WO2024002160A1 - 数据处理方法、装置、电子设备及存储介质 - Google Patents

数据处理方法、装置、电子设备及存储介质 Download PDF

Info

Publication number
WO2024002160A1
WO2024002160A1 PCT/CN2023/103187 CN2023103187W WO2024002160A1 WO 2024002160 A1 WO2024002160 A1 WO 2024002160A1 CN 2023103187 W CN2023103187 W CN 2023103187W WO 2024002160 A1 WO2024002160 A1 WO 2024002160A1
Authority
WO
WIPO (PCT)
Prior art keywords
data
vehicle
analyzed
mounted terminal
key
Prior art date
Application number
PCT/CN2023/103187
Other languages
English (en)
French (fr)
Inventor
陈明
李木犀
陈后立
吴淼
边泽宇
高铭霞
胡闯
邵馨蕊
刘毅
Original Assignee
中国第一汽车股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中国第一汽车股份有限公司 filed Critical 中国第一汽车股份有限公司
Publication of WO2024002160A1 publication Critical patent/WO2024002160A1/zh

Links

Classifications

    • G—PHYSICS
    • G07—CHECKING-DEVICES
    • G07C—TIME OR ATTENDANCE REGISTERS; REGISTERING OR INDICATING THE WORKING OF MACHINES; GENERATING RANDOM NUMBERS; VOTING OR LOTTERY APPARATUS; ARRANGEMENTS, SYSTEMS OR APPARATUS FOR CHECKING NOT PROVIDED FOR ELSEWHERE
    • G07C5/00—Registering or indicating the working of vehicles
    • G07C5/08—Registering or indicating performance data other than driving, working, idle, or waiting time, with or without registering driving, working, idle or waiting time
    • G07C5/0808—Diagnosing performance data
    • G—PHYSICS
    • G07—CHECKING-DEVICES
    • G07C—TIME OR ATTENDANCE REGISTERS; REGISTERING OR INDICATING THE WORKING OF MACHINES; GENERATING RANDOM NUMBERS; VOTING OR LOTTERY APPARATUS; ARRANGEMENTS, SYSTEMS OR APPARATUS FOR CHECKING NOT PROVIDED FOR ELSEWHERE
    • G07C5/00—Registering or indicating the working of vehicles
    • G07C5/08—Registering or indicating performance data other than driving, working, idle, or waiting time, with or without registering driving, working, idle or waiting time
    • G07C5/0816—Indicating performance data, e.g. occurrence of a malfunction
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1416—Event detection, e.g. attack signature detection
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0838—Key agreement, i.e. key establishment technique in which a shared key is derived by parties as a function of information contributed by, or associated with, each of these
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords

Definitions

  • This application relates to the field of computer processing technology, for example, to a data processing method, device, electronic equipment and storage medium.
  • In-vehicle terminals such as in-vehicle entertainment systems and in-vehicle positioning systems have gradually become essential equipment in cars.
  • intelligent devices when intelligent devices are introduced, information security risks are also introduced.
  • Attackers can launch attacks on vehicle-mounted terminals through application vulnerabilities and system vulnerabilities in terminal devices, causing the terminals to be maliciously implanted with spam applications, or data to be stolen. Problems of getting and losing. This enables real-time detection of vehicles and timely discovery of abnormalities, which has become an effective measure for information protection.
  • the method for detecting abnormal data is usually for the vehicle terminal to report its own data to the data analysis system in real time.
  • an abnormality in the reported data such as the traffic used by the vehicle terminal exceeds the threshold, it is considered that an abnormal behavior has been detected, but in During the data transmission process, this method is prone to data tampering and theft, which affects the authenticity of the reported data and reduces the anomaly detection effect.
  • This application provides a data processing method, device, electronic equipment and storage medium to improve the timeliness and accuracy of anomaly detection while improving the security of data transmission.
  • a data processing method which method includes:
  • the indicator item data corresponds to the configuration change operation, application type, access traffic, message field rules and memory usage information inspection items
  • an alarm prompt message is generated.
  • a data processing device which device includes:
  • the data to be decrypted determination module is configured to determine the data to be decrypted carried in the data access request when receiving a data access request sent by the vehicle-mounted terminal in the target vehicle;
  • the data to be analyzed determination module is configured to decrypt the data to be decrypted based on a temporary session key to obtain the data to be analyzed; wherein the temporary session key is changed from a non-working state to a working state on the vehicle-mounted terminal. generated;
  • the inspection result determination module is configured to compare and process the same indicator item data in the data to be analyzed and the preset reference data to obtain the inspection result; wherein the indicator item data is related to the configuration change operation, application type, and access traffic. , the message field rules correspond to the memory usage information check items;
  • the prompt information generation module is configured to generate alarm prompt information in response to the inspection result being data anomaly.
  • an electronic device including:
  • the memory stores a computer program that can be executed by the at least one processor, and the computer program is executed by the at least one processor, so that the at least one processor can execute the method described in any embodiment of the present application. Data processing methods.
  • a computer-readable storage medium stores computer instructions, and the computer instructions are used to implement any of the embodiments of the present application when executed by a processor. data processing methods.
  • Figure 1 is a flow chart of a data processing method provided according to Embodiment 1 of the present application.
  • Figure 2 is a schematic diagram of a data processing method provided according to Embodiment 2 of the present application.
  • Figure 3 is a schematic diagram of abnormal event reporting according to Embodiment 2 of the present application.
  • Figure 4 is a schematic diagram of the key negotiation process provided according to Embodiment 2 of the present application.
  • Figure 5 is a schematic diagram of pulling new detection items provided according to Embodiment 2 of the present application.
  • Figure 6 is a schematic structural diagram of a data processing device provided according to Embodiment 3 of the present application.
  • FIG. 7 is a schematic structural diagram of an electronic device that implements the data processing method according to the embodiment of the present application.
  • Figure 1 is a flow chart of a data processing method provided according to Embodiment 1 of the present application. This embodiment can be applied to data transmission situations.
  • the method can be executed by a data processing device.
  • the data processing device can use hardware and/or Implemented in the form of software, the data processing device can be configured in a computing device. As shown in Figure 1, the method includes:
  • the vehicle terminal can be a telematics-BOX (T-BOX) or an in-vehicle entertainment system (In-Vehicle Infotainment, IVI).
  • T-BOX Telematics-BOX
  • IVI In-Vehicle Infotainment
  • the data to be decrypted can be understood as the data that needs to be decrypted.
  • the intermediate transmission data between the vehicle terminal and the system can be encrypted, and the system receives the encrypted data sent by the vehicle terminal.
  • the data is regarded as the data to be decrypted, and the data to be decrypted can be decrypted and read later.
  • the control associated with the event to be detected can be triggered in the vehicle terminal when it is detected.
  • the system has received the data access request sent by the vehicle-mounted terminal. For example, when a file is read in the vehicle-mounted terminal, the read information will be reported to the system; or when an unclear program is loaded in the vehicle-mounted terminal, the system will be loaded. Information reporting system, etc.
  • a data access request is received when detecting the data uploaded by the vehicle-mounted terminal (such as basic information of the terminal). The data access request can be parsed and processed to obtain the data carried in the data access request, that is, the data to be decrypted.
  • the data to be decrypted may be generated through key encryption jointly negotiated by the vehicle terminal and the system.
  • the component in the vehicle terminal can actively initiate the key negotiation process to the system.
  • the vehicle terminal can be re-requested for the key from the system each time the vehicle terminal is turned on. If the key negotiation process fails, the negotiation will not stop. The vehicle terminal will request the key from the system again when it generates a data access request next time to encrypt the data.
  • the method further includes: when detecting that the state of the vehicle-mounted terminal changes from a non-working state to a working state, receiving a key update request and determining the key update data carried in the key update request; based on the pre-set key update request.
  • the generated registration key decrypts the key update data to obtain the data to be used; determines a random generation number based on the data to be used; generates a temporary session key based on the randomly generated number, and sends the temporary session key to the vehicle terminal to
  • the vehicle-mounted terminal is configured to generate data to be encrypted when it detects that a control associated with an event to be detected is triggered, and encrypts the data to be encrypted based on the temporary session key to generate data to be decrypted.
  • the event to be detected corresponds to at least one item to be tested.
  • Items to be inspected can include files, applications, configuration change operations, access traffic, message fields, memory usage, etc.
  • the key update data can include the device identification and random number corresponding to the vehicle terminal.
  • the device identification is the product serial number (Serial Number, SN), and the random number can be a randomly generated 8-byte number.
  • the registration key can be a pre-generated key used for encryption and decryption.
  • the vehicle-mounted terminal Before the vehicle-mounted terminal generates data to be decrypted, it needs to initiate a key negotiation process to the system, that is, request a key from the system.
  • the transmission data When performing the key negotiation process, the transmission data also needs to be encrypted and transmitted, such as the vehicle-mounted terminal
  • the encrypted device identification and random number corresponding to the vehicle terminal can be sent to the system to improve the security of data transmission.
  • the key update request can be parsed to obtain the data carried in the key update request.
  • the key update data can be decrypted using the pre-generated registration key, and the decrypted data can be obtained as the data to be used, as well as the randomly generated number carried in the data to be used, and the algorithm can be used to randomly generate the data.
  • the generated number is processed to obtain the temporary session key required for this session.
  • the vehicle terminal can determine the intermediate transmission data, that is, the data to be encrypted.
  • the vehicle-mounted terminal can use the temporary session key to encrypt the data to be encrypted to generate data to be decrypted and transmit it to the system.
  • the system can use the temporary session key to decrypt and read the data to be decrypted.
  • the component can use the registration key (Registration Key, RK) to identify the device identification (such as SN) corresponding to the vehicle-mounted terminal and the randomly generated 8-digit number. Number of sections to encrypt.
  • the information digest algorithm (such as MD5) can be used to calculate the transmitted device identification and the randomly generated 8-byte number to obtain the corresponding information digest.
  • the encrypted data and corresponding information digest can be used as Key update data is sent to the system to begin negotiating session keys.
  • the system decrypts the key update data based on the device registration key (RK) queried by the device identification, and obtains the data to be used (including randomly generated numbers).
  • the randomly generated numbers can be used to generate temporary session keys.
  • the system can use the registration key to The temporary session key is encrypted and transmitted to the vehicle-mounted terminal, so that all subsequent session contents of the vehicle-mounted terminal are encrypted and transmitted through the temporary session key.
  • the unencrypted data can be calculated for information digest during the data transmission process, and the data integrity can be verified through the information digest.
  • determine the random generation number based on the data to be used including: converting the data to be used to obtain the message digest to be used; if the message digest to be applied associated with the key update data is consistent with the message digest to be used, Then determine the randomly generated number carried in the data to be used.
  • the system decrypts the key update data based on the device registration key queried by the device identification. After obtaining the data to be used, it can use the information digest algorithm (such as MD5) to calculate the data to be used and obtain the information summary. That is, the summary of the message to be used is compared with the summary of the information transmitted by the vehicle terminal. If they are consistent, the summary is considered legitimate and the data has not been tampered with. At this time, the randomly generated number carried in the data to be used can be determined. To generate a temporary session key based on a randomly generated number.
  • MD5 information digest algorithm
  • the automatic update function of events to be detected can also be implemented. For example, if you want to add new items to be detected, such as Trojan horse event detection, you can This new detection item is added to the events to be detected to monitor the vehicle terminal in real time based on the updated events to be detected and improve the safety of the entire vehicle.
  • the data processing method further includes: determining a new inspection item corresponding to the at least one to-be-inspected item; and updating an event to be detected based on the new inspection item.
  • a complete round of configuration pulling operations can be performed to the system, and no configuration pulling and updating operations will be performed in the subsequent session.
  • the component can be used to initiate a configuration pull request to the system, and the configuration pull request can be transmitted to the system server through the protocol channel between the vehicle-mounted terminal and the access gateway.
  • the system detects whether a new verification item needs to exist. If it exists, it forwards the new configuration verification item through the access gateway. into the component on the vehicle-mounted terminal, so that the vehicle-mounted terminal uses the component to update the event to be detected and obtain a new event to be detected.
  • vehicle-mounted terminal to generate data to be encrypted when it detects that a control associated with a new event to be detected is triggered, and encrypts the data to be encrypted based on the temporary session key to generate data to be decrypted and sends it to the system.
  • the registration key can be pre-generated based on the key generation algorithm, so that the intermediate transmission data in the process of generating the temporary session key can be encrypted and decrypted based on the registration key to prevent the key agreement event from being leaked and ensure the data Transmission security.
  • Generating the registration key may be achieved by: determining the vehicle identification corresponding to the target vehicle and the equipment identification corresponding to the vehicle-mounted terminal; and generating the registration key based on the vehicle identification and equipment identification.
  • the vehicle identification can be used to represent the uniqueness of the vehicle, for example, it can be a vehicle identification number (Vehicle Identification Number, VIN).
  • VIN Vehicle Identification Number
  • the device identification can be used to characterize the uniqueness of the vehicle-mounted terminal.
  • the vehicle-mounted terminal can use the component to obtain the vehicle identification corresponding to the target vehicle and the equipment identification corresponding to the vehicle-mounted terminal.
  • the vehicle identification and equipment identification parameters can be sent to the data transmission interface, and the vehicle-mounted terminal is encapsulated at the interface. Customize the protocol and other related data, transmit the data to the access gateway, and then send the data to the system for key registration.
  • the system receives the vehicle identification and equipment identification, it can save the vehicle identification and equipment identification, and calculate the registration key based on the equipment identification and save it.
  • the system can perform information digest calculation on the registration key to obtain the digest corresponding to the registration key, and send the registration key and the corresponding digest to the vehicle-mounted terminal, so that the vehicle-mounted terminal can determine the digest by calculating the digest of the registration key and the digest sent by the system. Whether the transmission data is complete, if the two digests are consistent, the registration key can be saved in the vehicle-mounted terminal, so that the intermediate transmission data of the key negotiation is encrypted and decrypted based on the registration key every time the vehicle-mounted terminal starts.
  • the temporary session key is generated when the vehicle-mounted terminal changes from a non-working state to a working state. It can be understood that the temporary session key generated each time the vehicle-mounted terminal changes from a non-working state to a working state may be different.
  • the data to be decrypted can be decrypted using the temporary session key to obtain the data to be analyzed.
  • information digest algorithms can be used to verify the integrity of the data to be analyzed.
  • the data processing method further includes: converting the data to be analyzed to obtain the target message summary; if the target message summary and the data to be analyzed are If the message digests to be compared associated with the data are inconsistent, an alarm message will be generated.
  • the message digest to be compared is generated by converting the data to be encrypted.
  • the information digest algorithm can also be used to convert the data to be encrypted, and the corresponding summary information, that is, the message digest to be compared, is sent to the system together.
  • the system receives the data to be decrypted, it uses The temporary session key is used to decrypt the data to be decrypted.
  • the information digest algorithm can be used to convert the data to be analyzed to obtain the corresponding summary information, that is, the target message summary.
  • the target message summary and the message summary to be compared can be compared.
  • Alarm prompt information provides abnormal prompts so that users can perform data protection in a timely manner based on the alarm prompt information.
  • the indicator data corresponds to inspection items such as configuration change operations, application types, access traffic, message field rules, and memory usage information.
  • the data to be analyzed uploaded by the vehicle terminal can be compared with the data of the same indicator item in the preset reference data. For example, if the data to be analyzed is an operation of changing the configuration, it can be compared with the operation of changing the configuration. If the two If they are consistent, it means that there is an operation to change the configuration of the vehicle terminal, and the test result can be considered abnormal; if the two are inconsistent, the test result can be considered normal.
  • the inspection results including: if the indicator item data corresponding to the configuration change operation is consistent, if the indicator item data corresponding to the application type is inconsistent, If the access traffic data of the data to be analyzed is within the preset traffic threshold range, the message fields of the data to be analyzed do not meet the preset message field rules, or the memory value of the data to be analyzed is not within the preset memory threshold range, then the test result is Exception for the message.
  • the inspection result can be considered as a message exception.
  • the vehicle-mounted terminal can use components to collect basic information of the device, such as system, version, etc.; it can also collect various potential security suspicious events, such as network attack alarm events. The collected data can be reported to the system.
  • the vehicle-mounted terminal component monitors an event to be detected and initiates a data access request.
  • the vehicle-mounted terminal encapsulates the component's request into an ACP message and forwards the ACP message to the access gateway.
  • the access gateway receives the data. Finally, unpack the ACP data and store the data in the database.
  • the access gateway sends data to the system through the interface.
  • the system receives the data access request, obtains the data to be analyzed, and performs data analysis and processing. For example, you can use file event monitoring technology to promptly discover suspicious files released by suspicious processes (applications), use the file preprocessing module to parse files and finally find executable files, collect information summaries for executable files and compare them with local information summaries. Identify malicious files.
  • Process detection technology can also be used to regularly monitor and detect system processes, and provide early warning and reporting for potential suspicious processes. The judgment of suspicious processes is mainly based on the preset library and the system knowledge base of the cloud platform. When an exception occurs, the program calls The abnormal event alarm interface reports events and blocks abnormal processes. Resource monitoring and detection technology can also be used to periodically (such as 30 seconds) detect resource occupancy, including RAM, ROM and CPU occupancy, and upload alarm events when resource occupancy exceeds the threshold.
  • Network security detection technology can also be used to monitor network traffic. When abnormal traffic is detected, abnormal events can be recorded and reported.
  • network protocols Through multi-dimensional cross-analysis of vulnerability data, security test data and security events related to the Internet of Vehicles, security strategies and security patches are formed to provide security detection strategies for the vehicle.
  • test result is abnormal data, generate an alarm prompt.
  • the vehicle-mounted terminal when the test result is abnormal data, the vehicle-mounted terminal can be considered to be at risk of intrusion. At this time, an alarm prompt information can be generated to prompt the abnormality, so that the user can perform data protection in a timely manner based on the alarm prompt information to ensure that the vehicle-mounted terminal safe operation.
  • the technical solution of this embodiment determines the data to be decrypted carried in the data access request when receiving the data access request sent by the vehicle-mounted terminal in the target vehicle; and decrypts the data to be decrypted based on the temporary session key to obtain the data to be analyzed. ;
  • the temporary session key is generated when the vehicle-mounted terminal changes from a non-working state to a working state; the data to be analyzed and the same indicator data in the preset reference data are compared and processed to obtain the inspection result; if the inspection result is data Abnormal, an alarm message is generated, which solves the problem in related technologies that the original data is directly transmitted, resulting in low data transmission security.
  • each The temporary session keys generated when the secondary vehicle-mounted terminal changes from non-working state to working state are different, which improves the security of data transmission and ensures data accuracy. It is then compared based on the decrypted data to be analyzed and the preset reference data. Accurately detect abnormal events and provide timely alarms to achieve the technical effect of effectively ensuring the safe operation of vehicle-mounted terminals.
  • the access gateway is used to establish a secure communication link with the vehicle-mounted terminal, and establish a communication link with the vehicle monitoring system.
  • the private protocol ACP protocol is used with the vehicle-mounted terminal to ensure the security of the transmission layer data, and with the vehicle monitoring system.
  • Data is transmitted in the form of Hypertext Transfer Protocol Secure (HTTPS) interface.
  • HTTPS Hypertext Transfer Protocol Secure
  • the vehicle monitoring system is used to perform statistics and analysis on the data reported by components in the vehicle terminal, to realize the safety monitoring of the vehicle controller, and to conduct multi-dimensional analysis of vulnerability data, intelligence data, security test data and security events related to the Internet of Vehicles.
  • Cross-analysis to form security strategies and security patches to provide security detection strategies for the vehicle end For example, by integrating the vehicle-side probe IDS component into the vehicle-mounted terminal, the system resources, application behavior, network connections, and file systems of the vehicle-mounted terminal can be monitored in real time, and the monitoring data can be reported to the vehicle monitoring system.
  • Vehicle monitoring The system combines the security big data provided by the cloud data monitoring and analysis system to discover and locate abnormal behaviors in vehicle terminals, implement dynamic protection of vehicle terminal information security based on terminal detection and response technology, and ensure the safe operation of vehicle terminals.
  • the vehicle-mounted terminal can be a T-Box.
  • the vehicle-mounted terminal can use components to collect basic information of the device, such as system, version, etc.; it can also collect various potential security suspicious events, such as network attack alarm events.
  • the file event monitoring module can be used to promptly discover suspicious files released by suspicious processes (applications), the file preprocessing module can be used to parse the files and finally find the executable file, and the information summary of the executable file can be collected and compared with the local information summary. Identify malicious files. You can also use the file event monitoring module to monitor important system configuration files of the system. When the monitored system configuration files change, the event will be reported in a timely manner and the operation of abnormal files will be blocked in a timely manner.
  • the judgment of suspicious processes is mainly based on the preset library and the system knowledge base of the cloud platform.
  • the program calls The abnormal event alarm interface reports events and blocks abnormal processes.
  • network protocol layer attack events such as network scanning, DOS, and malformed messages.
  • anomaly detection can be implemented as follows: when the intrusion detection and prevention system is running, the data packet capture module function for monitoring the designated network is turned on; the network monitoring module enters a passive waiting state, and the module waits for the arrival of network data traffic in real time. ; After the network data module detects the traffic data, it performs hierarchical recursive data unpacking of the network traffic data, and distributes the data to the corresponding functional sub-modules; do in the sub-module Verify the validity and legality of network data, perform preliminary abnormal screening of network data, report network anomalies if any, and record the network data characteristic values of the corresponding network. The sub-module regularly counts the recorded network data characteristic values, and determines whether there is a network attack or abnormality based on the recorded data characteristic values. If there is an abnormality, the abnormality is reported.
  • the components in the vehicle terminal can report the collected data to the system.
  • Figure 3 which can be expressed as a schematic diagram of abnormal event reporting.
  • the vehicle terminal component monitors the event to be detected, that is, when an abnormal event is discovered, the vehicle
  • the terminal interface initiates a data access request.
  • the vehicle-mounted terminal encapsulates the component request into an ACP message and forwards the ACP message to the access gateway.
  • the access gateway After receiving the data, the access gateway unpacks the ACP data and stores it in the database.
  • the access gateway sends data to the system through the interface, converts the data into a data format acceptable to the system, and forwards it to the system.
  • the system receives the data access request, obtains the data to be analyzed, and performs data storage and analysis processing.
  • the key negotiation process can be initiated when the vehicle terminal is powered on and the intermediate transmission data can be processed through the generated temporary session key.
  • Encryption for example, see Figure 4, can be represented as a schematic diagram of the key negotiation process.
  • the vehicle terminal encapsulates the parameters, ACP protocol and related data in the interface, transmits the encapsulated data to the access gateway, and then sends it to the vehicle monitoring The system registers.
  • the vehicle monitoring system receives the vehicle identification and equipment identification, it saves the vehicle identification and equipment identification, calculates the registration key based on the equipment identification and saves it, and performs summary calculation on the registration key to obtain the information summary (such as MD5 value), return the registration key and the information digest of the registration key to the vehicle terminal.
  • the component in the vehicle terminal performs summary calculation on the registration key, and verifies the obtained information summary with the received information summary. If they are consistent, the verification is successful and the registration key is stored.
  • the vehicle monitoring system uses the registration key to decrypt the encrypted data to obtain the data to be used, and uses the digest algorithm to calculate the information summary of the data to be used. If the two information summaries are consistent, the verification is successful.
  • Determine the randomly generated number in the data to be used generate a temporary session key based on the randomly generated number, and use the registration key to encrypt the temporary session key and send it to the vehicle terminal component.
  • the component uses the registration key to encrypt the temporary session key. Decrypt to obtain the temporary session key, and use the temporary session key to interact with business data. All subsequent session contents of the vehicle-mounted terminal are encrypted and transmitted using the temporary session key.
  • FIG. 5 a schematic diagram of pulling new detection items.
  • the component After the component starts and completes key negotiation, the component initiates configuration pulling. request, configure the pull request to include the address and data packet, call the corresponding interface of the vehicle terminal to forward the ACP to the access gateway, the access gateway will store the ACP unpacked data in the database, and push the data to the vehicle monitoring system through the interface , and convert the data into a configuration pull request.
  • the vehicle monitoring system receives the configuration pull request, it returns new configuration information, that is, a new configuration item.
  • the access gateway sends the message to the vehicle-mounted terminal through the ACP protocol.
  • the vehicle-mounted terminal returns the new detection items to the component in the form of function return parameters, and the component can obtain the configuration pull.
  • the configuration pull results include new detection items, and the events to be detected are updated based on the new detection items.
  • the technical solution of this embodiment determines the data to be decrypted carried in the data access request when receiving the data access request sent by the vehicle-mounted terminal in the target vehicle; and decrypts the data to be decrypted based on the temporary session key to obtain the data to be analyzed. ;
  • the temporary session key is generated when the vehicle-mounted terminal changes from a non-working state to a working state; the data to be analyzed and the same indicator data in the preset reference data are compared and processed to obtain the inspection result; if the inspection result is data Abnormal, an alarm message is generated, which solves the problem in related technologies that the original data is directly transmitted, resulting in low data transmission security.
  • each The temporary session keys generated when the secondary vehicle-mounted terminal changes from non-working state to working state are different, which improves the security of data transmission and ensures data accuracy. It is then compared based on the decrypted data to be analyzed and the preset reference data. Accurately detect abnormal events and provide timely alarms to achieve the technical effect of effectively ensuring the safe operation of vehicle-mounted terminals.
  • FIG. 6 is a schematic structural diagram of a data processing device provided according to Embodiment 3 of the present application. As shown in Figure 6, the device includes: a data to be decrypted determining module 610, a data to be analyzed determining module 620, a test result determining module 630 and a prompt information generating module 640.
  • the data to be decrypted determination module 610 is configured to determine the data to be decrypted carried in the data access request when receiving a data access request sent by the vehicle-mounted terminal in the target vehicle; the data to be analyzed determination module 620 is configured to determine based on The temporary session key decrypts the data to be decrypted to obtain the data to be analyzed; wherein the temporary session key is generated when the vehicle-mounted terminal changes from a non-working state to a working state; the test result determination module 630 , set to compare the same indicator item data in the data to be analyzed and the preset reference data to obtain the inspection result; wherein the indicator item data is related to the configuration change operation, application type, access traffic, and message fields.
  • the rules correspond to the memory occupation information check items; the prompt information generation module 640 is configured to generate alarm prompt information if the test result is data abnormality.
  • the technical solution of this embodiment is to determine the data to be decrypted carried in the data access request when receiving the data access request sent by the vehicle-mounted terminal in the target vehicle; the data to be decrypted is determined based on the temporary session key.
  • the encrypted data is decrypted to obtain the data to be analyzed; the temporary session key is generated when the vehicle-mounted terminal changes from a non-working state to a working state; the data to be analyzed is compared with the data of the same indicator items in the preset reference data, Obtain the inspection result; if the inspection result is data abnormality, an alarm message is generated, which solves the problem in related technologies of directly transmitting original data, resulting in low data transmission security, and realizes the encryption process based on the temporary session key.
  • To-be-decrypted data reporting system At the same time, the temporary session key generated every time the vehicle-mounted terminal changes from non-working state to working state is different. This improves the security of data transmission and ensures data accuracy. Based on the decrypted data to be analyzed, The data is compared with the preset reference data to accurately detect abnormal events and provide timely alarms to achieve the technical effect of effectively ensuring the safe operation of the vehicle terminal.
  • the device also includes a temporary session key generation module.
  • the temporary session key generation module includes a key update data determination unit, a data to be used determination unit, and a random generation number determination unit. The unit and temporary session key determine the unit.
  • a key update data determination unit configured to receive a key update request and determine the key update data carried in the key update request when detecting that the state of the vehicle-mounted terminal changes from a non-working state to a working state.
  • the data to be used determining unit is configured to decrypt the key update data based on the pre-generated registration key to obtain the data to be used;
  • a randomly generated number determining unit configured to determine a randomly generated number based on the data to be used
  • a temporary session key determination unit configured to generate a temporary session key based on the randomly generated number, and send the temporary session key to the vehicle-mounted terminal, so that the vehicle-mounted terminal detects a trigger and an event to be detected.
  • the control is associated, data to be encrypted is generated, and the data to be encrypted is encrypted based on the temporary session key to generate data to be decrypted; wherein the event to be detected corresponds to at least one item to be checked.
  • the randomly generated number determining unit includes a message digest to be used determining subunit and a randomly generated number determining subunit.
  • the to-be-used message summary determination subunit is configured to perform conversion processing on the to-be-used data to obtain the to-be-used message summary;
  • the randomly generated number determining subunit is configured to determine the randomly generated number carried in the data to be used if the message digest to be applied associated with the key update data is consistent with the message digest to be used.
  • the temporary session key generation module also includes a new check item determination unit and a to-be-detected event update unit.
  • a new inspection item determination unit is configured to determine a new inspection item corresponding to the at least one item to be inspected. Inspection items;
  • the event to be detected updating unit is configured to update the event to be detected based on the newly added inspection item.
  • the device further includes a registration key determination module.
  • the registration key determination module includes a device identification determination unit and a registration key determination unit.
  • a device identification determining unit configured to determine the vehicle identification corresponding to the target vehicle and the equipment identification corresponding to the vehicle-mounted terminal
  • a registration key determination unit is configured to generate the registration key based on the vehicle identification and the device identification.
  • the device further includes an alarm prompt module.
  • the alarm prompt module includes a target message summary determination unit and an alarm prompt unit.
  • the target message summary determination unit is configured to perform conversion processing on the data to be analyzed to obtain the target message summary
  • An alarm prompt unit configured to generate alarm prompt information if the target message summary and the message summary to be compared associated with the data to be analyzed are inconsistent; wherein the message summary to be compared is converted by the data to be encrypted Process generated.
  • the test result determination module 630 includes a test result determination unit.
  • the inspection result determination unit is configured to: if the indicator item data corresponding to the configuration change operation is consistent, the indicator item data corresponding to the application type is inconsistent, and the access traffic data of the data to be analyzed is within the preset traffic threshold range, If the message field of the data to be analyzed does not meet the preset message field rules, or the memory value of the data to be analyzed is not within the preset memory threshold range, the test result is a message exception.
  • the data processing device provided by the embodiments of this application can execute the data processing method provided by any embodiment of this application, and has functional modules and beneficial effects corresponding to the execution method.
  • FIG. 7 is a schematic structural diagram of an electronic device that implements the data processing method according to the embodiment of the present application.
  • Electronic devices may represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers.
  • Electronic devices may also represent various forms of mobile devices, such as personal digital assistants, cellular phones, smart phones, wearable devices (eg, helmets, glasses, watches, etc.), and other similar computing devices.
  • the components shown herein, their connections and relationships, and their functions are examples only.
  • the electronic device 10 includes at least one processor 11 , and at least one processor 11 Communicatively connected memories, such as read-only memory (Read Only Memory, ROM) 12, random access memory (Random Access Memory, RAM) 13, etc., wherein the memory stores computer programs that can be executed by at least one processor, the processor 11 Various appropriate actions and processes can be performed according to a computer program stored in the read-only memory (ROM) 12 or loaded from the storage unit 18 into the random access memory (RAM) 13 . In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored.
  • the processor 11, the ROM 12 and the RAM 13 are connected to each other via the bus 14.
  • An input/output (I/O) interface 15 is also connected to the bus 14 .
  • the I/O interface 15 Multiple components in the electronic device 10 are connected to the I/O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a magnetic disk, an optical disk, etc. etc.; and communication unit 19, such as network card, modem, wireless communication transceiver, etc.
  • the communication unit 19 allows the electronic device 10 to exchange information/data with other devices through computer networks such as the Internet and/or various telecommunications networks.
  • Processor 11 may be a variety of general and/or special purpose processing components having processing and computing capabilities. Some examples of the processor 11 may include a central processing unit (Central Processing Unit, CPU), a graphics processing unit (Graphic Processing Unit, GPU), various dedicated artificial intelligence (Artificial Intelligence, AI) computing chips, various types of machine learning Model algorithm processor, digital signal processor (Digital Signal Processing, DSP), and any appropriate processor, controller, microcontroller, etc.
  • the processor 11 performs various methods and processes described above, such as data processing methods.
  • the data processing method may be implemented as a computer program, which is tangibly embodied in a computer-readable storage medium, such as storage unit 18.
  • part or all of the computer program may be loaded and/or installed onto the electronic device 10 via the ROM 12 and/or the communication unit 19.
  • the processor 11 may be configured to perform the data processing method in other suitable ways (eg, by means of firmware).
  • Various implementations of the systems and techniques described above may be implemented in digital electronic circuit systems, integrated circuit systems, Field-Programmable Gate Arrays (FPGAs), Application Specific Integrated Circuits (ASICs) , Application Specific Standard Parts (ASSP), System on Chip (SOC), Complex Programmable Logic Device (CPLD), computer hardware, firmware, software, and/or implemented in their combination.
  • FPGAs Field-Programmable Gate Arrays
  • ASICs Application Specific Integrated Circuits
  • ASSP Application Specific Standard Parts
  • SOC System on Chip
  • CPLD Complex Programmable Logic Device
  • computer hardware firmware, software, and/or implemented in their combination.
  • These various embodiments may include implementation in one or more computer programs executable and/or interpreted on a programmable system including at least one programmable processor, the programmable processor
  • the processor which may be a special purpose or general purpose programmable processor, may receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage
  • Computer programs for implementing the methods of the present application may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that the computer program, when executed by the processor, causes the functions/operations specified in the flowcharts and/or block diagrams to be implemented.
  • a computer program may execute entirely on the machine, partly on the machine, as a stand-alone software package, partly on the machine and partly on a remote machine or entirely on the remote machine or server.
  • a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in connection with an instruction execution system, apparatus, or device.
  • Computer-readable storage media may include electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or devices, or any suitable combination of the foregoing.
  • the computer-readable storage medium may be a machine-readable signal medium.
  • machine-readable storage media may include an electrical connection based on one or more wires, a portable computer disk, a hard drive, random access memory (RAM), read only memory (ROM), erasable programmable read only memory (Electronic Programable Read Only Memory (EPROM) or flash memory, optical fiber, portable compact disk read-only memory (Compact Disc-Read Only Memory, CD-ROM), optical storage device, magnetic storage device, or a suitable combination of the above.
  • RAM random access memory
  • ROM read only memory
  • EPROM Electrical Programable Read Only Memory
  • flash memory electrical connection based on one or more wires
  • CD-ROM Compact Disc-Read Only Memory
  • CD-ROM Compact Disc-Read Only Memory
  • the systems and techniques described herein may be implemented on an electronic device having a display device (e.g., a cathode ray tube (CRT) or liquid crystal) for displaying information to the user.
  • a display device e.g., a cathode ray tube (CRT) or liquid crystal
  • a display Liquid Crystal Display, LCD or monitor
  • a keyboard and pointing device e.g., a mouse or a trackball
  • Other kinds of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and may be provided in any form, including Acoustic input, voice input or tactile input) to receive input from the user.
  • the systems and techniques described herein may be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., A user's computer having a graphical user interface or web browser through which the user can interact with implementations of the systems and technologies described herein), or including such backend components, middleware components, or any combination of front-end components in a computing system.
  • the components of the system may be interconnected by any form or medium of digital data communication (eg, a communications network). Examples of communication networks include: Local Area Network (LAN), Wide Area Network (WAN), blockchain network, and the Internet.
  • Computing systems may include clients and servers.
  • Clients and servers are generally remote from each other and typically interact over a communications network.
  • the relationship of client and server is created by computer programs running on corresponding computers and having a client-server relationship with each other.
  • the server can be a cloud server, also known as cloud computing server or cloud host. It is a host product in the cloud computing service system to solve the problems of difficult management and weak business scalability in traditional physical hosts and VPS services. defect.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Small-Scale Networks (AREA)
  • Information Retrieval, Db Structures And Fs Structures Therefor (AREA)

Abstract

本申请公开了一种数据处理方法、装置、电子设备及存储介质。该方法包括：当接收到目标车辆中车载终端发送的数据访问请求时，确定数据访问请求中所携带的待解密数据；基于临时会话密钥对待解密数据解密处理，得到待分析数据；其中，临时会话密钥是在车载终端由非工作状态变化为工作状态时生成的；将待分析数据和预设参考数据中相同指标项数据比对处理，得到检验结果；若检验结果为数据异常，则生成告警提示信息。

Description

数据处理方法、装置、电子设备及存储介质
本公开要求在2022年6月29日提交中国专利局、申请号为202210762102.1的中国专利的优先权，以上申请的全部内容通过引用结合在本申请中。
技术领域
本申请涉及计算机处理技术领域，例如涉及一种数据处理方法、装置、电子设备及存储介质。
背景技术
目前大众对汽车智能化的需求越来越多，像车载娱乐系统、车载定位系统等车载终端已逐渐成为汽车中的必备设备。但是在引入智能化设备的同时，也引入了信息安全风险，攻击者可通过终端设备中的应用漏洞、系统漏洞等，对车载终端发起攻击，导致终端被恶意植入垃圾应用，或者数据被盗取、丢失的问题。由此对车辆进行实时的检测，及时发现异常，成为了信息保护的有效措施。
在相关技术中，对异常数据的检测方法通常是由车端向数据分析系统实时上报自身数据，当检测到上报数据出现异常时，如车端使用流量超出阈值，认为检测到了异常行为，但是在数据传输过程中，该方法容易出现数据被篡改、被盗取的情况，影响上报数据的真实性，降低异常检测效果。
发明内容
本申请提供了一种数据处理方法、装置、电子设备及存储介质，以实现在提高数据传输的安全性的同时，提高异常检测的及时性、准确性。
根据本申请的一方面，提供了一种数据处理方法，该方法包括：
当接收到目标车辆中车载终端发送的数据访问请求时，确定所述数据访问请求中所携带的待解密数据；
基于临时会话密钥对所述待解密数据进行解密处理，得到待分析数据；其中，所述临时会话密钥是在所述车载终端由非工作状态变化为工作状态时生成的；
将所述待分析数据和预设参考数据中相同指标项数据进行比对处理，得到 检验结果；其中，所述指标项数据与配置更改操作、应用程序类型、访问流量、报文字段规则和内存占用信息检验项相对应；
响应于所述检验结果为数据异常，生成告警提示信息。
根据本申请的另一方面，提供了一种数据处理装置，该装置包括：
待解密数据确定模块，设置为当接收到目标车辆中车载终端发送的数据访问请求时，确定所述数据访问请求中所携带的待解密数据；
待分析数据确定模块，设置为基于临时会话密钥对所述待解密数据进行解密处理，得到待分析数据；其中，所述临时会话密钥是在所述车载终端由非工作状态变化为工作状态时生成的；
检验结果确定模块，设置为将所述待分析数据和预设参考数据中相同指标项数据进行比对处理，得到检验结果；其中，所述指标项数据与配置更改操作、应用程序类型、访问流量、报文字段规则和内存占用信息检验项相对应；
提示信息生成模块，设置为响应于所述检验结果为数据异常，生成告警提示信息。
根据本申请的另一方面，提供了一种电子设备，所述电子设备包括：
至少一个处理器；以及
与所述至少一个处理器通信连接的存储器；其中，
所述存储器存储有可被所述至少一个处理器执行的计算机程序，所述计算机程序被所述至少一个处理器执行，以使所述至少一个处理器能够执行本申请任一实施例所述的数据处理方法。
根据本申请的另一方面，提供了一种计算机可读存储介质，所述计算机可读存储介质存储有计算机指令，所述计算机指令用于使处理器执行时实现本申请任一实施例所述的数据处理方法。
附图说明
下面将对实施例描述中所需要使用的附图作介绍，下面描述中的附图仅仅是本申请的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1是根据本申请实施例一提供的一种数据处理方法的流程图；
图2是根据本申请实施例二所提供的一种数据处理方法的示意图；
图3是根据本申请实施例二所提供的异常事件上报示意图；
图4是根据本申请实施例二所提供的密钥协商流程示意图；
图5是根据本申请实施例二所提供的新增检测项拉取示意图；
图6是根据本申请实施例三提供的一种数据处理装置的结构示意图；
图7是实现本申请实施例的数据处理方法的电子设备的结构示意图。
具体实施方式
为了使本技术领域的人员理解本申请，下面将结合本申请实施例中的附图，对本申请实施例进行描述，所描述的实施例仅仅是本申请一部分的实施例，而不是全部的实施例。基于本申请中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其他实施例，都应当属于本申请保护的范围。
需要说明的是，本申请的说明书和权利要求书及上述附图中的术语“第一”、“第二”等是用于区别类似的对象，而不必用于描述特定的顺序或先后次序。应该理解这样使用的数据在适当情况下可以互换，以便这里描述的本申请的实施例能够以除了在这里图示或描述的那些以外的顺序实施。此外，术语“包括”和“具有”以及他们的任何变形，意图在于覆盖不排他的包含，例如，包含了一系列步骤或单元的过程、方法、系统、产品或设备不必限于列出的那些步骤或单元，而是可包括没有列出的或对于这些过程、方法、产品或设备固有的其它步骤或单元。
实施例一
图1是根据本申请实施例一提供的一种数据处理方法的流程图，本实施例可适用于数据传输情况，该方法可以由数据处理装置来执行，该数据处理装置可以采用硬件和/或软件的形式实现，该数据处理装置可配置于计算设备中。如图1所示，该方法包括：
S110、当接收到目标车辆中车载终端发送的数据访问请求时，确定所述数据访问请求中所携带的待解密数据。
其中，车载终端可以为远程信息处理器(Telematics-BOX，T-BOX)，也可以为车载娱乐系统(In-Vehicle Infotainment，IVI)。待解密数据可以理解为需要被解密的数据。需要说明的是，为了保证数据传输的安全性、准确性，有效防止数据在传输过程中被篡改，可以为车载终端和系统之间的中间传输数据进行加密，将系统接收到车载终端发送的加密数据作为待解密数据，后续可以对待解密数据进行解密读取。
在实际应用中，可以当检测到在车载终端中触发与待检测事件相关联控件 时，认为系统接收到了车载终端发送的数据访问请求，例如当车载终端中一个文件被读取时，将读取信息上报系统；或者当车载终端中载入一个不清楚的程序时，将载入信息上报系统等等。也可以当检测车载终端上传的数据(如终端的基本信息)时，认为接收到了数据访问请求。可以对数据访问请求进行解析处理，得到数据访问请求中所携带的数据，即待解密数据。
需要说明的是，待解密数据可以是通过车载终端和系统共同协商的密钥加密生成的。可以在进行密钥协商过程中，由车载终端中组件向系统主动发起密钥协商流程，为了提高加密的强度，保证数据传输的安全性，可以在每次开启车载终端时，重新向系统请求密钥，若密钥协商流程失败以后也不会停止协商，车载终端会在下一次生成数据访问请求时再次向系统请求密钥，以实现为数据进行加密。
可选的，所述方法还包括：在检测到车载终端的状态由非工作状态变化为工作状态时，接收密钥更新请求，并确定密钥更新请求中所携带的密钥更新数据；基于预先生成的注册密钥对密钥更新数据进行解密处理，得到待使用数据；基于待使用数据确定随机生成数；基于随机生成数生成临时会话密钥，并将临时会话密钥发送至车载终端，以使车载终端在检测到触发与待检测事件相关联控件时，生成待加密数据，并基于临时会话密钥对待加密数据加密处理生成待解密数据。
其中，待检测事件与至少一个待检验项相对应。待检验项可以包括文件、应用程序、配置更改操作、访问流量、报文字段和内存占用等。密钥更新数据中可以包括与车载终端所对应的设备标识和随机数，如设备标识为产品序列号(Serial Number，SN)，随机数可以为随机生成的8字节数。注册密钥可以是预先生成的，用于加解密的密钥。
需要说明的是，在车载终端生成待解密数据之前，需要向系统发起密钥协商流程，即向系统请求密钥，在进行密钥协商流程时，也需要对传输数据进行加密传输，如车载终端可以将被加密处理后的与车载终端所对应的设备标识和随机数发送至系统，提高数据传输的安全性。
在实际应用中，可以当检测到车载终端的状态由非工作状态变化为工作状态，认为系统接收到了密钥更新请求，可以对密钥更新请求进行解析，得到密钥更新请求中所携带的数据，即密钥更新数据，可以利用预先生成的注册密钥对密钥更新数据解密处理，得到解密后的数据作为待使用数据，以及待使用数据中所携带的随机生成数，可以利用算法对随机生成数进行处理，得到本次会话所需要的临时会话密钥。并将临时会话密钥发送至车载终端，以使车载终端在检测到触发与待检测事件相关联控件时，确定中间传输数据，即待加密数据， 车载终端可以利用临时会话密钥对待加密数据加密处理生成待解密数据传输至系统，系统在接收到待解密数据后，可以利用临时会话密钥对待解密数据进行解密读取。
示例性的，假设车载终端为T-Box，T-Box在启动后，可以利用组件使用注册密钥(Registration Key，RK)对车载终端所对应的设备标识(如SN)和随机生成的8字节数进行加密。为了防止数据被篡改，可以利用信息摘要算法(如MD5)对传输的对设备标识和随机生成的8字节数进行计算，得到相对应的信息摘要，可以将加密后的数据和相应信息摘要作为密钥更新数据发送给系统，开始协商会话密钥。系统根据设备标识查询到的设备注册密钥(RK)对密钥更新数据进行解密，得到待使用数据(包括随机生成数)，可以利用随机生成数生成临时会话密钥，系统可以通过注册密钥对临时会话密钥进行加密传送给车载终端，以使车载终端后续的所有会话内容通过临时会话密钥进行加密传输。
需要说明的是，为了保证传输数据的完整性、准确性，可以在数据传输的过程中，将未加密的数据进行信息摘要的计算，通过信息摘要进行数据完整性校验。可选的，基于待使用数据确定随机生成数，包括：对待使用数据进行转换处理，得到待使用消息摘要；若与密钥更新数据相关联的待应用消息摘要，和待使用消息摘要相一致，则确定待使用数据中所携带的随机生成数。
在实际应用中，系统在根据设备标识查询到的设备注册密钥对密钥更新数据进行解密，得到待使用数据之后，可以利用信息摘要算法(如MD5)对待使用数据进行计算，得到信息摘要，即待使用消息摘要，将该信息摘要与车载终端传输的信息摘要进行比对，若相一致，则认为摘要合法，数据未被篡改，此时可以确定待使用数据中所携带的随机生成数，以基于随机生成数生成临时会话密钥。
需要说明的是，为了提高事件检测的准确性、及时性，满足实际需求，还可以实现待检测事件的自动更新功能，例如，若要新增新的待检测项，如木马事件检测，可以将该新增检测项添加进待检测事件中，以基于更新后的待检测事件对车辆终端进行实时监测，提高整车安全性。
可选的，所述数据处理方法还包括：确定与所述至少一个待检验项相对应的新增检验项；基于新增检验项更新待检测事件。
在实际应用中，可以在车载终端上电后，向系统进行一轮完整的配置拉取操作，本次会话后续不再进行配置拉取更新操作。例如，车载终端启动，完成密钥协商，确定临时会话密钥后，可以利用组件向系统发起配置拉取请求，可以通过车载终端和接入网关间协议通道将配置拉取请求传到系统服务器，系统检测是否需要存在新增检验项，若存在，将新的配置检验项通过接入网关转发 到车载终端上的组件中，以使车载终端利用组件更新待检测事件，得到新的待检测事件。以及使车载终端在检测到触发与新的待检测事件相关联控件时，生成待加密数据，并基于临时会话密钥对待加密数据加密处理生成待解密数据发送到系统。
在实际应用中，可以预先基于密钥生成算法预先生成注册密钥，以使基于注册密钥对生成临时会话密钥过程中的中间传输数据进行加解密，防止密钥协商事件被泄露，保证数据传输安全性。生成注册密钥的实现方式可以是：确定目标车辆所对应的车辆标识，以及车载终端所对应的设备标识；基于车辆标识和设备标识，生成注册密钥。
其中，车辆标识可以用于表征车辆的唯一性，例如可以为车辆识别码(Vehicle Identification Number，VIN)。设备标识可以用于表征车载终端的唯一性。
在本实施例中，车载终端可以利用组件获取目标车辆所对应的车辆标识，以及车载终端所对应的设备标识，可以将车辆标识和设备标识组成参数发送至数据传输接口，车载终端在接口处封装自定义协议以及其他相关数据，将数据传输到接入网关，然后由接入网关发给系统进行密钥注册。当系统接收到车辆标识和设备标识时，可以保存车辆标识和设备标识，并结合设备标识计算出注册密钥并保存。系统可以将注册密钥进行信息摘要计算，得到注册密钥所对应的摘要，并将注册密钥和相应摘要发送至车载终端，以使车载终端通过计算注册密钥的摘要与系统发送的摘要确定传输数据是否完整，若两个摘要相一致，可以将注册密钥保存在车载终端，以使在每次车载终端开始时，基于注册密钥对密钥协商的中间传输数据进行加解密。
S120、基于临时会话密钥对所述待解密数据解密处理，得到待分析数据。
其中，临时会话密钥是在车载终端由非工作状态变化为工作状态时生成的。可以理解的是，每次车载终端由非工作状态变化为工作状态所生成的临时会话密钥可能是不同的。
示例性的，可以通过临时会话密钥对待解密数据解密处理，得到待分析数据。例如，可以利用信息摘要算法对待分析数据进行完整性校验。可选的，在基于临时会话密钥对待解密数据解密处理，得到待分析数据之后，所述数据处理方法还包括：对待分析数据进行转换处理，得到目标消息摘要；若目标消息摘要和与待分析数据相关联的待比对消息摘要不一致，则生成告警提示信息。
其中，待比对消息摘要是通过对待加密数据转换处理生成的。
在实际应用中，当车载终端将基于临时会话密钥对待加密数据加密处理生 成的待解密数据传输到系统时，还可以利用信息摘要算法对待加密数据进行转换，得到相应的摘要信息，即待比对消息摘要并一同发送至系统，当系统接收到待解密数据时，利用临时会话密钥对待解密数据解密处理，得到待分析数据之后，可以利用信息摘要算法对待分析数据进行转换，得到相应的摘要信息，即目标消息摘要，可以将目标消息摘要和待比对消息摘要进行比对，若两者相一致，则说明车载终端发送的待分析数据是完整未被篡改的，若两者不一致，则说明车载终端发送的待分析数据可以是被篡改过的，此时可以生成告警提示信息进行异常提示，以使用户可以根据告警提示信息及时进行数据防护。
S130、将所述待分析数据和预设参考数据中相同指标项数据比对处理，得到检验结果。
其中，指标项数据与配置更改操作、应用程序类型、访问流量、报文字段规则和内存占用信息等检验项相对应。
在实际应用中，可以将车辆终端上传的待分析数据与预设的参考数据中相同指标项数据进行比对，如待分析数据为更改配置的操作，与配置更改操作进行比对，若两者相一致，则说明车辆终端存在更改配置的操作，可以认为检验结果为异常；若两者不一致，可以认为检验结果为正常。
可选的，将待分析数据和预设参考数据中相同指标项数据比对处理，得到检验结果，包括：若配置更改操作对应的指标项数据相一致、应用程序类型对应的指标项数据不一致、待分析数据的访问流量数据在预设流量阈值范围内、待分析数据的报文字段未满足预设报文字段规则、或待分析数据的内存值未在预设内存阈值范围内，则检验结果为消息异常。
在实际应用中，若检测到待分析数据和预设参考数据中配置更改操作对应的指标项数据相一致、应用程序类型对应的指标项数据不一致、待分析数据的访问流量数据在预设流量阈值范围内、待分析数据的报文字段未满足预设报文字段规则、或待分析数据的内存值未在预设内存阈值范围内中任一项，可以认为检验结果为消息异常。例如，车载终端可以利用组件采集设备的基础信息，如系统，版本等；也可以采集各种潜在的安全可疑事件，如网络攻击告警事件等。可以将采集的数据上报系统，如车载终端组件监控到待检测事件，发起数据访问请求，车载终端将组件的请求封装成ACP消息，并将ACP消息转发到接入网关，接入网关接收到数据后，将ACP数据拆包，并将数据存到数据库中。接入网关通过接口将数据发送给系统，系统接收到数据访问请求，得到待分析数据，进行数据分析处理。示例性的，可以利用文件事件监控技术，及时发现可疑进程(应用)释放的可疑文件，利用文件预处理模块解析文件最终发现可执行文件，对可执行文件采集信息摘要并和本地信息摘要对比来识别恶意文件。 还可以利用文件事件监控技术，监控系统重要的系统配置文件，当被监控的系统配置文件发生异动时，及时上报事件，并及时阻断异常文件的运行。还可以利用进程检测技术定期对系统进程进行监控检测，对于潜在的可疑进程进行预警上报，可疑进程的判断主要依据预设的库以及云平台的系统知识库进行判定，当发生异常时，程序调用异常事件告警接口对事件进行上报，并对异常进程进行阻断。还可以利用资源监控检测技术周期性(如30秒)的检测资源占用情况，包括RAM，ROM及CPU占用情况，当出现资源占用情况超出阈值的事件后则上传告警事件。还可以利用网络安全检测技术，对网络流量的监控，当检测到流量异常后，对异常事件进行记录并进行上报。还可以通过对车端控制器的特定网卡流量的实时监控和分析，计算网络流量和端口访问情况以及对协议进行检测，检测标识网络扫描、磁盘操作系统(Disk Operating System，DOS)、畸形报文等网络协议层攻击事件。实现通过对车联网相关的漏洞数据、安全测试数据以及安全事件进行多维度交叉分析，形成安全策略及安全补丁，为车端提供安全检测策略。
S140、若所述检验结果为数据异常，则生成告警提示信息。
在本实施例中，当检验结果为数据异常，可以认为车载终端是存在入侵风险的，此时可以生成告警提示信息进行异常提示，以使用户可以根据告警提示信息及时进行数据防护，保障车载终端的安全运行。
本实施例的技术方案，通过当接收到目标车辆中车载终端发送的数据访问请求时，确定数据访问请求中所携带的待解密数据；基于临时会话密钥对待解密数据解密处理，得到待分析数据；其中，临时会话密钥是在车载终端由非工作状态变化为工作状态时生成的；将待分析数据和预设参考数据中相同指标项数据比对处理，得到检验结果；若检验结果为数据异常，则生成告警提示信息，解决了相关技术中直接将原始数据进行传输，导致数据传输安全性低的问题，实现了通过将基于临时会话密钥加密处理过的待解密数据上报系统，同时每次车载终端由非工作状态变化为工作状态时生成的临时会话密钥是不同的，提高数据传输的安全性，保证数据准确性，再基于解密后的待分析数据和预设参考数据进行比较，准确地发现异常事件并及时告警，达到有效保证车载终端安全运行的技术效果。
实施例二
作为上述实施例的一可选实施例，为了使本领域技术人员理解本申请实施例的技术方案，给出应用场景实例。例如，可以参见下述示例性内容。
示例性的，参见图2，本技术方案可以通过车辆监控系统、接入网关、车载终端中的车端探针入侵检测系统(intrusion detection system，IDS)组件共同实现。其中，接入网关用于和车载终端建立安全通信链路，以及和车辆监控系统建立通信链路，与车载终端之间采用私有协议ACP协议，保证传输层数据的安全，与车辆监控系统之间采用超文本传输安全协议(Hypertext Transfer Protocol Secure，HTTPS)接口形式进行数据的传输。车辆监控系统，用于通过对车载终端中组件上报的数据进行统计和分析，实现车辆控制器的安全监控，以及通过对车联网相关的漏洞数据、情报数据、安全测试数据以及安全事件进行多维度交叉分析，形成安全策略及安全补丁，为车端提供安全检测策略。示例性的，可以通过将车端探针IDS组件集成在车载终端中，实时对车载终端的系统资源、应用行为、网络连接以及文件系统进行监控，并将监控数据上报至车辆监控系统，车辆监控系统结合云端数据监控和分析系统提供的安全大数据，发现并定位车载终端中的异常行为，实现基于终端检测与响应技术的车载终端信息安全动态防护，保障车载终端的安全运行。其中，车载终端可以为T-Box。例如，车载终端可以利用组件采集设备的基础信息，如系统，版本等；也可以采集各种潜在的安全可疑事件，如网络攻击告警事件等。示例性的，可以利用文件事件监控模块，及时发现可疑进程(应用)释放的可疑文件，利用文件预处理模块解析文件最终发现可执行文件，对可执行文件采集信息摘要并和本地信息摘要对比来识别恶意文件。还可以利用文件事件监控模块，监控系统重要的系统配置文件，当被监控的系统配置文件发生异动时，及时上报事件，并及时阻断异常文件的运行。还可以利用进程监控模块定期对系统进程进行监控检测，对于潜在的可疑进程进行预警上报，可疑进程的判断主要依据预设的库以及云平台的系统知识库进行判定，当发生异常时，程序调用异常事件告警接口对事件进行上报，并对异常进程进行阻断。还可以利用资源监控模块周期性(如30秒)的检测资源占用情况，包括RAM，ROM及CPU占用情况，当出现资源占用情况超出阈值的事件后则上传告警事件。还可以利用网络监控模块，对网络流量的监控，当检测到流量异常后，对异常事件进行记录并进行上报。还可以通过对车端控制器的特定网卡流量的实时监控和分析，计算网络流量和端口访问情况以及对协议进行检测，检测标识网络扫描、DOS、畸形报文等网络协议层攻击事件。实现通过对车联网相关的漏洞数据、安全测试数据以及安全事件进行多维度交叉分析，形成安全策略及安全补丁，为车端提供安全检测策略。
需要说明的是，异常检测的实现方式可以为：当入侵检测与防御系统运行后，监控指定网络的数据抓包模块功能开启；网络监控模块进入被动等待状态，该模块实时等待网络数据流量的到来；网络数据模块检测到流量数据后，对网络流量数据进行分层递归数据解包，数据分发到所属功能子模块；子模块中做 网络数据有效性与合法性校验，做网络数据的初步异常筛选，如有异常则上报网络异常，同时记录对应网络的网络数据特征值。子模块定时统计记录的网络数据特征值，根据记录的数据特征值判断是否存在网络攻击或者异常，如有异常则上报异常。
在上述方案的基础上，车载终端中的组件可以将采集的数据上报系统，如，参见图3，可以表示为异常事件上报示意图，车载终端组件监控到待检测事件，即发现异常事件，调用车载终端接口发起数据访问请求，车载终端将组件的请求封装成ACP消息，并将ACP消息转发到接入网关，接入网关接收到数据后，将ACP数据拆包存到数据库中。接入网关通过接口将数据发送给系统，并将数据转化成系统能接受的数据格式，转发给系统，系统接收到数据访问请求，得到待分析数据，进行数据存储和分析处理。
在上述方案的基础上，为了保证数据传输的安全性、准确性，防止数据被篡改，可以在车载终端上电启动时，发起密钥协商流程，通过生成的临时会话密钥对中间传输数据进行加密，示例性的，参见图4，可以表示为密钥协商流程示意图，车载终端中组件在启动后，组件自主调用接口进行密钥协商流程，组件获取目标车辆的车辆标识(如车辆VIN)和车载终端的设备标识(如SN)，并组成参数发给车载终端数据传输接口，车载终端在接口封装参数、ACP协议和相关数据，将封装好的数据传输到接入网关，然后发给车辆监控系统进行注册，车辆监控系统收到车辆标识和设备标识后，保存车辆标识和设备标识，并结合设备标识计算出注册密钥并保存，并对注册密钥进行摘要计算，得到信息摘要(如MD5值)，将注册密钥以及注册密钥的信息摘要一起返回给车载终端。车载终端中组件对注册密钥进行摘要计算，将得到的信息摘要与接收的信息摘要进行校验，若相一致，则验证成功，将注册密钥存储。使用注册密钥对设备标识和随机生成的8字节数进行加密，并对设备标识和随机生成的8字节数进行摘要计算，将计算结果发送给车辆监控系统，开始协商会话密钥。车辆监控系统在接收到加密数据和信息摘要，利用注册密钥对加密数据进行解密，得到待使用数据，利用摘要算法计算待使用数据的信息摘要，若两个信息摘要相一致，则验证成功，确定待使用数据中的随机生成数，基于随机生成数生成临时会话密钥，并用注册密钥对临时会话密钥进行加密发送至车载终端组件，组件使用注册密钥对加密后的临时会话密钥进行解密，得到临时会话密钥，使用临时会话密钥进行业务数据交互。车载终端后续的所有会话内容通过临时会话密钥进行加密传输。
在上述方案的基础上，可以在车载终端上电后，向系统进行一轮完整的配置拉取操作，本次会话后续不再进行配置拉取更新操作。示例性的，参见图5，新增检测项拉取示意图，组件启动并完成密钥协商后，组件进行发起配置拉取 请求，配置拉取请求中包括地址和数据包，调用车载终端相应接口将ACP转发到接入网关，接入网关将ACP拆包后数据存到数据库中，并通过接口将数据推到车辆监控系统，并将数据转化为配置拉取请求，车辆监控系统在接收到配置拉取请求时，返回新的配置信息，即新增配置项。并通过结构调用新增检测项返回给接入网关，接入网关通过ACP协议将消息发给车载终端，车载终端以函数返回参数形式将新增检测项返回给组件，组件即可获取配置拉取结果，配置拉取结果中包括新增检测项，基于新增检测项更新待检测事件。
本实施例的技术方案，通过当接收到目标车辆中车载终端发送的数据访问请求时，确定数据访问请求中所携带的待解密数据；基于临时会话密钥对待解密数据解密处理，得到待分析数据；其中，临时会话密钥是在车载终端由非工作状态变化为工作状态时生成的；将待分析数据和预设参考数据中相同指标项数据比对处理，得到检验结果；若检验结果为数据异常，则生成告警提示信息，解决了相关技术中直接将原始数据进行传输，导致数据传输安全性低的问题，实现了通过将基于临时会话密钥加密处理过的待解密数据上报系统，同时每次车载终端由非工作状态变化为工作状态时生成的临时会话密钥是不同的，提高数据传输的安全性，保证数据准确性，再基于解密后的待分析数据和预设参考数据进行比较，准确地发现异常事件并及时告警，达到有效保证车载终端安全运行的技术效果。
实施例三
图6是根据本申请实施例三提供的一种数据处理装置的结构示意图。如图6所示，该装置包括：待解密数据确定模块610、待分析数据确定模块620、检验结果确定模块630和提示信息生成模块640。
其中，待解密数据确定模块610，设置为当接收到目标车辆中车载终端发送的数据访问请求时，确定所述数据访问请求中所携带的待解密数据；待分析数据确定模块620，设置为基于临时会话密钥对所述待解密数据进行解密处理，得到待分析数据；其中，所述临时会话密钥是在所述车载终端由非工作状态变化为工作状态时生成的；检验结果确定模块630，设置为将所述待分析数据和预设参考数据中相同指标项数据进行比对处理，得到检验结果；其中，所述指标项数据与配置更改操作、应用程序类型、访问流量、报文字段规则和内存占用信息检验项相对应；提示信息生成模块640，设置为若所述检验结果为数据异常，则生成告警提示信息。
本实施例的技术方案，通过当接收到目标车辆中车载终端发送的数据访问请求时，确定数据访问请求中所携带的待解密数据；基于临时会话密钥对待解 密数据解密处理，得到待分析数据；其中，临时会话密钥是在车载终端由非工作状态变化为工作状态时生成的；将待分析数据和预设参考数据中相同指标项数据比对处理，得到检验结果；若检验结果为数据异常，则生成告警提示信息，解决了相关技术中直接将原始数据进行传输，导致数据传输安全性低的问题，实现了通过将基于临时会话密钥加密处理过的待解密数据上报系统，同时每次车载终端由非工作状态变化为工作状态时生成的临时会话密钥是不同的，提高数据传输的安全性，保证数据准确性，再基于解密后的待分析数据和预设参考数据进行比较，准确地发现异常事件并及时告警，达到有效保证车载终端安全运行的技术效果。
在上述装置的基础上，可选的，所述装置还包括临时会话密钥生成模块，所述临时会话密钥生成模块，包括密钥更新数据确定单元、待使用数据确定单元、随机生成数确定单元和临时会话密钥确定单元。
密钥更新数据确定单元，设置为在检测到所述车载终端的状态由非工作状态变化为工作状态时，接收密钥更新请求，并确定所述密钥更新请求中所携带的密钥更新数据；
待使用数据确定单元，设置为基于预先生成的注册密钥对所述密钥更新数据解密处理，得到待使用数据；
随机生成数确定单元，设置为基于所述待使用数据确定随机生成数；
临时会话密钥确定单元，设置为基于所述随机生成数生成临时会话密钥，并将所述临时会话密钥发送至所述车载终端，以使所述车载终端在检测到触发与待检测事件相关联控件时，生成待加密数据，并基于所述临时会话密钥对所述待加密数据加密处理生成待解密数据；其中，所述待检测事件与至少一个待检验项相对应。
在上述装置的基础上，可选的，所述随机生成数确定单元包括待使用消息摘要确定子单元和随机生成数确定子单元。
待使用消息摘要确定子单元，设置为对所述待使用数据进行转换处理，得到待使用消息摘要；
随机生成数确定子单元，设置为若与所述密钥更新数据相关联的待应用消息摘要，和所述待使用消息摘要相一致，则确定所述待使用数据中所携带的随机生成数。
在上述装置的基础上，可选的，所述临时会话密钥生成模块还包括新增检验项确定单元和待检测事件更新单元。
新增检验项确定单元，设置为确定与所述至少一个待检验项相对应的新增 检验项；
待检测事件更新单元，设置为基于所述新增检验项更新所述待检测事件。
在上述装置的基础上，可选的，所述装置还包括注册密钥确定模块，所述注册密钥确定模块，包括设备标识确定单元和注册密钥确定单元。
设备标识确定单元，设置为确定所述目标车辆所对应的车辆标识，以及所述车载终端所对应的设备标识；
注册密钥确定单元，设置为基于所述车辆标识和所述设备标识，生成所述注册密钥。
在上述装置的基础上，可选的，所述装置还包括告警提示模块，所述告警提示模块，包括目标消息摘要确定单元和告警提示单元。
目标消息摘要确定单元，设置为对所述待分析数据进行转换处理，得到目标消息摘要；
告警提示单元，设置为若所述目标消息摘要和与所述待分析数据相关联的待比对消息摘要不一致，则生成告警提示信息；其中，所述待比对消息摘要是通过对待加密数据转换处理生成的。
在上述装置的基础上，可选的，所述检验结果确定模块630，包括检验结果确定单元。
检验结果确定单元，设置为若所述配置更改操作对应的指标项数据相一致、所述应用程序类型对应的指标项数据不一致、所述待分析数据的访问流量数据在预设流量阈值范围内、所述待分析数据的报文字段未满足预设报文字段规则、或所述待分析数据的内存值未在预设内存阈值范围内，则检验结果为消息异常。
本申请实施例所提供的数据处理装置可执行本申请任意实施例所提供的数据处理方法，具备执行方法相应的功能模块和有益效果。
实施例四
图7是实现本申请实施例的数据处理方法的电子设备的结构示意图。电子设备可以表示各种形式的数字计算机，诸如，膝上型计算机、台式计算机、工作台、个人数字助理、服务器、刀片式服务器、大型计算机、和其它适合的计算机。电子设备还可以表示各种形式的移动装置，诸如，个人数字处理、蜂窝电话、智能电话、可穿戴设备(如头盔、眼镜、手表等)和其它类似的计算装置。本文所示的部件、它们的连接和关系、以及它们的功能仅仅作为示例。
如图7所示，电子设备10包括至少一个处理器11，以及与至少一个处理器11 通信连接的存储器，如只读存储器(Read Only Memory，ROM)12、随机访问存储器(Random Access Memory，RAM)13等，其中，存储器存储有可被至少一个处理器执行的计算机程序，处理器11可以根据存储在只读存储器(ROM)12中的计算机程序或者从存储单元18加载到随机访问存储器(RAM)13中的计算机程序，来执行各种适当的动作和处理。在RAM 13中，还可存储电子设备10操作所需的各种程序和数据。处理器11、ROM 12以及RAM 13通过总线14彼此相连。输入/输出(Input/Output，I/O)接口15也连接至总线14。
电子设备10中的多个部件连接至I/O接口15，包括：输入单元16，例如键盘、鼠标等；输出单元17，例如各种类型的显示器、扬声器等；存储单元18，例如磁盘、光盘等；以及通信单元19，例如网卡、调制解调器、无线通信收发机等。通信单元19允许电子设备10通过诸如因特网的计算机网络和/或各种电信网络与其他设备交换信息/数据。
处理器11可以是各种具有处理和计算能力的通用和/或专用处理组件。处理器11的一些示例可包括中央处理单元(Central Processing Unit，CPU)、图形处理单元(Graphic Processing Unit，GPU)、各种专用的人工智能(Artificial Intelligence，AI)计算芯片、各种运行机器学习模型算法的处理器、数字信号处理器(Digital Signal Processing，DSP)、以及任何适当的处理器、控制器、微控制器等。处理器11执行上文所描述的各个方法和处理，例如数据处理方法。
在一些实施例中，数据处理方法可被实现为计算机程序，其被有形地包含于计算机可读存储介质，例如存储单元18。在一些实施例中，计算机程序的部分或者全部可以经由ROM 12和/或通信单元19而被载入和/或安装到电子设备10上。当计算机程序加载到RAM 13并由处理器11执行时，可以执行上文描述的数据处理方法的一个或多个步骤。备选地，在其他实施例中，处理器11可以通过其他适当的方式(例如，借助于固件)而被配置为执行数据处理方法。
本文中以上描述的系统和技术的各种实施方式可以在数字电子电路系统、集成电路系统、场可编程门阵列(Field-Programmable Gate Array，FPGA)、专用集成电路(Application Specific Integrated Circuit，ASIC)、专用标准产品(Application Specific Standard Parts，ASSP)、芯片上系统的系统(System on Chip，SOC)、复杂可编程逻辑设备(Complex Programmable Logic Device，CPLD)、计算机硬件、固件、软件、和/或它们的组合中实现。这些各种实施方式可以包括：实施在一个或者多个计算机程序中，该一个或者多个计算机程序可在包括至少一个可编程处理器的可编程系统上执行和/或解释，该可编程处理器可以是专用或者通用可编程处理器，可以从存储系统、至少一个输入装置、和至少一个输出装置接收数据和指令，并且将数据和指令传输至该存储系统、该至少一 个输入装置、和该至少一个输出装置。
用于实施本申请的方法的计算机程序可以采用一个或多个编程语言的任何组合来编写。这些计算机程序可以提供给通用计算机、专用计算机或其他可编程数据处理装置的处理器，使得计算机程序当由处理器执行时使流程图和/或框图中所规定的功能/操作被实施。计算机程序可以完全在机器上执行、部分地在机器上执行，作为独立软件包部分地在机器上执行且部分地在远程机器上执行或完全在远程机器或服务器上执行。
在本申请的上下文中，计算机可读存储介质可以是有形的介质，其可以包含或存储以供指令执行系统、装置或设备使用或与指令执行系统、装置或设备结合地使用的计算机程序。计算机可读存储介质可以包括电子的、磁性的、光学的、电磁的、红外的、或半导体系统、装置或设备，或者上述内容的任何合适组合。备选地，计算机可读存储介质可以是机器可读信号介质。机器可读存储介质的示例可包括基于一个或多个线的电气连接、便携式计算机盘、硬盘、随机存取存储器(RAM)、只读存储器(ROM)、可擦除可编程只读存储器(Electronic Programable Read Only Memory，EPROM)或快闪存储器、光纤、便捷式紧凑盘只读存储器(Compact Disc-Read Only Memory，CD-ROM)、光学储存设备、磁储存设备、或上述内容的合适组合。
为了提供与用户的交互，可以在电子设备上实施此处描述的系统和技术，该电子设备具有：用于向用户显示信息的显示装置(例如，阴极射线管(Cathode Ray Tube，CRT)或者液晶显示器(Liquid Crystal Display，LCD)或者监视器)；以及键盘和指向装置(例如，鼠标或者轨迹球)，用户可以通过该键盘和该指向装置来将输入提供给电子设备。其它种类的装置还可以用于提供与用户的交互；例如，提供给用户的反馈可以是任何形式的传感反馈(例如，视觉反馈、听觉反馈、或者触觉反馈)；并且可以用任何形式(包括声输入、语音输入或者、触觉输入)来接收来自用户的输入。
可以将此处描述的系统和技术实施在包括后台部件的计算系统(例如，作为数据服务器)、或者包括中间件部件的计算系统(例如，应用服务器)、或者包括前端部件的计算系统(例如，具有图形用户界面或者网络浏览器的用户计算机，用户可以通过该图形用户界面或者该网络浏览器来与此处描述的系统和技术的实施方式交互)、或者包括这种后台部件、中间件部件、或者前端部件的任何组合的计算系统中。可以通过任何形式或者介质的数字数据通信(例如，通信网络)来将系统的部件相互连接。通信网络的示例包括：局域网(Local Area Network，LAN)、广域网(Wide Area Network，WAN)、区块链网络和互联网。
计算系统可以包括客户端和服务器。客户端和服务器一般远离彼此并且通常通过通信网络进行交互。通过在相应的计算机上运行并且彼此具有客户端-服务器关系的计算机程序来产生客户端和服务器的关系。服务器可以是云服务器，又称为云计算服务器或云主机，是云计算服务体系中的一项主机产品，以解决了传统物理主机与VPS服务中，存在的管理难度大，业务扩展性弱的缺陷。
应该理解，可以使用上面所示的各种形式的流程，重新排序、增加或删除步骤。例如，本申请中记载的各步骤可以并行地执行也可以顺序地执行也可以不同的次序执行，只要能够实现本申请的技术方案所期望的结果。

Claims (10)

  1. 一种数据处理方法，包括：
    当接收到目标车辆中车载终端发送的数据访问请求时，确定所述数据访问请求中所携带的待解密数据；
    基于临时会话密钥对所述待解密数据进行解密处理，得到待分析数据；其中，所述临时会话密钥是在所述车载终端由非工作状态变化为工作状态时生成的；
    将所述待分析数据和预设参考数据中相同指标项数据进行比对处理，得到检验结果；其中，所述指标项数据与配置更改操作、应用程序类型、访问流量、报文字段规则和内存占用信息检验项相对应；
    响应于所述检验结果为数据异常，生成告警提示信息。
  2. 根据权利要求1所述的方法，所述方法还包括：
    在检测到所述车载终端的状态由非工作状态变化为工作状态时，接收密钥更新请求，并确定所述密钥更新请求中所携带的密钥更新数据；
    基于预先生成的注册密钥对所述密钥更新数据进行解密处理，得到待使用数据；
    基于所述待使用数据确定随机生成数；
    基于所述随机生成数生成临时会话密钥，并将所述临时会话密钥发送至所述车载终端，以使所述车载终端在检测到触发与待检测事件相关联控件时，生成待加密数据，并基于所述临时会话密钥对所述待加密数据进行加密处理生成待解密数据；其中，所述待检测事件与至少一个待检验项相对应。
  3. 根据权利要求2所述的方法，其中，所述基于所述待使用数据确定随机生成数，包括：
    对所述待使用数据进行转换处理，得到待使用消息摘要；
    响应于与所述密钥更新数据相关联的待应用消息摘要，和所述待使用消息摘要相一致，确定所述待使用数据中所携带的随机生成数。
  4. 根据权利要求2所述的方法，所述方法还包括：
    确定与所述至少一个待检验项相对应的新增检验项；
    基于所述新增检验项更新所述待检测事件。
  5. 根据权利要求2所述的方法，所述方法还包括：
    确定注册密钥；
    所述确定注册密钥，包括：
    确定所述目标车辆所对应的车辆标识，以及所述车载终端所对应的设备标识；
    基于所述车辆标识和所述设备标识，生成所述注册密钥。
  6. 根据权利要求1所述的方法，在所述基于临时会话密钥对所述待解密数据解密处理，得到待分析数据之后，所述方法还包括：
    对所述待分析数据进行转换处理，得到目标消息摘要；
    响应于所述目标消息摘要和与所述待分析数据相关联的待比对消息摘要不一致，生成告警提示信息；其中，所述待比对消息摘要是通过对待加密数据转换处理生成的。
  7. 根据权利要求1所述的方法，其中，所述将所述待分析数据和预设参考数据中相同指标项数据比对处理，得到检验结果，包括：
    响应于所述配置更改操作对应的指标项数据相一致、所述应用程序类型对应的指标项数据不一致、所述待分析数据的访问流量数据在预设流量阈值范围内、所述待分析数据的报文字段未满足预设报文字段规则、或所述待分析数据的内存值未在预设内存阈值范围内，检验结果为消息异常。
  8. 一种数据处理装置，包括：
    待解密数据确定模块，设置为当接收到目标车辆中车载终端发送的数据访问请求时，确定所述数据访问请求中所携带的待解密数据；
    待分析数据确定模块，设置为基于临时会话密钥对所述待解密数据进行解密处理，得到待分析数据；其中，所述临时会话密钥是在所述车载终端由非工作状态变化为工作状态时生成的；
    检验结果确定模块，设置为将所述待分析数据和预设参考数据中相同指标项数据进行比对处理，得到检验结果；其中，所述指标项数据与配置更改操作、应用程序类型、访问流量、报文字段规则和内存占用信息检验项相对应；
    提示信息生成模块，设置为响应于所述检验结果为数据异常，生成告警提示信息。
  9. 一种电子设备，所述电子设备包括：
    至少一个处理器；以及
    与所述至少一个处理器通信连接的存储器；其中，
    所述存储器存储有可被所述至少一个处理器执行的计算机程序，所述计算 机程序被所述至少一个处理器执行，以使所述至少一个处理器能够执行如权利要求1-7中任一项所述的数据处理方法。
  10. 一种计算机可读存储介质，所述计算机可读存储介质存储有计算机指令，所述计算机指令用于使处理器执行时实现如权利要求1-7中任一项所述的数据处理方法。
PCT/CN2023/103187 2022-06-29 2023-06-28 数据处理方法、装置、电子设备及存储介质 WO2024002160A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202210762102.1A CN115147956B (zh) 2022-06-29 2022-06-29 数据处理方法、装置、电子设备及存储介质
CN202210762102.1 2022-06-29

Publications (1)

Publication Number Publication Date
WO2024002160A1 true WO2024002160A1 (zh) 2024-01-04

Family

ID=83410671

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2023/103187 WO2024002160A1 (zh) 2022-06-29 2023-06-28 数据处理方法、装置、电子设备及存储介质

Country Status (2)

Country Link
CN (1) CN115147956B (zh)
WO (1) WO2024002160A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN117834136A (zh) * 2024-03-01 2024-04-05 南京中科齐信科技有限公司 一种车联网通信过程中量子密钥动态管理方法

Families Citing this family (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115147956B (zh) * 2022-06-29 2024-06-14 中国第一汽车股份有限公司 数据处理方法、装置、电子设备及存储介质
CN116032668B (zh) * 2023-03-29 2023-09-15 广东维信智联科技有限公司 一种计算机网络数据安全保密系统
CN118316785B (zh) * 2024-06-07 2024-09-27 南凌科技股份有限公司 路由安全检测方法、装置、设备及存储介质

Citations (11)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1497411A (zh) * 2002-10-08 2004-05-19 佳能株式会社 具有低耗电模式的图像形成装置及其控制方法
KR20100050621A (ko) * 2008-10-24 2010-05-14 넷시큐어테크놀러지 주식회사 차량 전용 컴퓨터(Ｃａｒ ＰＣ)와 무선통신 환경하에서 운행중 차량의 상태 전이에 따른 실시간 이상 징후 판단과 차량 관제 정보 송수신 시스템과 그 방법
CN102420821A (zh) * 2011-11-28 2012-04-18 飞天诚信科技股份有限公司 一种提高文件传输安全性的方法和系统
US9202076B1 (en) * 2013-07-26 2015-12-01 Symantec Corporation Systems and methods for sharing data stored on secure third-party storage platforms
US20170163607A1 (en) * 2015-12-03 2017-06-08 Microsoft Technology Licensing, Llc Establishing a Communication Event Using Secure Signalling
CN110572418A (zh) * 2019-10-25 2019-12-13 国机智骏科技有限公司 车辆身份认证的方法、装置、计算机设备及存储介质
CN110602046A (zh) * 2019-08-13 2019-12-20 上海陆家嘴国际金融资产交易市场股份有限公司 数据监控处理方法、装置、计算机设备和存储介质
CN111181928A (zh) * 2019-12-14 2020-05-19 深圳市元征科技股份有限公司 车辆诊断方法、服务器及计算机可读存储介质
CN112468995A (zh) * 2020-12-09 2021-03-09 湖南科技学院 一种基于车联网的可搜索加密隐私保护方法及系统
CN113872770A (zh) * 2021-10-14 2021-12-31 中国第一汽车股份有限公司 一种安全性验证方法、系统、电子设备及存储介质
CN115147956A (zh) * 2022-06-29 2022-10-04 中国第一汽车股份有限公司 数据处理方法、装置、电子设备及存储介质

Family Cites Families (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN100350816C (zh) * 2005-05-16 2007-11-21 航天科工信息技术研究院 基于gsm网络实现无线身份认证和数据安全传输的方法
CN105700509B (zh) * 2014-11-28 2018-04-06 奇点新源国际技术开发(北京)有限公司 基于can总线的车载终端检测方法及装置
CN108322451B (zh) * 2018-01-12 2020-09-22 深圳壹账通智能科技有限公司 数据处理方法、装置、计算机设备和存储介质
CN109343515A (zh) * 2018-11-30 2019-02-15 深圳市元征科技股份有限公司 车辆故障诊断方法、系统、设备及计算机可读存储介质
CN110430047B (zh) * 2019-07-19 2023-03-28 如般量子科技有限公司 基于非对称密钥和mqv的抗量子计算节能设备密钥协商方法和系统
CN112653654A (zh) * 2019-10-12 2021-04-13 深圳市奇虎智能科技有限公司 安全监控方法、装置、计算机设备及存储介质
CN111695166B (zh) * 2020-06-11 2023-06-06 阿波罗智联(北京)科技有限公司 磁盘加密保护方法及装置
CN113192348A (zh) * 2021-04-21 2021-07-30 支付宝(杭州)信息技术有限公司 车辆异常告警方法、装置及计算机设备
CN114281642B (zh) * 2021-12-10 2024-09-20 重庆长安汽车股份有限公司 一种车载娱乐终端控制器卡顿监测及预警方法

Patent Citations (11)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1497411A (zh) * 2002-10-08 2004-05-19 佳能株式会社 具有低耗电模式的图像形成装置及其控制方法
KR20100050621A (ko) * 2008-10-24 2010-05-14 넷시큐어테크놀러지 주식회사 차량 전용 컴퓨터(Ｃａｒ ＰＣ)와 무선통신 환경하에서 운행중 차량의 상태 전이에 따른 실시간 이상 징후 판단과 차량 관제 정보 송수신 시스템과 그 방법
CN102420821A (zh) * 2011-11-28 2012-04-18 飞天诚信科技股份有限公司 一种提高文件传输安全性的方法和系统
US9202076B1 (en) * 2013-07-26 2015-12-01 Symantec Corporation Systems and methods for sharing data stored on secure third-party storage platforms
US20170163607A1 (en) * 2015-12-03 2017-06-08 Microsoft Technology Licensing, Llc Establishing a Communication Event Using Secure Signalling
CN110602046A (zh) * 2019-08-13 2019-12-20 上海陆家嘴国际金融资产交易市场股份有限公司 数据监控处理方法、装置、计算机设备和存储介质
CN110572418A (zh) * 2019-10-25 2019-12-13 国机智骏科技有限公司 车辆身份认证的方法、装置、计算机设备及存储介质
CN111181928A (zh) * 2019-12-14 2020-05-19 深圳市元征科技股份有限公司 车辆诊断方法、服务器及计算机可读存储介质
CN112468995A (zh) * 2020-12-09 2021-03-09 湖南科技学院 一种基于车联网的可搜索加密隐私保护方法及系统
CN113872770A (zh) * 2021-10-14 2021-12-31 中国第一汽车股份有限公司 一种安全性验证方法、系统、电子设备及存储介质
CN115147956A (zh) * 2022-06-29 2022-10-04 中国第一汽车股份有限公司 数据处理方法、装置、电子设备及存储介质

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN117834136A (zh) * 2024-03-01 2024-04-05 南京中科齐信科技有限公司 一种车联网通信过程中量子密钥动态管理方法
CN117834136B (zh) * 2024-03-01 2024-05-17 南京中科齐信科技有限公司 一种车联网通信过程中量子密钥动态管理方法

Also Published As

Publication number Publication date
CN115147956B (zh) 2024-06-14
CN115147956A (zh) 2022-10-04

Similar Documents

Publication Publication Date Title
WO2024002160A1 (zh) 数据处理方法、装置、电子设备及存储介质
US8533806B2 (en) Method for authenticating a trusted platform based on the tri-element peer authentication(TEPA)
US7937760B2 (en) System security agent authentication and alert distribution
CN112615858B (zh) 物联网设备监控方法、装置与系统
WO2019213869A1 (zh) 一种用于区块链节点的方法及装置
CN113574841A (zh) 一种信息处理方法及装置、设备、存储介质
CN110113351B (zh) Cc攻击的防护方法及装置、存储介质、计算机设备
CN110138731B (zh) 一种基于大数据的网络防攻击方法
CN112738121B (zh) 密码安全态势感知方法、装置、设备和可读存储介质
CN111314381A (zh) 安全隔离网关
CN116132989B (zh) 一种工业互联网安全态势感知系统及方法
US10122755B2 (en) Method and apparatus for detecting that an attacker has sent one or more messages to a receiver node
CN113938312B (zh) 一种暴力破解流量的检测方法及装置
CN115883170A (zh) 网络流量数据监测分析方法、装置及电子设备及存储介质
CN110012099A (zh) 信息监控系统和方法
CN108600173B (zh) 一种具备加密安全性的分布式行波测距系统与方法
US12028375B2 (en) Detecting and protecting against employee targeted phishing attacks
CN114726579A (zh) 防御网络攻击的方法、装置、设备、存储介质及程序产品
CN110535886B (zh) 用于检测中间人攻击的方法、装置、系统、设备及介质
CN115623013A (zh) 一种策略信息同步方法、系统及相关产品
CN102164129A (zh) 防火墙与入侵检测系统的联动方法
CN113452702B (zh) 一种微服务流量检测系统和方法
Liu et al. Security Enhancement Technology for Power Internet of Things Protocol and Vulnerability Mining of Edge Devices Based on Fuzz Testing
CN112541187B (zh) 一种云计算方法及云计算集群
CN117240611B (zh) 一种基于人工智能的plc信息安全保护系统和方法

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 23830333

Country of ref document: EP

Kind code of ref document: A1