WO2024124387A1 - 一种服务调用方法、通信装置、服务调用系统以及车辆 - Google Patents

一种服务调用方法、通信装置、服务调用系统以及车辆 Download PDF

Info

Publication number
WO2024124387A1
WO2024124387A1 PCT/CN2022/138522 CN2022138522W WO2024124387A1 WO 2024124387 A1 WO2024124387 A1 WO 2024124387A1 CN 2022138522 W CN2022138522 W CN 2022138522W WO 2024124387 A1 WO2024124387 A1 WO 2024124387A1
Authority
WO
WIPO (PCT)
Prior art keywords
control command
information
service
service provider
behavior information
Prior art date
Application number
PCT/CN2022/138522
Other languages
English (en)
French (fr)
Inventor
洪佳琦
王辰昱
魏卓
张立
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to PCT/CN2022/138522 priority Critical patent/WO2024124387A1/zh
Publication of WO2024124387A1 publication Critical patent/WO2024124387A1/zh

Links

Images

Definitions

  • the present application relates to the field of security, and in particular to a service calling method, a communication device, a service calling system and a vehicle.
  • control commands for example, body control commands such as opening door locks, opening windows, adjusting seat backs, turning on air conditioning, etc.
  • the service provider in the smart car receives the control command
  • the service provider first verifies whether the control command comes from the aforementioned service caller. If the service provider determines that the control command comes from the service caller, the service provider determines that the control command is legal and sends the control command to the execution device corresponding to the control command so that the execution device executes the control command.
  • the service provider in traditional technology identifies and verifies the control command through the identification information of the service application (for example, the identity document (ID)).
  • ID the identity document
  • each service provided by the smart vehicle has a global ID at the vehicle level.
  • the service provider receives a control command from the service caller (for example, the smart cockpit)
  • the service provider decides whether the control command is legal based on the service ID carried by the control command and the access control policy based on the service ID, and then decides whether to send the control command to the execution device.
  • the present application provides a service calling method, a communication device, a service calling system and a vehicle for improving the security of service calling.
  • the present application provides a service calling method, which can be executed by a service provider or by a component of the service provider (for example, a processor, a chip or a chip system).
  • the service provider can be a vehicle control domain (also known as vehicle domain control (VDC) or vehicle domain control), a communication box (Telematics Box, T-Box) in a vehicle, or a combination of a T-Box and a vehicle control domain.
  • VDC vehicle domain control
  • T-Box communication box
  • the service provider receives a first control command and verification information of the first control command from a service caller.
  • the first control command is used to call a first service
  • the verification information of the first control command is used to verify the first control command.
  • the verification information of the first control command includes first behavior information, and the first behavior information is used to indicate the behavior of the user triggering the generation of the first control command. Then, the service provider verifies the first control command based on the verification information of the first control command; if the verification of the first control command passes, the service provider sends the first control command to an execution device, and the execution device is used to execute the first control command.
  • the verification information received by the service provider for verifying the first control command includes first behavior information, and the first behavior information is used to indicate the behavior of the user triggering the generation of the first control command.
  • the service provider can determine based on the first behavior information that the first control command is triggered by the user's behavior, rather than forged by an attacker. Therefore, the legitimacy verification of the first control command based on the first behavior information is conducive to improving the security of the body control service call.
  • the service provider verifies the first control command based on the verification information of the first control command, including: the service provider determines the second control command corresponding to the first behavior information based on the first behavior information and a first mapping rule, the first mapping rule including at least one type of behavior information and a control command corresponding to each type of behavior information; if the first control command is the same as the second control command, the service provider determines that the verification of the first control command passes.
  • the verification information received by the service provider for verifying the first control command includes the first behavior information, and the service provider can find the second control command in the first mapping rule based on the first behavior information.
  • the service provider determines that the first control command is the same as the second control command determined based on the first behavior information, the service provider determines that the first control command is triggered by the user and has not been tampered with, and then triggers the sending of the first control command to the execution device. Therefore, it is beneficial to improve the security of the body control service call.
  • the verification information of the first control command also includes the first execution flow information, which is used to indicate the process information of calling the first service; the first mapping rule also includes the execution flow information of calling each service.
  • the service provider must compare both the control command corresponding to the first behavior information and the execution flow information of the service corresponding to the control command. Specifically, if the first control command is the same as the second control command, the service provider determines the second execution flow information corresponding to the second control command based on the second control command and the first mapping rule; if the first execution flow information is the same as the second execution flow information, the service provider determines that the verification of the first control command passes.
  • the first execution flow information is an execution flow for calling the first service or a hash value of the execution flow for calling the first service.
  • the execution flow of the service call is a set of instructions or jump instructions executed by the service caller in the process of generating control commands based on behavior information. Therefore, the execution flow of the service call can reflect the integrity of the service call process. If the service call process is tampered by an attacker, the execution flow collected by the service caller must have instructions that reflect the tampering. Therefore, the execution flow of the service call triggered by the user to generate a control command is different from the execution flow of the service call tampered by the attacker. Therefore, using the execution flow of the service call as the verification information of the control command is conducive to the service provider identifying whether it is under attack, which is conducive to improving the security of the service call process.
  • the first behavior information includes a first coordinate, and the first coordinate is a coordinate corresponding to the operation of the user; each behavior information in the at least one behavior information in the first mapping rule includes at least one coordinate area.
  • the service provider determines the second control command corresponding to the first behavior information based on the first behavior information and the first mapping rule, including: the service provider determines the coordinate area where the first coordinate is located; the service provider determines the control command corresponding to the coordinate area where the first coordinate is located as the second control command based on the first mapping rule.
  • the first behavior information includes a first coordinate, which is the coordinate corresponding to the user's operation on the touch screen.
  • the first coordinate can be the coordinate value of a click position on the touch screen.
  • the user can trigger the generation of the first control command by simply clicking a button on the touch screen.
  • the first coordinate can also be the coordinate value of several click positions on the touch screen.
  • the user continuously clicks on several buttons on the touch screen to trigger the generation of the first control command.
  • the first coordinate can also be a continuous coordinate range.
  • the user slides continuously on the touch screen to make a specific sliding gesture (for example, the finger slides to the left on the touch screen or the finger slides to the right on the touch screen), and the specific gesture can trigger the generation of the first control command.
  • a specific sliding gesture for example, the finger slides to the left on the touch screen or the finger slides to the right on the touch screen
  • the specific gesture can trigger the generation of the first control command.
  • other behaviors of the user may also cause the service caller to detect one or more coordinates.
  • the coordinates corresponding to the user's operation are used as the first behavior information. Since the aforementioned coordinates are generated only when the user operates on the touch screen, using the aforementioned coordinates as the first behavior information can reflect the user's behavior, which is beneficial for the service provider to determine based on the coordinates that the first control command is triggered by the user's behavior, rather than forged by an attacker, thereby improving the security of the body control service call.
  • the first behavior information includes first semantic information, which is semantics generated based on the voice command input by the user; each type of behavior information in at least one type of behavior information in the first mapping rule includes a semantic information; the service provider determines the second control command corresponding to the first behavior information based on the first behavior information and the first mapping rule, including: the service provider determines, based on the first mapping rule, that the control command corresponding to the first semantic information is the second control command.
  • the first semantic information converted from the voice command issued by the user is used as the first behavior information. Since the first semantic information is generated only when the user issues a voice command to the microphone, using the first semantic information as the first behavior information can reflect the user's behavior, which is beneficial for the service provider to determine that the first control command is triggered by the user's behavior based on the first semantic information, rather than forged by an attacker, thereby improving the security of the vehicle body control service call.
  • the first behavior information includes first time information
  • the first time information is the time when the service caller detects that the user triggers the behavior of generating the first control command.
  • the first behavior information includes a first coordinate
  • the first time indicated by the first time information is the time when the user clicks the coordinate on the touch screen.
  • the first behavior information includes first semantic information
  • the first time indicated by the first time information is the time when the service caller detects the voice instruction.
  • the service provider determines that the difference between the moment indicated by the first time information and the current moment is outside the first threshold range, the service provider determines that the verification of the first control command fails.
  • the service provider determines whether the first control command is a replay attack based on the first time information, which is helpful for identifying replay attacks and improving the security of the service calling process.
  • the verification information of the first control command is signed by the service caller.
  • the method also includes: the service provider verifies the signature of the verification information of the first control command. If the service provider verifies the signature of the verification information of the first control command and succeeds, the service provider determines the second control command corresponding to the first behavior information based on the first behavior information and the first mapping rule; if the service provider fails to verify the signature of the verification information of the first control command, the service provider determines that the verification of the first control command fails.
  • the service provider needs to verify whether the signature of the verification information of the first control command comes from the service caller.
  • the service provider can identify whether the verification information of the first control command is the verification information signed by the service caller, which is conducive to improving the security of the service call process.
  • the method further includes: if the first control command is different from the second control command, the service provider determines that the verification of the first control command fails.
  • the first control command when the first control command is different from the second control command determined based on the first mapping rule and the first behavior information, it means that the first control command does not match the first behavior information, and then it is determined that the verification of the first control command fails, that is, the first control command is not a legal command. Therefore, it is helpful for the service provider to identify forged control commands, and then it is helpful to improve the security of the service call process.
  • the method further includes: if the first execution flow information is different from the second execution flow information, then the service provider determines that verification of the first control command fails.
  • the service provider when the first execution flow information is different from the second execution flow information determined based on the first mapping rule and the first control command, it indicates that the first execution flow information does not match the first control command, thereby identifying forged or tampered execution flow information. At this time, the service provider will determine that the first control command verification fails, thus facilitating the service provider to identify forged control commands, thereby facilitating the security of the service call process.
  • the method further includes: if the service provider determines that the verification of the first control command fails, the service provider prompts an alarm message to the user, and the alarm message is used to indicate that the verification of the first control command fails; or, if the service provider determines that the verification of the first control command fails, the service provider sends an alarm message to the service caller, and the service caller is used to prompt the user with the alarm message.
  • the service provider will directly or indirectly prompt the user with a warning message when the verification of the first control command fails, which is helpful for the user to quickly detect abnormalities, thereby providing a reference for the user's driving decision and improving the user's driving experience.
  • the first execution flow information is acquired by a trusted module in the service caller.
  • the trusted module is a processing module with higher authority than the operating system (i.e., the kernel), that is, the authority of the trusted module in the service caller is higher than the authority of the kernel in the service caller. It can also be understood that the authority of the operating environment of the trusted module is higher than the authority of the operating environment of the kernel. Since the authority of the trusted module is higher than the authority of the kernel, it is not easy for an attacker to break through the trusted module and tamper with the data in the trusted module.
  • the operating system i.e., the kernel
  • the scheme of obtaining the first behavior information by the trusted module can make the first behavior information less likely to be stolen or tampered with, thereby improving the accuracy and security of the service caller obtaining the first behavior information.
  • the present application provides a service calling method, which can be executed by a service caller or by a component of the service caller (for example, a processor, a chip, or a chip system).
  • the service caller can be a smart cockpit or a smart terminal device (for example, a smart phone, a smart watch, or other smart wearable device, etc.).
  • the service caller obtains first behavior information, and the first behavior information is used to indicate that the user has triggered the behavior of generating a first control command; the service caller generates the first control command based on the first behavior information, and the first control command is used to call the first service; the service caller sends the first control command and verification information of the first control command, and the verification information of the first control command includes the first behavior information, and the verification information of the first control command is used to verify the first control command.
  • the service caller sends the first behavior information as verification information of the first control command together with the first control command to the service provider, so that the service provider can determine based on the first behavior information that the first control command is triggered by the user's behavior rather than forged by an attacker. Therefore, verifying the legitimacy of the first control command based on the first behavior information is conducive to improving the security of the vehicle body control service call.
  • the service caller obtains the first behavior information, including: a trusted module in the service caller obtains the first behavior information.
  • the trusted module is a processing module with higher authority than the operating system (i.e., the kernel), that is, the authority of the trusted module in the service caller is higher than the authority of the kernel in the service caller. It can also be understood that the authority of the operating environment of the trusted module is higher than the authority of the operating environment of the kernel. Since the authority of the trusted module is higher than the authority of the kernel, it is not easy for an attacker to break through the trusted module and tamper with the data in the trusted module.
  • the scheme of obtaining the first behavior information by the trusted module can make the first behavior information less likely to be stolen or tampered with, thereby improving the accuracy and security of the service caller obtaining the first behavior information.
  • the operating environment of the trusted module is independent of the operating environment of the kernel.
  • the trusted module When the kernel is attacked by an attacker, the trusted module will not be affected. Therefore, even if the data in the kernel is tampered by the attacker, the data in the trusted module will not be affected, and the data in the trusted module will still be accurate and secure.
  • the trusted module has read and write permissions to the storage module, the kernel has no access permissions to the storage module, and the storage module is used to store the first behavior information.
  • the storage module includes registers and/or memory. Since the kernel in the conventional technology has read and/or write permissions to the storage module, the data located in the kernel in the conventional technology is easily attacked and tampered.
  • the kernel in the service caller in the present application is configured to have no access permissions to the storage module, so that it is possible to prevent attackers from stealing or tampering with the data in the storage module through the kernel.
  • the trusted module in the service caller in the present application is configured to have read and write permissions to the storage module. Since the permissions of the trusted module are higher than those of the kernel and are not easily breached by attackers compared to the kernel, the accuracy and security of the first behavior information obtained by the trusted module can be guaranteed.
  • the method before the service caller sends the first control command and verification information of the first control command to the service provider, the method further includes: the service caller obtains the first execution flow information, where the first execution flow information is used to indicate process information of calling the first service.
  • the first execution flow information is an execution flow for calling the first service or a hash value of the execution flow for calling the first service.
  • the execution flow of the service call is a set of instructions or jump instructions executed by the service caller in the process of generating control commands based on behavior information. Therefore, the execution flow of the service call can reflect the integrity of the service call process. If the service call process is tampered by an attacker, the execution flow collected by the service caller must have instructions that reflect the tampering. Therefore, the execution flow of the service call triggered by the user to generate a control command is different from the execution flow of the service call tampered by the attacker. Therefore, using the execution flow of the service call as the verification information of the control command is conducive to the service provider identifying whether it is under attack, which is conducive to improving the security of the service call process.
  • the service caller obtains the first execution flow information, including: a trusted module in the service caller obtains the first execution flow information.
  • the first execution flow information is obtained by the trusted module in the service caller, it can be guaranteed that the first execution flow information as verification information is safe and reliable.
  • the first execution flow information is information that the service caller will inevitably generate when generating the first control command based on the first behavior information, using the first execution flow information as one of the verification information can ensure that the first control command is triggered by the user, rather than forged by an attacker. Therefore, using the first execution flow information and the first behavior information as verification information for the first control command is conducive to improving the security and reliability of the body control service.
  • the verification information of the first control command is signed by a service caller key; before the service caller sends the first control command and the verification information of the first control command to the service provider, the method further includes: the service caller uses the key to sign the verification information of the first control command.
  • the first behavior information includes a first coordinate, which is a coordinate corresponding to the user's operation; or, the first behavior information includes a first semantic information, which is a semantic generated based on a voice instruction input by the user.
  • the coordinates corresponding to the user's operation are used as the first behavior information. Since the aforementioned coordinates are generated only when the user operates on the touch screen, using the aforementioned coordinates as the first behavior information can reflect the user's behavior, which is beneficial for the service provider to determine based on the coordinates that the first control command is triggered by the user's behavior, rather than forged by an attacker, thereby improving the security of the vehicle body control service call.
  • the first behavior information includes first time information, and the first time information is the time when the service caller detects the user triggering the behavior of generating the first control command.
  • the first time indicated by the first time information is the time when the user clicks the coordinate on the touch screen.
  • the first time indicated by the first time information is the time when the service caller detects the voice command.
  • the first semantic information converted from the voice command issued by the user is used as the first behavior information. Since the first semantic information is generated only when the user issues a voice command to the microphone, using the first semantic information as the first behavior information can reflect the user's behavior, which is beneficial for the service provider to determine that the first control command is triggered by the user's behavior based on the first semantic information, rather than forged by an attacker, thereby improving the security of the vehicle body control service call.
  • the trusted module includes at least one of the following: a virtual machine monitor, a trusted kernel, or a trusted execution environment TEE.
  • the present application provides a communication device, which may be a service provider or a component of a service provider (for example, a processor, a chip, or a chip system, etc.).
  • the communication device includes: a transceiver module and a processing module.
  • the transceiver module is used to receive a first control command from a service caller and verification information of the first control command, the first control command is used to call a first service, the verification information of the first control command is used to verify the first control command, and the verification information of the first control command includes first behavior information, and the first behavior information is used to indicate the user triggers the behavior of generating the first control command.
  • the processing module is used to verify the first control command based on the verification information of the first control command, and when the verification of the first control command passes, the control transceiver module sends the first control command to the execution device, and the execution device is used to execute the first control command.
  • a processing module is specifically used to determine a second control command corresponding to the first behavior information based on the first behavior information and a first mapping rule, wherein the first mapping rule includes at least one type of behavior information and a control command corresponding to each type of behavior information; and, when the first control command is the same as the second control command, determine that verification of the first control command passes.
  • the verification information of the first control command also includes the first execution flow information, where the first execution flow information is used to indicate process information of calling the first service; and the first mapping rule also includes execution flow information of each service.
  • the processing module is specifically used to determine the second execution flow information corresponding to the second control command based on the second control command and the first mapping rule when the first control command is the same as the second control command; and when the first execution flow information is the same as the second execution flow information, determine that the verification of the first control command is passed.
  • the first execution flow information is an execution flow of calling the first service or a hash value of the execution flow of calling the first service.
  • the first behavior information includes a first coordinate
  • the first coordinate is a coordinate corresponding to the operation of the user
  • each behavior information in the at least one behavior information in the first mapping rule includes at least one coordinate area.
  • the processing module is specifically used to determine the coordinate area where the first coordinate is located; and based on the first mapping rule, determine that the control command corresponding to the coordinate area where the first coordinate is located is the second control command.
  • the first behavior information includes first semantic information
  • the first semantic information is semantic information generated based on the voice command input by the user
  • each behavior information in at least one behavior information in the first mapping rule includes a semantic information.
  • the processing module is specifically configured to determine, based on the first mapping rule, that the control command corresponding to the first semantic information is the second control command.
  • the first behavior information includes first time information
  • the first time information is the time when the service caller detects that the user triggers the behavior of generating the first control command.
  • the processing module is specifically configured to determine that the verification of the first control command fails when the service provider determines that the difference between the moment indicated by the first time information and the current moment is outside the first threshold range.
  • the verification information of the first control command is signed by the service caller.
  • the processing module is further configured to verify the signature of the verification information of the first control command; and, if the signature of the verification information of the first control command is successfully verified, determine the second control command corresponding to the first behavior information based on the first behavior information and the first mapping rule.
  • the processing module is further configured to determine that verification of the first control command fails when the service provider fails to verify the signature of the verification information of the first control command.
  • the processing module is further configured to determine that verification of the first control command fails when the first control command is different from the second control command.
  • the processing module is further configured to determine that verification of the first control command fails when the first execution flow information is different from the second execution flow information.
  • the processing module is further used to control the input-output module to prompt an alarm message to the user when it is determined that the verification of the first control command fails, and the alarm message is used to indicate that the verification of the first control command fails; or, the processing module is further used to control the transceiver module to send an alarm message to the service caller when it is determined that the verification of the first control command fails, and the service caller is used to prompt the user with the alarm message.
  • the first execution flow information is acquired by a trusted module in the service caller.
  • the present application provides a communication device, which may be a service caller or a component of the service caller (for example, a processor, a chip, or a chip system, etc.).
  • the communication device includes: a transceiver module and a processing module.
  • the processing module is used to obtain first behavior information, and the first behavior information is used to indicate that the user has triggered the behavior of generating a first control command; and, based on the first behavior information, the first control command is generated, and the first control command is used to call the first service.
  • the transceiver module is used to send the first control command and verification information of the first control command, and the verification information of the first control command includes the first behavior information, and the verification information of the first control command is used to verify the first control command.
  • the processing module includes a trusted module.
  • the trusted module in the communication device obtains the first behavior information, and the authority of the trusted module is higher than the authority of the kernel in the service caller.
  • the operating environment of the trusted module is independent of the operating environment of the kernel.
  • the trusted module has read permission and write permission for a storage module
  • the kernel has no access permission to the storage module
  • the storage module is used to store the first behavior information
  • the processing module is further used to obtain the first execution flow information, the first execution flow information is used to indicate process information of calling the first service.
  • the first execution flow information is the execution flow of calling the first service or the hash value of the execution flow of calling the first service.
  • a trusted module in the communication device obtains the first execution flow information.
  • the verification information of the first control command is signed by the service caller.
  • the processing module is further configured to use a key to perform signature processing on the verification information of the first control command.
  • the first behavior information includes a first coordinate, which is a coordinate corresponding to the user's operation; or, the first behavior information includes a first semantic information, which is a semantic generated based on a voice command input by the user.
  • the first behavior information includes first time information, where the first time information is the time when the service caller detects that the user triggers the behavior of generating the first control command.
  • the trusted module includes at least one of the following: a virtual machine monitor, a trusted kernel, or a trusted execution environment TEE.
  • an embodiment of the present application provides a communication device, which may be a service provider in the aforementioned implementation mode, or a chip in the service provider.
  • the communication device may include a processing module and a transceiver module.
  • the processing module may be a processor, and the transceiver module may be a transceiver;
  • the service provider may also include a storage module, and the storage module may be a memory; the storage module is used to store instructions, and the processing module executes the instructions stored in the storage module so that the service provider executes the first aspect or the method in any one of the implementation modes of the first aspect.
  • the processing module may be a processor, and the transceiver module may be an input/output interface, a pin or a circuit, etc.; the processing module executes the instructions stored in the storage module so that the service provider executes the first aspect or the method in any one of the implementation modes of the first aspect.
  • the storage module may be a storage module in the chip (for example, a register, a cache, etc.), or it may be a storage module in the service provider located outside the chip (for example, a read-only memory, a random access memory, etc.).
  • an embodiment of the present application provides a communication device, which may be a service caller in the aforementioned implementation mode, or a chip in the service caller.
  • the communication device may include a processing module and a transceiver module.
  • the processing module may be a processor, and the transceiver module may be a transceiver;
  • the service caller may also include a storage module, and the storage module may be a memory; the storage module is used to store instructions, and the processing module executes the instructions stored in the storage module so that the service caller executes the second aspect or the method in any one of the implementation modes of the second aspect.
  • the processing module may be a processor, and the transceiver module may be an input/output interface, a pin or a circuit, etc.; the processing module executes the instructions stored in the storage module so that the service caller executes the second aspect or the method in any one of the implementation modes of the second aspect.
  • the storage module may be a storage module in the chip (e.g., a register, a cache, etc.), or a storage module in the service caller located outside the chip (e.g., a read-only memory, a random access memory, etc.).
  • the present application provides a communication device, which may be an integrated circuit chip.
  • the integrated circuit chip includes a processor.
  • the processor is coupled to a memory, and the memory is used to store a program or instruction.
  • the communication device executes the method described in any one of the embodiments of the aforementioned various aspects.
  • an embodiment of the present application provides a computer program product comprising instructions, which, when executed on a computer, enables the computer to execute a method as described in any one of the aforementioned aspects.
  • an embodiment of the present application provides a computer-readable storage medium, comprising instructions, which, when executed on a computer, enable the computer to execute a method as described in any one of the embodiments in the preceding aspects.
  • an embodiment of the present application provides a service calling system, which includes a service provider that executes the aforementioned first aspect and any one of the implementations of the first aspect; or, the service calling system includes a service caller that executes the aforementioned second aspect and any one of the implementations of the second aspect.
  • an embodiment of the present application provides a vehicle, which includes a service provider that executes the aforementioned first aspect and any one of the implementations of the first aspect; or, the vehicle includes a service caller that executes the aforementioned second aspect and any one of the implementations of the second aspect.
  • FIG1A is a system architecture diagram applicable to the service calling method proposed in this application.
  • FIG1B is a system architecture diagram applicable to the service calling method proposed in this application.
  • FIG1C is an example diagram of a processor architecture applicable to the service calling method of the present application.
  • FIG1D is another example diagram of a processor architecture applicable to the service calling method of the present application.
  • FIG2 is a flow chart of a service calling method in this application.
  • FIG3 is another flow chart of the service calling method in the present application.
  • FIG. 4 is a schematic diagram of an embodiment of a communication device in the present application.
  • the service calling method provided in this application is mainly applied to the scenario where a user triggers the generation of a control command to call a service in a vehicle. For example, a user inputs a control command through the vehicle's software or hardware to call the service corresponding to the control command.
  • the system to which the service calling method provided in the present application is applicable mainly includes a service caller, a service provider and an execution device.
  • the service caller is a device or functional module that generates a control command in response to the user's instructions to call the service corresponding to the control command.
  • the service provider is a device or functional module in the vehicle that provides services based on the control command.
  • the execution device is used to execute the control command to implement the service corresponding to the control command.
  • the aforementioned services can be body control services such as opening and closing doors, opening and closing windows, opening and closing wipers, adjusting seats, etc., or over the air technology (OTA) usually refers to upgrades, diagnosis and other services, or other vehicle services, which are not limited in this application.
  • OTA over the air technology
  • the service is a body control service.
  • the body control service can be a door and window control service, a wiper control service, a seat control service, or a light control service. If the user wants to open the window, the user can trigger the service caller to generate a control command to open the window. After receiving the control command, the service provider will perform a legality check on the control command. If the service provider determines that the control command is a legal command, the service provider will send the control command to the execution device corresponding to the control command.
  • the service caller may be a smart cockpit or a smart terminal device (e.g., a smart phone, a smart watch, or other smart wearable devices, etc.).
  • the service provider may be a vehicle control domain (also known as vehicle domain control (VDC) or vehicle domain control), or a communication box (Telematics Box, T-Box) in a vehicle, or a combination of a T-Box and a vehicle control domain.
  • VDC vehicle domain control
  • T-Box communication box in a vehicle
  • the execution device may be a motor or controller that drives the vehicle body hardware. For example, if the control command is to open the window, the execution device is a control motor related to the window, and the window is opened by starting the control motor.
  • the aforementioned service provider is a vehicle control domain.
  • the user can trigger the generation of a control command by clicking a button on the touch screen on the smart cockpit.
  • the vehicle control domain After receiving the control command, the vehicle control domain performs a legitimacy check on the control command to decide whether to send the control command to the execution device corresponding to the control command.
  • the service provider includes a communication box and/or a vehicle control domain.
  • the user triggers the generation of a control command through a smart terminal.
  • the communication box can perform a legitimacy check on the control command, or the communication box can transparently transmit the control command to the vehicle control domain, which then performs a legitimacy check on the control command.
  • the processing architecture of the aforementioned service caller includes a kernel and a trusted module.
  • the permissions of the trusted module are higher than those of the kernel, and the trusted module is less vulnerable to attack than the kernel.
  • the following will introduce the examples of two common processor architectures:
  • an example of a processor architecture applicable to the service call method of the present application is an Advanced RISC Machine (ARM) architecture.
  • the service caller includes multiple privilege levels (exception levels, EL), and the privileges gradually increase from privilege level 0 (EL0), privilege level 1 (EL1) to privilege level 2 (EL2), that is, the execution privileges of the software increase accordingly.
  • EL0 is called unprivileged execution, which is used to run body control applications;
  • EL1 is used to run the operating system (i.e., the kernel);
  • EL2 provides support for virtualization and is used to run a virtual machine monitor (Hypervisor).
  • EL1 is also used for a trusted kernel (Trusted Kernel).
  • the ARM architecture based on hardware isolation technology can also run a trusted execution environment (trusted execution environment, TEE).
  • TEE trusted execution environment
  • any one of the virtual machine monitor (Hypervisor), the trusted kernel, and the trusted execution environment can be used as a trusted module to execute the service call method to be introduced later.
  • the service caller includes multiple permission levels (Rings). From permission level 0 (Ring0) to permission level 3 (Ring3), the permissions gradually decrease, that is, the execution permissions of the software are reduced accordingly.
  • Ring3 has the lowest permissions and is used to run body control applications; Ring0 permissions are higher than Ring3 permissions and are usually used to run operating systems (ie, kernels).
  • VMX root mode also known as the privileged mode under hardware virtualization technology
  • VMX non-root mode also known as the non-privileged mode under hardware virtualization technology
  • VMMs virtual machine monitors
  • the service provider in the traditional technology verifies the legitimacy of the control command based on the ID sent by the service caller.
  • the service ID can be easily obtained or forged. Therefore, the legitimacy verification of the control command based on the service ID alone is not enough to ensure the security of the service call in the vehicle.
  • the present application provides a service calling method, which is mainly used in software-based body control scenarios.
  • the received control commands are verified based on the user's behavior, and the control commands forged by the attacker can be identified, thereby improving the security of the body control service call.
  • Step 201 The service caller obtains first behavior information.
  • the first behavior information is used to indicate the behavior of the user triggering the generation of the first control command.
  • the first control command is used to call the first service.
  • the first service is a body control service.
  • the first service is a body control service.
  • the first behavior information can also be understood as the behavior of the user detected by the service caller that can trigger the generation of the first control command and call the first service.
  • the input and output hardware used when the user inputs the instruction is different, and the specific implementation method of the first behavior information detected by the service caller is different.
  • the first behavior information includes a first coordinate, which is the coordinate corresponding to the user's operation.
  • the first behavior information also includes first time information, and the first time indicated by the first time information is the time when the coordinate is generated based on the user's operation.
  • the first coordinate may be the coordinate corresponding to the user's click, slide, and other operations on the touch screen (for example, the vehicle-mounted central control screen).
  • the first coordinate may be the coordinate value of a certain click position on the touch screen.
  • the user can trigger the generation of the first control command by simply clicking a certain button on the touch screen.
  • the first coordinate may also be the coordinate value of several click positions on the touch screen.
  • the user continuously clicks on several buttons on the touch screen to trigger the generation of the first control command.
  • the first coordinate may also be a continuous coordinate range.
  • the user slides continuously on the touch screen to make a specific sliding gesture (for example, the finger slides to the left on the touch screen or the finger slides to the right on the touch screen), and the specific gesture can trigger the generation of the first control command.
  • a specific sliding gesture for example, the finger slides to the left on the touch screen or the finger slides to the right on the touch screen
  • other user behaviors may also cause the service caller to detect one or more coordinates.
  • the first behavior information includes first semantic information, which is semantic information generated based on the voice command input by the user.
  • the first behavior information also includes first time information, and the first time indicated by the first time information is the time when the service caller detects the voice command.
  • the behavior that generates the first behavior information may be other behaviors that can achieve human-computer interaction in addition to clicking the touch screen of the smart cockpit and speaking a voice command.
  • a sensor may be used to detect a specific gesture made by the user, etc., which is not limited here.
  • the first behavior information including the first coordinate and the first time is taken as an example for detailed description.
  • the trusted module in the service caller obtains the first behavior information.
  • the user generates an electrical signal through hardware (e.g., input/output hardware) in the service caller and transmits it to the trusted module, and the trusted module timestamps the electrical signal to obtain the first behavior information.
  • hardware e.g., input/output hardware
  • the trusted module is a processing module with higher authority than the operating system (i.e., the kernel), that is, the authority of the trusted module in the service caller is higher than the authority of the kernel in the service caller. It can also be understood that the authority of the operating environment of the trusted module is higher than the authority of the operating environment of the kernel. Since the authority of the trusted module is higher than the authority of the kernel, it is not easy for an attacker to break through the trusted module and tamper with the data in the trusted module.
  • the operating system i.e., the kernel
  • the scheme of obtaining the first behavior information by the trusted module can make the first behavior information less likely to be stolen or tampered with, thereby improving the accuracy and security of the service caller obtaining the first behavior information.
  • the specific implementation form of the trusted module is different in different processor architectures.
  • the trusted module can be implemented by any one of the trusted kernel, the hypervisor, and the trusted execution environment TEE.
  • the trusted module can be a virtual machine monitor VMM or a virtual control structure VMCS.
  • the operating environment of the trusted module is independent of the operating environment of the kernel.
  • the trusted module When the kernel is attacked by an attacker, the trusted module will not be affected. Therefore, even if the data in the kernel is tampered by the attacker, the data in the trusted module will not be affected, and the data in the trusted module will still be accurate and secure.
  • the trusted module has read and write permissions to the storage module, and the kernel has no access to the storage module, and the storage module is used to store the first behavior information.
  • the storage module includes registers and/or memory. Since the kernel in the conventional technology has read and/or write permissions to the storage module, the data located in the kernel in the conventional technology is easily attacked and tampered.
  • the kernel in the service caller in the present application is configured to have no access to the storage module, so that it can prevent attackers from stealing or tampering with the data in the storage module through the kernel.
  • the trusted module in the service caller in the present application is configured to have read and write permissions to the storage module. Since the permissions of the trusted module are higher than those of the kernel and are not easily broken by attackers compared to the kernel, the accuracy and security of the first behavior information obtained by the trusted module can be guaranteed.
  • the electrical signals transmitted to the trusted module are different depending on the input and output hardware used by the user. They are introduced below:
  • the first behavior information includes a first coordinate and a first time. For example, when the user clicks the touch screen on the smart cockpit, the register of the touch screen digitizes the detected electrical signal and then transmits the electrical signal to the trusted module.
  • the trusted module is a virtual machine monitor (Hypervisor)
  • the virtual machine monitor can obtain the coordinates of the user's click from the storage module, that is, the trusted module obtains the first coordinate.
  • the virtual machine monitor timestamps the first coordinate after getting the first coordinate, and obtains the first behavior information including the first coordinate and the first time.
  • the first behavior information includes the first semantic information and the first time.
  • the microphone converts the detected analog signal into an electrical signal, which is then transmitted to the semantic recognition module to recognize the semantic information, and then the semantic information is transmitted to the trusted module.
  • the processor architecture shown in FIG1C is still used as an example.
  • the trusted module is a virtual machine monitor (Hypervisor)
  • the virtual machine monitor can obtain the semantic information from the storage module, that is, the trusted module obtains the first semantic information.
  • the virtual machine monitor (Hypervisor) timestamps the first semantic information after obtaining it, and obtains the first behavior information including the first semantic information and the first time.
  • Step 202 The service caller generates a first control command based on the first behavior information.
  • the service caller determines the area where the first coordinate is relative to the touch screen interface based on the first coordinate, and then generates the first control command based on the area.
  • the kernel in the service caller may generate the first control command based on the first behavior information.
  • the service caller if the button on the touch screen corresponding to the first coordinate is "open the car door", the service caller generates a control command for opening the car door based on the first coordinate, so that the control command for opening the car door can call the service for opening the car door after being sent to the service provider.
  • the specific implementation method of the first control command may be a string of command codes or a command identifier. This application does not limit the specific implementation method of the control command.
  • Step 203 The service caller performs signature processing on the verification information of the first control command.
  • step 203 is an optional step. If the service caller executes step 203, the service provider will execute step 205 after receiving the verification information of the first control command. If the service caller does not execute step 203, the service provider will not execute step 205 after receiving the verification information of the first control command, but will execute step 206.
  • the verification information of the first control command is used by the service provider to verify the first control command, and the verification information of the first control command includes the first behavior information, that is, the first behavior information obtained by the service caller in step 201.
  • the trusted module in the service caller uses the key to sign the verification information of the first control command (i.e., the first behavior information). For example, after obtaining the first behavior information, the trusted module in the service caller uses the aforementioned key to sign the verification information of the first control command (i.e., the first behavior information).
  • the trusted module is implemented by two modules (for example, the trusted module is a virtual machine monitor and a TEE), after the virtual machine monitor obtains the first behavior information, the virtual machine monitor transmits the first behavior information to the TEE, and then the TEE signs the first behavior information, and then the TEE returns the signed first behavior information to the virtual machine monitor; or, after the virtual machine monitor obtains the first behavior information, the first behavior information is stored in the trusted memory, and then the TEE obtains the first behavior information from the trusted memory of the virtual machine monitor, and then signs the first behavior information, and writes the signed first behavior information to the trusted memory of the virtual machine monitor.
  • the trusted module is implemented by two modules (for example, the trusted module is a virtual machine monitor and a TEE)
  • the virtual machine monitor transmits the first behavior information to the TEE, and then the TEE signs the first behavior information, and then the TEE returns the signed first behavior information to the virtual machine monitor; or, after the virtual machine monitor obtains the first behavior information, the first behavior information is stored in the trusted memory, and then
  • the trusted module is implemented by one module (for example, the trusted module is a virtual machine monitor), after the virtual machine monitor obtains the first behavior information, the virtual machine monitor signs the first behavior information to obtain the signed first behavior information.
  • the trusted module is implemented by one module (for example, the trusted module is a virtual machine monitor)
  • the virtual machine monitor signs the first behavior information to obtain the signed first behavior information.
  • the trusted module since the first behavior information is obtained by the trusted module, the trusted module has a higher authority, and it is not easy for an attacker to break through the trusted module and tamper with the information in the trusted module, the first behavior information is safe and reliable, and it is also safe and reliable to use the first behavior information obtained by the trusted module as the verification information of the first control command.
  • the first behavior information obtained by the trusted module is less likely to be tampered with or forged than the application identifier. Therefore, the solution of using the first behavior information as the verification information of the first control command is more reliable and secure.
  • this embodiment also proposes using a key to sign the verification information of the first control command, which is beneficial to further prevent attackers from forging the verification information of the first control command and is beneficial to improving the reliability and security of the verification information of the first control command.
  • Step 204 the service caller sends the first control command and verification information of the first control command to the service provider; correspondingly, the service provider receives the first control command and verification information of the first control command from the service caller.
  • the verification information of the first control command has a key signature of the service caller, that is, the verification information of the first control command is processed by the signature of the service caller.
  • the verification information of the first control command includes the first behavior information.
  • Step 205 The service provider verifies the signature of the verification information of the first control command.
  • step 205 is an optional step. If the service caller executes step 203, the service provider will execute step 205 after receiving the verification information of the first control command. If the service caller does not execute step 203, the service provider will not execute step 205 after receiving the verification information of the first control command, but will execute step 206.
  • the service provider uses a key to verify the signature of the verification information of the first control command.
  • the aforementioned key can be a symmetric key or an asymmetric key, which is not limited here.
  • the service caller uses the service caller's private key to sign the verification information of the first control command
  • the service provider needs to use the service caller's public key to verify the verification information of the first control command.
  • the service caller uses a symmetric key to sign the verification information of the first control command
  • the service provider needs to use the symmetric key to verify the verification information of the first control command.
  • the service provider can determine whether all received control commands have been signed through the information pre-configured by the operation and maintenance personnel. For example, if the operation and maintenance personnel configure the steps related to signature verification for both the service caller and the service provider, that is, the operation and maintenance personnel configure the service caller to execute step 203, and the service provider to execute step 205, then the service provider will verify each received control command (e.g., the first control command) to determine whether the received control command (e.g., the first control command) is a control command with a legal signature.
  • each received control command e.g., the first control command
  • the service provider uses the public key of the service caller to verify the signature of the verification information of the first control command and succeeds, it means that the signature on the first control command comes from the service caller, that is, the first control command is a command with a legal signature, and the service provider executes step 206; if the service provider uses the public key of the service caller to verify the signature of the verification information of the first control command and fails, it means that the signature on the first control command does not come from the service caller, that is, the first control command may be forged by an attacker, and the service provider executes step 208b.
  • the service provider needs to determine whether the first control command is subject to a replay attack based on the first time information before executing step 206. Specifically, the service provider can determine whether the difference between the moment indicated by the first time information and the current moment is outside the first threshold range.
  • step 206 If the difference between the moment indicated by the first time information and the current moment is within the first threshold range, it means that the verification information of the first control command is not intercepted and resent by the attacker, and the service provider triggers the execution of step 206; if the difference between the moment indicated by the first time information and the current moment is outside the first threshold range, it means that the verification information of the first control command may be intercepted and resent by the attacker, and the service provider stops triggering the execution of step 206 and triggers the execution of step 208b.
  • Step 206 The service provider determines a second control command corresponding to the first behavior information based on the first behavior information and the first mapping rule.
  • the first mapping rule is a mapping rule pre-configured in the service provider for verifying the verification information of the first control command.
  • the first mapping rule includes at least one behavior information and a control command corresponding to each behavior information.
  • the service provider searches for the first behavior information from at least one behavior information in the first mapping rule, and then determines that the control command corresponding to the first behavior information is the second control command.
  • the behavior information included in the first mapping rule is also different.
  • the following are introduced respectively:
  • the first behavior information includes a first coordinate and a first time; each behavior information in the at least one behavior information in the first mapping rule includes at least one coordinate region.
  • the service provider first determines the coordinate region where the first coordinate is located, and then the service provider determines, based on the first mapping rule, that the control command corresponding to the coordinate region where the first coordinate is located is the second control command.
  • the first mapping rule may be as shown in the following Table 1-1:
  • Coordinate area Control commands corresponding to each behavior information a 0 ⁇ X ⁇ b 0 ; c 0 ⁇ Y ⁇ d 0 ; Open car door command a 1 ⁇ X ⁇ b 1 ; c 1 ⁇ Y ⁇ d 1 ; Open windows command e 0 ⁇ X ⁇ f 0 ; c 2 ⁇ Y ⁇ d 2 ; Wiper on command
  • X represents the horizontal coordinate
  • Y represents the vertical coordinate
  • the coordinate area determined by the value range of X and Y corresponds to a key on the touch screen.
  • the key corresponding to the coordinate area determined by a 0 ⁇ X ⁇ b 0 and c 0 ⁇ Y ⁇ d 0 is the "car door open button”, so the control command corresponding to the coordinate area is the "car door open command”.
  • the key corresponding to the coordinate area determined by a 1 ⁇ X ⁇ b 1 and c 1 ⁇ Y ⁇ d 1 is the "car window open button", so the control command corresponding to the coordinate area is the "car window open command”.
  • the service provider determines that the second control command corresponding to the first behavior information is a "door opening command" based on the first coordinate and the first mapping rule.
  • the first behavior information includes first semantic information and a first time; each behavior information in at least one behavior information in the first mapping rule includes a semantic information. Specifically, the service provider determines that the control command corresponding to the first semantic information is the second control command based on the first mapping rule.
  • the first mapping rule may be as shown in the following Table 1-2:
  • Semantic Information Control commands corresponding to each behavior information "Open the car door” Open car door command "Open the window” Open windows command "Windshield wipers on” Wiper on command
  • the service provider determines that the second control command corresponding to the first behavior information is the "car door open command” based on the semantic information and the first mapping rule.
  • control command in the first mapping rule may be a string of command codes or a command identifier. This application does not limit the specific implementation method of the control command.
  • Step 207 The service provider determines whether the first control command is the same as the second control command.
  • first control command is the same as the second control command, it means that the first control command is a legal command initiated by the user, and the service provider executes step 208a; if the first control command is different from the second control command, it means that the first control command is not a legal command initiated by the user, and the service provider executes step 208b.
  • Step 208a The service provider sends a first control command to the execution device.
  • the service provider determines that the first control command is verified successfully, that is, the first control command is a legitimate command initiated by the user, and then the service provider sends the first control command to the execution device so that the execution device executes the first control command.
  • Step 208b The service provider determines that the first control command fails verification.
  • the service provider determines that the first control command fails verification, that is, the first control command is not a legal command initiated by the user. At this time, the service provider will not send the aforementioned first control command to the execution device. Optionally, the service provider will also trigger an alarm process. Specifically, the service provider will execute step 210a or execute step 210b.
  • Step 209 The execution device executes the first control command.
  • the execution device After receiving the first control command from the service provider, the execution device will execute the first control command to implement the call of the first service. For example, if the first control command is a command to open a car door, the execution device is a controller or a driving device related to the car door, and the execution device controls the car door to open. For another example, if the first control command is a command to open a car window, the execution device is a controller or a driving device related to the car window, and the execution device controls the car window to open.
  • Step 210a The service provider prompts the user with warning information.
  • Step 210a is an optional step.
  • the warning information is used to indicate that the verification of the first control command fails. It can also be understood that the warning information is used to indicate that the verification of the first control command is illegal.
  • the service provider can control the communication of the vehicle's input and output devices, and can then prompt the user with warning information through the input and output devices.
  • the service provider can control the speaker of the vehicle, the service provider can control the speaker to broadcast the warning information to the user through voice broadcast.
  • the service provider can control the vehicle's central control display screen, the service provider can control the central control display screen to display the warning information to the user in the form of text and/or images.
  • Step 210b the service provider sends an alarm message to the service caller; accordingly, the service caller receives the alarm message from the service provider, and then the service caller prompts the user with the alarm message.
  • Step 210b is an optional step.
  • the service caller After the service caller receives the aforementioned warning information, the service caller will prompt the user with the warning information.
  • the service caller is a device located in the vehicle, for example, the service caller is the smart cockpit in the vehicle; the service provider is the vehicle control domain.
  • the vehicle control domain sends an alarm message to the smart cockpit, and the smart cockpit prompts the user with the alarm message through the connected input and output devices.
  • the smart cockpit can control the speaker to broadcast the alarm message to the user through voice broadcast.
  • the smart cockpit can control the central control display to display the alarm message to the user in the form of text and/or images.
  • the smart cockpit can control the head-up display (HUD) to display the alarm message to the user in the form of text and/or images.
  • HUD head-up display
  • the smart cockpit can also communicate with other input and output devices, which are not listed here one by one.
  • the service caller is a device that can communicate with the vehicle.
  • the service caller is an intelligent terminal device (e.g., a smart phone, a smart watch, or other smart wearable device, etc.).
  • the service provider is the vehicle control domain, or the service provider is a combination of the communication box T-Box in the vehicle and the vehicle control domain.
  • the intelligent terminal device can receive alarm information from the vehicle control domain through the communication box T-Box in the vehicle, and then the terminal device can prompt the alarm information by voice broadcast, or display the alarm information to the user in the form of text and/or images.
  • the service caller delegates the authority to obtain the first behavior information from a kernel with lower authority (e.g., a kernel in privilege level 1 (EL1)) to a trusted module with higher authority (e.g., a hypervisor in privilege level 2 (EL2)). Since the data in the trusted module with higher authority is less likely to be tampered with than the data in the kernel with lower authority, the service caller obtains the first behavior information through the trusted module instead of through the kernel, which is beneficial to preventing the first behavior information obtained by the service caller from being tampered with or forged, and further beneficial to ensuring the security of the verification information of the first control command sent to the service provider.
  • a kernel with lower authority e.g., a kernel in privilege level 1 (EL1)
  • EL2 hypervisor in privilege level 2
  • the verification information received by the service provider for verifying the first control command includes the first behavior information, and the service provider can determine whether the first control command is triggered by the user's behavior based on the first behavior information.
  • the service provider determines that the first control command is the same as the second control command determined based on the first behavior information, the service provider determines that the first control command is triggered by the user and has not been tampered with, and then triggers the sending of the first control command to the execution device. Therefore, it is beneficial to improve the security of the body control service call.
  • Step 301 The service caller obtains first behavior information.
  • a trusted module in the service caller obtains the first behavior information.
  • Step 302 The service caller generates a first control command based on the first behavior information.
  • Step 301 and step 302 are similar to the above-mentioned step 201 and step 202. Please refer to the relevant descriptions in the above-mentioned step 201 and step 202 for details, which will not be repeated here.
  • Step 303 The service caller obtains first execution flow information.
  • the execution flow (also known as the control flow) is a collection of instructions executed by the service caller in the process of generating control commands based on behavior information. Therefore, the execution flow of a service call can reflect the integrity of the service call process. If the service call process is tampered by an attacker, the execution flow collected by the service caller must have instructions that reflect the tampering. Therefore, the execution flow of the service call triggered by the user to generate a control command is different from the execution flow of the service call that has been tampered by the attacker. Therefore, using the execution flow of the service call as the verification information of the control command is conducive to the service provider identifying whether it has been attacked, which is conducive to improving the security of the service call process.
  • the aforementioned first execution flow information is used to indicate the process information of calling the first service.
  • the first execution flow information is the information generated by the service caller in the process of generating the first control command based on the first behavior information. Therefore, the first execution flow information can indicate the integrity of the first service calling process.
  • the aforementioned first execution flow information is the execution flow of calling the first service or the hash value of the execution flow of calling the first service. For example, when generating the first control command, the service caller directly determines the obtained execution flow of calling the first service as the verification information of the first control command.
  • the service caller uses a hash algorithm to perform a hash calculation on the execution flow of calling the first service to obtain the hash value of the execution flow of calling the first service, and uses the hash value of the execution flow of calling the first service as the verification information of the first control command.
  • the trusted module in the service caller obtains the first execution flow information.
  • the trusted module in the service caller can collect the execution flow based on hardware (for example, hardware modules on the ARM architecture (for example, on-chip debugging modules such as coresight), processor trace (processor trace, PT) modules of the Intel architecture, performance monitoring unit (performance monitoring unit, PMU), etc.), or can collect the execution flow based on software instrumentation, which is not limited here.
  • the kernel in the service caller generates the first control command based on the first behavior information, and at the same time, the trusted module in the service caller collects the execution flow of the first service generated by the kernel when generating the first control command. Then, the trusted module in the service caller determines the first behavior information and the execution flow of the first service as the verification information of the first control command.
  • the trusted module in the service caller collects the execution flow of the first service generated by the kernel when generating the first control command. Then, the trusted module in the service caller calculates the hash value of the execution flow of the first service. Then, the trusted module in the service caller determines the hash value of the first behavior information and the execution flow of the first service as the verification information of the first control command.
  • the first execution flow information is obtained by the trusted module in the service caller, it can be guaranteed that the first execution flow information as verification information is safe and reliable.
  • the first execution flow information is information that the service caller will inevitably generate when generating the first control command based on the first behavior information, using the first execution flow information as one of the verification information can ensure that the first control command is triggered by the user, rather than forged by an attacker. Therefore, using the first execution flow information and the first behavior information as verification information for the first control command is conducive to improving the security and reliability of the body control service.
  • Step 304 The service caller performs signature processing on the verification information of the first control command.
  • step 304 is an optional step. If the service caller executes step 304, the service provider will execute step 306 after receiving the verification information of the first control command. If the service caller does not execute step 304, the service provider will not execute step 306 after receiving the verification information of the first control command, but will execute step 307.
  • the verification information of the first control command is used to verify the first control command.
  • the verification information of the first control command includes the first behavior information (i.e., the first behavior information obtained by the service caller in step 301) and the first execution flow information (i.e., the first execution flow information obtained by the service caller in step 303).
  • the service caller will use the key to sign the verification information of the first control command (ie, the first behavior information and the first execution flow information).
  • the trusted module is implemented by two modules (for example, the trusted module is a virtual machine monitor and a TEE), after the virtual machine monitor obtains the first behavior information and the first execution flow information, the virtual machine monitor transmits the first behavior information and the first execution flow information to the TEE together, and then the TEE performs signature processing on the first behavior information and the first execution flow information together, and then the TEE returns the verification information of the first control command processed by the signature to the virtual machine monitor; or, after the virtual machine monitor obtains the first behavior information and the first execution flow information, the first behavior information and the first execution flow information are stored in the trusted memory, and then the TEE obtains the first behavior information and the first execution flow information from the trusted memory of the virtual machine monitor, and then performs signature processing on the first behavior information and the first execution flow information, and writes the signed first behavior information and the first execution flow information to the trusted memory of the virtual machine monitor.
  • the trusted module is implemented by two modules (for example, the trusted module is a virtual machine monitor and a TEE)
  • the virtual machine monitor transmit
  • the trusted module is implemented by one module (for example, the trusted module is a virtual machine monitor), after the virtual machine monitor obtains the first behavior information and the first execution flow information, the virtual machine monitor performs signature processing on the first behavior information and the first execution flow information together to obtain the verification information of the first control command processed by the signature.
  • the trusted module implements the signature processing function.
  • Step 305 The service caller sends the first control command and verification information of the first control command to the service provider; correspondingly, the service provider receives the first control command and verification information of the first control command from the service caller.
  • the verification information of the first control command has a key signature of the service caller.
  • the verification information of the first control command includes first behavior information and first execution flow information.
  • Step 306 The service provider verifies the signature of the verification information of the first control command.
  • step 306 is an optional step. If the service caller executes step 304, the service provider will execute step 306 after receiving the verification information of the first control command. If the service caller does not execute step 304, the service provider will not execute step 306 after receiving the verification information of the first control command, but will execute step 307.
  • the service provider uses a key to verify the signature of the verification information of the first control command.
  • the key may be a symmetric key or an asymmetric key, which is not limited here.
  • the service provider uses the public key of the service caller to verify the signature of the verification information of the first control command and succeeds, it means that the signature on the first control command comes from the service caller, that is, the first control command is a command with a legal signature, and the service provider executes step 307; if the service provider uses the public key of the service caller to verify the signature of the verification information of the first control command and fails, it means that the signature on the first control command does not come from the service caller, that is, the first control command may be forged by an attacker, and the service provider executes step 311b.
  • the service provider needs to determine whether the first control command is subject to a replay attack based on the first time information before executing step 307. Specifically, the service provider can determine whether the difference between the moment indicated by the first time information and the current moment is outside the first threshold range.
  • step 307 If the difference between the moment indicated by the first time information and the current moment is within the first threshold range, it means that the verification information of the first control command is not intercepted and resent by the attacker, and the service provider triggers the execution of step 307; if the difference between the moment indicated by the first time information and the current moment is outside the first threshold range, it means that the verification information of the first control command may be intercepted and resent by the attacker, and the service provider stops triggering the execution of step 307 and triggers the execution of step 311b.
  • Step 307 The service provider determines a second control command corresponding to the first behavior information based on the first behavior information and the first mapping rule.
  • the first mapping rule includes at least one type of behavior information and a control command corresponding to each type of behavior information.
  • step 307 is similar to the above step 206. Please refer to the relevant description in the above step 206 for details, which will not be repeated here.
  • Step 308 The service provider determines whether the first control command is the same as the second control command.
  • the service provider executes step 309; if the first control command is different from the second control command, it means that the first control command is not a legal command initiated by the user, and the service provider executes step 311b.
  • Step 309 The service provider determines second execution flow information corresponding to the second control command based on the second control command and the first mapping rule.
  • the first mapping rule in addition to including at least one type of behavior information and a control command corresponding to each type of behavior information, also includes execution flow information of the service corresponding to each control command.
  • the service provider can not only find the second control command corresponding to the first behavior information from the first mapping rule, but also find the second execution flow information corresponding to the second control command based on the second control command.
  • the behavior information included in the first mapping rule is also different.
  • the following are introduced respectively:
  • the first behavior information includes a first coordinate and a first time; and each type of behavior information in the at least one type of behavior information in the first mapping rule includes at least one coordinate area.
  • the first mapping rule may be as shown in the following Table 2-1:
  • the service provider first determines the coordinate area where the first coordinate is located, and then, based on the first mapping rule, the service provider determines that the control command corresponding to the coordinate area where the first coordinate is located is the second control command, and then, the service provider determines the second control command based on the first mapping rule.
  • the first behavior information includes first semantic information and a first time; and each type of behavior information in at least one type of behavior information in the first mapping rule includes a semantic information.
  • the first mapping rule may be as shown in the following Table 2-2:
  • the service provider determines, based on the first mapping rule, that the control command corresponding to the first semantic information is the second control command. Then, the service provider determines the second control command based on the first mapping rule.
  • Step 310 Determine whether the first execution flow information is the same as the second execution flow information.
  • the service provider executes step 311a; if the first execution flow information is different from the second execution flow information, it means that the first control command is not a legal command initiated by the user, and the service provider executes step 311b.
  • Step 311a The service provider sends the first control command to the execution device.
  • Step 311b The service provider determines that the first control command fails verification.
  • Step 312 The execution device executes the first control command.
  • Step 313a The service provider prompts the user with warning information.
  • Step 313b The service provider sends an alarm message to the service caller, so that the service caller prompts the user with the alarm message.
  • step 311a, step 311b, step 312, step 313a and step 313b are similar to step 208a, step 208b, step 209, step 210a and step 210b in the corresponding embodiment of Figure 2 above. Please refer to the relevant descriptions of each step in the corresponding embodiment of Figure 2 above for details, and they are not repeated here.
  • the service caller can generate a first control command based on the first behavior information, and obtain the first execution flow information generated in the process of generating the first control command, and then send the first behavior information and the first execution flow information as verification information of the first control command to the service provider, so that the service provider verifies the first control command based on the first behavior information and the first execution flow information. Therefore, it is beneficial to improve the security of the body control service call.
  • the verification information received by the service provider for verifying the first control command includes the first behavior information and the first execution flow information.
  • the service provider determines the second execution flow information corresponding to the first behavior information in the first mapping rule based on the first mapping rule and the first behavior information.
  • the service provider determines that the first control command is legal, and then triggers the sending of the first control command to the execution device. Since the service provider can determine that the first control command is triggered by the user based on the first behavior information, and can determine that the first control command has not been tampered with based on the first execution flow information, it is beneficial to improve the security of the body control service call.
  • the present application provides a communication device 40.
  • the communication device 40 may be a service caller, or a component in the service caller (e.g., an integrated circuit, a chip, etc.).
  • the communication device 40 may be a service provider, or a component in the service provider (e.g., an integrated circuit, a chip, etc.).
  • the communication device 40 may also be other communication modules for implementing the method in the method embodiment of the present application.
  • the communication device 40 may include a processing module 401 (or a processing unit).
  • the communication device 40 may also include an interface module 402 (or a transceiver unit or a transceiver module) and a storage module 403 (or a storage unit).
  • the interface module 402 is used to communicate with other devices.
  • the interface module 402 may be a transceiver module or an input/output module.
  • one or more modules as shown in FIG. 4 may be implemented by one or more processors, or by one or more processors and memories; or by one or more processors and transceivers; or by one or more processors, memories, and transceivers, which are not limited in the embodiments of the present application.
  • the aforementioned processors, memories, and transceivers may be provided separately or integrated into one.
  • the architecture of the processing module 401 in the communication device 40 may refer to the examples shown in FIG. 1C or FIG. 1D.
  • the communication device 40 has the function of implementing the service caller in the embodiment corresponding to Figure 2 or Figure 3.
  • the communication device 40 includes a module or unit or means corresponding to the steps involved in the service caller described in the embodiment of the present application by the service caller, and the function or unit or means can be implemented by software, or by hardware, or by hardware executing the corresponding software implementation, or by a combination of software and hardware.
  • the interface module 402 in the communication device 40 is used to receive a first control command from the service caller and verification information of the first control command, the first control command is used to call the first service, the verification information of the first control command is used to verify the first control command, and the verification information of the first control command includes first behavior information, and the first behavior information is used to indicate the user triggers the behavior of generating the first control command.
  • the processing module 401 is used to verify the first control command based on the verification information of the first control command, and when the verification of the first control command is passed, the control interface module 402 sends the first control command to the execution device, and the execution device is used to execute the first control command.
  • the processing module 401 is specifically used to determine a second control command corresponding to the first behavior information based on the first behavior information and a first mapping rule, wherein the first mapping rule includes at least one type of behavior information and a control command corresponding to each type of behavior information; and, when the first control command is the same as the second control command, determine that verification of the first control command passes.
  • the verification information of the first control command also includes the first execution flow information
  • the first execution flow information is used to indicate the process information of calling the first service.
  • the first mapping rule also includes the execution flow information of each service.
  • the processing module 401 is specifically used to determine the second execution flow information corresponding to the second control command based on the second control command and the first mapping rule when the first control command is the same as the second control command; and when the first execution flow information is the same as the second execution flow information, determine that the verification of the first control command passes.
  • the first execution flow information is the execution flow of calling the first service or the hash value of the execution flow of calling the first service.
  • the first behavior information includes a first coordinate, and the first coordinate is a coordinate corresponding to the operation of the user; each behavior information in the at least one behavior information in the first mapping rule includes at least one coordinate area.
  • the processing module 401 is specifically used to determine the coordinate area where the first coordinate is located; and based on the first mapping rule, determine that the control command corresponding to the coordinate area where the first coordinate is located is the second control command.
  • the first behavior information includes first semantic information, and the first semantic information is semantic information generated based on the voice command input by the user; each behavior information in at least one behavior information in the first mapping rule includes a semantic information.
  • the processing module 401 is specifically configured to determine, based on the first mapping rule, that the control command corresponding to the first semantic information is the second control command.
  • the first behavior information includes first time information
  • the first time information is the time when the service caller detects the user triggering the behavior of generating the first control command.
  • Processing module 401 is specifically configured to determine that the verification of the first control command fails when the service provider determines that the difference between the moment indicated by the first time information and the current moment is outside the first threshold range.
  • the verification information of the first control command is signed by the service caller.
  • the processing module 401 is further used to verify the signature of the verification information of the first control command; and, if the signature of the verification information of the first control command is successfully verified, determine the second control command corresponding to the first behavior information based on the first behavior information and the first mapping rule.
  • the processing module 401 is further configured to determine that the verification of the first control command fails when the service provider fails to verify the signature of the verification information of the first control command.
  • the processing module 401 is further configured to determine that verification of the first control command fails when the first control command is different from the second control command.
  • the processing module 401 is further configured to determine that verification of the first control command fails when the first execution flow information is different from the second execution flow information.
  • the processing module 401 is further used to control the input-output module to prompt an alarm message to the user when it is determined that the verification of the first control command fails, and the alarm message is used to indicate that the verification of the first control command fails; or, the processing module 401 is further used to control the interface module 402 to send an alarm message to the service caller when it is determined that the verification of the first control command fails, and the service caller is used to prompt the user with the alarm message.
  • the communication device 40 is used to execute the method of the service caller in the embodiment corresponding to FIG. 2 or FIG. 3 .
  • the processing module 401 in the communication device 40 is used to obtain first behavior information, where the first behavior information is used to indicate that the user has triggered the behavior of generating a first control command; and, based on the first behavior information, the first control command is generated, where the first control command is used to call the first service.
  • the interface module 402 is used to send the first control command and verification information of the first control command, where the verification information of the first control command includes the first behavior information, and the verification information of the first control command is used to verify the first control command.
  • the processing module 401 includes a trusted module.
  • the trusted module in the communication device obtains the first behavior information, and the authority of the trusted module is higher than the authority of the kernel in the service caller.
  • the operating environment of the trusted module is independent of the operating environment of the kernel.
  • the trusted module has read and write permissions to a storage module, and the kernel does not have access to the storage module, and the storage module is used to store the first behavior information.
  • the processing module 401 is further used to obtain the first execution flow information, which is used to indicate process information of calling the first service.
  • the first execution flow information is the execution flow of calling the first service or the hash value of the execution flow of calling the first service.
  • a trusted module in the communication device obtains the first execution flow information.
  • the verification information of the first control command is signed by the service caller.
  • the processing module 401 is further configured to use a key to perform signature processing on the verification information of the first control command.
  • the first behavior information includes a first coordinate, which is a coordinate corresponding to the user's operation; or, the first behavior information includes a first semantic information, which is a semantic generated based on a voice instruction input by the user.
  • the first behavior information includes first time information, where the first time information is the time when the service caller detects that the user triggers the behavior of generating the first control command.
  • the trusted module includes at least one of the following: a virtual machine monitor, a trusted kernel, or a trusted execution environment TEE.
  • the present application provides a computer program product, which includes one or more computer instructions.
  • the process or function according to the embodiment of the present application is generated in whole or in part.
  • the computer can be a general-purpose computer, a special-purpose computer, a computer network or other programmable device.
  • the computer instruction can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium.
  • the computer instruction can be transmitted from a website site, computer, server or data center by wired (for example, coaxial cable, optical fiber, digital subscriber line (digital subscriber line, DSL)) or wireless (for example, infrared, wireless, microwave, etc.) mode to another website site, computer, server or data center.
  • the computer-readable storage medium can be any available medium that a computer can store or a data storage device such as a server or data center that includes one or more available media integrated.
  • the available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a magnetic tape), an optical medium (e.g., a digital versatile disc (DVD)), or a semiconductor medium (e.g., a solid state disk (SSD)), etc.
  • a magnetic medium e.g., a floppy disk, a hard disk, a magnetic tape
  • an optical medium e.g., a digital versatile disc (DVD)
  • DVD digital versatile disc
  • SSD solid state disk
  • the present application also provides a computer-readable storage medium, which stores a computer program, and the computer program is executed by a processor to implement the method related to the service caller as shown in Figure 2 or Figure 3 above.
  • the present application also provides a computer-readable storage medium, which stores a computer program, and the computer program is executed by a processor to implement the method related to the service provider as shown in Figure 2 or Figure 3 above.
  • the present application also provides a service calling system, which includes the service provider in the embodiment corresponding to FIG. 2 or FIG. 3 and the service caller in the embodiment corresponding to FIG. 2 or FIG. 3 .
  • the present application also provides a vehicle, which includes the service provider in the embodiment corresponding to FIG. 2 or FIG. 3 and the service caller in the embodiment corresponding to FIG. 2 or FIG. 3.
  • the vehicle also includes an execution device.
  • the vehicle also includes a human-computer interaction external device such as a touch screen and a microphone.
  • the size of the serial numbers of the above-mentioned processes does not mean the order of execution.
  • the execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

Landscapes

  • Telephonic Communication Services (AREA)

Abstract

本申请提供了一种服务调用方法、通信装置、服务调用系统以及车辆，在该方法中，服务调用方将第一行为信息作为第一控制命令的验证信息与第一控制命令一起发送给服务提供方，以使得服务提供方能够基于第一行为信息确定该第一控制命令是由用户的行为触发的，而不是攻击者伪造的。因此，基于第一行为信息对第一控制命令进行合法性校验，有利于提高车身控制服务调用的安全性。

Description

一种服务调用方法、通信装置、服务调用系统以及车辆 技术领域
本申请涉及安全领域，尤其涉及一种服务调用方法、通信装置、服务调用系统以及车辆。
背景技术
随着智能汽车的迅速发展，车载软件越来越丰富。用户可通过智能汽车的服务调用方(例如，智能座舱)中的车载软件发布控制命令(例如，开车门锁、开车窗、调节座椅靠背、开空调等车身控制命令)。当智能汽车中的服务提供方(例如，整车控制域)收到控制命令后，服务提供方先验证该控制命令是否来自前述服务调用方。若服务提供方确定该控制命令来自服务调用方，则服务提供方确定该控制命令合法，并向该控制命令对应的执行设备发送该控制命令，以使得该执行设备执行该控制命令。
目前，传统技术中的服务提供方通过服务应用的标识信息(例如，身份标识号(identity document，ID))来识别并验证控制命令。具体地，智能车辆提供的每一项服务具有一个整车级的全局ID。当服务提供方(例如，整车控制域)收到来自服务调用方(例如，智能座舱)的控制命令时，服务提供方基于该控制命令携带的服务ID和基于该服务ID的访问控制策略，决策该控制命令是否合法，进而决策是否向执行设备发送该控制命令。
然而，当服务调用方被入侵时，服务ID容易被获取或伪造。因此，仅靠服务ID进行鉴权不足以保证车辆中服务调用的安全性。寻求一种能够保证服务安全调用的方案是亟待解决的问题。
发明内容
本申请提供了一种服务调用方法、通信装置、服务调用系统以及车辆，用于提高服务调用的安全性。
第一方面，本申请提供了一种服务调用方法，该服务调用方法可以由服务提供方执行，也可以由服务提供方的部件(例如，处理器、芯片或芯片系统等部件)执行。示例性的，该服务提供方可以是整车控制域(也被称为车身域控制(vehicle domain control，VDC)或车辆域控制)，也可以是车辆中的通信盒子(Telematics Box，T-Box)，还可以是T-Box和整车控制域的组合。在该方法中，服务提供方接收来自服务调用方的第一控制命令和该第一控制命令的验证信息。其中，该第一控制命令用于调用第一服务，该第一控制命令的验证信息用于验证该第一控制命令。此外，该第一控制命令的验证信息包括第一行为信息，该第一行为信息用于指示用户触发生成该第一控制命令的行为。然后，该服务提供方基于该第一控制命令的验证信息验证该第一控制命令；若验证该第一控制命令通过，则该服务提供方向执行设备发送该第一控制命令，该执行设备用于执行该第一控制命令。
本实施方式中，服务提供方接收的用于验证第一控制命令的验证信息包括第一行为信息，该第一行为信息用于指示用户触发生成该第一控制命令的行为。服务提供方能够基于第一行为信息确定该第一控制命令是由用户的行为触发的，而不是攻击者伪造的。因此，基于第一行为信息对第一控制命令进行合法性校验，有利于提高车身控制服务调用的安全性。
在一种可能的实施方式中，该服务提供方基于该第一控制命令的验证信息验证该第一控制命令，包括：该服务提供方基于该第一行为信息和第一映射规则确定该第一行为信息对应的第二控制命令，该第一映射规则包括至少一种行为信息以及每种行为信息对应的控制命令；若该第一控制命令与该第二控制命令相同，则该服务提供方确定验证该第一控制命令通过。
本实施方式中，服务提供方接收的用于验证第一控制命令的验证信息包括第一行为信息，服务提供方能够基于第一行为信息在第一映射规则中查找到第二控制命令。当服务提供方确定第一控制命令与基于第一行为信息确定的第二控制命令相同时，服务提供方确定该第一控制命令是由用户触发且未被篡改的，才触发向执行设备发送该第一控制命令。因此，有利于提高车身控制服务调用的安全性。
在一种可能的实施方式中，该第一控制命令的验证信息还包括该第一执行流信息，该第一执行流信息用于指示调用第一服务的过程信息；该第一映射规则还包括调用每个服务的执行流信息。此时，服务提供方既要比对第一行为信息对应的控制命令，又要比对该控制命令对应的服务的执行流信息。具体地，若该第一控制命令与该第二控制命令相同，则该服务提供方基于该第二控制命令和该第一映射规则确定与该第二控制命令对应的第二执行流信息；若该第一执行流信息与该第二执行流信息相同，则该服务提供方确定验证该第一控制命令通过。
可选的，该第一执行流信息为调用第一服务的执行流或调用第一服务的执行流的哈希值。其中，该服务调用的执行流是服务调用方在基于行为信息生成控制命令过程中执行的指令或跳转指令的集合。因此，该服务调用的执行流能够反映该服务调用过程的完整性。若该服务调用过程有攻击者的篡改行为发生，则服务调用方收集的执行流必定有反应篡改行为的指令。因此，由用户触发生成控制命令的服务调用的执行流和经过攻击者篡改的服务调用的执行流是不同的。因此，采用服务调用的执行流作为控制命令的验证信息有利于服务提供方识别出是否遭受攻击，有利于提高服务调用过程的安全性。
在一种可能的实施方式中，该第一行为信息包括第一坐标，该第一坐标为该用户的操作对应的坐标；该第一映射规则中的至少一种行为信息中的每种行为信息包括至少一个坐标区域。该服务提供方基于该第一行为信息和第一映射规则确定该第一行为信息对应的第二控制命令，包括：该服务提供方确定该第一坐标所在的坐标区域；该服务提供方基于该第一映射规则确定该第一坐标所在的坐标区域对应的控制命令为该第二控制命令。
示例性的，若用户通过触屏输入指令，则该第一行为信息包括第一坐标，该第一坐标为该用户在触屏上的操作对应的坐标。需要说明的是，该第一坐标可以是触屏上某一个点击位置的坐标值。例如，用户仅点击触屏上某一个按键便能够触发生成第一控制命令。此外，该第一坐标也可以是触屏上某几个点击位置的坐标值。例如，用户连续点击触屏上某几个按键才能够触发生成第一控制命令。此外，该第一坐标还可以是连续的坐标范围。例如，用户在触屏上连续滑动以做出特定的滑动手势(例如，手指在触屏向左滑动或者手指在触屏向右滑动)，该特定的手势能够触发生成第一控制命令。在实际应用中，还可以是用户的其他行为使得服务调用方检测到一个或多个坐标。
本实施方式中，提出将用户的操作对应的坐标作为第一行为信息。由于，用户在触屏上进行了操作才会生成前述坐标，因此，采用前述坐标作为第一行为信息能够体现用户的行为， 有利于服务提供方基于该坐标确定该第一控制命令是由用户的行为触发的，而不是攻击者伪造的，进而有利于提高车身控制服务调用的安全性。
在一种可能的实施方式中，该第一行为信息包括第一语义信息，该第一语义信息为基于该用户输入的语音指令生成的语义；该第一映射规则中的至少一种行为信息中的每种行为信息包括一个语义信息；该服务提供方基于该第一行为信息和第一映射规则确定该第一行为信息对应的第二控制命令，包括：该服务提供方基于该第一映射规则确定该第一语义信息对应的控制命令为该第二控制命令。
本实施方式中，提出将用户发出的语音指令转换而成的第一语义信息作为第一行为信息。由于，用户对麦克风发出语音指令才会生成前述第一语义信息，因此，采用前述第一语义信息作为第一行为信息能够体现用户的行为，有利于服务提供方基于该第一语义信息确定该第一控制命令是由用户的行为触发的，而不是攻击者伪造的，进而有利于提高车身控制服务调用的安全性。
在一种可能的实施方式中，该第一行为信息包括第一时间信息，该第一时间信息为该服务调用方检测到用户触发生成该第一控制命令的行为的时间。例如，若该第一行为信息包括第一坐标，则该第一时间信息指示的第一时间为该用户在该触屏上点击该坐标的时间。又例如，若该第一行为信息包括第一语义信息，则该第一时间信息指示的第一时间为服务调用方检测到该语音指令的时间。具体地，若该服务提供方确定该第一时间信息指示的时刻与当前时刻的差值位于第一阈值范围之外，则该服务提供方确定验证第一控制命令不通过。
本实施方式中，服务提供方基于第一时间信息确定该第一控制命令是否为重放攻击，有利于识别重放攻击，有利于提高服务调用过程的安全性。
在一种可能的实施方式中，该第一控制命令的验证信息经过服务调用方签名。该服务提供方基于该第一行为信息和第一映射规则确定该第一行为信息对应的第二控制命令之前，该方法还包括：该服务提供方验证该第一控制命令的验证信息的签名。若该服务提供方验证该第一控制命令的验证信息的签名通过，则该服务提供方基于该第一行为信息和第一映射规则确定该第一行为信息对应的第二控制命令；若该服务提供方验证该第一控制命令的验证信息的签名不通过，则服务提供方确定验证第一控制命令不通过。
本实施方式中，若第一控制命令的验证信息具有签名，该服务提供方需要验证该第一控制命令的验证信息的签名是否来自与服务调用方。通过签名验证过程，服务提供方能够识别该第一控制命令的验证信息是否为经过服务调用方签名的验证信息，有利于提高服务调用过程的安全性。
在一种可能的实施方式中，该方法还包括：若该第一控制命令与该第二控制命令不相同，则该服务提供方确定验证第一控制命令不通过。
本实施方式中，当第一控制命令与基于第一映射规则和第一行为信息确定的第二控制命令不相同，说明该第一控制命令与第一行为信息不匹配，进而确定验证第一控制命令不通过，即该第一控制命令不是合法的命令。因此，有利于服务提供方识别出伪造的控制命令，进而有利于提高服务调用过程的安全性。
在一种可能的实施方式中，该方法还包括：若该第一执行流信息与该第二执行流信息不相同，则该服务提供方确定验证第一控制命令不通过。
本实施方式中，当第一执行流信息与基于第一映射规则和第一控制命令确定的第二执行流信息不相同，说明该第一执行流信息与第一控制命令不匹配，进而识别出伪造的或被篡改的执行流信息。此时，该服务提供方将确定该第一控制命令验证不通过，因此，有利于服务提供方识别出伪造的控制命令，进而有利于提高服务调用过程的安全性。
在一种可能的实施方式中，该方法还包括：若服务提供方确定验证第一控制命令不通过，则服务提供方向用户提示告警信息，该告警信息用于指示验证该第一控制命令不通过；或者，若服务提供方确定验证第一控制命令不通过，则所述服务提供方向所述服务调用方发送告警信息，所述服务调用方用于向用户提示所述告警信息。
本实施方式中，服务提供方在验证第一控制命令不通过的情况下还将直接或间接地向用户提示告警信息。有利于用户快速察觉异常，进而为用户的行车决策提供参考，提升用户的行车体验。
在一种可能的实施方式中，该第一执行流信息由该服务调用方中的可信模块获取。
其中，可信模块是权限高于操作系统(即内核)的处理模块，即服务调用方中的可信模块的权限高于服务调用方中的内核的权限。也可以理解为，可信模块的运行环境的权限高于内核的运行环境的权限。由于，可信模块的权限高于内核的权限，因此，攻击者不容易攻破可信模块而篡改可信模块中的数据。因此，由可信模块获取的第一行为信息的方案相比于由传统技术中的内核获取第一行为信息的方案，能够使得第一行为信息更不容易被窃取或篡改，提高了服务调用方获取第一行为信息的准确性和安全性。
第二方面，本申请提供了一种服务调用方法，该服务调用方法可以由服务调用方执行，也可以由服务调用方的部件(例如，处理器、芯片或芯片系统等部件)执行。示例性的，该服务调用方可以是智能座舱或智能终端设备(例如，智能手机、智能手表或者其他的智能穿戴设备等)。在该方法中，服务调用方获取第一行为信息，该第一行为信息用于指示用户触发了生成第一控制命令的行为；该服务调用方基于该第一行为信息生成该第一控制命令，该第一控制命令用于调用第一服务；该服务调用方发送该第一控制命令和该第一控制命令的验证信息，该第一控制命令的验证信息包括该第一行为信息，该第一控制命令的验证信息用于验证该第一控制命令。
本实施方式中，服务调用方将第一行为信息作为第一控制命令的验证信息与第一控制命令一起发送给服务提供方，以使得服务提供方能够基于第一行为信息确定该第一控制命令是由用户的行为触发的，而不是攻击者伪造的。因此，基于第一行为信息对第一控制命令进行合法性校验，有利于提高车身控制服务调用的安全性。
在一种可能的实施方式中，该服务调用方获取第一行为信息，包括：该服务调用方中的可信模块获取该第一行为信息。其中，可信模块是权限高于操作系统(即内核)的处理模块，即服务调用方中的可信模块的权限高于服务调用方中的内核的权限。也可以理解为，可信模块的运行环境的权限高于内核的运行环境的权限。由于，可信模块的权限高于内核的权限，因此，攻击者不容易攻破可信模块而篡改可信模块中的数据。因此，由可信模块获取的第一行为信息的方案相比于由传统技术中的内核获取第一行为信息的方案，能够使得第一行为信息更不容易被窃取或篡改，提高了服务调用方获取第一行为信息的准确性和安全性。
在一种可能的实施方式中，该可信模块的运行环境与该内核的运行环境相互独立。当内核遭受攻击者攻击时，可信模块不会受影响。因此，即使内核中的数据被攻击者篡改，可信模块中的数据不会受影响，该可信模块中的数据仍然是准确且安全的。
在一种可能的实施方式中，可信模块具有对存储模块的读权限和写权限，该内核没有对该存储模块的访问权限，该存储模块用于存储该第一行为信息。其中，所述存储模块包括寄存器和/或内存。由于，传统技术中的内核具有对存储模块的读权限和/或写权限，因此，传统技术中位于内核中的数据容易被攻击篡改。将本申请中的服务调用方中的内核配置为没有对存储模块的访问权限，因此，能够避免攻击者通过内核对存储模块中的数据进行窃取或篡改。此外，将本申请中的服务调用方中的可信模块配置为具有对存储模块的读权限和写权限，由于可信模块的权限本就高于内核的权限而相比于内核不容易被攻击者攻破，因此，能够保证可信模块获取的第一行为信息的准确性和安全性。
在一种可能的实施方式中，该服务调用方向服务提供方发送该第一控制命令和该第一控制命令的验证信息之前，该方法还包括：该服务调用方获取该第一执行流信息，该第一执行流信息用于指示调用该第一服务的过程信息。
可选的，该第一执行流信息为调用第一服务的执行流或调用第一服务的执行流的哈希值。其中，该服务调用的执行流是服务调用方在基于行为信息生成控制命令过程中执行的指令或跳转指令的集合。因此，该服务调用的执行流能够反映该服务调用过程的完整性。若该服务调用过程有攻击者的篡改行为发生，则服务调用方收集的执行流必定有反应篡改行为的指令。因此，由用户触发生成控制命令的服务调用的执行流和经过攻击者篡改的服务调用的执行流是不同的。因此，采用服务调用的执行流作为控制命令的验证信息有利于服务提供方识别出是否遭受攻击，有利于提高服务调用过程的安全性。
在一种可能的实施方式中，该服务调用方获取该第一执行流信息，包括：该服务调用方中的可信模块获取该第一执行流信息。
本实施方式中，由于，该第一执行流信息是由该服务调用方中的可信模块获取的，因此，能够保证作为验证信息的第一执行流信息是安全且可靠的。又由于，第一执行流信息是服务调用方在基于第一行为信息生成第一控制命令时必然会产生的信息，因此，将第一执行流信息作为验证信息之一，能够保证第一控制命令是由用户触发的，而不是攻击者伪造的。因此，将第一执行流信息和第一行为信息作为第一控制命令的验证信息有利于提高车身控制服务的安全性和可靠性。
在一种可能的实施方式中，该第一控制命令的验证信息经过服务调用方密钥签名；该服务调用方向服务提供方发送该第一控制命令和该第一控制命令的验证信息之前，该方法还包括：该服务调用方采用密钥对该第一控制命令的验证信息进行签名处理。
本实施方式中，提出对第一控制命令的验证信息进行签名处理，有利于提升攻击者伪造第一控制命令的验证信息的难度，进而有利于提高服务调用过程的安全性。
在一种可能的实施方式中，该第一行为信息包括第一坐标，该第一坐标为用户的操作对应的坐标；或者，该第一行为信息包括第一语义信息，该第一语义信息为基于用户的输入的语音指令生成的语义。
本实施方式中，提出将用户的操作对应的坐标作为第一行为信息。由于，用户在触屏上 进行了操作才会生成前述坐标，因此，采用前述坐标作为第一行为信息能够体现用户的行为，有利于服务提供方基于该坐标确定该第一控制命令是由用户的行为触发的，而不是攻击者伪造的，进而有利于提高车身控制服务调用的安全性。
在一种可能的实施方式中，该第一行为信息包括第一时间信息，该第一时间信息为该服务调用方检测到用户触发生成该第一控制命令的行为的时间。例如，若该第一行为信息包括第一坐标，则该第一时间信息指示的第一时间为该用户在该触屏上点击该坐标的时间。又例如，若该第一行为信息包括第一语义信息，则该第一时间信息指示的第一时间为服务调用方检测到该语音指令的时间。
本实施方式中，提出将用户发出的语音指令转换而成的第一语义信息作为第一行为信息。由于，用户对麦克风发出语音指令才会生成前述第一语义信息，因此，采用前述第一语义信息作为第一行为信息能够体现用户的行为，有利于服务提供方基于该第一语义信息确定该第一控制命令是由用户的行为触发的，而不是攻击者伪造的，进而有利于提高车身控制服务调用的安全性。
在一种可能的实施方式中，该可信模块包括如下至少一项：虚拟机监视器、可信内核或可信执行环境TEE。
本实施方式中，提供了多种可信模块的具体实施方式，有利于提高可信模块在具体实现的多样性。
需要说明的是，本方面的具体实施方式和有益效果与前文第一方面中的部分实施方式类似，具体可参见第一方面的具体实施方式和其有益效果，在此不再赘述。
第三方面，本申请提供了一种通信装置，该通信装置可以是服务提供方，也可以是服务提供方的部件(例如，处理器、芯片或芯片系统等部件)。该通信装置包括：收发模块和处理模块。其中，收发模块用于接收来自服务调用方的第一控制命令和该第一控制命令的验证信息，该第一控制命令用于调用第一服务，该第一控制命令的验证信息用于验证该第一控制命令，该第一控制命令的验证信息包括第一行为信息，该第一行为信息用于指示用户触发生成该第一控制命令的行为。处理模块用于基于该第一控制命令的验证信息验证该第一控制命令，以及，当验证该第一控制命令通过时，控制收发模块向执行设备发送该第一控制命令，该执行设备用于执行该第一控制命令。
在一种可能的实施方式中，处理模块，具体用于基于该第一行为信息和第一映射规则确定该第一行为信息对应的第二控制命令，该第一映射规则包括至少一种行为信息以及每种行为信息对应的控制命令；以及，当该第一控制命令与该第二控制命令相同时，确定验证该第一控制命令通过。
在一种可能的实施方式中，该第一控制命令的验证信息还包括该第一执行流信息，该第一执行流信息用于指示调用第一服务的过程信息；该第一映射规则还包括每个服务的执行流信息。
处理模块，具体用于当该第一控制命令与该第二控制命令相同时，基于该第二控制命令和该第一映射规则确定与该第二控制命令对应的第二执行流信息；以及，当该第一执行流信息与该第二执行流信息相同时，确定验证该第一控制命令通过。
可选的，该第一执行流信息为调用第一服务的执行流或调用第一服务的执行流的哈希值。
在一种可能的实施方式中，该第一行为信息包括第一坐标，该第一坐标为该用户的操作对应的坐标；该第一映射规则中的至少一种行为信息中的每种行为信息包括至少一个坐标区域。该处理模块，具体用于确定该第一坐标所在的坐标区域；以及，基于该第一映射规则确定该第一坐标所在的坐标区域对应的控制命令为该第二控制命令。
在一种可能的实施方式中，该第一行为信息包括第一语义信息，该第一语义信息为基于该用户输入的语音指令生成的语义；该第一映射规则中的至少一种行为信息中的每种行为信息包括一个语义信息。该处理模块，具体用于基于该第一映射规则确定该第一语义信息对应的控制命令为该第二控制命令。
在一种可能的实施方式中，该第一行为信息包括第一时间信息，该第一时间信息为该服务调用方检测到用户触发生成该第一控制命令的行为的时间。处理模块，具体用于在该服务提供方确定该第一时间信息指示的时刻与当前时刻的差值位于第一阈值范围之外的情况下，确定验证所述第一控制命令不通过。
在一种可能的实施方式中，该第一控制命令的验证信息经过服务调用方签名。处理模块，还用于验证该第一控制命令的验证信息的签名；以及，在验证该第一控制命令的验证信息的签名成功的情况下，基于该第一行为信息和第一映射规则确定该第一行为信息对应的第二控制命令。
在一种可能的实施方式中，处理模块，还用于在该服务提供方验证该第一控制命令的验证信息的签名不通过的情况下，确定验证该第一控制命令不通过。
在一种可能的实施方式中，处理模块，还用于在该第一控制命令与该第二控制命令不相同的情况下，确定验证第一控制命令不通过。
在一种可能的实施方式中，处理模块，还用于在该第一执行流信息与该第二执行流信息不相同的情况下，确定验证第一控制命令不通过。
在一种可能的实施方式中，处理模块，还用于在确定验证第一控制命令不通过时，控制输入输出模块向用户提示告警信息，所述告警信息用于指示验证所述第一控制命令不通过；或者，处理模块，还用于在确定验证第一控制命令不通过时，控制收发模块向服务调用方发送告警信息，所述服务调用方用于向用户提示所述告警信息。
在一种可能的实施方式中，其特征在于，该第一执行流信息由该服务调用方中的可信模块获取。
需要说明的是，本方面的具体实施方式和有益效果与前文第一方面中的部分实施方式类似，具体可参见第一方面的具体实施方式和其有益效果，在此不再赘述。
第四方面，本申请提供了一种通信装置，该通信装置可以是服务调用方，也可以是服务调用方的部件(例如，处理器、芯片或芯片系统等部件)。该通信装置包括：收发模块和处理模块。其中，处理模块用于获取第一行为信息，该第一行为信息用于指示用户触发了生成第一控制命令的行为；以及，基于该第一行为信息生成该第一控制命令，该第一控制命令用于调用第一服务。收发模块，用于发送该第一控制命令和该第一控制命令的验证信息，该第一控制命令的验证信息包括该第一行为信息，该第一控制命令的验证信息用于验证该第一控制命令。
在一种可能的实施方式中，该处理模块包括可信模块。该通信装置中的可信模块获取该 第一行为信息，该可信模块的权限高于该服务调用方中的内核的权限。
可选的，该可信模块的运行环境与该内核的运行环境相互独立。
可选的，该可信模块具有对存储模块的读权限和写权限，该内核没有对该存储模块的访问权限，该存储模块用于存储该第一行为信息。
在一种可能的实施方式中，该处理模块还用于获取该第一执行流信息，该第一执行流信息用于指示调用该第一服务的过程信息。可选的，该第一执行流信息为调用第一服务的执行流或调用第一服务的执行流的哈希值。
在一种可能的实施方式中，该通信装置中的可信模块获取该第一执行流信息。
在一种可能的实施方式中，该第一控制命令的验证信息经过服务调用方签名。该处理模块，还用于采用密钥对该第一控制命令的验证信息进行签名处理。
在一种可能的实施方式中，该第一行为信息包括第一坐标，该第一坐标为用户的操作对应的坐标；或者，该第一行为信息包括第一语义信息，该第一语义信息为基于用户输入的语音指令生成的语义。
在一种可能的实施方式中，该第一行为信息包括第一时间信息，该第一时间信息为该服务调用方检测到用户触发生成该第一控制命令的行为的时间。
在一种可能的实施方式中，该可信模块包括如下至少一项：虚拟机监视器、可信内核或可信执行环境TEE。
需要说明的是，本方面的具体实施方式和有益效果与前文第二方面中的部分实施方式类似，具体可参见第二方面的具体实施方式和其有益效果，在此不再赘述。
第五方面，本申请实施例提供了一种通信装置，该通信装置可以是前述实施方式中的服务提供方，也可以是该服务提供方内的芯片。该通信装置可以包括处理模块和收发模块。当该通信装置是服务提供方时，该处理模块可以是处理器，该收发模块可以是收发器；该服务提供方还可以包括存储模块，该存储模块可以是存储器；该存储模块用于存储指令，该处理模块执行该存储模块所存储的指令，以使该服务提供方执行第一方面或第一方面的任一种实施方式中的方法。当该通信装置是服务提供方内的芯片时，该处理模块可以是处理器，该收发模块可以是输入/输出接口、管脚或电路等；该处理模块执行存储模块所存储的指令，以使该服务提供方执行第一方面或第一方面的任一种实施方式中的方法。该存储模块可以是该芯片内的存储模块(例如，寄存器、缓存等)，也可以是该服务提供方内的位于该芯片外部的存储模块(例如，只读存储器、随机存取存储器等)。
第六方面，本申请实施例提供了一种通信装置，该通信装置可以是前述实施方式中的服务调用方，也可以是该服务调用方内的芯片。该通信装置可以包括处理模块和收发模块。当该通信装置是服务调用方时，该处理模块可以是处理器，该收发模块可以是收发器；该服务调用方还可以包括存储模块，该存储模块可以是存储器；该存储模块用于存储指令，该处理模块执行该存储模块所存储的指令，以使该服务调用方执行第二方面或第二方面的任一种实施方式中的方法。当该通信装置是服务调用方内的芯片时，该处理模块可以是处理器，该收发模块可以是输入/输出接口、管脚或电路等；该处理模块执行存储模块所存储的指令，以使该服务调用方执行第二方面或第二方面的任一种实施方式中的方法。该存储模块可以是该芯片内的存储模块(例如，寄存器、缓存等)，也可以是该服务调用方内的位于该芯片外部的存 储模块(例如，只读存储器、随机存取存储器等)。
第七方面，本申请提供了一种通信装置，该装置可以是集成电路芯片。该集成电路芯片包括处理器。该处理器与存储器耦合，该存储器用于存储程序或指令，当该程序或指令被该处理器执行时，使得该通信装置执行如前述各个方面的中的任一种实施方式所介绍的方法。
第八面，本申请实施例提供了一种包含指令的计算机程序产品，当其在计算机上运行时，使得该计算机执行如前述各个方面中的任一种实施方式所介绍的方法。
第九方面，本申请实施例提供了一种计算机可读存储介质，包括指令，当该指令在计算机上运行时，以使得计算机执行如前各个方面中的任一种实施方式所介绍的方法。
第十方面，本申请实施例提供了一种服务调用系统，该服务调用系统包括执行前述第一方面以及第一方面的任一种实施方式中的服务提供方；或者，该服务调用系统包括执行前述第二方面以及第二方面的任一种实施方式中的服务调用方。
第十一方面，本申请实施例提供了一种车辆，该车辆包括执行前述第一方面以及第一方面的任一种实施方式中的服务提供方；或者，该车辆包括执行前述第二方面以及第二方面的任一种实施方式中的服务调用方。
附图说明
为了更清楚地说明本申请实施例的技术方案，下面将对实施例描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本申请的一些实施例。
图1A为本申请提出的服务调用方法适用的一个系统架构图；
图1B为本申请提出的服务调用方法适用的一个系统架构图；
图1C为本申请的服务调用方法适用的处理器架构的一种示例图；
图1D为本申请的服务调用方法适用的处理器架构的另一种示例图；
图2为本申请中服务调用方法的一个流程图；
图3为本申请中服务调用方法的另一个流程图；
图4为本申请中通信装置的一个实施例示意图。
具体实施方式
下面将结合本申请实施例中的附图，对本申请实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例仅仅是本申请一部分实施例，而不是全部的实施例。
本申请的说明书和权利要求书及上述附图中的术语“第一”、“第二”、“第三”、“第四”等(如果存在)是用于区别类似的对象，而不必用于描述特定的顺序或先后次序。应该理解这样使用的术语在适当情况下可以互换，以便这里描述的实施例能够以除了在这里图示或描述的内容以外的顺序实施。此外，术语“包括”和“具有”以及他们的任何变形，意图在于覆盖不排他的包含，例如，包含了一系列步骤或单元的过程、方法、系统、产品或设备不必限于清楚地列出的那些步骤或单元，而是可包括没有清楚地列出的或对于这些过程、方法、产品或设备固有的其它步骤或单元。
应理解，本文中术语“和/或”，仅仅是一种描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B这三种情况。另外，本文中字符“/”，一般表示前后关联对象是一种“或”的关系。
为便于理解，下面先对本申请的服务调用方法适用的系统架构和应用场景进行介绍：
本申请提供的服务调用方法主要应用于用户触发生成控制命令以调用车辆中的服务的场景。例如，用户通过车辆的软件或硬件输入控制命令以调用该控制命令对应的服务。
如图1A和图1B所示，本申请提供的服务调用方法适用的系统主要包括服务调用方、服务提供方和执行设备。
其中，服务调用方是响应用户的指令而生成控制命令以调用该控制命令对应的服务的设备或功能模块。而服务提供方是车辆中基于控制命令提供服务的设备或功能模块。此外，执行设备用于执行控制命令以实现该控制命令对应的服务。其中，前述服务可以是开关车门、开关车窗、开关雨刮器、调整座椅等车身控制服务，也可以是空中下载技术(over the air technology，OTA)通常是指升级、诊断等服务，还可以是其他的车辆服务，本申请不限制。
示例性的，以该服务为车身控制服务为例。该车身控制服务可以是门窗控制服务、雨刮控制服务、座椅控制服务或车灯控制服务等。若用户想打开车窗，用户可以通过服务调用方触发生成指示打开车窗的控制命令，该服务提供方在收到该控制命令后将对该控制命令进行合法性校验。若服务提供方确定该控制命令是合法的命令，则该服务提供方将该控制命令发送至该控制命令对应的执行设备。
示例性的，服务调用方可以是智能座舱或智能终端设备(例如，智能手机、智能手表或者其他的智能穿戴设备等)。该服务提供方可以是整车控制域(也被称为车身域控制(vehicle domain control，VDC)或车辆域控制)，也可以是车辆中的通信盒子(Telematics Box，T-Box)，还可以是T-Box和整车控制域的组合。该执行设备可以是驱动车身硬件的电机或控制器。例如，若控制命令为打开车窗，则该执行设备为车窗相关的控制电机，通过启动该控制电机控制打开车窗。需要说明的是，本申请中，当前述服务调用方为智能座舱时，前述服务提供方为整车控制域。例如，在如图1A所示示例中，用户可以通过点击智能座舱上的触摸屏上的按键触发生成控制命令。该整车控制域在收到该控制命令后对该控制命令进行合法性校验，以决策是否将该控制命令发送至该控制命令对应的执行设备。当前述服务调用方为终端设备时，服务提供方包括通信盒子和/或整车控制域。例如，在如图1B所示示例中，用户通过智能终端触发生成控制命令。该通信盒子在收到该控制命令后可以对该控制命令进行合法性校验，也可以该通信盒子将控制命令透传给整车控制域，由该整车控制域对该控制命令进行合法性校验。
此外，前述服务调用方的处理架构包括内核和可信模块。其中，可信模块的权限高于内核的权限，可信模块相比与内核更不容易被攻击。为便于理解，下面将结合常见的两种处理器架构的示例进行介绍：
如图1C所示，为本申请的服务调用方法适用的一种处理器架构的示例，该示例为进阶精简指令集机器(Advanced RISC Machine，ARM)架构。在该架构中，服务调用方包括多个特权级别(exception levels，EL)，从特权级别0(EL0)、特权级别1(EL1)到特权级别2(EL2)权限逐渐提高，即软件的执行权限相应的增加。其中，EL0被称为无特权执行，用于 运行车身控制应用；EL1用于运行操作系统(即内核(Kernel))；EL2提供了对虚拟化的支持，用于运行虚拟机监视器(Hypervisor)。可选的，EL1还用于可信内核(Trusted Kernel)。此外，基于硬件隔离技术的ARM架构还可以运行可信执行环境(trusted execution environment，TEE)。在如图1C所示的架构中，虚拟机监视器(Hypervisor)、可信内核和可信执行环境任意一项均可以作为可信模块执行后文将介绍的服务调用方法。
如图1D所示，为本申请的服务调用方法适用的另一种处理器架构的示例，该示例为X86_64架构。在该架构中，服务调用方包括多个权限级别(Rings)。从权限级别0(Ring0)到权限级别3(Ring3)权限逐渐降低，即软件的执行权限相应的减少。其中，Ring3的权限最低，用于运行车身控制应用；Ring0的权限高于Ring3的权限，通常用于运行操作系统(即内核(Kernel))。此外，虚拟机器扩展根模块式(virtual-machine extensions root mode，VMX root mode)(也被称为硬件虚拟化技术下的特权模式)的权限高于虚拟机器扩展非根模块式(virtual-machine extensions non-root mode，VMX non-root mode)(也被称为硬件虚拟化技术下的非特权模式)的权限，用于运行虚拟机监视器(virtual-machine monitors，VMM)，虚拟机监视器通过配置虚拟控制结构(virtual-machine control data structure，VMCS)来控制虚拟机的执行。在如图1D所示的架构中，虚拟机监视器VMM和虚拟控制结构VMCS均可以作为可信模块执行后文将介绍的服务调用方法。
在该系统中，传统技术中的服务提供方是基于服务调用方发送的ID对控制命令进行合法性校验。当服务调用方被入侵时，服务ID容易被获取或伪造。因此，仅靠服务ID对控制命令进行合法性校验不足以保证车辆中服务调用的安全性。
对此，本申请提供了一种服务调用方法，主要应用于基于软件的车身控制场景。该方法中基于用户的行为对收到的控制命令进行验证，能够识别出由攻击者伪造的控制命令，进而能够提高车身控制服务的调用的安全性。
下面将结合图2对本申请的服务调用方法的一种实施例的主要流程进行介绍。该方法中，服务调用方和服务提供方主要执行如下步骤：
步骤201，服务调用方获取第一行为信息。
其中，第一行为信息用于指示用户触发生成第一控制命令的行为。其中，第一控制命令用于调用第一服务。示例性的，若第一控制命令为车身控制命令，则第一服务为车身控制服务。例如，若第一控制命令为开车门命令，则第一服务为开车门服务；若第一控制命令为开车窗命令，则第一服务为开车窗服务；若第一控制命令为开雨刮器命令，则第一服务为开雨刮器服务。该第一行为信息也可以理解为服务调用方检测到的用户发出的能够触发生成第一控制命令而调用第一服务的行为。
具体地，用户输入指令时使用的输入输出硬件不同，服务调用方检测到的第一行为信息的具体实现方式不同。
在一种可能的实施方式中，若用户通过触屏输入指令，则该第一行为信息包括第一坐标，该第一坐标为该用户的操作对应的坐标。可选的，该第一行为信息还包括第一时间信息，该第一时间信息指示的第一时间为基于用户的操作而产生该坐标的时间。
需要说明的是，该第一坐标可以是用户在触屏(例如，车载中控屏)上的点击、滑动等 操作对应的坐标。具体地，该第一坐标可以是触屏上某一个点击位置的坐标值。例如，用户仅点击触屏上某一个按键便能够触发生成第一控制命令。此外，该第一坐标也可以是触屏上某几个点击位置的坐标值。例如，用户连续点击触屏上某几个按键才能够触发生成第一控制命令。此外，该第一坐标还可以是连续的坐标范围。例如，用户在触屏上连续滑动以做出特定的滑动手势(例如，手指在触屏向左滑动或者手指在触屏向右滑动)，该特定的手势能够触发生成第一控制命令。在实际应用中，还可以是用户的其他行为使得服务调用方检测到一个或多个坐标。
在另一种可能的实施方式中，若用户通过麦克风输入语音指令，则该第一行为信息包括第一语义信息，该第一语义信息为基于该用户的输入的语音指令生成的语义。可选的，该第一行为信息还包括第一时间信息，该第一时间信息指示的第一时间为服务调用方检测到该语音指令的时间。
在实际应用中，生成第一行为信息的行为除了可以是点击智能座舱的触摸屏和说出语音指令之外，还可以是其他的能够实现人机交互的行为。例如，通过传感器检测用户做出的特定手势等，此处不做限定。在后续实施例中，以第一行为信息包括第一坐标和第一时间为例进行详细介绍。
可选的，服务调用方中的可信模块获取第一行为信息。具体地，用户通过服务调用方中的硬件(例如，输入输出硬件)产生电信号并传输至可信模块，由该可信模块对该电信号打上时间戳，得到该第一行为信息。
其中，可信模块是权限高于操作系统(即内核)的处理模块，即服务调用方中的可信模块的权限高于服务调用方中的内核的权限。也可以理解为，可信模块的运行环境的权限高于内核的运行环境的权限。由于，可信模块的权限高于内核的权限，因此，攻击者不容易攻破可信模块而篡改可信模块中的数据。因此，由可信模块获取的第一行为信息的方案相比于由传统技术中的内核获取第一行为信息的方案，能够使得第一行为信息更不容易被窃取或篡改，提高了服务调用方获取第一行为信息的准确性和安全性。
需要说明的是，在不同的处理器架构中，可信模块的具体实现形式不同。示例性的，在如图1C所示的ARM架构中，可信模块可以由可信内核(Trusted Kernel)、虚拟机监视器(Hypervisor)和可信执行环境TEE中的任意一项实现。示例性的，在如图1D所示的X86_64架构中，可信模块可以是虚拟机监视器VMM或虚拟控制结构VMCS。
可选的，可信模块的运行环境与该内核的运行环境相互独立。当内核遭受攻击者攻击时，可信模块不会受影响。因此，即使内核中的数据被攻击者篡改，可信模块中的数据不会受影响，该可信模块中的数据仍然是准确且安全的。
可选的，可信模块具有对存储模块的读权限和写权限，该内核没有对该存储模块的访问权限，该存储模块用于存储该第一行为信息。其中，所述存储模块包括寄存器和/或内存。由于，传统技术中的内核具有对存储模块的读权限和/或写权限，因此，传统技术中位于内核中的数据容易被攻击篡改。将本申请中的服务调用方中的内核配置为没有对存储模块的访问权限，因此，能够避免攻击者通过内核对存储模块中的数据进行窃取或篡改。此外，将本申请中的服务调用方中的可信模块配置为具有对存储模块的读权限和写权限，由于可信模块的权 限本就高于内核的权限而相比于内核不容易被攻击者攻破，因此，能够保证可信模块获取的第一行为信息的准确性和安全性。
需要说明的是，用户采用的输入输出硬件不同，传输给可信模块的电信号不同。下面分别进行介绍：
在一种可能的实施方式中，若用户通过触屏输入指令，则该第一行为信息包括第一坐标和第一时间。例如，当用户点击智能座舱上的触屏时，触屏的寄存器将检测到的电信号进行数字化处理，然后将该电信号传输至可信模块。
为便于理解，以图1C所示的处理器架构为例。若可信模块为虚拟机监视器(Hypervisor)，则触屏检测到用户的点击操作并将点击的坐标记录在存储模块之后，虚拟机监视器能够从该存储模块获取用户点击的坐标，即可信模块获取到第一坐标。可信的，虚拟机监视器(Hypervisor)在拿到第一坐标之后打上时间戳，得到包含第一坐标和第一时间的第一行为信息。需要说明的是，图1C和图1D所示示例中的其他的可信模块(例如，可信内核、TEE或VMM)获取第一行为信息的过程与虚拟机监视器获取第一行为信息的过程类似，此处不予赘述。
在另一种可能的实施方式中，若用户通过麦克风输入语音指令，则该第一行为信息包括第一语义信息和第一时间。例如，当用户发出语音指令时，麦克风将检测到的模拟信号转换为电信号，进而传输给语义识别模块识别出语义信息，然后将该语义信息传输至可信模块。
为便于理解，仍旧以图1C所示的处理器架构为例。若可信模块为虚拟机监视器(Hypervisor)，则麦克风检测到用户的语音指令并将该语义指令转换为语义信息并记录在存储模块之后，虚拟机监视器能够从该存储模块获取该语义信息，即可信模块获取到第一语义信息。可信的，虚拟机监视器(Hypervisor)在拿到第一语义信息之后打上时间戳，得到包含第一语义信息和第一时间的第一行为信息。
步骤202，服务调用方基于第一行为信息生成第一控制命令。
具体地，以第一行为信息包括第一坐标和第一时间为例。服务调用方基于第一坐标确定该第一坐标相对于触屏界面所在的区域，进而基于该区域生成第一控制命令。可选的，可以是服务调用方中的内核基于第一行为信息生成第一控制命令。
示例性的，若第一坐标对应在触屏上的按键为“开车门”，则服务调用方基于第一坐标生成用于开车门的控制命令，以使得该用于开车门的控制命令在发送到服务提供方后能够调用开车门的服务。
需要说明的是，第一控制命令的具体实现方式可能是一串命令代码，也可能是一个命令标识，具体本申请不对控制命令的具体实现方式进行限定。
步骤203，服务调用方对第一控制命令的验证信息进行签名处理。
本实施例中，步骤203为可选的步骤。若服务调用方执行了步骤203，则服务提供方在收到第一控制命令的验证信息之后将执行步骤205。若服务调用方没有执行步骤203，则服务提供方在收到第一控制命令的验证信息之后不执行步骤205，而是执行步骤206。
其中，第一控制命令的验证信息用于服务提供方验证第一控制命令，该第一控制命令的验证信息包括第一行为信息，即步骤201中服务调用方获取的第一行为信息。
可选的，服务调用方中的可信模块采用密钥对第一控制命令的验证信息(即第一行为信 息)进行签名处理。例如，服务调用方中的可信模块在获取第一行为信息之后，采用前述密钥对应第一控制命令的验证信息(即第一行为信息)进行签名处理。
为便于理解，以图1C所示的处理器架构为例。若可信模块由2个模块实现(例如，可信模块为虚拟机监视器和TEE)，则虚拟机监视器获取到第一行为信息之后，该虚拟机监视器将第一行为信息传输至TEE，然后，TEE对第一行为信息进行签名处理，然后，TEE向虚拟机监视器返回经过签名处理的第一行为信息；或者，虚拟机监视器在获取到第一行为信息之后，将第一行为信息存储在可信内存中，然后，TEE从虚拟机监视器的可信内存中获取第一行为信息，进而对该第一行为信息进行签名处理，并向虚拟机监视器的可信内存中写入经过签名处理的第一行为信息。若可信模块由1个模块实现(例如，可信模块为虚拟机监视器)，则虚拟机监视器获取到第一行为信息之后，该虚拟机监视器对第一行为信息进行签名处理，得到经过签名处理的第一行为信息。本申请不限定具体由哪个可信模块实现签名处理的功能。
本实施方式中，由于，第一行为信息是由可信模块获取的，该可信模块的权限较高，攻击者不容易攻破可信模块而篡改可信模块中的信息，因此，该第一行为信息是安全可靠的，采用该可信模块获取的第一行为信息作为第一控制命令的验证信息也是安全可靠的。相比于传统技术中采用车身控制服务的应用标识作为验证信息的方案，由可信模块获取的第一行为信息相比于应用标识更不容易被篡改伪造，因此，采用第一行为信息作为第一控制命令的验证信息的方案更具有可靠性和安全性。
此外，本实施例还提出采用密钥对第一控制命令的验证信息进行签名，有利于进一步防止攻击者伪造第一控制命令的验证信息，有利于提高第一控制命令的验证信息的可靠性和安全性。
步骤204，服务调用方向服务提供方发送第一控制命令和第一控制命令的验证信息；相应地，该服务提供方从服务调用方接收第一控制命令和第一控制命令的验证信息。
可选的，该第一控制命令的验证信息具有该服务调用方的密钥签名，即该第一控制命令的验证信息经过服务调用方的签名处理。该第一控制命令的验证信息包括第一行为信息。
步骤205，服务提供方验证第一控制命令的验证信息的签名。
本实施例中，步骤205为可选的步骤。若服务调用方执行了步骤203，则服务提供方在收到第一控制命令的验证信息之后将执行步骤205。若服务调用方没有执行步骤203，则服务提供方在收到第一控制命令的验证信息之后不执行步骤205，而是执行步骤206。
具体地，服务提供方采用密钥验证该第一控制命令的验证信息的签名。前述密钥可以是对称密钥，也可以是非对称密钥，此处不做限定。例如，若服务调用方采用服务调用方的私钥对第一控制命令的验证信息进行签名处理，则服务提供方需要采用服务调用方的公钥对第一控制命令的验证信息进行验证处理。又例如，若服务调用方采用对称密钥对第一控制命令的验证信息进行签名处理，则服务提供方需要采用该对称密钥对第一控制命令的验证信息进行验证处理。
还需要说明的是，服务提供方能够通过运维人员预配置的信息确定收到的控制命令是否都经过了签名。例如，若运维人员针对服务调用方和服务提供方都配置了与签名验证相关的步骤，即运维人员配置服务调用方需要执行步骤203，且，服务提供方需要执行步骤205，则服务提供方会对每个收到的控制命令(例如，第一控制命令)进行验证，以确定收到的控制 命令(例如，第一控制命令)是否为经过合法签名的控制命令。
以第一控制命令为例，若该服务提供方采用该服务调用方的公钥验证该第一控制命令的验证信息的签名通过，说明该第一控制命令上的签名是来自于服务调用方，即第一控制命令是经过合法签名的命令，则该服务提供方执行步骤206；若该服务提供方采用该服务调用方的公钥验证该第一控制命令的验证信息的签名不通过，说明该第一控制命令上的签名不是来自于服务调用方，即该第一控制命令可能是攻击者伪造的，则该服务提供方执行步骤208b。
可选的，若第一行为信息包括第一时间信息，则该服务提供方在执行步骤206之前，还需要基于第一时间信息确定该第一控制命令是否遭受重放攻击。具体地，该服务提供方可以判断该第一时间信息指示的时刻与当前时刻的差值是否位于第一阈值范围之外。若第一时间信息指示的时刻与当前时刻的差值位于第一阈值范围之内，说明该第一控制命令的验证信息不是由攻击者拦截后进行重发的，则该服务提供方触发执行步骤206；若第一时间信息指示的时刻与当前时刻的差值位于第一阈值范围之外，说明该第一控制命令的验证信息可能由攻击者拦截后进行重发的，则该服务提供方停止触发执行步骤206，而触发执行步骤208b。
步骤206，服务提供方基于第一行为信息和第一映射规则确定第一行为信息对应的第二控制命令。
其中，第一映射规则是预配置在服务提供方的用于校验第一控制命令的验证信息的映射规则。该第一映射规则包括至少一种行为信息以及每种行为信息对应的控制命令。服务提供方从第一映射规则中的至少一种行为信息中查找第一行为信息，进而确定该第一行为信息对应的控制命令为第二控制命令。
需要说明的是，当第一行为信息的实现方式不同时，该第一映射规则中包含的行为信息也不同。下面分别进行介绍：
在一种可能的实施方式中，该第一行为信息包括第一坐标和第一时间；该第一映射规则中的至少一种行为信息中的每种行为信息包括至少一个坐标区域。具体地，服务提供方先确定该第一坐标所在的坐标区域，然后，服务提供方基于该第一映射规则确定该第一坐标所在的坐标区域对应的控制命令为该第二控制命令。
示例性的，若行为信息包括坐标区域，则该第一映射规则可以如下表1-1所示：
表1-1
坐标区域 每种行为信息对应的控制命令
a 0<X<b 0；c 0<Y<d 0； 开车门命令
a 1<X<b 1；c 1<Y<d 1； 开车窗命令
e 0<X<f 0；c 2<Y<d 2； 开雨刮器命令
表1-1所示示例中，X表示横坐标，Y表示纵坐标，X和Y的取值范围确定的坐标区域对应触屏上的某一个按键。例如，由a 0<X<b 0和c 0<Y<d 0确定的坐标区域对应的按键是“开车门按键”，因此，该坐标区域对应的控制命令为“开车门命令”。又例如，由a 1<X<b 1和c 1<Y<d 1确定的坐标区域对应的按键是“开车窗按键”，因此，该坐标区域对应的控制命令为“开车窗命令”。
示例性的，若第一坐标为X＝a 3且Y＝b 3，并且，a 0<a 3<b 0且c 0<b 3<d 0，则服务提供方基于第一坐标和第一映射规则确定与第一行为信息对应的第二控制命令为“开车门命令”。
在另一种可能的实施方式中，该第一行为信息包括第一语义信息和第一时间；该第一映射规则中的至少一种行为信息中的每种行为信息包括一个语义信息。具体地，该服务提供方基于该第一映射规则确定该第一语义信息对应的控制命令为该第二控制命令。
示例性的，若行为信息包括语义信息，则该第一映射规则可以如下表1-2所示：
表1-2
语义信息 每种行为信息对应的控制命令
“开车门” 开车门命令
“开车窗” 开车窗命令
“开雨刮器” 开雨刮器命令
表1-2所示示例中，若服务提供方收到的第一行为信息包含的语义信息为“开车门”，则服务提供方基于语义信息和第一映射规则确定与第一行为信息对应的第二控制命令为“开车门命令”。
需要说明的是，第一映射规则(例如，表1-1或表1-2)中的控制命令的具体实现方式可能是一串命令代码，也可能是一个命令标识，具体本申请不对控制命令的具体实现方式进行限定。
步骤207，服务提供方判断第一控制命令与第二控制命令是否相同。
若第一控制命令与第二控制命令相同，说明该第一控制命令是由用户发起的合法命令，则服务提供方执行步骤208a；若第一控制命令与第二控制命令不相同，说明该第一控制命令不是由用户发起的合法命令，则服务提供方执行步骤208b。
步骤208a，服务提供方向执行设备发送第一控制命令。
当第一控制命令与第二控制命令相同时，服务提供方确定该第一控制命令验证通过，即第一控制命令是由用户发起的合法命令，则服务提供方向执行设备发送第一控制命令，以使得执行设备执行第一控制命令。
步骤208b，服务提供方确定第一控制命令验证不通过。
当第一控制命令与第二控制命令不相同时，服务提供方确定该第一控制命令验证不通过，即第一控制命令不是由用户发起的合法命令。此时，该服务提供方不会向执行设备发送前述第一控制命令。可选的，该服务提供方还将触发告警流程。具体地，该服务提供方将执行步骤210a或执行步骤210b。
步骤209，执行设备执行第一控制命令。
执行设备在收到来自服务提供方的第一控制命令之后，该执行设备将执行第一控制命令以实现第一服务的调用。例如，若该第一控制命令为开车门命令，则执行设备为与车门相关的控制器或驱动设备，该执行设备控制车门打开。又例如，若第一控制命令为开车窗命令，则执行设备为与车窗相关的控制器或驱动设备，该执行设备控制车窗打开。
步骤210a，服务提供方向用户提示告警信息。
步骤210a为可选的步骤。
其中，该告警信息用于指示验证该第一控制命令不通过。也可以理解为，该告警信息用于指示验证该第一控制命令不合法。
可选的，该服务提供方能够控制车辆的输入输出设备通信，进而能够通过输入输出设备 向用户提示告警信息。例如，若服务提供方能够控制车辆的扬声器，则该服务提供方可以控制该扬声器通过语音播报的方式向用户播报告警信息。又例如，若服务提供方能够控制车辆的中控显示屏，则该服务提供方可以控制该中控显示屏以文字和/或图像的方式向用户展示告警信息。本申请不限制服务提供方能够进行通信或控制的输入输出设备，此处不再一一列举。
步骤210b，服务提供方向服务调用方发送告警信息；相应地，服务调用方从服务提供方接收告警信息，进而该服务调用方向用户提示告警信息。
步骤210b为可选的步骤。
当该服务调用方收到前述告警信息之后，该服务调用方将向用户提示告警信息。
在一种可能的示例中，服务调用方是位于车辆中设备，例如，该服务调用方是车辆中的智能座舱；服务提供方是整车控制域。整车控制域向智能座舱发送告警信息，该智能座舱通过连接的输入输出设备向用户提示告警信息。例如，该智能座舱可以控制该扬声器通过语音播报的方式向用户播报告警信息。又例如，智能座舱可以控制该中控显示屏以文字和/或图像的方式向用户展示告警信息。又例如，智能座舱可以控制抬头显示器(head up display，HUD)以文字和/或图像的方式向用户展示告警信息。在实际应用中，智能座舱还可以与其他输出输入设备进行通信，此处不再一一列举。
在另一种可能的示例中，服务调用方是能够与车辆进行通信的设备。例如，该服务调用方是智能终端设备(例如，智能手机、智能手表或者其他的智能穿戴设备等)。服务提供方是整车控制域，或者，服务提供方是车辆中的通信盒子T-Box和整车控制域的组合。本示例中，智能终端设备能够通过车辆中的通信盒子T-Box从整车控制域接收告警信息，进而该终端设备能够通过语音播报的方式提示告警信息，或者，以文字和/或图像的方式向用户展示告警信息。
本实施例中，服务调用方将获取第一行为信息的权限从权限较低的内核(例如，特权级别1(EL1)中的内核(Kernel))下放到权限较高的可信模块(例如，特权级别2(EL2)中的虚拟机监视器(Hypervisor))。由于，由于权限较高的可信模块中的数据相比于权限较低的内核中的数据更不容易被篡改，因此，服务调用方通过可信模块获取的第一行为信息而不是通过内核获取第一行为信息，有利于防止服务调用方获得的第一行为信息被篡改或伪造，进而有利于保证发送给服务提供方的第一控制命令的验证信息的安全性。
此外，服务提供方接收的用于验证第一控制命令的验证信息包括第一行为信息，服务提供方能够基于第一行为信息确定该第一控制命令是否由用户的行为触发的。当服务提供方确定第一控制命令与基于第一行为信息确定的第二控制命令相同时，服务提供方确定该第一控制命令是由用户触发且未被篡改的，才触发向执行设备发送该第一控制命令。因此，有利于提高车身控制服务调用的安全性。
下面将结合图3对本申请的服务调用方的另一种实施例的主要流程进行介绍。该方法中，服务调用方和服务提供方主要执行如下步骤：
步骤301，服务调用方获取第一行为信息。
可选的，服务调用方中的可信模块获取第一行为信息。
步骤302，服务调用方基于第一行为信息生成第一控制命令。
步骤301和步骤302与前文步骤201和步骤202类似，具体请参阅前文步骤201和步骤202中的相关描述，此处不予赘述。
步骤303，服务调用方获取第一执行流信息。
其中，执行流(也被称为控制流(control flow))是服务调用方在基于行为信息生成控制命令过程中执行的指令的集合。因此，一项服务调用的执行流能够反映该服务调用过程的完整性。若该服务调用过程有攻击者的篡改行为发生，则服务调用方收集的执行流必定有反应篡改行为的指令。因此，由用户触发生成控制命令的服务调用的执行流和经过攻击者篡改的服务调用的执行流是不同的。因此，采用服务调用的执行流作为控制命令的验证信息有利于服务提供方识别出是否遭受攻击，有利于提高服务调用过程的安全性。
前述第一执行流信息用于指示调用第一服务的过程信息。例如，该第一执行流信息是服务调用方在基于第一行为信息生成第一控制命令过程中产生的信息。因此，该第一执行流信息能够指示该第一服务调用过程的完整性。可选的，前述第一执行流信息为调用第一服务的执行流或调用第一服务的执行流的哈希值。例如，该服务调用方在生成第一控制命令时直接将获取的调用第一服务的执行流确定为第一控制命令的验证信息。又例如，该服务调用方在生成第一控制命令并收集到调用第一服务的执行流之后，采用哈希算法对调用第一服务的执行流进行哈希计算得到调用第一服务的执行流的哈希值，将调用第一服务的执行流的哈希值作为第一控制命令的验证信息。
可选的，服务调用方中的可信模块获取第一执行流信息。可选的，服务调用方中的可信模块可以基于硬件(例如，ARM架构上的硬件模块(例如，coresight等片上调试模块)，Intel架构的处理器跟踪(processor trace，PT)模块，性能监督单元(performance monitoring unit，PMU)等)收集执行流，也可以基于软件插桩的方式收集执行流，具体此处不做限定。
在一种可能的示例中，服务调用方中的内核基于第一行为信息生成第一控制命令，与此同时，该服务调用方中可信模块收集内核在生成第一控制命令时产生的第一服务的执行流。然后，该服务调用方中的可信模块将第一行为信息和第一服务的执行流确定为第一控制命令的验证信息。
在另一种可能的示例中，服务调用方中的内核在基于第一行为信息生成第一控制命令时，该服务调用方中可信模块收集内核在生成第一控制命令时产生的第一服务的执行流。然后，该服务调用方中的可信模块计算该第一服务的执行流的哈希值。然后，该服务调用方中的可信模块将第一行为信息和第一服务的执行流的哈希值确定为第一控制命令的验证信息。
本步骤中，由于，该第一执行流信息是由该服务调用方中的可信模块获取的，因此，能够保证作为验证信息的第一执行流信息是安全且可靠的。又由于，第一执行流信息是服务调用方在基于第一行为信息生成第一控制命令时必然会产生的信息，因此，将第一执行流信息作为验证信息之一，能够保证第一控制命令是由用户触发的，而不是攻击者伪造的。因此，将第一执行流信息和第一行为信息作为第一控制命令的验证信息有利于提高车身控制服务的安全性和可靠性。
步骤304，服务调用方对第一控制命令的验证信息进行签名处理。
本实施例中，步骤304为可选的步骤。若服务调用方执行了步骤304，则服务提供方在收到第一控制命令的验证信息之后将执行步骤306。若服务调用方没有执行步骤304，则服务 提供方在收到第一控制命令的验证信息之后不执行步骤306，而是执行步骤307。
其中，第一控制命令的验证信息用于验证第一控制命令。该第一控制命令的验证信息包括第一行为信息(即步骤301中服务调用方获取的第一行为信息)和第一执行流信息(即步骤303中服务调用方获取的第一执行流信息)。
具体地，服务调用方中的可信模块在获取第一行为信息和第一执行流信息之后，该服务调用方将采用密钥对应第一控制命令的验证信息(即第一行为信息和第一执行流信息)进行签名处理。
为便于理解，以图1C所示的处理器架构为例。若可信模块由2个模块实现(例如，可信模块为虚拟机监视器和TEE)，则虚拟机监视器获取到第一行为信息和第一执行流信息之后，该虚拟机监视器将第一行为信息和第一执行流信息一起传输至TEE，然后，TEE对第一行为信息和第一执行流信息一起进行签名处理，然后，TEE向虚拟机监视器返回经过签名处理的第一控制命令的验证信息；或者，虚拟机监视器在获取到第一行为信息和第一执行流信息之后，将第一行为信息和第一执行流信息存储在可信内存中，然后，TEE从虚拟机监视器的可信内存中获取第一行为信息和第一执行流信息，进而对该第一行为信息和第一执行流信息进行签名处理，并向虚拟机监视器的可信内存中写入经过签名处理的第一行为信息和第一执行流信息。若可信模块由1个模块实现(例如，可信模块为虚拟机监视器)，则虚拟机监视器获取到第一行为信息和第一执行流信息之后，该虚拟机监视器对第一行为信息和第一执行流信息一起进行签名处理，得到经过签名处理的第一控制命令的验证信息。本申请不限定具体由哪个可信模块实现签名处理的功能。
本实施例中，提出采用密钥对第一控制命令的验证信息进行签名，有利于进一步防止攻击者伪造第一控制命令的验证信息，有利于提高第一控制命令的验证信息的可靠性和安全性。
步骤305，服务调用方向服务提供方发送第一控制命令和第一控制命令的验证信息；相应地，该服务提供方从服务调用方接收第一控制命令和第一控制命令的验证信息。
可选的，该第一控制命令的验证信息具有该服务调用方的密钥签名。该第一控制命令的验证信息包括第一行为信息和第一执行流信息。
步骤306，服务提供方验证第一控制命令的验证信息的签名。
本实施例中，步骤306为可选的步骤。若服务调用方执行了步骤304，则服务提供方在收到第一控制命令的验证信息之后将执行步骤306。若服务调用方没有执行步骤304，则服务提供方在收到第一控制命令的验证信息之后不执行步骤306，而是执行步骤307。
具体地，服务提供方采用密钥验证第一控制命令的验证信息的签名。其中，前述密钥可以是对称密钥，也可以是非对称密钥，此处不做限定。具体请参阅前文步骤205中的相关介绍，此处不予赘述。
以第一控制命令为例，若该服务提供方采用该服务调用方的公钥验证该第一控制命令的验证信息的签名通过，说明该第一控制命令上的签名是来自于服务调用方，即第一控制命令是经过合法签名的命令，则该服务提供方执行步骤307；若该服务提供方采用该服务调用方的公钥验证该第一控制命令的验证信息的签名不通过，说明该第一控制命令上的签名不是来自于服务调用方，即该第一控制命令可能是攻击者伪造的，则该服务提供方执行步骤311b。
可选的，若第一行为信息包括第一时间信息，则该服务提供方在执行步骤307之前，还 需要基于第一时间信息确定该第一控制命令是否遭受重放攻击。具体地，该服务提供方可以判断该第一时间信息指示的时刻与当前时刻的差值是否位于第一阈值范围之外。若第一时间信息指示的时刻与当前时刻的差值位于第一阈值范围之内，说明该第一控制命令的验证信息不是由攻击者拦截后进行重发的，则该服务提供方触发执行步骤307；若第一时间信息指示的时刻与当前时刻的差值位于第一阈值范围之外，说明该第一控制命令的验证信息可能由攻击者拦截后进行重发的，则该服务提供方停止触发执行步骤307，而触发执行步骤311b。
步骤307，服务提供方基于第一行为信息和第一映射规则确定第一行为信息对应的第二控制命令。
其中，该第一映射规则包括至少一种行为信息以及每种行为信息对应的控制命令。
具体地，步骤307与前文步骤206类似，具体请参阅前文步骤206中的相关描述，此处不予赘述。
步骤308，服务提供方判断第一控制命令与第二控制命令是否相同。
若第一控制命令与第二控制命令相同，则服务提供方执行步骤309；若第一控制命令与第二控制命令不相同，说明该第一控制命令不是由用户发起的合法命令，则服务提供方执行步骤311b。
步骤309，服务提供方基于第二控制命令和该第一映射规则确定与该第二控制命令对应的第二执行流信息。
本实施例中，该第一映射规则除了包括至少一种行为信息以及每种行为信息对应的控制命令之外，该第一映射规则还包括每个控制命令对应的服务的执行流信息。服务提供方不仅能够从第一映射规则中查找第一行为信息对应的第二控制命令，还能够基于该第二控制命令查找到与该第二控制命令对应的第二执行流信息。
需要说明的是，当第一行为信息的实现方式不同时，该第一映射规则中包含的行为信息也不同。下面分别进行介绍：
在一种可能的实施方式中，该第一行为信息包括第一坐标和第一时间；该第一映射规则中的至少一种行为信息中的每种行为信息包括至少一个坐标区域。
示例性的，若行为信息包括坐标区域，则该第一映射规则可以如下表2-1所示：
表2-1
Figure PCTCN2022138522-appb-000001
具体地，服务提供方先确定该第一坐标所在的坐标区域，然后，服务提供方基于该第一映射规则确定该第一坐标所在的坐标区域对应的控制命令为该第二控制命令，然后，服务提供方基于该第一映射规则确定该第二控制命令。
在另一种可能的实施方式中，该第一行为信息包括第一语义信息和第一时间；该第一映射规则中的至少一种行为信息中的每种行为信息包括一个语义信息。
示例性的，若行为信息包括语义信息，则该第一映射规则可以如下表2-2所示：
表2-2
Figure PCTCN2022138522-appb-000002
具体地，该服务提供方基于该第一映射规则确定该第一语义信息对应的控制命令为该第二控制命令，然后，服务提供方基于该第一映射规则确定该第二控制命令。
步骤310，判断第一执行流信息与第二执行流信息是否相同。
若第一执行流信息与第二执行流信息相同，则服务提供方执行步骤311a；若第一执行流信息与第二执行流信息不相同，说明该第一控制命令不是由用户发起的合法命令，则服务提供方执行步骤311b。
步骤311a，服务提供方向执行设备发送该第一控制命令。
步骤311b，服务提供方确定第一控制命令验证不通过。
步骤312，执行设备执行第一控制命令。
步骤313a，服务提供方向用户提示告警信息。
步骤313b，服务提供方向服务调用方发送告警信息，以使得服务调用方向用户提示告警信息。
本实施例中，步骤311a、步骤311b、步骤312、步骤313a以及步骤313b与前述图2对应实施例中的步骤208a、步骤208b、步骤209、步骤210a以及步骤210b类似，具体请参阅前述图2对应实施例中各步骤中的相关描述，此处不予赘述。
本实施例中，服务调用方能够基于第一行为信息生成第一控制命令，并获取在生成第一控制命令过程中产生的第一执行流信息，然后，将第一行为信息和第一执行流信息作为第一控制命令的验证信息发送给服务提供方，以使得服务提供方基于第一行为信息和第一执行流信息对第一控制命令进行验证。因此，有利于提高车身控制服务调用的安全性。
此外，服务提供方接收的用于验证第一控制命令的验证信息包括第一行为信息和第一执行流信息。服务提供方基于第一映射规则和第一行为信息确定与第一映射规则中与第一行为信息对应的第二执行流信息，当第一执行流信息与第二执行流信息相同时，服务提供方确定该第一控制命令是合法的，才触发向执行设备发送该第一控制命令。由于，服务提供方能够基于第一行为信息确定第一控制命令由用户触发，能够基于第一执行流信息确定第一控制命令未被篡改，因此，有利于提高车身控制服务调用的安全性。
如图4所示，本申请提供了一种通信装置40。该通信装置40可以是服务调用方，也可以是服务调用方中的部件(例如，集成电路、芯片等)。该通信装置40可以是服务提供方，也可以是服务提供方中的部件(例如，集成电路、芯片等)。该通信装置40也可以是其他用于实现本申请方法实施例中的方法的通信模块。
该通信装置40可以包括处理模块401(或称为处理单元)。可选的，该通信装置40还可以包括接口模块402(或称为收发单元或收发模块)和存储模块403(或称为存储单元)。接 口模块402用于实现与其他设备进行通信。例如，接口模块402可以是收发模块或输入输出模块。
在一种可能的设计中，如图4中的一个或者多个模块可能由一个或者多个处理器来实现，或者由一个或者多个处理器和存储器来实现；或者由一个或多个处理器和收发器实现；或者由一个或者多个处理器、存储器和收发器实现，本申请实施例对此不作限定。前述处理器、存储器、收发器可以单独设置，也可以集成于一体。当该通信装置40用于实现服务调用方的功能时，该通信装置40中的处理模块401的架构可以参阅图1C或图1D所示的示例。
在一种设计中，该通信装置40具备实现前述图2或图3对应实施例中服务调用方的功能。例如，通信装置40包括服务调用方执行本申请实施例描述的服务调用方涉及步骤所对应的模块或单元或手段(means)，所述功能或单元或手段(means)可以通过软件实现，或者通过硬件实现，也可以通过硬件执行相应的软件实现，还可以通过软件和硬件结合的方式实现。例如，通信装置40中的接口模块402用于接收来自服务调用方的第一控制命令和该第一控制命令的验证信息，该第一控制命令用于调用第一服务，该第一控制命令的验证信息用于验证该第一控制命令，该第一控制命令的验证信息包括第一行为信息，该第一行为信息用于指示用户触发生成该第一控制命令的行为。处理模块401用于基于该第一控制命令的验证信息验证该第一控制命令，以及，当验证该第一控制命令通过时，控制接口模块402向执行设备发送该第一控制命令，该执行设备用于执行该第一控制命令。
在一种可能的实施方式中，处理模块401，具体用于基于该第一行为信息和第一映射规则确定该第一行为信息对应的第二控制命令，该第一映射规则包括至少一种行为信息以及每种行为信息对应的控制命令；以及，当该第一控制命令与该第二控制命令相同时，确定验证该第一控制命令通过。
在一种可能的实施方式中，该第一控制命令的验证信息还包括该第一执行流信息，该第一执行流信息用于指示调用该第一服务的过程信息。该第一映射规则还包括每个服务的执行流信息。处理模块401，具体用于当该第一控制命令与该第二控制命令相同时，基于该第二控制命令和该第一映射规则确定与该第二控制命令对应的第二执行流信息；以及，当该第一执行流信息与该第二执行流信息相同时，确定验证该第一控制命令通过。可选的，该第一执行流信息为调用第一服务的执行流或调用第一服务的执行流的哈希值。
在一种可能的实施方式中，该第一行为信息包括第一坐标，该第一坐标为该用户的操作对应的坐标；该第一映射规则中的至少一种行为信息中的每种行为信息包括至少一个坐标区域。该处理模块401，具体用于确定该第一坐标所在的坐标区域；以及，基于该第一映射规则确定该第一坐标所在的坐标区域对应的控制命令为该第二控制命令。
在一种可能的实施方式中，该第一行为信息包括第一语义信息，该第一语义信息为基于该用户输入的语音指令生成的语义；该第一映射规则中的至少一种行为信息中的每种行为信息包括一个语义信息。该处理模块401，具体用于基于该第一映射规则确定该第一语义信息对应的控制命令为该第二控制命令。
在一种可能的实施方式中，该第一行为信息包括第一时间信息，该第一时间信息为该服务调用方检测到用户触发生成该第一控制命令的行为的时间。处理模块401，具体用于在该服务提供方确定该第一时间信息指示的时刻与当前时刻的差值位于第一阈值范围之外的情况 下，确定验证所述第一控制命令不通过。
在一种可能的实施方式中，该第一控制命令的验证信息经过服务调用方签名。处理模块401，还用于验证该第一控制命令的验证信息的签名；以及，在验证该第一控制命令的验证信息的签名成功的情况下，基于该第一行为信息和第一映射规则确定该第一行为信息对应的第二控制命令。
在一种可能的实施方式中，处理模块401，还用于在该服务提供方验证该第一控制命令的验证信息的签名不通过的情况下，确定验证该第一控制命令不通过。
在一种可能的实施方式中，处理模块401，还用于在该第一控制命令与该第二控制命令不相同的情况下，确定验证该第一控制命令不通过。
在一种可能的实施方式中，处理模块401，还用于在该第一执行流信息与该第二执行流信息不相同的情况下，确定验证该第一控制命令不通过。
在一种可能的实施方式中，处理模块401，还用于在确定验证第一控制命令不通过时，控制输入输出模块向用户提示告警信息，所述告警信息用于指示验证所述第一控制命令不通过；或者，处理模块401，还用于在确定验证第一控制命令不通过时，控制接口模块402向服务调用方发送告警信息，所述服务调用方用于向用户提示所述告警信息。
需要说明的是，本实施例的具体实施方式和有益效果可参考上述实施例中服务提供方的方法，此处不再赘述。
在一种设计中，通信装置40用于执行前述图2或图3对应实施例中服务调用方的方法。通信装置40中的处理模块401用于获取第一行为信息，该第一行为信息用于指示用户触发了生成第一控制命令的行为；以及，基于该第一行为信息生成该第一控制命令，该第一控制命令用于调用第一服务。接口模块402，用于发送该第一控制命令和该第一控制命令的验证信息，该第一控制命令的验证信息包括该第一行为信息，该第一控制命令的验证信息用于验证该第一控制命令。
在一种可能的实施方式中，该处理模块401包括可信模块。该通信装置中的可信模块获取该第一行为信息，该可信模块的权限高于该服务调用方中的内核的权限。可选的，该可信模块的运行环境与该内核的运行环境相互独立。可选的，该可信模块具有对存储模块的读权限和写权限，该内核没有对该存储模块的访问权限，该存储模块用于存储该第一行为信息。
在一种可能的实施方式中，该处理模块401还用于获取该第一执行流信息，该第一执行流信息用于指示调用第一服务的过程信息。可选的，该第一执行流信息为调用第一服务的执行流或调用第一服务的执行流的哈希值。
在一种可能的实施方式中，该通信装置中的可信模块获取该第一执行流信息。
在一种可能的实施方式中，该第一控制命令的验证信息经过服务调用方签名。该处理模块401，还用于采用密钥对该第一控制命令的验证信息进行签名处理。
在一种可能的实施方式中，该第一行为信息包括第一坐标，该第一坐标为用户的操作对应的坐标；或者，该第一行为信息包括第一语义信息，该第一语义信息为基于用户的输入的语音指令生成的语义。
在一种可能的实施方式中，该第一行为信息包括第一时间信息，该第一时间信息为该服务调用方检测到用户触发生成该第一控制命令的行为的时间。
在一种可能的实施方式中，该可信模块包括如下至少一项：虚拟机监视器、可信内核或可信执行环境TEE。
需要说明的是，本实施例的具体实施方式和有益效果可参考上述实施例中服务调用方的方法，此处不再赘述。
此外，本申请提供了一种计算机程序产品，该计算机程序产品包括一个或多个计算机指令。在计算机上加载和执行该计算机程序指令时，全部或部分地产生按照本申请实施例该的流程或功能。例如，实现如前述图2或图3中的服务调用方相关的方法。又例如，实现如前述图2或图3中的服务提供方相关的方法。该计算机可以是通用计算机、专用计算机、计算机网络或者其他可编程装置。该计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一计算机可读存储介质传输，例如，该计算机指令可以从一个网站站点、计算机、服务器或数据中心通过有线(例如，同轴电缆、光纤、数字用户线(digital subscriber line，DSL))或无线(例如，红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。该计算机可读存储介质可以是计算机能够存储的任何可用介质或者是包含一个或多个可用介质集成的服务器、数据中心等数据存储设备。该可用介质可以是磁性介质，(例如，软盘、硬盘、磁带)、光介质(例如，数字通用光盘(digital versatile disc，DVD))、或者半导体介质(例如固态硬盘(solid state disk，SSD))等。
此外，本申请还提供了一种计算机可读存储介质，该存储介质存储有计算机程序，该计算机程序被处理器执行以实现如前述图2或图3中的服务调用方相关的方法。
此外，本申请还提供了一种计算机可读存储介质，该存储介质存储有计算机程序，该计算机程序被处理器执行以实现如前述图2或图3中的服务提供方相关的方法。
此外，本申请还提供了一种服务调用系统，该服务调用系统包括前述图2或图3对应实施例中的服务提供方和前述图2或图3对应实施例中的服务调用方。
此外，本申请还提供了一种车辆，该车辆包括前述图2或图3对应实施例中的服务提供方和前述图2或图3对应实施例中的服务调用方。此外，该车辆还包括执行设备。此外，该车辆还包括触摸屏、麦克风等人机交互外部设备。
应理解，在本申请的各种实施例中，上述各过程的序号的大小并不意味着执行顺序的先后，各过程的执行顺序应以其功能和内在逻辑确定，而不应对本申请实施例的实施过程构成任何限定。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的系统，装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。

Claims (30)

  1. 一种服务调用方法，其特征在于，包括：
    服务提供方接收来自服务调用方的第一控制命令和所述第一控制命令的验证信息，所述第一控制命令用于调用第一服务，所述第一控制命令的验证信息用于验证所述第一控制命令，所述第一控制命令的验证信息包括第一行为信息，所述第一行为信息用于指示用户触发生成所述第一控制命令的行为；
    所述服务提供方基于所述第一控制命令的验证信息验证所述第一控制命令；
    若验证所述第一控制命令通过，则所述服务提供方向执行设备发送所述第一控制命令，所述执行设备用于执行所述第一控制命令。
  2. 根据权利要求1所述的方法，其特征在于，所述服务提供方基于所述第一控制命令的验证信息验证所述第一控制命令，包括：
    所述服务提供方基于所述第一行为信息和第一映射规则确定所述第一行为信息对应的第二控制命令，所述第一映射规则包括至少一种行为信息以及每种行为信息对应的控制命令；
    若所述第一控制命令与所述第二控制命令相同，则所述服务提供方确定验证所述第一控制命令通过。
  3. 根据权利要求2所述的方法，其特征在于，所述第一控制命令的验证信息还包括第一执行流信息，所述第一执行流信息用于指示调用所述第一服务的过程信息；所述第一映射规则还包括调用每个服务的执行流信息；
    所述方法还包括：
    若所述第一控制命令与所述第二控制命令相同，则所述服务提供方基于所述第二控制命令和所述第一映射规则确定与所述第二控制命令对应的第二执行流信息，所述第二执行流信息用于指示调用第二服务的过程信息；
    所述服务提供方确定验证所述第一控制命令通过，包括：
    若所述第一执行流信息与所述第二执行流信息相同，则所述服务提供方确定验证所述第一控制命令通过。
  4. 根据权利要求3所述的方法，其特征在于，所述第一执行流信息为调用所述第一服务的执行流或调用所述第一服务的执行流的哈希值。
  5. 根据权利要求2至4中任意一项所述的方法，其特征在于，所述第一行为信息包括第一坐标，所述第一坐标为所述用户的操作对应的坐标；所述第一映射规则中的至少一种行为信息中的每种行为信息包括至少一个坐标区域；
    所述服务提供方基于所述第一行为信息和第一映射规则确定所述第一行为信息对应的第二控制命令，包括：
    所述服务提供方确定所述第一坐标所在的坐标区域；
    所述服务提供方基于所述第一映射规则确定所述第一坐标所在的坐标区域对应的控制命令为所述第二控制命令。
  6. 根据权利要求2至4中任意一项所述的方法，其特征在于，所述第一行为信息包括第一语义信息，所述第一语义信息为基于所述用户输入的语音指令生成的语义；所述第一映射规则中的至少一种行为信息中的每种行为信息包括一个语义信息；
    所述服务提供方基于所述第一行为信息和第一映射规则确定所述第一行为信息对应的第二控制命令，包括：
    所述服务提供方基于所述第一映射规则确定所述第一语义信息对应的控制命令为所述第二控制命令。
  7. 根据权利要求2至6中任意一项所述的方法，其特征在于，所述第一行为信息包括第一时间信息，所述第一时间信息为所述服务调用方检测到用户触发生成所述第一控制命令的行为的时间；
    所述方法还包括：
    若所述服务提供方确定所述第一时间信息指示的时刻与当前时刻的差值位于第一阈值范围之外，则所述服务提供方确定验证所述第一控制命令不通过。
  8. 根据权利要求2至7中任意一项所述的方法，其特征在于，所述第一控制命令的验证信息经过所述服务调用方签名；
    所述服务提供方基于所述第一行为信息和第一映射规则确定所述第一行为信息对应的第二控制命令之前，所述方法还包括：
    所述服务提供方验证所述第一控制命令的验证信息的签名；
    所述服务提供方基于所述第一行为信息和第一映射规则确定所述第一行为信息对应的第二控制命令，包括：
    若所述服务提供方验证所述第一控制命令的验证信息的签名通过，则所述服务提供方基于所述第一行为信息和第一映射规则确定所述第一行为信息对应的第二控制命令。
  9. 根据权利要求8所述的方法，其特征在于，所述方法还包括：
    若所述服务提供方验证所述第一控制命令的验证信息的签名不通过，则所述服务提供方确定验证所述第一控制命令不通过。
  10. 根据权利要求2所述的方法，其特征在于，所述方法还包括：
    若所述第一控制命令与所述第二控制命令不相同，则所述服务提供方确定验证所述第一控制命令不通过。
  11. 根据权利要求3所述的方法，其特征在于，所述方法还包括：
    若所述第一执行流信息与所述第二执行流信息不相同，则所述服务提供方确定验证所述第一控制命令不通过。
  12. 根据权利要求7、9、10或11所述的方法，其特征在于，所述方法还包括：
    若所述服务提供方确定验证所述第一控制命令不通过，则所述服务提供方向所述用户提示告警信息，所述告警信息用于指示验证所述第一控制命令不通过；
    或者，
    若所述服务提供方确定验证所述第一控制命令不通过，则所述服务提供方向所述服务调用方发送告警信息，所述服务调用方用于向用户提示所述告警信息。
  13. 根据权利要求3至12中任意一项所述的方法，其特征在于，所述第一执行流信息由所述服务调用方中的可信模块获取。
  14. 一种服务调用方法，其特征在于，包括：
    服务调用方获取第一行为信息，所述第一行为信息用于指示用户触发了生成第一控制命 令的行为；
    所述服务调用方基于所述第一行为信息生成所述第一控制命令，所述第一控制命令用于调用第一服务；
    所述服务调用方发送所述第一控制命令和所述第一控制命令的验证信息，所述第一控制命令的验证信息包括所述第一行为信息，所述第一控制命令的验证信息用于验证所述第一控制命令。
  15. 根据权利要求14所述的方法，其特征在于，所述服务调用方获取第一行为信息，包括：
    所述服务调用方中的可信模块获取所述第一行为信息，所述可信模块的权限高于所述服务调用方中的内核的权限。
  16. 根据权利要求15所述的方法，其特征在于，所述可信模块的运行环境与所述内核的运行环境相互独立。
  17. 根据权利要求15或16所述的方法，其特征在于，所述可信模块具有对存储模块的读权限和写权限，所述内核没有对所述存储模块的访问权限，所述存储模块用于存储所述第一行为信息。
  18. 根据权利要求14至17中任意一项所述的方法，其特征在于，所述服务调用方向服务提供方发送所述第一控制命令和所述第一控制命令的验证信息之前，所述方法还包括：
    所述服务调用方获取第一执行流信息，所述第一执行流信息用于指示调用所述第一服务的过程信息。
  19. 根据权利要求18所述的方法，其特征在于，所述第一执行流信息为调用所述第一服务的执行流或调用所述第一服务的执行流的哈希值。
  20. 根据权利要求18或19所述的方法，其特征在于，所述服务调用方获取所述第一执行流信息，包括：
    所述服务调用方中的可信模块获取所述第一执行流信息。
  21. 根据权利要求14至20中任意一项所述的方法，其特征在于，所述第一控制命令的验证信息经过所述服务调用方签名；
    所述服务调用方向服务提供方发送所述第一控制命令和所述第一控制命令的验证信息之前，所述方法还包括：
    所述服务调用方采用密钥对所述第一控制命令的验证信息进行签名处理。
  22. 根据权利要求14至21中任意一项所述的方法，其特征在于，所述第一行为信息包括第一坐标，所述第一坐标为用户的操作对应的坐标；
    或者，
    所述第一行为信息包括第一语义信息，所述第一语义信息为基于用户输入的语音指令生成的语义。
  23. 根据权利要求22所述的方法，其特征在于，所述第一行为信息包括第一时间信息，所述第一时间信息为所述服务调用方检测到用户触发生成所述第一控制命令的行为的时间。
  24. 根据权利要求15至23中任意一项所述的方法，其特征在于，所述可信模块包括如下至少一项：
    虚拟机监视器、可信内核或可信执行环境TEE。
  25. 一种通信装置，其特征在于，包括处理器和存储器；
    其中，存储器存储有计算机程序；
    所述处理器调用所述计算机程序以使得所述通信装置执行如权利要求1至13中任意一项所述的方法。
  26. 一种通信装置，其特征在于，包括处理单元和存储单元；
    其中，存储单元存储有计算机程序；
    所述处理单元调用所述计算机程序以使得所述通信装置执行如权利要求14至24中任意一项所述的方法。
  27. 一种服务调用系统，其特征在于，包括：
    如权利要求25所述的通信装置和如权利要求26所述的通信装置。
  28. 一种车辆，其特征在于，包括：
    如权利要求25所述的通信装置和如权利要求26所述的通信装置。
  29. 一种计算机可读存储介质，存储有指令，当所述指令在计算机上运行时，使得计算机执行如权利要求1至13中任意一项所述的方法；或者，执行如权利要求14至24中任意一项所述的方法。
  30. 一种计算机程序产品，存储有指令，当所述指令在计算机上运行时，使得计算机执行如权利要求1至13中任意一项所述的方法；或者，执行如权利要求14至24中任意一项所述的方法。
PCT/CN2022/138522 2022-12-13 2022-12-13 一种服务调用方法、通信装置、服务调用系统以及车辆 WO2024124387A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
PCT/CN2022/138522 WO2024124387A1 (zh) 2022-12-13 2022-12-13 一种服务调用方法、通信装置、服务调用系统以及车辆

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2022/138522 WO2024124387A1 (zh) 2022-12-13 2022-12-13 一种服务调用方法、通信装置、服务调用系统以及车辆

Publications (1)

Publication Number Publication Date
WO2024124387A1 true WO2024124387A1 (zh) 2024-06-20

Family

ID=91484205

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/138522 WO2024124387A1 (zh) 2022-12-13 2022-12-13 一种服务调用方法、通信装置、服务调用系统以及车辆

Country Status (1)

Country Link
WO (1) WO2024124387A1 (zh)

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20070018790A1 (en) * 2005-07-19 2007-01-25 Lafrance Autoworks Inc. Touch-sensitive electronically controlled automotive door opener
CN103648852A (zh) * 2011-07-15 2014-03-19 博泽哈尔施塔特汽车零件两合公司 在以手势控制的方式打开机动车车门和后备箱时的错误回避
CN103944945A (zh) * 2013-01-22 2014-07-23 广州汽车集团股份有限公司 对车载网络进行配置的方法、智能车载终端
CN106960486A (zh) * 2016-01-08 2017-07-18 福特全球技术公司 通过手势识别和语音命令进行功能特性激活的系统和方法
CN111179617A (zh) * 2018-11-09 2020-05-19 南京锦和佳鑫信息科技有限公司 一种智能网联车的车载单元
CN112491559A (zh) * 2020-12-03 2021-03-12 中国联合网络通信集团有限公司 一种身份验证方法及装置

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20070018790A1 (en) * 2005-07-19 2007-01-25 Lafrance Autoworks Inc. Touch-sensitive electronically controlled automotive door opener
CN103648852A (zh) * 2011-07-15 2014-03-19 博泽哈尔施塔特汽车零件两合公司 在以手势控制的方式打开机动车车门和后备箱时的错误回避
CN103944945A (zh) * 2013-01-22 2014-07-23 广州汽车集团股份有限公司 对车载网络进行配置的方法、智能车载终端
CN106960486A (zh) * 2016-01-08 2017-07-18 福特全球技术公司 通过手势识别和语音命令进行功能特性激活的系统和方法
CN111179617A (zh) * 2018-11-09 2020-05-19 南京锦和佳鑫信息科技有限公司 一种智能网联车的车载单元
CN112491559A (zh) * 2020-12-03 2021-03-12 中国联合网络通信集团有限公司 一种身份验证方法及装置

Similar Documents

Publication Publication Date Title
US11144301B2 (en) Over-the-air (OTA) update for firmware of a vehicle component
US11461146B2 (en) Scheduling sub-thread on a core running a trusted execution environment
US11687653B2 (en) Methods and apparatus for identifying and removing malicious applications
JP6898420B2 (ja) セキュアロックダウンを実装するように構成された関連装置を有する特別にプログラムされたコンピューティングシステムおよびその使用方法
US10169585B1 (en) System and methods for advanced malware detection through placement of transition events
US20200250302A1 (en) Security control method and computer system
EP2017765B1 (en) System and method for out-of-band assisted biometric secure boot
US10671726B1 (en) System and method for malware analysis using thread-level event monitoring
US20160036834A1 (en) System and method for determining category of trustof applications performing interface overlay
US10078754B1 (en) Volume cryptographic key management
US20090254986A1 (en) Method and apparatus for processing and displaying secure and non-secure data
CN108475217A (zh) 用于审计虚拟机的系统及方法
US20150169875A1 (en) Automatic Strong Identity Generation For Cluster Nodes
CN107609368A (zh) 应用程序的安全防护方法、装置、设备和计算机存储介质
US9537738B2 (en) Reporting platform information using a secure agent
TW201939337A (zh) 行為識別、數據處理方法及裝置
EP3646180A1 (en) Camera usage notification
WO2024124387A1 (zh) 一种服务调用方法、通信装置、服务调用系统以及车辆
US8898806B1 (en) Systems and methods for protecting services
US20190356655A1 (en) Techniques of using facial recognition to authenticate kvm users at service processor
US20220300330A1 (en) Runtime Container Protection
WO2021208354A1 (zh) 一种引入外置式硬件信任根进行可信度量的装置与方法
US11755704B2 (en) Facilitating secure unlocking of a computing device
CN115982708A (zh) 图像处理方法、装置、设备及存储介质
US11100215B2 (en) Management of a display of a view of an application on a screen of an electronic data entry device, corresponding method, device and computer program product