the N-n+1th encrypted vehicle service data, wherein, N ⁇ n ⁇ 1, the nth data transmission
  • the node is the nth data transmission node in the transmission order among the N data transmission nodes, the transmission order is the order in which the N data transmission nodes transmit the vehicle service data, and the 0th encrypted vehicle service data is the vehicle service data;
  • a sending module configured to send the Nth encrypted vehicle service data to the first data transmission node, wherein the Nth encrypted vehicle service data is encrypted by using the data transmission key of the first data transmission node to encrypt the N-1th encrypted vehicle service data owned.
  • the encryption module is specifically configured to use the data transmission key of the nth data transmission node to encrypt the N-nth encrypted vehicle service data and the communication credential of the nth data transmission node to obtain the N-nth data transmission node.
  • the nth data transmission node is an external transmission node of the vehicle
  • the first data transfer node is a transfer node inside the vehicle.
  • a data transmission device is provided, and the data transmission device is applied to a data transmission node.
  • the data transmission apparatus has some or all of the functions of implementing the second aspect and any possible implementation manner of the second aspect.
  • the function of the data transmission apparatus may have the function of independently implementing any one of the embodiments in this application.
  • the functions can be implemented by hardware, or can be implemented by hardware executing corresponding software.
  • the hardware or software includes one or more units or modules corresponding to the above functions.
  • the data transmission device includes:
  • the obtaining module is used to obtain the decrypted encrypted vehicle service data, wherein the decrypted encrypted vehicle service data is obtained after decrypting the encrypted vehicle service data using the data transmission key of the data transmission node, and the decrypted encrypted vehicle service data is obtained.
  • the data is encrypted using the data transmission key of the next data transmission node.
  • the data transmission apparatus further includes a sending module
  • the obtaining module is specifically configured to obtain the decrypted encrypted vehicle service data and the communication certificate of the data transmission node, wherein the decrypted encrypted vehicle service data and the communication certificate of the data transmission node are encrypted using the data transmission key of the data transmission node. Obtained after the vehicle service data is decrypted, the communication credential of the data transmission node indicates the transmission conditions of the decrypted encrypted vehicle service data in the data transmission node;
  • the sending module is used to send the decrypted encrypted vehicle service data to the next data transmission node when the transmission condition of the decrypted encrypted vehicle service data in the data transmission node is satisfied after the obtaining module obtains the decrypted encrypted vehicle service data and the communication certificate of the data transmission node Decrypted encrypted vehicle service data.
  • the receiving module is further configured to receive the data transmission key of the data transmission node
  • the obtaining module is specifically configured to decrypt the encrypted vehicle service data by using the data transmission key of the data transmission node, and obtain the decrypted encrypted vehicle service data and the communication certificate of the data transmission node.
  • an acquisition module is specifically configured to send encrypted vehicle service data to a decryption module
  • a data encryption device including a processor.
  • the processor is coupled to the memory and can be used to execute instructions in the memory to implement the method in any one of the possible implementations of the first aspect above.
  • the data encryption apparatus further includes a memory.
  • the data encryption apparatus further includes a communication interface, the processor is coupled to the communication interface, and the communication interface is used for inputting and/or outputting information, and the information includes at least one of instructions and data.
  • the data encryption apparatus is a data processing device.
  • the communication interface may be a transceiver, or an input/output interface.
  • the transceiver may be a transceiver circuit.
  • the input/output interface may be an input/output circuit.
  • the data encryption device is a chip or a chip system configured in a data processing device.
  • the communication interface may be an input/output interface, an interface circuit, an output circuit, an input circuit, a pin or a related circuit.
  • the processor may also be embodied as a processing circuit or a logic circuit.
  • a data transmission device including a processor.
  • the processor is coupled to the memory and can be used to execute instructions in the memory to implement the method in any of the possible implementations of the second aspect above.
  • the data transmission device further includes a memory.
  • the data transmission device further includes a communication interface, the processor is coupled to the communication interface, and the communication interface is used for inputting and/or outputting information, and the information includes at least one of instructions and data.
  • the data transmission apparatus is a data processing device.
  • the communication interface may be a transceiver, or an input/output interface.
  • the transceiver may be a transceiver circuit.
  • the input/output interface may be an input/output circuit.
  • the data transmission apparatus is a chip or a chip system configured in a data processing device.
  • the communication interface may be an input/output interface, an interface circuit, an output circuit, an input circuit, a pin or a related circuit.
  • the processor may also be embodied as a processing circuit or a logic circuit.
  • a processor including: an input circuit, an output circuit, and a processing circuit.
  • the processing circuit is configured to receive a signal through the input circuit and transmit a signal through the output circuit, so that the processor executes the method in any of the possible implementation manners of the first aspect, or executes the second A method in any of the possible implementations of an aspect.
  • the above-mentioned processor may be a chip
  • the input circuit may be an input pin
  • the output circuit may be an output pin
  • the processing circuit may be a transistor, a gate circuit, a flip-flop, and various logic circuits.
  • the input signal received by the input circuit may be received and input by, for example, but not limited to, a receiver
  • the signal output by the output circuit may be, for example, but not limited to, output to and transmitted by a transmitter
  • the circuit can be the same circuit that acts as an input circuit and an output circuit at different times.
  • the embodiments of the present application do not limit the specific implementation manners of the processor and various circuits.
  • a data encryption device including a communication interface and a processor.
  • the communication interface is coupled with the processor.
  • the communication interface is used to input and/or output information.
  • the information includes at least one of instructions and data.
  • the processor is configured to execute a computer program, so that the data encryption apparatus executes the method in any of the possible implementations of the first aspect.
  • processors there are one or more processors and one or more memories.
  • a data transmission device including a communication interface and a processor.
  • the communication interface is coupled with the processor.
  • the communication interface is used to input and/or output information.
  • the information includes at least one of instructions and data.
  • the processor is configured to execute a computer program to cause the data encryption apparatus to perform the method in any of the possible implementations of the second aspect.
  • processors there are one or more processors and one or more memories.
  • a data encryption apparatus including a processor and a memory.
  • the processor is configured to read instructions stored in the memory, and can receive signals through a receiver and transmit signals through a transmitter, so that the apparatus performs the method in any possible implementation manner of the first aspect.
  • processors there are one or more processors and one or more memories.
  • the memory may be integrated with the processor, or the memory may be provided separately from the processor.
  • a data transmission device including a processor and a memory.
  • the processor is configured to read instructions stored in the memory, and can receive signals through a receiver and transmit signals through a transmitter, so that the apparatus performs the method in any possible implementation manner of the second aspect.
  • processors there are one or more processors and one or more memories.
  • the memory may be integrated with the processor, or the memory may be provided separately from the processor.
  • the memory can be a non-transitory memory, such as a read only memory (ROM), which can be integrated with the processor on the same chip, or can be separately set in different On the chip, the embodiment of the present application does not limit the type of the memory and the setting manner of the memory and the processor.
  • ROM read only memory
  • sending a message may be a process of outputting a message from the processor
  • receiving a message may be a process of inputting a received message to the processor.
  • the information output by the processing can be output to the transmitter, and the input information received by the processor can be from the receiver.
  • the transmitter and the receiver may be collectively referred to as a transceiver.
  • the data encryption device and the data transmission device in the above eighth to eleventh aspects may be chips, and the processor may be implemented by hardware or software.
  • the processor When implemented by hardware, the processor may be a logic circuit. , integrated circuit, etc.; when implemented by software, the processor may be a general-purpose processor, implemented by reading software codes stored in a memory, which may be integrated in the processor or located outside the processor , exist independently.
  • a twelfth aspect provides a computer program product, the computer program product comprising: a computer program (also referred to as code, or instructions), when the computer program is executed, causes the computer to execute the above-mentioned first aspect.
  • a computer program also referred to as code, or instructions
  • the method in any one of the possible implementations, or the method in any one of the possible implementations of the second aspect above.
  • a thirteenth aspect provides a computer-readable storage medium, where the computer-readable storage medium stores a computer program (also referred to as code, or instruction), when it runs on a computer, causing the computer to execute the above-mentioned first
  • a computer program also referred to as code, or instruction
  • the present application provides a chip system, the chip system includes a processor and an interface, the interface is used to obtain a program or an instruction, and the processor is used to call the program or instruction to implement or support data processing
  • the device implements the functions involved in the first aspect, or invokes the program or instructions to implement or support the data processing device to implement the functions involved in the second aspect.
  • the chip system further includes a memory for storing necessary program instructions and data of the data processing device.
  • the chip system may be composed of chips, or may include chips and other discrete devices.
  • FIG. 1 is a schematic structural diagram of a system framework in an embodiment of the application.
  • FIG. 2 is a schematic flowchart of a method for controlling vehicle service data transmission in an embodiment of the application
  • FIG. 3 is another schematic flowchart of a method for controlling vehicle service data transmission in an embodiment of the application
  • FIG. 4 is a schematic diagram of a data encryption device provided by an embodiment of the present application.
  • FIG. 5 is a schematic diagram of a data transmission apparatus according to an embodiment of the present application.
  • the technical solution provided in this application is suitable for the business scenario in which vehicle service data is transmitted from inside to outside the vehicle, and the propagation paths covering vehicle service data are usually the node where the vehicle service data is located, the in-vehicle data transmission node and the out-of-vehicle data transmission node , the node where the vehicle service data is located is the original data source of the vehicle service data that needs to be transmitted outside the vehicle, and the in-vehicle data transmission node is the node that the vehicle service data must pass through in the process of in-vehicle transmission, such as a telematics BOX (Telematics BOX).
  • a telematics BOX Telematics BOX
  • the off-vehicle data transmission node needs to transmit the vehicle service data to the cloud server for storage or processing. Before the vehicle service data reaches the target application, it needs to go through another data transmission node.
  • the data transmission node is an off-vehicle data transmission node.
  • the number of data transmission nodes needs to be flexibly determined according to requirements. And due to the mechanism requirements, the node where the data transmission node is located needs to have the capability of data encryption and decryption.
  • the data transmission node can be used to locate the propagation path of the vehicle service data in the vehicle. When the number of data transmission nodes increases, the transmission path of the vehicle service data becomes more refined, and the number of encryption and decryption that the vehicle service data needs to go through will also increase accordingly. Therefore, in actual business scenarios, it is necessary to balance the path granularity and the performance consumption brought by encryption and decryption, and deploy the number of data transmission nodes.
  • controlling the transmission of vehicle service data from inside the vehicle to outside the vehicle cannot be applied to the scenario of uploading personal service data to the cloud server for processing inside the vehicle.
  • the technical solutions provided in this application are also applicable to the scenario where the vehicle service data interacts with the terminal equipment (such as smart phones, tablet computers, etc.) outside the vehicle through Bluetooth or other short-range communication methods. Do limit.
  • This application can be used for a data transmission protection system composed of a vehicle end and a cloud server.
  • a data transmission control center is deployed at the vehicle end, and the data transmission control center is responsible for the data transmission control at the vehicle level, so that the data transmission control center can perform data transmission control.
  • Data transmission related functions such as transmission notification and data transmission policy control.
  • a data transmission node is also deployed at the vehicle end, which is responsible for receiving the data transmission policy configuration items issued by the data transmission control center, and at the same time, detects the vehicle service data flowing through the data transmission node.
  • the cloud server is also deployed with data transmission nodes, which are responsible for the data transmission management, control strategy and other functions of the overall IoV service. Further, the vehicle-side data transmission control center and the cloud server data transmission node can synchronize the data transmission strategy configuration, and the data transmission node deployed by the cloud server can also detect the passing vehicle service data.
  • KMS Key Management System
  • IAM Identity and Access Management
  • KMS and IAM are used in this application.
  • a data security identifier that is, a data transmission key used to ensure confidentiality of vehicle service data during transmission.
  • KMS and IAM can also be configured in combination with data transmission policies in this embodiment of the present application. Service data is marked for data transfer.
  • the data transmission technical facilities include a data transmission control center, an in-vehicle KMS, and an in-vehicle IAM.
  • the data transmission control center configures the user data transmission communication strategy.
  • the user data transmission communication strategy includes the data transmission nodes that can transmit vehicle service data and the data transmission sequence, and then sends the user data transmission communication strategy to the in-vehicle KMS and in-vehicle IAM.
  • the in-vehicle KMS and in-vehicle IAM authorize the communication credentials corresponding to the vehicle service data according to the user data transmission communication strategy, and then the in-vehicle KMS and in-vehicle IAM transmit the communication strategy to the data deployed on the security network boundary network element according to the user data transmission communication strategy.
  • the transmission node issues a key, which is used to verify the communication credentials corresponding to the vehicle service data.
  • the vehicle service data is authenticated by the in-vehicle KMS and the in-vehicle IAM, the vehicle service data is transmitted.
  • the data transmission node performs real-time detection on the vehicle service data in the vehicle and on the network boundary outside the vehicle, and verifies the communication credentials corresponding to the vehicle service data. If the transmission conditions indicated by the communication credentials satisfy the user data By transmitting the transmission conditions indicated by the communication strategy, the vehicle service data corresponding to the communication credential can be transmitted, and the vehicle service data can be updated to the communication credential of the next data transmission node, thereby completing the transmission of the vehicle service data.
  • the in-vehicle data transmission control center can also provide users with a visualization of vehicle service data transmission according to the transmission records (such as alarms or logs) of vehicle service data detected by the data transmission node. The interface is used for the user to further control and manage the transmission of vehicle service data based on this.
  • the data processing devices described in the technical solutions provided in this application can be ECUs, terminal devices, in-vehicle devices, Bluetooth and devices deployed in cloud servers
  • the data sources can be ECUs, terminal devices, in-vehicle devices, etc., data transmission nodes It can be terminal equipment, in-vehicle equipment, Bluetooth and equipment deployed in cloud servers, etc.
  • the data transmission node may be a low computing power node without decryption capability, or a high computing power node with decryption capability (having the decryption capability required by the technical solution provided by this application).
  • the vehicle service data needs to be sent to the decryption module (in the embodiment of this application, IAM or KMS is used as an example) for decryption operation, Then, the decryption module returns the decrypted vehicle service data to the data transmission node, and then determines whether the decrypted vehicle service data can continue to be transmitted. If it is a node with high computing power with decryption capability, the vehicle service data can be decrypted directly at the data transmission node. The following will introduce the cases where the data transmission node is a low computing power node or a high computing power node.
  • FIG. 2 is a schematic flowchart of the method for controlling the transmission of vehicle service data in the embodiment of the present application, as shown in FIG. 2
  • the step of controlling vehicle service data transmission includes:
  • the data transmission control center determines N data transmission nodes for transmitting vehicle service data and the transmission sequence according to user requirements;
  • the user in the user configuration stage, can configure the flow permission of the vehicle service data in the vehicle through the data transmission control center, that is, select N data transmission nodes that allow the vehicle service data to flow through, and N data transmission nodes
  • the order in which the nodes transmit the vehicle service data, and the order in which the N data transmission nodes transmit the vehicle service data is the transmission order. For example, if the transmission sequence is that the first data transmission node is transmitted to the second data transmission node, and the second data transmission node is transmitted to the third data transmission node, then the vehicle service data will be transmitted from the first data transmission node to the second data transmission node based on the transmission order.
  • the node to the third data transmission node transmits sequentially.
  • the data transmission control center will also send the relevant information of the N data transmission nodes to the IAM or KMS, as well as the transmission sequence to the data source.
  • the Nth data transmission node is a transmission node outside the vehicle
  • the first data transmission node indicated by the transmission sequence is a transmission node inside the vehicle.
  • the data transmission control center has the ability to summarize all the data related to the vehicle service in the vehicle and display it to the user through the central control screen menu or other means, then the user can transfer the N data transmission nodes of the vehicle service data as required. and the transmission order to configure.
  • the IAM or KMS receives the related information of the N data transmission nodes from the data transmission control center, and generates the data transmission keys of the N data transmission nodes based on the relevant information of the N data transmission nodes.
  • the keys correspond one-to-one with the data transmission nodes. It should be understood that the data transmission key described in this application may be symmetric or asymmetric, which is not specifically limited here.
  • the IAM or KMS can generate the data transmission key of the first data transmission node, The data transmission key of the second data transmission node, and the data transmission key of the third data transmission node. It should be understood that only three data transmission nodes are described in the foregoing example. In practical applications, if the number of data transmission nodes that allow vehicle service data to flow through is determined, then the number of corresponding data transmission keys generated is the same, and the specific number is here Not limited.
  • the generation method of the data transmission key set is determined by the KMS.
  • the key material preset in the KMS is used to generate the data transmission key of each data transmission node, or the data transmission key of each data transmission node can be randomly generated in real time.
  • the data transmission key so the specific generation method of the data transmission key set should not be construed as a limitation of this embodiment of the present application.
  • the IAM or KMS sends the data transmission key to the corresponding data transmission node and sends the data transmission keys of the N data transmission nodes to the data source;
  • the IAM or KMS sends the data transmission key generated in step S102 to the corresponding data transmission node, and sends the data transmission keys of the N data transmission nodes to the data source.
  • the data transmission key of the first data transmission node can be obtained through step S102, The data transmission key of the second data transmission node and the data transmission key of the third data transmission node, so the IAM or KMS needs to send the data transmission key of the first data transmission node to the first data transmission.
  • the KMS needs to send the data transmission key of the second data transmission node to the second data transmission, and the third data transmission to send the data transmission key of the third data transmission node, and the data transmission key of the first data transmission node,
  • the data transmission key of the second data transmission node and the data transmission key of the third data transmission node are sent to the data source.
  • the foregoing example only describes sending the corresponding data transmission keys to three data transmission nodes. In practical applications, if the number of data transmission nodes through which the vehicle service data is allowed to flow is determined, then the corresponding data transmission keys that need to be sent are determined. The number of keys is the same, so the number of corresponding data transmission keys to be sent is not limited here.
  • IAM or KMS generates communication credentials of N data transmission nodes
  • the IAM or KMS receives the relevant information of the N data transmission nodes from the data transmission control center, and can also generate the communication credentials of the N data transmission nodes based on the relevant information of the N data transmission nodes, and the communication credential is the same as that of the N data transmission nodes.
  • the data transmission nodes are in one-to-one correspondence, and each communication credential indicates the transmission conditions of the decrypted encrypted vehicle service data at the data transmission node.
  • the data transmission node set includes a first data transmission node, a second data transmission node and a third data transmission node as an example for description. If the communication certificate of the first data transmission node indicates that the transmission is performed between 14:00 and 15:00, that is, the transmission condition of the first data transmission node is that the decrypted encrypted vehicle service data needs to be between 14:00 and 15:00. For transmission, if the decrypted encrypted vehicle service data is between 14:00 and 15:00, the first data transmission node sends the decrypted encrypted vehicle service data to the next data transmission node. Data is not transmitted between 14:00 and 15:00.
  • the communication certificate of the second data transmission node indicates that the data is less than 10 megabytes (M) for transmission, that is, the transmission condition of the second data transmission node is that the size of the decrypted encrypted vehicle service data needs to be less than 10 M. If the vehicle service data is less than 10M, the second data transmission node sends the decrypted vehicle service data to the next data transmission node. If the decrypted encrypted vehicle service data is greater than or equal to 10M, data transmission is not performed. It should be understood that the foregoing examples are only used to understand this solution, and the specific communication credentials of each data transmission node are not limited herein.
  • step S102 and step S104 have no time sequence limitation, so the sequence numbers of step S102 and step S104 should not be construed as a limitation of this embodiment of the present application.
  • the execution order is not specifically limited here.
  • the IAM or KMS sends the communication credentials of the N data transmission nodes to the data source;
  • the IAM or KMS sends the communication credentials of the N data transmission nodes obtained in step S104 to the data source.
  • N data transmission nodes include a first data transmission node, a second data transmission node and a third data transmission node
  • the transmission sequence is that the first data transmission node transmits to the second data transmission node, and the second data transmission node transmits
  • the third data transmission node is described as an example, and it should be understood that the number of specific data transmission nodes and the specific transmission sequence should not be construed as a limitation of the present application.
  • the data source encrypts the vehicle service data and the communication credential of the third data transmission node by using the data transmission key of the third data transmission node to obtain the first encrypted vehicle service data;
  • the data source before each encryption of the data source, it is necessary to ensure that the payload of the message carries the communication credential of the data transmission node.
  • the data source After the data source obtains the data transmission keys of the N data transmission nodes in step S103 and the communication credentials of the N data transmission nodes obtained in step S105 and sends them to the data source, the data source needs to first obtain the data transmission keys from the N data transmission nodes.
  • the data transmission key of the third data transmission node determines the data transmission key of the third data transmission node, and then obtains the communication credential of the third data transmission node from the communication credential of the N data transmission nodes.
  • the data source encrypts the vehicle service data and the communication credential of the third data transmission node through the data transmission key of the third data transmission node to obtain the first encrypted vehicle service data.
  • the data source encrypts the first encrypted vehicle service data and the communication credential of the second data transmission node by using the data transmission key of the second data transmission node to obtain the second encrypted vehicle service data;
  • the data source after the data source obtains the first encrypted vehicle service data through step S106, it needs to determine the data transmission key of the second data transmission node from the data transmission keys of the N data transmission nodes, and then use the data transmission keys of the N data transmission nodes to determine the data transmission key of the second data transmission node.
  • the node's communication credential acquires the communication credential of the second data transfer node.
  • the data source encrypts the first encrypted vehicle service data and the communication credential of the second data transmission node by using the data transmission key of the second data transmission node to obtain the second encrypted vehicle service data.
  • the data source encrypts the second encrypted vehicle service data and the communication credential of the first data transmission node by using the data transmission key of the first data transmission node to obtain third encrypted vehicle service data;
  • the data source after the data source obtains the second encrypted vehicle service data through step S107, it needs to further determine the data transmission key of the first data transmission node from the data transmission keys of the N data transmission nodes, and then determine the data transmission key of the first data transmission node from the data transmission keys of the N data transmission nodes.
  • the communication credential of the transmission node acquires the communication credential of the first data transmission node.
  • the data source encrypts the second encrypted vehicle service data and the communication credential of the first data transmission node through the data transmission key of the first data transmission node to obtain the third encrypted vehicle service data.
  • the encryption operation of the vehicle service data is completed, and thus the third encrypted vehicle service data obtained after encryption can be encrypted.
  • the first data transmission node receives the third encrypted vehicle service number sent by the data source;
  • the first data transmission node receives the third encrypted vehicle service data sent by the data source.
  • the first data transmission node decrypts the third encrypted vehicle service data by using the data transmission key of the first data transmission node to obtain the second encrypted vehicle service data and the communication credential of the first data transmission node;
  • the third encrypted vehicle service data needs to be decrypted by the data transmission key of the first data transmission node to obtain the second encrypted vehicle service data and a communication credential of the first data transmission node, the communication credential of the first data transmission node indicating the transmission conditions of the second encrypted vehicle service data at the first data transmission node.
  • the first data transmission node determines whether the transmission condition of the second encrypted vehicle service data at the first data transmission node is satisfied, and when the transmission condition of the second encrypted vehicle service data at the first data transmission node is satisfied, the The second data transfer node transmits the second encrypted vehicle service data.
  • the second encrypted vehicle service data is not further transmitted, thereby improving the security of data transmission.
  • the transmission condition of the first data transmission node is that the second encrypted vehicle service data needs to be transmitted between 14:00 and 15:00: 00
  • the first data transmission node decrypts the third encrypted vehicle service data to obtain the second encrypted vehicle service data, and obtains the second encrypted vehicle service data between 14:00 and 15:00
  • the next data transmission node is the second data transmission node, so the first data transmission node sends the second encrypted vehicle service data to the second data transmission node.
  • the transmission condition of the second encrypted vehicle service data in the first data transmission node is not satisfied, The second encrypted vehicle service data needs to be intercepted without further transmission of the second encrypted vehicle service data.
  • the second data transmission node decrypts the second encrypted vehicle service data by using the data transmission key of the second data transmission node to obtain the first encrypted vehicle service data and the communication credential of the second data transmission node;
  • the second data transmission node may receive the second encrypted vehicle service data sent by the first data transmission node, and then pass the second encrypted vehicle service data through the second data transmission node.
  • the data transmission key of the data transmission node decrypts the second encrypted vehicle service data to obtain the first encrypted vehicle service data and the communication credential of the second data transmission node, the communication credential of the second data transmission node indicating the first encrypted vehicle
  • the transmission condition of the service data at the second data transmission node may receive the second encrypted vehicle service data sent by the first data transmission node, and then pass the second encrypted vehicle service data through the second data transmission node.
  • the data transmission key of the data transmission node decrypts the second encrypted vehicle service data to obtain the first encrypted vehicle service data and the communication credential of the second data transmission node, the communication credential of the second data transmission node indicating the first encrypted vehicle.
  • the second data transmission node determines whether the transmission condition of the first encrypted vehicle service data at the second data transmission node is satisfied, and when the transmission condition of the first encrypted vehicle service data at the second data transmission node is satisfied, the The third data transfer node transmits the first encrypted vehicle service data. However, when the transmission condition of the first encrypted vehicle service data at the second data transmission node is not satisfied, the first encrypted vehicle service data is not further transmitted, thereby improving the security of data transmission.
  • the transmission condition of the second data transmission node is that the size of the first encrypted vehicle service data needs to be less than 10 M
  • the transmission node decrypts the second encrypted vehicle service data and obtains that the size of the first encrypted vehicle service data is 8M, it is determined that the transmission conditions of the first encrypted vehicle service data in the second data transmission node are satisfied, and the next data can be known according to the transmission order.
  • the transmission node is the third data transmission node, so the second data transmission node sends the first encrypted vehicle service data to the third data transmission node.
  • the second data transmission node decrypts the second encrypted vehicle service data and obtains that the size of the first encrypted vehicle service data is 16M, the transmission conditions of the first encrypted vehicle service data in the second data transmission node are not satisfied, and the The second encrypted vehicle service data is intercepted without further transmission of the second encrypted vehicle service data.
  • the third data transmission node decrypts the first encrypted vehicle service data by using the data transmission key of the third data transmission node to obtain the vehicle service data and the communication credential of the third data transmission node;
  • the third data transmission node may receive the first encrypted vehicle service data sent by the second data transmission node, and then pass the third data transmission node through the third data transmission node.
  • the data transmission key of the data transmission node decrypts the first encrypted vehicle service data to obtain the vehicle service data and the communication credential of the third data transmission node, the communication credential of the third data transmission node indicating that the vehicle service data is in the third data transmission node.
  • the transport condition of the transport node is the transport condition of the transport node.
  • the third data transmission node sends the vehicle service data to the next data transmission node.
  • the third data transmission node judges whether the transmission condition of the vehicle service data in the third data transmission node is satisfied, and when the transmission condition of the vehicle service data in the third data transmission node is satisfied, it sends to the next data transmission node Vehicle service data.
  • Vehicle service data when the transmission conditions of the vehicle service data at the third data transmission node are not satisfied, the vehicle service data is not further transmitted or processed, thereby improving the security of data transmission.
  • the third data transmission node is a node deployed on the cloud server.
  • the third data transmission node of the cloud server can be used as a screening threshold for vehicle service data to enter the cloud server in practical applications, and the actual transmission destination may be a deeper module in the cloud server.
  • the third data transmission node needs to transmit vehicle service data to a deeper module in the cloud server, so the next data transmission node can be a deeper module in the cloud server.
  • the vehicle service data service can be provided for the target vehicle directly based on the vehicle service data.
  • the above two scenarios may be implemented, but in a cross-domain scenario, when a new domain is reached (for example, data is transmitted from a vehicle to a cloud server, the cloud server is a new domain), the At least one data transmission node is set in the new domain for judging the transmission conditions indicated by the communication credentials of the data transmission node, thereby improving the reliability and security of data transmission.
  • the transmission condition of the vehicle service data at the third data transmission node is that the vehicle service data is allowed to be sent to 192.168.1.1, that is, the transmission condition of the third data transmission node is that the vehicle service data can be sent to 192.168.1.1
  • the transmission conditions of the vehicle service data in the third data transmission node are satisfied, based on The data transmission sequence transmits the vehicle service data to the next data transmission node (ie, the data transmission node whose address is "192.168.1.1").
  • the third data transmission node decrypts the first encrypted vehicle service data to obtain the vehicle service data, and the address of the next data transmission node is "192.167.1.0", it is not satisfied that the vehicle service data is in the third data transmission node.
  • the transmission conditions require that the vehicle service data be intercepted, the vehicle service data not be further transmitted, or the service of the vehicle service data not to be provided.
  • FIG. 3 is another schematic flowchart of the method for controlling the transmission of vehicle service data in the embodiment of the present application.
  • the steps of controlling vehicle service data transmission include:
  • the data transmission control center determines N data transmission nodes for transmitting vehicle service data and the transmission sequence according to user requirements;
  • step S101 the specific manner in which the data transmission control center determines the N data transmission nodes for transmitting vehicle service data and the transmission sequence according to the user's requirements is similar to step S101 , and details are not repeated here.
  • step S102 the specific manner in which the IAM or the KMS generates the data transmission keys of the N data transmission nodes is similar to step S102, and details are not described herein again.
  • the IAM or KMS sends the data transmission keys of the N data transmission nodes to the data source;
  • the data transmission node since the data transmission node is a low computing power node without decryption capability, the data transmission node cannot decrypt the encrypted data, so the IAM or KMS only needs to convert the data of the N data transmission nodes generated in step S202.
  • the data transfer key is sent to the data source.
  • IAM or KMS generates communication credentials of N data transmission nodes
  • step S104 the specific manner in which the IAM or the KMS generates the communication credentials of the N data transmission nodes is similar to step S104, and details are not described herein again.
  • step S202 and step S204 have no timing limitation, so the sequence numbers of step S202 and step S204 should not be construed as a limitation of this embodiment of the present application.
  • the execution order is not specifically limited here.
  • the IAM or KMS sends the communication credentials of the N data transmission nodes to the data source;
  • the specific manner in which the IAM or KMS sends the communication credentials of the N data transmission nodes generated in step S204 to the data source is similar to that in step S105, and details are not repeated here.
  • N data transmission nodes include a first data transmission node, a second data transmission node and a third data transmission node, and the transmission sequence is that the first data transmission node transmits to the second data transmission node.
  • the transmission node, the transmission of the second data transmission node to the third data transmission node is described as an example, and it should be understood that the specific number of data transmission nodes and the specific transmission order should not be construed as limitations of this application.
  • the data source encrypts the vehicle service data and the communication credential of the third data transmission node by using the data transmission key of the third data transmission node to obtain the first encrypted vehicle service data;
  • the data source encrypts the vehicle service data and the communication credential of the third data transmission node by using the data transmission key of the third data transmission node, and the specific method of obtaining the first encrypted vehicle service data is similar to step S106. This will not be repeated here.
  • the data source encrypts the first encrypted vehicle service data and the communication credential of the second data transmission node by using the data transmission key of the second data transmission node to obtain the second encrypted vehicle service data;
  • the data source encrypts the first encrypted vehicle service data and the communication credential of the second data transmission node through the data transmission key of the second data transmission node, and the specific method of obtaining the second encrypted vehicle service data and step S107 similar, and will not be repeated here.
  • the data source encrypts the second encrypted vehicle service data and the communication credential of the first data transmission node by using the data transmission key of the first data transmission node to obtain third encrypted vehicle service data;
  • the data source encrypts the second encrypted vehicle service data and the communication credential of the first data transmission node by using the data transmission key of the first data transmission node to obtain the specific method and steps of the third encrypted vehicle service data S108 is similar and will not be repeated here.
  • the first data transmission node receives the third encrypted vehicle service data sent by the data source, and sends the third encrypted vehicle service data to the IAM or KMS;
  • the first data transmission node receives the third encrypted vehicle service data sent by the data source. Since the data transmission node is a low-computing node without decryption capability, the first data transmission node needs to send the third encrypted vehicle service data to the IAM or KMS. The third encrypts the vehicle service data.
  • the IAM or KMS decrypts the third encrypted vehicle service data through the data transmission key of the first data transmission node to obtain the second encrypted vehicle service data and the communication credential of the first data transmission node;
  • the IAM or KMS decrypts the third encrypted vehicle service data by using the data transmission key of the first data transmission node to obtain the second encrypted vehicle service data.
  • the specific manner of encrypting the vehicle service data and the communication credential of the first data transmission node is similar to the decryption method of the first data transmission node in step S110, and details are not repeated here.
  • the IAM or KMS obtains the second encrypted vehicle service data and the communication credential of the first data transmission node, it is also necessary to send the second encrypted vehicle service data and the communication credential of the first data transmission node to the first data transmission node.
  • the communication credential of the first data transmission node indicates the transmission condition of the second encrypted vehicle service data at the first data transmission node.
  • the first data transmission node determines the second data transmission node through the communication credential of the first data transmission node.
  • the transmission conditions of the encrypted vehicle service data at the first data transmission node are determined, and whether the transmission conditions of the second encrypted vehicle service data at the first data transmission node are satisfied, and if the transmission conditions of the second encrypted vehicle service data at the first data transmission node are satisfied When conditions are met, the second encrypted vehicle service data is sent to the second data transmission node.
  • the second encrypted vehicle service data is not further transmitted, thereby improving the security of data transmission.
  • the first data transmission node determines that the transmission conditions of the second encrypted vehicle service data in the first data transmission node are satisfied, and the specific method of sending the second encrypted vehicle service data to the second data transmission node is similar to step S111, and details are not repeated here. .
  • the second data transmission node receives the second encrypted vehicle service data sent by the first data transmission node, and sends the second encrypted vehicle service data to the IAM or KMS;
  • the second data transmission node receives the second encrypted vehicle service data sent by the first data transmission node. Since the data transmission node is a low computing power node without decryption capability, the second data transmission node needs to report to the IAM or The KMS sends the second encrypted vehicle service data.
  • the IAM or KMS decrypts the second encrypted vehicle service data through the data transmission key of the second data transmission node to obtain the first encrypted vehicle service data and the communication credential of the second data transmission node;
  • the IAM or KMS decrypts the second encrypted vehicle service data by using the data transmission key of the second data transmission node to obtain the first encrypted vehicle service data.
  • the specific manner of encrypting the vehicle service data and the communication credential of the second data transmission node is similar to the decryption method of the second data transmission node in step S112, and details are not repeated here.
  • the IAM or KMS obtains the first encrypted vehicle service data and the communication credential of the second data transmission node, it is also necessary to send the first encrypted vehicle service data and the communication credential of the second data transmission node to the second data transmission node.
  • the communication credentials of the second data transmission node indicate the transmission conditions of the first encrypted vehicle service data at the second data transmission node.
  • the second data transmission node determines the first data transmission node through the communication credential of the second data transmission node. Encrypt the transmission conditions of the vehicle service data at the second data transmission node, and determine whether the transmission conditions of the first encrypted vehicle service data at the second data transmission node are satisfied, and if the transmission conditions of the first encrypted vehicle service data at the second data transmission node are satisfied In transmission conditions, the first encrypted vehicle service data is transmitted to the third data transmission node.
  • the second data transmission node determines that the transmission condition of the first encrypted vehicle service data in the second data transmission node is satisfied, and the specific manner in which the third data transmission node sends the first encrypted vehicle service data is similar to step S113, and will not be repeated here.
  • the third data transmission node receives the first encrypted vehicle service data sent by the second data transmission node, and sends the first encrypted vehicle service data to the IAM or KMS;
  • the third data transmission node receives the first encrypted vehicle service data sent by the second data transmission node. Since the data transmission node is a low computing power node without decryption capability, the second data transmission node needs to report to the IAM or The KMS sends the first encrypted vehicle service data.
  • the IAM or KMS decrypts the first encrypted vehicle service data through the data transmission key of the third data transmission node to obtain the vehicle service data and the communication credential of the third data transmission node;
  • the IAM or KMS decrypts the first encrypted vehicle service data by using the data transmission key of the third data transmission node to obtain the vehicle service data
  • the specific manner of the data and the communication credential of the third data transfer node is similar to the decryption method of the third data transfer node in step S114, and details are not repeated here.
  • the IAM or KMS obtains the vehicle service data and the communication credential of the third data transmission node, it is also necessary to send the vehicle service data and the communication credential of the third data transmission node to the third data transmission node, and the third data transmission
  • the node's communication credentials indicate the transmission conditions of the vehicle service data at the third data transmission node.
  • the third data transmission node receives the vehicle service data sent by the IAM or KMS in step S216 and the communication credential of the third data transmission node, and determines that the vehicle service data is in the third data transmission node according to the communication credential of the third data transmission node.
  • the transmission conditions of the data transmission node and determine whether the transmission conditions of the vehicle service data in the third data transmission node are satisfied, and when the transmission conditions of the vehicle service data in the third data transmission node are satisfied, send the vehicle service to the next data transmission node. data.
  • the transmission conditions of the vehicle service data at the third data transmission node are not satisfied, the vehicle service data is not further transmitted or processed, thereby improving the security of data transmission.
  • the third data transmission node is a node deployed on the cloud server.
  • the architecture of the cloud server may include multiple modules or a single module.
  • the third data transmission node transmits the vehicle service data in different ways and for different purposes.
  • the specific transmission method of the vehicle service data is similar to step S115. This will not be repeated here.
  • the data encryption device and the data transmission device include corresponding hardware structures and/or software modules for performing each function.
  • the present application can be implemented in hardware or in the form of a combination of hardware and computer software. Whether a function is performed by hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Skilled artisans may implement the described functionality using different methods for each particular application, but such implementations should not be considered beyond the scope of this application.
  • the data encryption device and the data transmission device may be divided into functional modules based on the foregoing method examples.
  • each functional module may be divided corresponding to each function, or two or more functions may be integrated into one processing module. middle.
  • the above-mentioned integrated modules can be implemented in the form of hardware, and can also be implemented in the form of software function modules. It should be noted that, the division of modules in the embodiments of the present application is schematic, and is only a logical function division, and there may be other division manners in actual implementation.
  • FIG. 4 is a schematic diagram of a data encryption device provided by an embodiment of the present application.
  • the data encryption device 400 includes:
  • an acquisition module 401 configured to acquire vehicle service data of the target vehicle
  • the acquiring module 401 is further configured to acquire N data transmission nodes that transmit vehicle service data, where N ⁇ 2;
  • An encryption module 402 configured to encrypt the N-nth encrypted vehicle service data using the data transmission key of the nth data transmission node to obtain the N-n+1th encrypted vehicle service data, wherein N ⁇ n ⁇ 1, the nth data
  • the transmission node is the nth data transmission node in the transmission order among the N data transmission nodes, the transmission order is the order in which the N data transmission nodes transmit the vehicle service data, and the 0th encrypted vehicle service data is the vehicle service data;
  • the sending module 403 is configured to send the Nth encrypted vehicle service data to the first data transmission node, wherein the Nth encrypted vehicle service data is performed by using the data transmission key of the first data transmission node on the N-1th encrypted vehicle service data. encrypted.
  • the encryption module 402 is specifically configured to use the nth data
  • the data transmission key of the transmission node encrypts the N-nth encrypted vehicle service data and the communication credential of the nth data transmission node to obtain the N-n+1th encrypted vehicle service data, wherein the communication credential of the nth data transmission node indicates the th The transmission condition of N-n encrypted vehicle service data at the nth data transmission node.
  • the nth data transmission node It is an external transmission node for the vehicle;
  • the first data transfer node is a transfer node inside the vehicle.
  • FIG. 5 is a schematic diagram of a data transmission device provided by an embodiment of the present application. As shown in FIG. 5, the data transmission device 500 includes:
  • a receiving module 501 configured to receive encrypted vehicle service data
  • the obtaining module 502 is configured to obtain the decrypted encrypted vehicle service data, wherein the decrypted encrypted vehicle service data is obtained by decrypting the encrypted vehicle service data using the data transmission key of the data transmission node, and the decrypted encrypted vehicle service data is obtained by decrypting the encrypted vehicle service data.
  • the service data is encrypted using the data transmission key of the next data transmission node.
  • the data transmission apparatus 500 further includes a sending module 503;
  • the obtaining module 502 is specifically configured to obtain the decrypted encrypted vehicle service data and the communication credential of the data transmission node, wherein the decrypted encrypted vehicle service data and the communication credential of the data transmission node are the data transmission key pair using the data transmission node Obtained after the encrypted vehicle service data is decrypted, the communication credentials of the data transmission node indicate the transmission conditions of the decrypted encrypted vehicle service data in the data transmission node;
  • the sending module is configured to, after the obtaining module 502 obtains the decrypted encrypted vehicle service data and the communication credential of the data transmission node, when the transmission conditions of the decrypted encrypted vehicle service data at the data transmission node are satisfied, send the data to the next data transmission node. Send decrypted encrypted vehicle service data.
  • the receiving module 501 is further configured to receive a data transmission node the data transfer key
  • the obtaining module 502 is specifically configured to decrypt the encrypted vehicle service data by using the data transmission key of the data transmission node, and obtain the decrypted encrypted vehicle service data and the communication certificate of the data transmission node.
  • the obtaining module 502 is specifically configured to send the data to the decryption module. Encrypt vehicle service data;
  • the decrypted encrypted vehicle service data is obtained using the next It is obtained by encrypting the data transmission key of the data transmission node.
  • the present application further provides a data encryption apparatus, including at least one processor, and the at least one processor is configured to execute a computer program stored in a memory, so that the data encryption apparatus executes the data encryption control in any of the foregoing method embodiments The method performed by the center, data source, IAM or KMS.
  • the above data encryption device may be one or more chips.
  • the data encryption device may be a field programmable gate array (FPGA), an application specific integrated circuit (ASIC), a system on chip (SoC), or a system on chip (SoC). It can be a central processing unit (CPU), a network processor (NP), a digital signal processing circuit (DSP), or a microcontroller (microcontroller). unit, MCU), it can also be a programmable logic device (PLD) or other integrated chips.
  • FPGA field programmable gate array
  • ASIC application specific integrated circuit
  • SoC system on chip
  • SoC system on chip
  • SoC system on chip
  • MCU microcontroller
  • MCU programmable logic device
  • PLD programmable logic device
  • the present application further provides a data transmission apparatus, comprising at least one processor, and the at least one processor is configured to execute a computer program stored in a memory, so that the data transmission apparatus executes the data source in any of the above method embodiments, IAM or KMS, a method performed by a first data transfer node, a second data transfer node, and a third data transfer node.
  • the above data transmission device may be one or more chips.
  • the data transmission device may be FPGA, ASIC, SoC, CPU, NP, DSP, MCU, PLD or other integrated chips.
  • the embodiments of the present application also provide a data encryption device, which includes a processor and a communication interface.
  • the communication interface is coupled with the processor.
  • the communication interface is used to input and/or output information.
  • the information includes at least one of instructions and data.
  • the processor is configured to execute a computer program, so that the data encryption apparatus executes the method executed by the data encryption control center, data source, IAM or KMS in any of the above method embodiments.
  • the embodiments of the present application also provide a data transmission device, which includes a processor and a communication interface.
  • the communication interface is coupled with the processor.
  • the communication interface is used to input and/or output information.
  • the information includes at least one of instructions and data.
  • the processor is configured to execute a computer program, so that the data transmission apparatus executes the data source, IAM or KMS, the first data transmission node, the second data transmission node and the third data transmission node in any of the above method embodiments. Methods.
  • the embodiments of the present application also provide a data encryption device, which includes a processor and a memory.
  • the memory is used to store a computer program
  • the processor is used to call and run the computer program from the memory, so that the data encryption device executes the data encryption control center, data source, IAM in any of the above method embodiments. or the method performed by the KMS.
  • Embodiments of the present application also provide a data transmission device, including a processor and a memory.
  • the memory is used to store a computer program
  • the processor is used to call and run the computer program from the memory, so that the data transmission apparatus executes the data source in any of the above method embodiments, IAM or KMS, the first A method performed by a data transfer node, a second data transfer node, and a third data transfer node.
  • each step of the above-mentioned method can be completed by a hardware integrated logic circuit in a processor or an instruction in the form of software.
  • the steps of the methods disclosed in conjunction with the embodiments of the present application may be directly embodied as executed by a hardware processor, or executed by a combination of hardware and software modules in the processor.
  • the software modules may be located in random access memory, flash memory, read-only memory, programmable read-only memory or electrically erasable programmable memory, registers and other storage media mature in the art.
  • the storage medium is located in the memory, and the processor reads the information in the memory, and completes the steps of the above method in combination with its hardware. To avoid repetition, detailed description is omitted here.
  • the processor in this embodiment of the present application may be an integrated circuit chip, which has a signal processing capability.
  • each step of the above method embodiments may be completed by a hardware integrated logic circuit in a processor or an instruction in the form of software.
  • the aforementioned processors may be general purpose processors, digital signal processors (DSPs), application specific integrated circuits (ASICs), field programmable gate arrays (FPGAs) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components .
  • DSPs digital signal processors
  • ASICs application specific integrated circuits
  • FPGAs field programmable gate arrays
  • the methods, steps, and logic block diagrams disclosed in the embodiments of this application can be implemented or executed.
  • a general purpose processor may be a microprocessor or the processor may be any conventional processor or the like.
  • the steps of the method disclosed in conjunction with the embodiments of the present application may be directly embodied as executed by a hardware decoding processor, or executed by a combination of hardware and software modules in the decoding processor.
  • the software modules may be located in random access memory, flash memory, read-only memory, programmable read-only memory or electrically erasable programmable memory, registers and other storage media mature in the art.
  • the storage medium is located in the memory, and the processor reads the information in the memory, and completes the steps of the above method in combination with its hardware.
  • the memory in this embodiment of the present application may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memory.
  • the non-volatile memory may be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically programmable Erase programmable read-only memory (electrically EPROM, EEPROM) or flash memory.
  • Volatile memory may be random access memory (RAM), which acts as an external cache.
  • RAM random access memory
  • DRAM dynamic random access memory
  • SDRAM synchronous DRAM
  • SDRAM double data rate synchronous dynamic random access memory
  • ESDRAM enhanced synchronous dynamic random access memory
  • SLDRAM synchronous link dynamic random access memory
  • direct rambus RAM direct rambus RAM
  • the present application also provides a computer program product, the computer program product includes: computer program code, when the computer program code is run on a computer, the computer is made to execute the steps shown in FIG. 2 and FIG. 3 .
  • the present application further provides a computer-readable storage medium, where the computer-readable storage medium stores program codes, and when the program codes are executed on a computer, the computer is made to execute FIG. 2 and FIG. 3. Methods performed by each unit in the embodiment shown.
  • the modules in the above-mentioned device embodiments correspond to the units in the method embodiments completely, and the corresponding modules or units perform corresponding steps. Other steps may be performed by a processing unit (processor). For functions of specific units, reference may be made to corresponding method embodiments.
  • the number of processors may be one or more.
  • a component may be, but is not limited to, a process running on a processor, a processor, an object, an executable, a thread of execution, a program, and/or a computer.
  • an application running on a computing device and the computing device may be components.
  • One or more components may reside within a process and/or thread of execution, and a component may be localized on one computer and/or distributed between 2 or more computers.
  • these components can execute from various computer readable media having various data structures stored thereon.
  • a component may, for example, be based on a signal having one or more data packets (eg, data from two components interacting with another component between a local system, a distributed system, and/or a network, such as the Internet interacting with other systems via signals) Communicate through local and/or remote processes.
  • data packets eg, data from two components interacting with another component between a local system, a distributed system, and/or a network, such as the Internet interacting with other systems via signals
  • the disclosed system, apparatus and method may be implemented in other manners.
  • the apparatus embodiments described above are only illustrative.
  • the division of the units is only a logical function division. In actual implementation, there may be other division methods.
  • multiple units or components may be combined or Can be integrated into another system, or some features can be ignored, or not implemented.
  • the shown or discussed mutual coupling or direct coupling or communication connection may be through some interfaces, indirect coupling or communication connection of devices or units, and may be in electrical, mechanical or other forms.
  • the units described as separate components may or may not be physically separated, and components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution in this embodiment.
  • each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically alone, or two or more units may be integrated into one unit.
  • the functions, if implemented in the form of software functional units and sold or used as independent products, may be stored in a computer-readable storage medium.
  • the technical solution of the present application can be embodied in the form of a software product in essence, or the part that contributes to the prior art or the part of the technical solution.
  • the computer software product is stored in a storage medium, including Several instructions are used to cause a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present application.
  • the aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (Read-Only Memory, ROM), random access memory (Random Access Memory, RAM), magnetic disk or optical disk and other media that can store program codes .

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computing Systems (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • Health & Medical Sciences (AREA)
  • General Health & Medical Sciences (AREA)
  • Medical Informatics (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

Un procédé de chiffrement de données, un procédé de transmission de données, des appareils associés et un dispositif, applicables au domaine technique des communications, sont divulgués. Des données transmises entre une pluralité de nœuds sont chiffrées, ce qui permet d'améliorer la sécurité de la transmission de données entre la pluralité de nœuds. Le procédé fait appel aux étapes suivantes : d'abord, l'acquisition de données de service de véhicule d'un véhicule cible, et N nœuds de transmission de données pour transmettre les données de service de véhicule ; ensuite, le chiffrement de (N-n)ièmes données de service de véhicule chiffrées au moyen d'une clé de transmission de données d'un nième nœud de transmission de données, de façon à obtenir (N-n +1)ièmes données de service de véhicule chiffrées, le nième nœud de transmission de données étant un nœud de transmission de données, dont l'ordre de transmission est le nième, parmi les N nœuds de transmission de données, et les données de service de véhicule chiffrées zéroièmes étant les données de service de véhicule ; le chiffrement de (N-1)ièmes données de service de véhicule chiffrées au moyen d'une clé de transmission de données d'un premier nœud de transmission de données, de façon à obtenir des Nièmes données de service de véhicule chiffrées ; et l'envoi des Nièmes données de service de véhicule chiffrées au premier nœud de transmission de données, N ≥ 2, et N ≥ n ≥ 1.
PCT/CN2021/072808 2021-01-20 2021-01-20 Procédé de chiffrement de données, procédé de transmission de données, appareils associés et dispositif WO2022155803A1 (fr)

Priority Applications (2)

Application Number Priority Date Filing Date Title
PCT/CN2021/072808 WO2022155803A1 (fr) 2021-01-20 2021-01-20 Procédé de chiffrement de données, procédé de transmission de données, appareils associés et dispositif
CN202180000112.5A CN115088232A (zh) 2021-01-20 2021-01-20 数据加密的方法、数据传输的方法、相关装置以及设备

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2021/072808 WO2022155803A1 (fr) 2021-01-20 2021-01-20 Procédé de chiffrement de données, procédé de transmission de données, appareils associés et dispositif

Publications (1)

Publication Number Publication Date
WO2022155803A1 true WO2022155803A1 (fr) 2022-07-28

Family

ID=82548473

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/072808 WO2022155803A1 (fr) 2021-01-20 2021-01-20 Procédé de chiffrement de données, procédé de transmission de données, appareils associés et dispositif

Country Status (2)

Country Link
CN (1) CN115088232A (fr)
WO (1) WO2022155803A1 (fr)

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN116049910A (zh) * 2023-02-01 2023-05-02 广东高云半导体科技股份有限公司 一种数据加密系统及方法
CN116248711A (zh) * 2022-12-19 2023-06-09 中电车联信安科技有限公司 一种基于车联网网关的网络安全系统
CN117812585A (zh) * 2024-03-01 2024-04-02 合肥工业大学 一种多云环境下的车云通信方法及通信系统

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1564508A (zh) * 2004-03-22 2005-01-12 西安电子科技大学 宽带无线ip网络匿名连接方法
US6986036B2 (en) * 2002-03-20 2006-01-10 Microsoft Corporation System and method for protecting privacy and anonymity of parties of network communications
CN111343207A (zh) * 2020-05-19 2020-06-26 北京华云安信息技术有限公司 多节点联合加密的数据传输方法、设备和存储介质

Family Cites Families (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
IL210169A0 (en) * 2010-12-22 2011-03-31 Yehuda Binder System and method for routing-based internet security
CN106254425A (zh) * 2016-07-22 2016-12-21 北京京东尚科信息技术有限公司 用于移动设备向云端传送数据的方法及系统、移动终端

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6986036B2 (en) * 2002-03-20 2006-01-10 Microsoft Corporation System and method for protecting privacy and anonymity of parties of network communications
CN1564508A (zh) * 2004-03-22 2005-01-12 西安电子科技大学 宽带无线ip网络匿名连接方法
CN111343207A (zh) * 2020-05-19 2020-06-26 北京华云安信息技术有限公司 多节点联合加密的数据传输方法、设备和存储介质

Non-Patent Citations (5)

* Cited by examiner, † Cited by third party
Title
BURGSTALLER FLORIAN; DERLER ANDREAS; KERN STEFAN; SCHANNER GABRIEL; REITER ANDREAS: "Anonymous Communication in the Browser via Onion-Routing", 2015 10TH INTERNATIONAL CONFERENCE ON P2P, PARALLEL, GRID, CLOUD AND INTERNET COMPUTING (3PGCIC), IEEE, 4 November 2015 (2015-11-04), pages 260 - 267, XP032876656, DOI: 10.1109/3PGCIC.2015.22 *
FENG ZHONGHUA, ET AL.: "Security and Privacy Issues of 5G VANETs", COMMUNICATIONS TECHNOLOGY, JI-DIAN-BU 30 SUO, CN, vol. 50, no. 5, 31 May 2017 (2017-05-31), CN , pages 1010 - 1015, XP055951947, ISSN: 1002-0802, DOI: 10.3969/j.issn.1002-0802.2017.05.031 *
LU RONGXING; ZHANG LAN; NI JIANBING; FANG YUGUANG: "5G Vehicle-to-Everything Services: Gearing Up for Security and Privacy", PROCEEDINGS OF THE IEEE, IEEE. NEW YORK., US, vol. 108, no. 2, 1 February 2020 (2020-02-01), US , pages 373 - 389, XP011768242, ISSN: 0018-9219, DOI: 10.1109/JPROC.2019.2948302 *
SAYAD HAGHIGHI MOHAMMAD; AZIMINEJAD ZAHRA: "Highly Anonymous Mobility-Tolerant Location-Based Onion Routing for VANETs", IEEE INTERNET OF THINGS JOURNAL, IEEE, USA, vol. 7, no. 4, 18 October 2019 (2019-10-18), USA , pages 2582 - 2590, XP011783750, DOI: 10.1109/JIOT.2019.2948315 *
WANG SHUAI; WANG BAOYI; ZHANG SHAOMIN: "A Secure Solution of V2G Communication Based on Trusted Computing", 2018 12TH IEEE INTERNATIONAL CONFERENCE ON ANTI-COUNTERFEITING, SECURITY, AND IDENTIFICATION (ASID), IEEE, 9 November 2018 (2018-11-09), pages 98 - 102, XP033538664, DOI: 10.1109/ICASID.2018.8693143 *

Cited By (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN116248711A (zh) * 2022-12-19 2023-06-09 中电车联信安科技有限公司 一种基于车联网网关的网络安全系统
CN116248711B (zh) * 2022-12-19 2024-01-30 中电车联信安科技有限公司 一种基于车联网网关的网络安全系统
CN116049910A (zh) * 2023-02-01 2023-05-02 广东高云半导体科技股份有限公司 一种数据加密系统及方法
CN117812585A (zh) * 2024-03-01 2024-04-02 合肥工业大学 一种多云环境下的车云通信方法及通信系统
CN117812585B (zh) * 2024-03-01 2024-05-03 合肥工业大学 一种多云环境下的车云通信方法及通信系统

Also Published As

Publication number Publication date
CN115088232A (zh) 2022-09-20

Similar Documents

Publication Publication Date Title
WO2022155803A1 (fr) Procédé de chiffrement de données, procédé de transmission de données, appareils associés et dispositif
US20220060322A1 (en) Technologies for internet of things key management
CN108833101B (zh) 物联网设备的数据传输方法、物联网设备及认证平台
US20170180330A1 (en) Method and electronic device for vehicle remote control and a non-transitory computer readable storage medium
CN110460439A (zh) 信息传输方法、装置、客户端、服务端及存储介质
WO2015180691A1 (fr) Procédé et dispositif d'accord sur des clés pour informations de validation
CN112019647A (zh) 一种获得设备标识的方法及装置
CN113016201B (zh) 密钥供应方法以及相关产品
US10803206B2 (en) Wireless enabled secure storage drive
CN116671062A (zh) 硬件安全模块的远程管理
WO2021155482A1 (fr) Procédé de transmission de données et dispositif ble
CN112910641B (zh) 用于跨链交易监管的验证方法、装置、中继链节点及介质
CN114095277A (zh) 配电网安全通信方法、安全接入设备及可读存储介质
CN110198538B (zh) 一种获得设备标识的方法及装置
US20230327869A1 (en) Authentication method and apparatus
KR102377045B1 (ko) 하드웨어 보안 모듈을 이용한 클라우드를 통한 IoT(Internet of Thing) 디바이스 인증 시스템 및 방법
US20230379146A1 (en) Securing network communications using dynamically and locally generated secret keys
KR20190078154A (ko) 차량용 통합 인증 장치 및 방법
CN114338091B (zh) 数据传输方法、装置、电子设备及存储介质
WO2019069308A1 (fr) Système et procédé de validation d'une authenticité de communication dans des réseaux embarqués
CN114036478A (zh) 区块链跨链方法、装置、存储介质及电子设备
CN113961931A (zh) adb工具使用方法、装置和电子设备
US11005651B2 (en) Method and terminal for establishing security infrastructure and device
KR20220000537A (ko) 차량 네트워크 기반의 데이터 송수신 시스템 및 그 방법
CN116158054A (zh) 访问令牌使用方法和设备

Legal Events

Date Code Title Description
NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 21920207

Country of ref document: EP

Kind code of ref document: A1