WO2023220854A1

WO2023220854A1 - Access control method, terminal, chip, readable storage medium, and computer program product

Info

Publication number: WO2023220854A1
Application number: PCT/CN2022/092978
Authority: WO
Inventors: 茹昭
Original assignee: Oppo广东移动通信有限公司
Priority date: 2022-05-16
Filing date: 2022-05-16
Publication date: 2023-11-23

Abstract

Provided are an access control method, a terminal, a chip, a readable storage medium, and a computer program product. The method comprises: a first terminal determines the permission of a second terminal to the first terminal according to first position information of the second terminal and access control information, wherein the first position information is used for indicating a positional relationship of a user equipment relative to a vehicle device. On the basis of the access control information, the first terminal can determine the permission of the second terminal to the first terminal according to the relative position of the second terminal. On the basis of the permission, the first terminal executes a corresponding access control policy, such that differential access control of the first terminal by the second terminal at different relative positions can be implemented.

Description

Access control methods, terminals, chips, readable storage media and computer program products

Technical field

The present application relates to the field of communication technology, and more specifically, to an access control method, terminal, chip, readable storage medium and computer program product.

Background technique

Communication can take place between the first terminal and the second terminal. When the second terminal accesses the first terminal, the first terminal can perform access control, that is, allow or deny the access. Related technologies can implement access control based on terminal identification, secure channel verification type and other information.

Contents of the invention

This application provides an access control method, terminal, chip, readable storage medium and computer program product.

In a first aspect, an access control method is provided, including: the first terminal determines the authority of the second terminal to the first terminal according to the first location information and access control information of the second terminal; wherein, The first location information is used to indicate the location relationship of the user equipment relative to the vehicle equipment.

In a second aspect, an access control method is provided, including: based on the authority of the second terminal to the first terminal, the second terminal accesses the first terminal; wherein the authority is based on the authority of the second terminal. The first location information and access control information of the terminal are determined, and the first location information is used to indicate the location relationship of the user equipment relative to the vehicle equipment.

In a third aspect, a terminal is provided, where the terminal is a first terminal, and the terminal includes: a determining unit configured to determine, according to the first location information and access control information of the second terminal, whether the second terminal is The authority of the first terminal; wherein the first location information is used to indicate the location relationship of the user equipment relative to the vehicle equipment.

In a fourth aspect, a terminal is provided, where the terminal is a second terminal, and the terminal includes: an access unit configured to access the first terminal based on the authority of the second terminal to the first terminal; wherein, The permission is determined based on the first location information and access control information of the second terminal, and the first location information is used to indicate the location relationship of the user equipment relative to the vehicle equipment.

In a fifth aspect, a terminal device is provided, including a processor, a memory, and a communication interface. The memory is used to store one or more computer programs. The processor is used to call the computer program in the memory so that the terminal device Perform the method described in the first aspect and/or the second aspect.

In a sixth aspect, a communication system is provided, which system includes the above-mentioned first terminal and/or second terminal. In another possible design, the system may also include other devices that interact with the first terminal and/or the second terminal in the solution provided by the embodiments of the present application.

In a seventh aspect, embodiments of the present application provide a computer-readable storage medium that stores a computer program. The computer program causes a terminal device to execute the method of the first aspect and/or the second aspect. some or all of the steps.

In an eighth aspect, embodiments of the present application provide a computer program product, wherein the computer program product includes a non-transitory computer-readable storage medium storing a computer program, and the computer program is operable to cause the terminal to execute the above-mentioned first step. Some or all of the steps in the method of the first aspect and/or the second aspect. In some implementations, the computer program product can be a software installation package.

In a ninth aspect, embodiments of the present application provide a chip, which includes a memory and a processor. The processor can call and run a computer program from the memory to implement the method of the first and/or second aspect. Describe some or all of the steps.

In a tenth aspect, a computer program product is provided, including a program that causes a computer to execute the method described in the first aspect and/or the second aspect.

An eleventh aspect provides a computer program, the computer program causing a computer to execute the first aspect and/or the method described.

Based on the access control information, the first terminal may determine the permissions of the second terminal to the first terminal according to the relative position of the second terminal (ie, the indication of the first position information). Based on the authority, the first terminal executes the corresponding access control policy, so that differentiated access control of the second terminal to the first terminal under different relative positions can be achieved.

Description of the drawings

Figure 1 is an example diagram of an application scenario according to the embodiment of the present application.

Figure 2 is a schematic flow chart of an access control method provided by an embodiment of the present application.

Figure 3 is a schematic flow chart of another access control method provided by an embodiment of the present application.

Figure 4 is a schematic flow chart of yet another access control method provided by an embodiment of the present application.

Figure 5 is a schematic flow chart of yet another access control method provided by an embodiment of the present application.

Figure 6 is a schematic structural diagram of a terminal provided by an embodiment of the present application.

Figure 7 is a schematic structural diagram of another terminal provided by an embodiment of the present application.

Figure 8 is a schematic structural diagram of a device provided by an embodiment of the present application.

Detailed ways

The technical solutions in this application will be described below with reference to the accompanying drawings.

Figure 1 is an example diagram of an application scenario according to the embodiment of the present application. The terminal 110 may be a device that communicates with the terminal 120.

The terminal in the embodiment of this application may also be called a node, user equipment (UE), access terminal, user unit, user station, mobile station, mobile station (MS), mobile terminal, MT), remote station, remote terminal, mobile device, user terminal, terminal equipment, wireless communications equipment, user agent or user device. The terminal device in the embodiment of the present application may be a device that provides voice and/or data connectivity to users, and may be used to connect people, things, and machines. For example, the terminal can be a handheld device, a vehicle-mounted device, etc. with wireless connection function. Alternatively, the terminal may be a car, home appliance, home system, etc. with wireless connection function. The terminal device in the embodiment of the present application can be a mobile phone (mobile phone), a tablet computer (Pad), a notebook computer, a handheld computer, a mobile internet device (mobile internet device, MID), a wearable device, a virtual reality (virtual reality, VR) equipment, augmented reality (AR) equipment, wireless terminals in industrial control (industrial control), wireless terminals in Internet of Things equipment, wireless terminals in self-driving (self driving), remote surgery (remote medical) Wireless terminals in surgery, wireless terminals in smart grid, wireless terminals in transportation safety, wireless terminals in smart city, and wireless terminals in smart home wait. Optionally, the terminal can be used to act as a base station. For example, a terminal may act as a scheduling entity that provides sidelink signals between terminals in V2X or D2D, etc. For example, cell phones and cars use sidelink signals to communicate with each other. Cell phones and smart home devices communicate between each other without having to relay communication signals through base stations.

Terminals can be deployed on land, indoors or outdoors, handheld or vehicle-mounted; they can also be deployed on water; they can also be deployed on aircraft, balloons and satellites in the air. In the embodiments of this application, the scenario in which the terminal is located is not limited.

It should be understood that all or part of the functions of the communication device in this application can also be implemented through software functions running on hardware, or through virtualization functions instantiated on a platform (such as a cloud platform).

It should be understood that the technical solutions of the embodiments of the present application can be applied to various communication systems, such as: fifth generation (5th generation, 5G) systems or new radio (NR), long term evolution (long term evolution, LTE) systems , LTE frequency division duplex (FDD) system, LTE time division duplex (TDD), cellular Internet of Things, WIFI communication system, Bluetooth communication system, etc. The technical solution provided by this application can also be applied to future communication systems, such as the sixth generation mobile communication system and so on.

The terminal 110 can access the resources of the terminal 120. As an implementation manner, the terminal 110 can be a mobile phone, and the terminal 120 can be a car. Users can operate on their mobile phones to control car resources. For example, the terminal 110 can implement a digital car key function to replace the traditional car key.

In some embodiments, the digital car key can implement a sensorless unlocking function, that is, a keyless entry and start system (passive entry passive start, PEPS). To facilitate the description of the digital car key function, the terminal 120 in FIG. 1 is referred to as the car 120 below.

In PEPS technology, when the user brings the terminal 110 into a certain range around the car 120, the car 120 can identify the location of the terminal 110 and the user authorized by the car 120. If the identification is passed, the car 120 can automatically open the door. Alternatively, when the user carries the terminal 110 and leaves a certain range of the car, the car 120 can recognize the location of the terminal 110 and can control the door locks and/or window locks of the car 120 to automatically lock and/or enter the anti-theft state.

PEPS can be implemented based on Bluetooth low energy (BLE) wireless communication and/or ultra wide band (UWB) technology. For example, the car 120 and the terminal 110 can perform broadcast discovery through BLE wireless communication. When the terminal 110 enters the discovery area, the terminal 110 can discover the car 120, and the terminal 110 can launch the car company's application (APP) background unlocking service to verify the user information and/or the validity of the digital key of the terminal 110. Further, the terminal 110 can establish a BLE connection with the car 120 . The car 120 can determine the distance between the terminal 110 and the car 120 based on the BLE connection (for example, through UWB). When the user brings the terminal 110 closer to the car, the car 120 can determine whether the terminal 110 is in a keyless entry (PE) area. If the terminal 110 is in the PE area, the car 120 can enter the unlocking allowed state. At this time, the user can open the door of the car 120.

The following will introduce in detail the digital car key technology based on BLE and UWB technology. The car unlocking method based on the digital car key may include steps S110 to S150. The method can be performed by the terminal 110 and the car 120 .

In step S110, the car 120 and/or the terminal 110 perform broadcast discovery through BLE wireless communication.

In step S120, the car 120 and the terminal 110 perform two-way authentication.

Step S130, the car 120 and the terminal 110 negotiate to start the UWB ranging channel on the BLE channel.

In step S140, the car 120 and/or the terminal 110 measure the distance between the car 120 and the terminal 110 through UWB.

In step S150, the car 120 determines whether the terminal 110 is in the PE area based on the distance between the car 120 and the terminal 110. If in the PE area, the car 120 can enter the unlocking allowed state.

It can be understood that with the PEPS digital car key mentioned above, the user does not need to operate on the mobile phone, and the car can automatically access the car lock (unlock or lock) based on the location of the mobile phone. In other words, the digital car key can achieve senseless access to the resource of the car lock based on location information.

In one implementation, the terminal 110's access to resources of the terminal 120 may be controlled by the terminal 120. The terminal 120 may allow the access of the terminal 110 or may deny the access of the terminal 110 . For example, the mobile phone's access to the car lock resource can be controlled by the car, that is, the car can control whether to allow the mobile phone to lock or unlock the car lock. Access control can be implemented based on access control list (ACL).

An ACL can include one or more access control entries (ACEs). ACE can define permissions for one or some resources for one or some specific nodes (or accounts). ACE can include one or more pieces of information. For example, an ACE may include one or more pieces of information related to permissions, identities, functional units, etc. Various information can be carried in fields in ACE. That is, an ACE can include one or more fields.

As an implementation method, ACE can include one or more fields such as permission level, authentication type, source principal, target, and extension. Different protocols or standards may have different settings for fields of the same or similar information. This application does not limit this, and the following is only an exemplary description. The fields that can be included in ACE are introduced in detail below.

The Targets field can be used to describe the target resources to which this ACE entry applies. The target resource may include, for example, one or more target functional units. The value type of the target field can be a list type. The target field may include a structure (struct) of one or more target functional units. In some embodiments, the EndPoints field may also be used to describe the target resource to which the ACE entry applies.

The Privilege field can be used to describe the level of privileges that can be granted by this ACE entry. The value type of the permission level field can be an enumeration (enum) type. The value of the permission level field can include: view permission, proxy view permission, operate permission, manage permission, administrator permission, etc.

View permissions can include permissions to read and observe all resources except access-controlled resources and non-proxy resources.

Agent permissions can include permissions to read and observe all agent resources. Delegate viewing rights can implicitly include viewing rights.

Operation permissions can include view permissions and permissions to perform the primary functions of the target resource. The main functions may be other than those of the access control unit. Operation permissions may implicitly include viewing permissions.

Administrative permissions can include operating permissions and modifying the persistent configuration of the node (in addition to the access control functional unit). Administrative permissions may implicitly include operation permissions and/or viewing permissions.

Administrator rights can include administrative rights and observing and modifying access control functional units. Administrator permissions may implicitly include one or more of management permissions, operation permissions, delegate viewing permissions, and viewing permissions.

The Source Subjects field can be used to describe one or more subjects. A principal can be the origin of an operation described using a given authentication method provided by the secure channel architecture. The value type of the source body field can be a list type. The source subject field may include identification (eg, ID) of one or more subjects. The subject can be one of the following three situations.

Case 1: An initiator node that interacts through a configuration channel (PASE) session during the debugging phase. The node can be implicitly identified by the fact that both peers in the PASE session authenticate to each other locally.

Case 2: Initiator node that interacts through the operation channel (CASE) session during the operation phase. The node can be identified using a distinguished name (such as a node ID) in the operational certificate (NOC) shared during session establishment.

Case 3: Initiator nodes interacting through message groups. The node can be identified by the group ID. The node can be authenticated by the operation group key.

The Authentication Type (AuthMode) field can be used to describe the type of secure channel authentication method applied to the subject of this ACE entry (or the authentication type or connection type known as the secure channel). The value type of the authentication type field can be an enumeration type. The value of the authentication type field can include CASE, PASE or group as mentioned above.

The Extension field can be an optional extension payload. Extension fields can be used for things like cryptographic signatures, vendor-specific ACL content, or other metadata.

As an implementation method, the fields included in ACE can be as shown in Table 1.

Table 1

It can be seen that the first terminal can implement access control based on information such as the ID of the second terminal, the authentication type of the secure channel between the first terminal and the second terminal, and the target resource. It is understandable that related technologies are difficult to implement access control based on location information.

Figure 2 shows an access control method provided by an embodiment of the present application to solve the above problems. The method shown in Figure 2 can be executed by the first terminal and the second terminal. This application does not limit the types of the first terminal and the second terminal. For example, they may be any terminal mentioned above. For example, the first terminal may be a car, and the second terminal may be a mobile phone used by the user.

The method shown in Figure 2 may include step S210 and step S220.

Step S210: The first terminal determines the authority of the second terminal to the first terminal based on the first location information and access control information of the second terminal.

The first location information may be used to indicate the location relationship of the second terminal relative to the first terminal. It can be understood that the first position information may be relative position information. For example, the first location information may be determined based on the location of the first terminal, the location of the second terminal, the distance and/or angle between the first terminal and the second terminal.

Taking the first terminal as a car as an example, the first location information can be used to indicate the location relationship of the second terminal relative to the car. For example, the first location information may include one or more of the following information: inside the car, outside the car, main driver's seat, passenger seat, passenger seat, car left front door, car right front door, car left rear door, car right rear door , the rear of the car. The car may not include a driver's seat (main driver's seat and/or co-pilot's seat).

It can be understood that the representation of the first position information may be related to the accuracy of the positioning mechanism. If a lower-precision positioning mechanism is used, the first location information may include inside the car and/or outside the car, etc. If a higher-precision positioning mechanism is adopted, the representation of the first position information can be refined. For example, the first location information may be one or more of the following: car left front door, car right front door, car left rear door, car right rear door, car rear, passenger seat, back seat, etc.

This application does not limit the positioning mechanism for obtaining the first location information. As an implementation method, the first location information can be obtained based on short-range positioning. For example, the first location information can be obtained through one or more of the following positioning methods: UWB positioning, Bluetooth positioning, and 5G positioning. As a real-time method, the first terminal and the second terminal can negotiate a UWB positioning channel and perform UWB positioning. As another implementation manner, the first terminal and the second terminal may negotiate on the BLE channel to start UWB ranging.

This application does not limit the device that obtains the first location information. For example, the first location information can be obtained through the first terminal or through the second terminal. After obtaining the first location information, the second terminal may send the first location information to the first terminal.

The authority of the second terminal to the first terminal may include authority to the target resource of the first terminal. Target resources can be represented by functional units. For example, the target resource can be one or more functional units.

The target resources may include resources belonging to the first terminal. Alternatively, the target resources may include resources associated with the first terminal. Taking the first terminal as a car as an example, the target resources may include resources of the car. Taking the first terminal as a vehicle-mounted terminal as an example, the target resource may be a resource of a car associated with the vehicle-mounted terminal. The resources of a car may include, for example, one or more of the resources of a car light (such as a turn signal, a headlight, etc.), a car door, a car window, a display screen, etc. This application does not limit the specific content of the permissions of the second terminal to the first terminal. For example, permissions may include one or more of the following: no permissions, view permissions, proxy view permissions, operate permissions, manage permissions, and administrator Permissions etc. When the second terminal has no authority over the first terminal, the first terminal may deny access to the second terminal. When the second terminal's access to the first terminal matches the authority, the first terminal can perform an action corresponding to the second terminal's access.

The access control information can be used to control the access of the first terminal to the second terminal, that is, the access control information can be used to indicate the authority of the second terminal to the first terminal. The access control information may be related to the positional relationship of the second terminal relative to the first terminal. In one implementation, the access control information can be used to record the permissions of the second terminal on the first terminal when the second terminal is in different locations. For example, the second terminal may have the operate authority for the first terminal when it is in the first location, but the second terminal may not have any authority for the first terminal when it is in the second location. In this case, when the second terminal moves to the first position, the first terminal may allow the second terminal to access the first terminal and allow the second terminal to perform operations related to the operate authority. Alternatively, when the second terminal moves to the second location, the first terminal may deny the second terminal access to the first terminal.

It can be understood that the access control information may also record the permissions of other terminals on the first terminal. The other terminal may be a different terminal than the second terminal. Alternatively, the other terminal may be a terminal whose logged-in user is different from the logged-in user of the second terminal.

The content of access control information can be flexibly modified according to needs. For example, after obtaining the permission to modify the access control information, the user can modify the access control information through one or more of the first terminal, the second terminal, and other terminals. As an implementation method, an operation interface can be provided for users to modify access control information.

It is understandable that by modifying the access control information, user-customized access control can be achieved, thereby improving the user experience.

This application does not limit the storage method of access control information. For example, the access control information can be recorded in the first terminal or in a remote server (such as a cloud platform). When the first terminal needs to control the access of the second terminal based on the access control information, the access control information can be obtained from the corresponding storage location.

Access control information may be included in the first entry for access control. As an implementation, the first entry could be an ACE. One or more ACEs can form an ACL. That is to say, access control information can be recorded in the ACL, and the ACL can include one or more ACEs.

The first entry may include one or more pieces of information related to permissions, identities, functional units, etc. Various information can be carried in fields in the first entry. That is, the first entry may include one or more fields.

As an implementation manner, the first entry may include a first field. The first field may be used to specifically carry location information corresponding to the access control item. The first field may be called a position field, for example.

It can be understood that when the first location information of the second terminal matches the content recorded in the first field, the permission corresponding to the first entry is valid. When the first field is empty or has a wildcard character (such as *), it may indicate that the permission corresponding to the first entry is valid when the second terminal is in any position. That is to say, when the first field is empty, the permission corresponding to the first entry may be independent of location. For example, if the value of the first field of the first entry is inside the car, when the second terminal is inside the car, the permission corresponding to the first entry is valid. Correspondingly, when the second terminal is outside the car, the permission corresponding to the first entry is invalid.

The type of the first field may be an enumeration type, for example. Taking the first terminal as a car as an example, the first field may include one or more of the following information: inside the car, outside the car, and driving position. Wherein, the inside of the car may be a position where the second terminal is in the car and the second terminal is not in the driving position. Outside the car may mean that the second terminal is outside the car and within a certain distance near the car. Alternatively, the first field can be refined into one or more of the following information: car left front door, car right front door, car left rear door, car right rear door, car rear, passenger seat, back seat, etc.

As another implementation, the first entry may include a second field. The second field may be used to carry the connection type of the secure channel established between the first terminal and the second terminal, and one or more of the connection types of the secure channel are consistent with the access control item. The corresponding location information is associated. In one embodiment, the second field may be an extension of the authentication type (AuthMode) field. The extended authentication type field may be represented as a connection type field (ConnMode), for example. The second field can be of enumeration type. Taking the first terminal as a car as an example, the enumeration value may include one or more of the following: configuration channel, external vehicle operation channel, in-vehicle operation channel, driver's seat operation channel, and cloud connection channel. The configuration channel may indicate that the first terminal and the second terminal establish a connection for configuring the first terminal. The outside-vehicle operation channel may represent the operation connection established between the second terminal and the car outside the car. The in-vehicle operation channel may represent an operation connection established between the second terminal and the car in the car (for example, in a non-driving position). The driving position operation channel may represent the operation connection established between the second terminal and the car at the driving position. The cloud connection channel can represent the remote connection established by the second terminal with the car through the cloud platform.

It can be understood that the value of the first location information may correspond to the content recorded in the first field or the second field. For example, the value of the first field is one or more of inside the car, outside the car, and driving position. The value of the first location information may also be one or more of inside the car, outside the car, and the driving position. Or, when the value of the second field is one or more of the configuration channel, external vehicle operation channel, in-vehicle operation channel, driver's seat operation channel, and cloud connection channel, the value of the first location information is also One or more of the configuration channel, external vehicle operation channel, in-car operation channel, driver's seat operation channel, and cloud connection channel. Therefore, the corresponding first entry can be matched according to the first location information, thereby performing access control on the second terminal according to the authority recorded in the first entry.

Optionally, an authenticated secure connection may be established between the first terminal and/or the second terminal. For example, the first terminal may establish an authenticated secure connection with the second terminal. Alternatively, the first terminal and the second terminal may establish a two-way authentication secure connection.

The method shown in Figure 2 may also include step S205. Step S205: The second terminal may send a control instruction to the first terminal. Among them, the control instruction can correspond to the target resource. When the second terminal wishes to access the target resource of the first terminal at a certain location, it can send a control instruction to the first terminal to apply for access to the target resource. The second terminal can send control instructions multiple times. For example, the second terminal can send control instructions multiple times at multiple different locations.

It is understood that control instructions can be transmitted through the established secure channel. Before transmitting the control instruction, the first terminal and/or the second terminal may establish an authenticated secure connection. For example, the first terminal and the second terminal can establish a bidirectional authentication secure connection.

The acquisition of the first location information may be triggered based on a message received by the first terminal. For example, after receiving the control instruction, the first terminal can trigger positioning to obtain the first location information of the second terminal. Alternatively, the acquisition of the first location information may also be triggered based on the establishment of a secure connection. That is to say, after establishing a secure connection, positioning can be triggered to obtain the first location information.

When establishing a secure connection triggers positioning, the first location information may be updated according to the positioning situation. That is to say, at least one positioning can be performed, and the first position information can be the position information obtained from the positioning whose measurement time is closest to the time when the first terminal receives the control instruction in at least one positioning. For example, the location of the second terminal can be measured in real time, and the real-time location of the second terminal can be continuously updated. After the first terminal receives the control instruction, the first location information is obtained according to the real-time location of the second terminal at the current time.

It is understood that for some positioning mechanisms, continuous positioning can be achieved, and therefore, continuous positioning can be achieved to continuously update the first location information. For other positioning mechanisms, continuous positioning cannot be achieved. Therefore, positioning can be triggered by a control command to obtain the first position information. An appropriate method can be selected to obtain the first location information according to the positioning mechanism that is achievable by the terminal's capabilities.

After obtaining the first location information, the first terminal can determine whether the access permission of the second terminal to the first terminal is established by searching for the access control information. For example, the first terminal may search for a matching first entry based on the first location of the second terminal. In one case, if the access permission of the second terminal to the first terminal is established, the first terminal can perform the corresponding action. Taking the first entry as an ACE as an example, if the first terminal finds the matching ACE and obtains the matching permission, the first terminal can perform the action corresponding to the permission. In another case, if the access permission of the second terminal to the first terminal is not established, the first terminal may deny the access of the second terminal. For example, if the first terminal does not find a matching ACE, the first terminal may deny the access of the second terminal.

After obtaining the first location information, the first terminal can determine the corresponding channel connection type information. The first terminal may determine the authority of the second terminal to the first terminal according to the corresponding channel connection type information and access control information. Taking the ACE including the second field as an example, the first terminal can compare the channel connection type information with the ACL to check whether there is an ACE matching the second field. If there is a matching ACE, the first terminal can perform the action corresponding to the ACE. If there is no matching ACE, the first terminal may deny access to the second terminal.

Optionally, the first terminal may return a response to the second terminal. This response can be used to inform the second terminal whether the access permission is established.

Step S220: Based on the authority of the second terminal to the first terminal, the second terminal accesses the first terminal. When the access authority of the second terminal to the first terminal is established, the second terminal can access the first terminal. When the access authority of the second terminal to the first terminal is not established, the second terminal cannot access the first terminal.

Optionally, the second terminal can access the resources of the first terminal through the client.

The permission status recorded in the access control information may be related to the location of the second terminal. According to the access control information, the second terminal may have corresponding permissions in different locations. The permissions corresponding to different locations can be different. Therefore, based on the access control information, the first terminal can execute different access control policies on the first terminal when the second terminal is in different locations, thereby satisfying the differentiated execution capabilities of the second terminal on the first terminal in different scenarios.

Taking the first terminal as a car and the second terminal as a mobile phone as an example, the implementation of the three embodiments provided in this application will be described in detail below.

Embodiment 1

In Embodiment 1, the first entry is ACE. Add the first field to ACE. The first field is represented as Position. The fields included in ACE can be shown in Table 2.

Table 2

The position field can be an enumeration type. Enumeration values may include: OutsideCar, InsidCar, and DrivingSeat. Among them, the position in the car other than the driving position in the car can be indicated.

One possible ACL configuration measurement for a car could be:

ACE2 contains Position=InsideCar, which means that the corresponding permissions of ACE2 are valid when it is detected that the mobile phone is inside the car. ACE3 contains Position=DrivingSeat, which means that the permission corresponding to ACE is valid when the mobile phone is detected to be in the driving seat. The Position field included in ACE4 is empty, which means that the permissions corresponding to ACE4 are valid when the terminal is in any position.

Among them, the target resource DeviceType=0x0000_0023 indicates that the device type is all functional units included in the endpoint of the player (video player). The functional unit included in the player may include, for example, a switch of the display screen. The target resource Endpoint=3 and Cluster=0x0000_0006 can represent the switch (on/off) functional unit on endpoint 3. Endpoint No. 3 may be a turn signal, for example.

Figure 3 is a schematic flow chart of the access control method provided in Embodiment 1. The method shown in Figure 3 may include steps S310 to S390.

Step S310 may include step S311 and/or step S312. Step S311: The car and the mobile phone establish an authenticated secure connection. Step S312: The mobile phone and the car establish an authenticated secure connection. It can be understood that when step S310 includes step S311 and step S312, a two-way authentication secure connection can be established between the mobile phone and the car.

Step S320: The mobile phone sends control instructions to the vehicle through the established safe channel. For example, the control instructions may include instructions to call (turn on or off, etc.) a display screen in the vehicle. Alternatively, the control instruction may be an instruction to turn on the turn signal.

Step S330: After receiving the control command, the car triggers UWB positioning.

Step S340 may include step S341 and/or step S342. Step S341: The car and the mobile phone negotiate the UWB positioning channel. Step S342: The mobile phone and the car negotiate the UWB positioning channel. It can be understood that, in the case where step S340 includes step S341 and step S342, the UWB positioning channel can be negotiated interactively between the mobile phone and the car.

Step S351: The car performs UWB positioning on the mobile phone.

Step S352: The car obtains the first location information of the mobile phone. The first location information may be, for example, inside the car, outside the car, driving position, etc.

Step S360: The car searches for a matching ACE based on the first location information of the mobile phone. Take the car configured with the ACL information mentioned above as an example for explanation. Taking the control instruction as an instruction to call the display screen as an example, if the display screen belongs to the functional unit of the player (DeviceType is 0x0000_0023), and the first location information is in the car, searching for the ACE provided in Embodiment 1 can be obtained, ACE2 The value of the location field is inside the car, so the matching ACE is ACE2. According to ACE2, the matching permissions that can be obtained are operation permissions. Taking the control instruction to turn on the turn signal as an example, when the first location information is inside the car (not the driving position), the ACL provided in Embodiment 1 is searched, but no matching ACE is found.

Step S370: The car determines whether the access permission is established. Whether the access permission is established can be determined based on whether a matching ACE is found. When the matching ACE is found and the matching permission is obtained, it can be judged that the access permission is established. Taking the above-mentioned control instruction including calling the in-car display screen as an example, it can be determined that the access permission of the control instruction is established. If no matching ACE is found, it can be determined that the access permission is not established. Taking the above-mentioned control instruction including calling the turn signal as an example, it can be judged that the access permission is not established. If the access rights are not established, the car can reject the control command.

Step S380: When the access rights are established, the car can execute the control instructions. Continuing to take the control instruction including calling the display screen in the car as an example, as mentioned above, if the access permission is established, the car can perform the operation on the display screen indicated by the control instruction.

Step S390, the car returns a response. In the case where the car executes the command, the car can return a response. Alternatively, the car can return a response in the event the car rejects the command.

Embodiment 2

In the second embodiment, the first entry may be ACE. The car can be configured with the ACL illustrated in Embodiment 1.

Figure 4 is a schematic flow chart of the access control method provided in Embodiment 2. The method shown in Figure 4 may include steps S410 to S490.

Step S410 may include step S411 and/or step S412. Step S411: The car and the mobile phone establish an authenticated secure connection. Step S412: The mobile phone and the car establish an authenticated secure connection. It can be understood that in the case where step S410 includes step S411 and step S412, a two-way authentication secure connection can be established between the mobile phone and the car.

Step S420: The car triggers UWB positioning.

Step S430 may include step S431 and/or step S432. Step S431: The car and the mobile phone negotiate the UWB positioning channel. Step S432: The mobile phone and the car negotiate the UWB positioning channel. It can be understood that, in the case where step S430 includes step S431 and step S432, the UWB positioning channel can be negotiated interactively between the mobile phone and the car.

Step S441: The car performs UWB positioning on the mobile phone.

Step S442: The car continues to obtain the positioning information of the mobile phone and updates the real-time location information of the mobile phone. That is to say, the car can obtain the location information of the mobile phone multiple times and update the recently obtained location information to the real-time location of the mobile phone.

Step S450: The mobile phone sends control instructions to the car through the established safe channel. For example, the control instruction may be an instruction to turn on the turn signal. It can be understood that the mobile phone can perform step S450 multiple times, thereby sending control instructions at different locations.

Step S443: After receiving the control command, the car obtains the location information of the mobile phone at the current time and obtains the first location information of the mobile phone.

Step S460: The car searches for a matching ACE based on the first location information of the mobile phone.

Taking the control command to turn on the turn signal as an example, the user can bring the mobile phone into the passenger seat, and the first location information is inside the car (not the driver's seat). The car searched for the ACL provided in Embodiment 1 and found no matching ACE. Users can move around with their mobile phones. In the case where the user enters the car and sits in the driving seat, the first location information may be the driving seat. The mobile phone can again send control instructions to the car to turn on the turn signal. The car searches for the ACL and can match ACE3, and the matching permission is the operate permission.

Step S470: The car determines whether the access permission is established. When the matching ACE is found and the matching permission is obtained, it can be judged that the access permission is established. When no matching ACE is found, it can be determined that the access permission is not established. Taking the control instruction including calling the turn signal in step S460 as an example, when the user is in the passenger seat, it can be determined that the access permission is not established, and when the user is in the driving seat, it can be determined that the access permission is established.

Step S480: When the access authority is established, execute the control instruction. Continuing to take the control instruction including calling the turn signal as an example, as mentioned above, when the user is in the driving position and the access permission is established, the car can perform the turn signal operation indicated by the control instruction.

Step S490, the car returns a response. In the case where the car executes the command, the car can return a response. Alternatively, the car can return a response in the event the car rejects the command.

Embodiment 3

In the third embodiment, the first entry is ACE. The AuthMode field of ACE is extended to the connection type (ConnMode) field. The connection type field can be associated with the location information of the mobile phone. The fields included in ACE can be shown in Table 3.

table 3

Among them, the connection type field can be an enumeration type. The enumeration value can include: configuration channel (PASE), outside car operation channel (CASE_OutsideCar), in-car operation channel (CASE_InsideCar), driving seat operation channel (CASE_DrivingSeat), and cloud connection channel. Among them, the operation channel outside the vehicle means that the client is outside the vehicle and within a certain distance near the vehicle. If a higher-precision positioning mechanism is used, it can be further refined into different positions such as the left front door, the right front door, the left rear door, the right rear door, and the rear of the car. The above enumeration values have been introduced in detail in the previous article and will not be repeated here.

One possible ACL configuration measurement for a car could be:

Among them, ACE1 contains ConnMode=PASE, which means that the mobile phone and the car establish a configuration channel. At this time, the mobile phone can have administrator rights for all resources. ACE2 contains ConnMode=CASE_InsideCar, which means that this permission is valid when the mobile phone is in the non-driving position of the car and an operating connection is established. ACE3 contains ConnMode=CASE_DrivingSeat, which means that this permission is valid when the mobile phone is in the driving position and an operating connection is established.

Figure 5 is a schematic flow chart of the access control method provided in Embodiment 3. The method shown in Figure 5 may include steps S510 to S592.

Step S510 may include step S511 and/or step S512. Step S511: The car and the mobile phone establish an authenticated secure connection. Step S512: The mobile phone and the car establish an authenticated secure connection. It can be understood that in the case where step S510 includes step S511 and step S512, a two-way authentication secure connection can be established between the mobile phone and the car.

Step S520: The car determines whether the connection type is an operational connection. Optionally, when the connection type is an operational connection, steps after step S520 may be performed.

Step S530: The car triggers UWB positioning.

Step S540 may include step S541 and/or step S542. Step S541: The car and the mobile phone negotiate the UWB positioning channel. Step S542: The mobile phone and the car negotiate the UWB positioning channel. It can be understood that, in the case where step S540 includes step S541 and step S542, the UWB positioning channel can be negotiated interactively between the mobile phone and the car.

Step S551: The car performs UWB positioning on the mobile phone.

Step S552: The car continues to obtain the positioning information of the mobile phone and updates the channel connection type information based on the positioning information. For example, when the mobile phone is outside the car, the channel type is CASE_OutsideCar. When the user brings the mobile phone into the back seat of the car, the channel type is updated to CASE_InsideCar.

Step S560: The mobile phone sends control instructions to the car through the established safe channel. For example, the control instruction may be an instruction to call the display screen.

Step S570: The car searches for a matching ACE based on the first location information of the mobile phone. When the channel connection type information of the mobile phone is CASE_InsideCar and the control instruction is to call the display screen, the car searches for the matching ACE according to the ACL in Embodiment 3, and finds that the matching ACE is ACE2 and the matching permission is operate.

Step S580: The car determines whether the access permission is established. When the matching ACE is found and the matching permission is obtained, it can be judged that the access permission is established. When no matching ACE is found, it can be determined that the access permission is not established. Taking the control instruction including calling the display screen in step S570 as an example, if the permission matched to ACE2 and equipped is the operation permission, it can be determined that the access permission is established.

Step S590: When the access rights are established, the car can execute the control instructions. If the access rights are not established, the car can reject the control command.

Step S592, the car returns a response. In the case where the car executes the command, the car can return a response. Alternatively, the car can return a response in the event the car rejects the command.

The method embodiments of the present application are described in detail above with reference to FIGS. 2 to 5 , and the device embodiments of the present application are described in detail below with reference to FIGS. 6 to 8 . It should be understood that the description of the method embodiments corresponds to the description of the device embodiments. Therefore, the parts not described in detail can be referred to the previous method embodiments.

FIG. 6 is a schematic structural diagram of a terminal 600 provided by an embodiment of the present application. Terminal 600 may be a first terminal. The terminal 600 may include a determining unit 610.

The determining unit 610 may be used to determine the authority of the second terminal to the first terminal according to the first location information and access control information of the second terminal; wherein the first location information is used to indicate that the second terminal The positional relationship of the terminal relative to the first terminal.

Optionally, the access control information is used to indicate the permissions of the second terminal on the first terminal when the second terminal is in different locations.

Optionally, the first location information includes one or more of the following information: inside the car, outside the car, main driver's seat, passenger seat, passenger seat, car left front door, car right front door, car left rear door, The right rear door and rear of the car.

Optionally, the first location information is obtained by positioning the second terminal, and the positioning is triggered by a control instruction sent by the second terminal to the first terminal.

Optionally, the first location information is obtained by positioning the second terminal, and the positioning is triggered by the establishment of a secure channel between the first terminal and the second terminal.

Optionally, the first location information is real-time location information of the second terminal, and the acquisition of the real-time location information is triggered by a control instruction sent by the second terminal to the first terminal.

Optionally, the access control information is recorded in an access control list, and the access control list includes one or more access control items.

Optionally, the access control item includes a first field, and the first field is used to specifically carry location information corresponding to the access control item.

Optionally, the first field includes one or more of the following information: inside the car, outside the car, and driving position.

Optionally, the access control item includes a second field, the second field is used to carry the connection type of the secure channel established between the first terminal and the second terminal, and the connection of the secure channel One or more connection types in the type are associated with location information corresponding to the access control item.

Optionally, the determining unit is specifically configured to: determine channel connection type information based on the first location information; determine whether the second terminal has access to the third channel connection type information based on the channel connection type information and the access control information. Permissions for a terminal.

Optionally, the second field includes one or more of the following information: configuration channel, off-vehicle operation channel, in-vehicle operation channel, driving position operation channel, and cloud connection channel.

Optionally, the first terminal is a car.

Optionally, the first location information is obtained through one or more of the following positioning methods: ultra-wideband UWB positioning, Bluetooth positioning, and 5G positioning.

Figure 7 is a schematic structural diagram of another terminal 700 provided by an embodiment of the present application. Terminal 700 may be a second terminal. The terminal 700 may include an access unit 710.

The access unit 710 may be used to access the first terminal based on the authority of the second terminal to the first terminal; wherein the authority is determined based on the first location information and access control information of the second terminal, and the The first location information is used to indicate the location relationship of the second terminal relative to the first terminal.

Optionally, the access control information is used to record the permissions of the second terminal on the first terminal when the second terminal is in different locations.

Optionally, the permission is determined based on the first location information and access control information of the second terminal, including: the permission is determined based on channel connection type information and the access control information, and the channel connection type information is based on the access control information. The first location information is determined.

Optionally, the first terminal is a car.

Figure 8 is a schematic structural diagram of a communication device according to an embodiment of the present application. The dashed line in Figure 8 indicates that the unit or module is optional. The device 800 can be used to implement the method described in the above method embodiment. Device 800 may be a chip or a terminal.

Apparatus 800 may include one or more processors 810. The processor 810 can support the device 800 to implement the method described in the foregoing method embodiments. The processor 810 may be a general-purpose processor or a special-purpose processor. For example, the processor may be a central processing unit (CPU). Alternatively, the processor can also be another general-purpose processor, a digital signal processor (DSP), an application specific integrated circuit (ASIC), or an off-the-shelf programmable gate array (FPGA) Or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or the processor may be any conventional processor, etc.

It should be noted that the determining unit 610 shown in FIG. 6 can be executed by the processor 810 shown in FIG. 8 . The access unit 710 shown in FIG. 7 may be executed by the processor 810 shown in FIG. 8 .

Apparatus 800 may also include one or more memories 820. The memory 820 stores a program, which can be executed by the processor 810, so that the processor 810 executes the method described in the foregoing method embodiment. The memory 820 may be independent of the processor 810 or integrated in the processor 810 .

Apparatus 800 may also include a transceiver 830. Processor 810 may communicate with other devices or chips through transceiver 830. For example, the processor 810 can transmit and receive data with other devices or chips through the transceiver 830 .

An embodiment of the present application also provides a computer-readable storage medium for storing a program. The computer-readable storage medium can be applied in the terminal or network device provided by the embodiments of the present application, and the program causes the computer to execute the methods performed by the terminal or network device in various embodiments of the present application.

An embodiment of the present application also provides a computer program product. The computer program product includes a program. The computer program product can be applied in the terminal or network device provided by the embodiments of the present application, and the program causes the computer to execute the methods performed by the terminal or network device in various embodiments of the present application.

An embodiment of the present application also provides a computer program. The computer program can be applied to the terminal or network device provided by the embodiments of the present application, and the computer program causes the computer to execute the methods performed by the terminal or network device in various embodiments of the present application.

It should be understood that the terms "system" and "network" may be used interchangeably in this application. In addition, the terms used in this application are only used to explain specific embodiments of the application and are not intended to limit the application. The terms “first”, “second”, “third” and “fourth” in the description, claims and drawings of this application are used to distinguish different objects, rather than to describe a specific sequence. . Furthermore, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusion.

In the embodiments of this application, the "instruction" mentioned may be a direct instruction, an indirect instruction, or an association relationship. For example, A indicates B, which can mean that A directly indicates B, for example, B can be obtained through A; it can also mean that A indirectly indicates B, for example, A indicates C, and B can be obtained through C; it can also mean that there is an association between A and B. relation.

In the embodiment of this application, "B corresponding to A" means that B is associated with A, and B can be determined based on A. However, it should also be understood that determining B based on A does not mean determining B only based on A. B can also be determined based on A and/or other information.

In the embodiments of this application, the term "correspondence" can mean that there is a direct correspondence or indirect correspondence between the two, or it can also mean that there is an association between the two, or it can also mean indicating and being instructed, configuring and being configured, etc. relation.

In the embodiment of this application, "predefinition" or "preconfiguration" can be achieved by pre-saving corresponding codes, tables or other methods that can be used to indicate relevant information in devices (for example, including terminal devices and network devices). The application does not limit its specific implementation method. For example, predefined can refer to what is defined in the protocol.

In the embodiment of this application, the "protocol" may refer to a standard protocol in the communication field, which may include, for example, LTE protocol, NR protocol, and related protocols applied in future communication systems. This application does not limit this.

The term "and/or" in the embodiment of this application is only an association relationship describing associated objects, indicating that there can be three relationships, for example, A and/or B, which can mean: A exists alone, and A and B exist simultaneously. , there are three situations of B alone. In addition, the character "/" in this article generally indicates that the related objects are an "or" relationship.

In the various embodiments of the present application, the size of the sequence numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its functions and internal logic, and should not be determined by the implementation process of the embodiments of the present application. constitute any limitation.

In the several embodiments provided in this application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only illustrative. For example, the division of the units is only a logical function division. In actual implementation, there may be other division methods. For example, multiple units or components may be combined or can be integrated into another system, or some features can be ignored, or not implemented. On the other hand, the coupling or direct coupling or communication connection between each other shown or discussed may be through some interfaces, and the indirect coupling or communication connection of the devices or units may be in electrical, mechanical or other forms.

The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place, or they may be distributed to multiple network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.

In addition, each functional unit in each embodiment of the present application can be integrated into one processing unit, each unit can exist physically alone, or two or more units can be integrated into one unit.

In the above embodiments, it may be implemented in whole or in part by software, hardware, firmware, or any combination thereof. When implemented using software, it may be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the processes or functions described in the embodiments of the present application are generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in or transmitted from one computer-readable storage medium to another, e.g., the computer instructions may be transferred from a website, computer, server, or data center Transmission to another website, computer, server or data center through wired (such as coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (such as infrared, wireless, microwave, etc.) means. The computer-readable storage medium may be any available medium that can be read by a computer or a data storage device such as a server or data center integrated with one or more available media. The available media may be magnetic media (e.g., floppy disks, hard disks, magnetic tapes), optical media (e.g., digital video discs (DVD)) or semiconductor media (e.g., solid state disks (SSD) )wait.

The above are only specific embodiments of the present application, but the protection scope of the present application is not limited thereto. Any person familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application. should be covered by the protection scope of this application. Therefore, the protection scope of this application should be subject to the protection scope of the claims.

Claims

An access control method, characterized by including:

The first terminal determines the authority of the second terminal to the first terminal according to the first location information and access control information of the second terminal;

Wherein, the first location information is used to indicate the location relationship of the second terminal relative to the first terminal.
The method according to claim 1, characterized in that the access control information is used to indicate the permissions of the second terminal on the first terminal when the second terminal is in different locations.
The method according to claim 1 or 2, characterized in that the first location information includes one or more of the following information: inside the car, outside the car, main driver’s seat, passenger seat, passenger seat, vehicle Left front door, car right front door, car left rear door, car right rear door, car rear.
The method according to any one of claims 1-3, characterized in that,

The first location information is obtained by positioning the second terminal, and the positioning is triggered by a control instruction sent by the second terminal to the first terminal.
The method according to any one of claims 1 to 3, characterized in that the first location information is obtained by positioning the second terminal, and the positioning is performed by the first terminal and the Triggered by the establishment of a secure channel between the second terminal.
The method of claim 5, wherein the first location information is real-time location information of the second terminal, and the real-time location information is obtained by sending the second terminal to the first terminal. The control command is triggered.
The method according to any one of claims 1 to 6, characterized in that the access control information is recorded in an access control list, and the access control list contains one or more access control items.
The method according to claim 7, wherein the access control item includes a first field, and the first field is used to specifically carry location information corresponding to the access control item.
The method of claim 8, wherein the first field includes one or more of the following information: inside the car, outside the car, and driving position.
The method according to claim 7, characterized in that the access control item includes a second field, the second field is used to carry the connection of the secure channel established between the first terminal and the second terminal. type, and one or more connection types among the connection types of the secure channel are associated with the location information corresponding to the access control item.
The method of claim 10, wherein the first terminal determines the permissions of the second terminal on the first terminal based on the first location information and access control information of the second terminal, including:

The first terminal determines channel connection type information based on the first location information;

The first terminal determines the authority of the second terminal to the first terminal based on the channel connection type information and the access control information.
The method according to claim 10 or 11, characterized in that the second field includes one or more of the following information: configuration channel, off-vehicle operation channel, in-vehicle operation channel, driving position operation channel, cloud Connection channel.
The method according to any one of claims 1-12, characterized in that the first terminal is a car.
The method according to any one of claims 1 to 13, characterized in that the first location information is obtained through one or more of the following positioning methods: ultra-wideband UWB positioning, Bluetooth positioning, and 5G positioning.
An access control method, characterized by including:

Based on the authority of the second terminal to the first terminal, the second terminal accesses the first terminal;

Wherein, the permission is determined based on the first location information and access control information of the second terminal, and the first location information is used to indicate the location relationship of the second terminal relative to the first terminal.
The method according to claim 15, characterized in that the access control information is used to record the permissions of the second terminal on the first terminal when the second terminal is in different locations.
The method according to claim 15 or 16, characterized in that the first location information includes one or more of the following information: inside the car, outside the car, main driver’s seat, passenger seat, passenger seat, vehicle Left front door, car right front door, car left rear door, car right rear door, car rear.
The method according to any one of claims 15-17, characterized in that,

The first location information is obtained by positioning the second terminal, and the positioning is triggered by a control instruction sent by the second terminal to the first terminal.
The method according to any one of claims 15-17, characterized in that the first location information is obtained by positioning the second terminal, and the positioning is performed by the first terminal and the Triggered by the establishment of a secure channel between the second terminal.
The method of claim 19, wherein the first location information is real-time location information of the second terminal, and the real-time location information is obtained by sending the second terminal to the first terminal. The control command is triggered.
The method according to any one of claims 15 to 20, characterized in that the access control information is recorded in an access control list, and the access control list contains one or more access control items.
The method according to claim 21, characterized in that the access control item includes a first field, and the first field is used to specifically carry the location information corresponding to the access control item.
The method of claim 22, wherein the first field includes one or more of the following information: inside the car, outside the car, and driving position.
The method according to claim 21, characterized in that the access control item includes a second field, the second field is used to carry the connection of the secure channel established between the first terminal and the second terminal. type, and one or more connection types among the connection types of the secure channel are associated with the location information corresponding to the access control item.
The method of claim 24, wherein the permission is determined based on the first location information of the second terminal and access control information, including: the permission is determined based on channel connection type information and the access control information. , the channel connection type information is determined based on the first location information.
The method according to claim 24 or 25, characterized in that the second field includes one or more of the following information: configuration channel, off-vehicle operation channel, in-vehicle operation channel, driving position operation channel, cloud Connection channel.
The method according to any one of claims 15-26, characterized in that the first terminal is a car.
The method according to any one of claims 15-27, characterized in that the first location information is obtained through one or more of the following positioning methods: ultra-wideband UWB positioning, Bluetooth positioning, and 5G positioning.
An access control terminal, characterized in that the terminal is a first terminal, and the terminal includes:

a determining unit configured to determine the authority of the second terminal to the first terminal according to the first location information and access control information of the second terminal;

Wherein, the first location information is used to indicate the location relationship of the second terminal relative to the first terminal.
The terminal according to claim 29, wherein the access control information is used to indicate the permissions of the second terminal on the first terminal when the second terminal is in different locations.
The terminal according to claim 29 or 30, characterized in that the first location information includes one or more of the following information: inside the car, outside the car, main driver’s seat, passenger seat, passenger seat, car Left front door, car right front door, car left rear door, car right rear door, car rear.
The terminal according to any one of claims 29-31, characterized in that,

The first location information is obtained by positioning the second terminal, and the positioning is triggered by a control instruction sent by the second terminal to the first terminal.
The terminal according to any one of claims 29 to 31, characterized in that the first location information is obtained by positioning the second terminal, and the positioning is performed by the first terminal and the Triggered by the establishment of a secure channel between the second terminal.
The terminal according to claim 33, wherein the first location information is real-time location information of the second terminal, and the real-time location information is obtained by sending the second terminal to the first terminal. The control command is triggered.
The terminal according to any one of claims 29 to 34, wherein the access control information is recorded in an access control list, and the access control list contains one or more access control items.
The terminal according to claim 35, wherein the access control item includes a first field, and the first field is used to specifically carry location information corresponding to the access control item.
The terminal according to claim 36, characterized in that the first field includes one or more of the following information: inside the car, outside the car, and driving position.
The terminal according to claim 35, characterized in that the access control item includes a second field, the second field is used to carry the connection of the secure channel established between the first terminal and the second terminal. type, and one or more connection types among the connection types of the secure channel are associated with the location information corresponding to the access control item.
The terminal according to claim 38, characterized in that the determining unit is specifically configured to:

Determine channel connection type information according to the first location information;

According to the channel connection type information and the access control information, the authority of the second terminal to the first terminal is determined.
The terminal according to claim 38 or 39, characterized in that the second field includes one or more of the following information: configuration channel, off-vehicle operation channel, in-vehicle operation channel, driving seat operation channel, cloud Connection channel.
The terminal according to any one of claims 29-40, characterized in that the first terminal is a car.
The terminal according to any one of claims 29 to 41, characterized in that the first location information is obtained through one or more of the following positioning methods: ultra-wideband UWB positioning, Bluetooth positioning, and 5G positioning.
A terminal, characterized in that the terminal is a second terminal, and the terminal includes:

An access unit, configured to access the first terminal based on the authority of the second terminal to the first terminal;

Wherein, the permission is determined based on the first location information and access control information of the second terminal, and the first location information is used to indicate the location relationship of the second terminal relative to the first terminal.
The terminal according to claim 43, characterized in that the access control information is used to record the permissions of the second terminal on the first terminal when the second terminal is in different locations.
The terminal according to claim 43 or 44, characterized in that the first location information includes one or more of the following information: inside the car, outside the car, main driver’s seat, passenger seat, passenger seat, car Left front door, car right front door, car left rear door, car right rear door, car rear.
The terminal according to any one of claims 43-45, characterized in that,

The first location information is obtained by positioning the second terminal, and the positioning is triggered by a control instruction sent by the second terminal to the first terminal.
The terminal according to any one of claims 43-45, characterized in that the first location information is obtained by positioning the second terminal, and the positioning is performed by the first terminal and the Triggered by the establishment of a secure channel between the second terminal.
The terminal according to claim 47, wherein the first location information is real-time location information of the second terminal, and the real-time location information is obtained by sending the second terminal to the first terminal. The control command is triggered.
The terminal according to any one of claims 43 to 48, characterized in that the access control information is recorded in an access control list, and the access control list contains one or more access control items.
The terminal according to claim 49, wherein the access control item includes a first field, and the first field is used to specifically carry location information corresponding to the access control item.
The terminal according to claim 50, characterized in that the first field includes one or more of the following information: inside the car, outside the car, and driving position.
The terminal according to claim 49, characterized in that the access control item includes a second field, the second field is used to carry the connection of the secure channel established between the first terminal and the second terminal. type, and one or more connection types among the connection types of the secure channel are associated with the location information corresponding to the access control item.
The terminal according to claim 52, wherein the permission is determined based on the first location information and access control information of the second terminal, including: the permission is determined based on channel connection type information and the access control information. , the channel connection type information is determined based on the first location information.
The terminal according to claim 52 or 53, characterized in that the second field includes one or more of the following information: configuration channel, off-vehicle operation channel, in-vehicle operation channel, driving seat operation channel, cloud Connection channel.
The terminal according to any one of claims 43-54, characterized in that the first terminal is a car.
The terminal according to any one of claims 43-55, characterized in that the first location information is obtained through one or more of the following positioning methods: ultra-wideband UWB positioning, Bluetooth positioning, and 5G positioning.
A terminal, characterized in that it includes a memory and a processor, the memory is used to store programs, and the processor is used to call the program in the memory to execute the method as described in any one of claims 1-28. method.
A device, characterized by comprising a processor for calling a program from a memory to execute the method according to any one of claims 1-28.
A chip, characterized in that it includes a processor for calling a program from a memory, so that a device equipped with the chip executes the method according to any one of claims 1-28.
A computer-readable storage medium, characterized in that a program is stored thereon, and the program causes the computer to execute the method according to any one of claims 1-28.
A computer program product, characterized by comprising a program that causes a computer to execute the method according to any one of claims 1-28.
A computer program, characterized in that the computer program causes the computer to perform the method according to any one of claims 1-28.