A certificate processing method, device and system for internet of vehicles

Abstract

This application discloses a certificate processing method, apparatus, and system for a vehicle-to-everything (V2X) network, used to improve the efficiency of short-term certificate issuance. This application provides a certificate processing method for a V2X network, applied to a vehicle communication system. The vehicle communication system includes: a V2X communication terminal and multiple short-term certificate issuing servers, the multiple short-term certificate issuing servers belonging to different regions. The method includes: the V2X communication terminal sending a first certificate acquisition request to a first short-term certificate issuing server, the first certificate acquisition request including: the long-term certificate of the V2X communication terminal and the region to which the short-term certificate issuing server belongs; the V2X communication terminal receiving a short-term certificate sent by the first short-term certificate issuing server.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of Internet of Vehicles, and in particular to a certificate processing method, device and system for Internet of Vehicles. BACKGROUND

[0002] At present, vehicle to everything (V2X) technology has become a hot spot for the development of new automobile technologies, is an important development direction for the automobile industry at present, and is one of the main directions of focus investment by related manufacturers in the industry value chain. V2X technology is one of the key auxiliary technical means for the realization of automatic driving of automobiles, and domestic and foreign standard organizations are actively involved in the construction of V2X technology.

[0003] Developing Internet of Vehicles is conducive to promoting the innovative development of the automobile industry, building new modes and new forms of automobile and transportation services, promoting the innovation and application of automatic driving technology, and improving traffic efficiency, saving resources, reducing pollution, and reducing the accident rate.

[0004] In a V2X communication system, a plurality of V2X terminals, a long-term certificate issuing server, and a short-term certificate issuing server can be included. The long-term certificate issuing server is configured to issue a long-term certificate to the V2X terminal, and the short-term certificate issuing server is configured to issue a short-term certificate to the V2X terminal. The long-term certificate is mainly used to indicate the identity of the vehicle, and the long-term certificate can be used as an identity credential by the V2X terminal to apply for a short-term certificate from the short-term certificate issuing server. The short-term certificate is used to provide a legal verification credential when sending a V2X message in the vehicle communication process.

[0005] Based on the above V2X communication system, a V2X terminal sends a V2X message in a broadcast manner, and other V2X terminals receive the V2X message. For security considerations, the short-term certificate and signature are used to provide data source authentication and integrity protection for the sent message. Therefore, each vehicle needs to apply for a short-term certificate for communication on a specific short-term certificate server, and the certificate needs to be carried in the broadcast message sent externally.

[0006] In the current V2V communication system, when a V2X terminal needs to obtain a short-term certificate, the V2X terminal sends a certificate request to the short-term certificate issuing server. The short-term certificate issuing server must interact with the long-term certificate issuing server to confirm the identity of the V2X terminal. Therefore, the acquisition of the short-term certificate depends on the interaction between the short-term certificate issuing server and the long-term certificate issuing server, so that the short-term certificate issuing server and the long-term certificate issuing server can only be coupled with each other, resulting in a lack of flexibility in the architecture, which is not conducive to actual deployment and reduces the efficiency of issuing short-term certificates. SUMMARY

[0007] The embodiment of the present application provides a certificate processing method, device and system for vehicle networking, which is used for improving the issuing efficiency of short-term certificates.

[0008] To solve the above technical problems, the embodiment of the present application provides the following technical solutions.

[0009] In the first aspect, the embodiment of the present application provides a certificate processing method for vehicle networking, which is applied to a vehicle communication system, the vehicle communication system comprises a vehicle networking communication terminal and a plurality of short-term certificate issuing servers, the plurality of short-term certificate issuing servers belong to different regions, and the method comprises the following steps: the vehicle networking communication terminal sends a first certificate obtaining request to a first short-term certificate issuing server, the first certificate obtaining request comprises a long-term certificate of the vehicle networking communication terminal and a region to which a short-term certificate issuing server belongs; and the vehicle networking communication terminal receives a short-term certificate sent by the first short-term certificate issuing server.

[0010] In the embodiment of the present application, the vehicle networking communication terminal sends a first certificate obtaining request to a first short-term certificate issuing server, the first certificate obtaining request comprises a long-term certificate of the vehicle networking communication terminal and a region to which a short-term certificate issuing server belongs, after the first short-term certificate issuing server receives the first certificate obtaining request sent by the vehicle networking communication terminal, the first short-term certificate issuing server can verify whether the region to which the short-term certificate issuing server belongs matches the first short-term certificate issuing server, when the region to which the short-term certificate issuing server belongs matches the first short-term certificate issuing server, the first short-term certificate issuing server verifies the long-term certificate according to a long-term certificate issuing server certificate, when the long-term certificate is verified, the first short-term certificate issuing server sends a short-term certificate to the vehicle networking communication terminal, and therefore the vehicle networking communication terminal receives the short-term certificate sent by the first short-term certificate issuing server. In the embodiment of the present application, the first short-term certificate issuing server can verify the long-term certificate of the vehicle networking communication terminal and the region to which the short-term certificate issuing server belongs according to the first certificate obtaining request, and therefore it is no longer necessary to verify the long-term certificate issuing server, and the issuing efficiency of the short-term certificate is improved.

[0011] In a possible implementation of the first aspect, the vehicle communication system further includes a long-term certificate issuing server, and the method further includes: obtaining, by the vehicle Internet communication terminal, the long-term certificate and short-term certificate issuing server attribution information from the long-term certificate issuing server, the short-term certificate issuing server attribution information including a short-term certificate issuing server attribution region and a short-term certificate issuing server address. In the embodiment of the application, the vehicle Internet communication terminal further stores an initial certificate configured by a manufacturer (i.e., a vehicle manufacturer) of the vehicle Internet communication terminal, and the vehicle Internet communication terminal has an identifier, by which different vehicle Internet communication terminals can be distinguished. When the vehicle Internet communication terminal needs a long-term certificate, the vehicle Internet communication terminal can further establish a communication connection with the long-term certificate issuing server in the vehicle communication system, and send a second certificate obtaining request to the long-term certificate issuing server, the second certificate obtaining request carrying the initial certificate of the vehicle Internet communication terminal and the identifier of the vehicle Internet communication terminal. The long-term certificate issuing server first verifies the initial certificate sent by the vehicle Internet communication terminal according to a preset vehicle manufacturer certificate, and if the initial certificate is verified, the long-term certificate issuing server issues a corresponding long-term certificate to the vehicle Internet communication terminal. In addition, when the vehicle Internet communication terminal needs a long-term certificate, the vehicle Internet communication terminal can further establish a communication connection with the long-term certificate issuing server in the vehicle communication system, and the long-term certificate issuing server sends a corresponding long-term certificate issued to the vehicle Internet communication terminal.

[0012] In a possible implementation of the first aspect, the vehicle communication system further includes a plurality of abnormal behavior detection servers, the plurality of abnormal behavior detection servers respectively corresponding to different regions where the vehicle Internet communication terminal is located; and the method further includes: receiving, by the vehicle Internet communication terminal, an address of a first abnormal behavior detection server sent by the first short-term certificate issuing server, the first abnormal behavior detection server belonging to the plurality of abnormal behavior detection servers. In the embodiment of the application, the first short-term certificate issuing server can further generate an address of the first abnormal behavior detection server, and then send the address of the first abnormal behavior detection server to the vehicle Internet communication terminal, so that the vehicle Internet communication terminal can obtain the address of the first abnormal behavior detection server. Further, the first short-term certificate issuing server determines the first abnormal behavior detection server from the plurality of abnormal behavior detection servers, and the first abnormal behavior detection server corresponds to the same region as the first short-term certificate issuing server.

[0013] In a possible implementation manner of the first aspect, after the vehicle Internet communication terminal receives the address of the first abnormal behavior detection server sent by the first short-term certificate issuing server, the method further includes: the vehicle Internet communication terminal sends a report message to the first abnormal behavior detection server, the report message including: a current region of the vehicle Internet communication terminal; the vehicle Internet communication terminal receives an address of a second abnormal behavior detection server matching the current region sent by the first abnormal behavior detection server, the second abnormal behavior detection server belonging to the plurality of abnormal behavior detection servers. After the vehicle Internet communication terminal obtains the current region of the vehicle Internet communication terminal, the vehicle Internet communication terminal sends the report message to the first abnormal behavior detection server. The first abnormal behavior detection server first detects whether the current region of the vehicle Internet communication terminal is the same as a home region of the first abnormal behavior detection server. If the current region of the vehicle Internet communication terminal is not the same as the home region of the first abnormal behavior detection server, the first abnormal behavior detection server determines an abnormal behavior detection server matching the current region of the vehicle Internet communication terminal from the plurality of abnormal behavior detection servers, that is, determines the address of the second abnormal behavior detection server. Then, the first abnormal behavior detection server sends the address of the second abnormal behavior detection server, so that the vehicle Internet communication terminal can determine the address of the second abnormal behavior detection server matching the current region, and the vehicle Internet communication terminal can further send the report message to the second abnormal behavior detection server, so that the second abnormal behavior detection server can provide abnormal behavior detection for the vehicle Internet communication terminal, and abnormal behavior processing in a switching scenario of the abnormal behavior detection server according to the home region is implemented.

[0014] In a possible implementation manner of the first aspect, the method further includes: when the vehicle Internet communication terminal determines that a region switch occurs, the vehicle Internet communication terminal sends an update request to the first abnormal behavior detection server, the update request including: a region to which the vehicle Internet communication terminal switches; and the vehicle Internet communication terminal receives an address of a third abnormal behavior detection server that matches the switched region and is sent by the first abnormal behavior detection server, the third abnormal behavior detection server belonging to the plurality of abnormal behavior detection servers. For example, the region of the vehicle Internet communication terminal switches from Guangdong to Guangxi. Since the abnormal behavior detection server corresponds to different regions, when the vehicle Internet communication terminal determines that the region switch occurs, the vehicle Internet communication terminal sends an update request to the first abnormal behavior detection server, the update request including: the region to which the vehicle Internet communication terminal switches, which is different from the home region of the first abnormal behavior detection server. The first abnormal behavior detection server determines the abnormal behavior detection server that matches the region to which the vehicle Internet communication terminal switches from the plurality of abnormal behavior detection servers, that is, determines the address of the third abnormal behavior detection server, and then the first abnormal behavior detection server sends the address of the third abnormal behavior detection server. Therefore, the vehicle Internet communication terminal can determine the address of the third abnormal behavior detection server that matches the switched region, and the vehicle Internet communication terminal can further send a report message to the third abnormal behavior detection server, so that the third abnormal behavior detection server can provide abnormal behavior detection for the vehicle Internet communication terminal, and abnormal behavior processing in the switching scenario of the abnormal behavior detection server according to the home region is realized.

[0015] In a possible implementation manner of the first aspect, the vehicle Internet communication terminal receiving the short-term certificate sent by the first short-term certificate issuing server includes: the vehicle Internet communication terminal receiving a plurality of short-term certificates sent by the first short-term certificate issuing server. The first short-term certificate issuing server can generate a plurality of short-term certificates in batches, and then the first short-term certificate issuing server sends the plurality of short-term certificates to the vehicle Internet communication terminal at the same time, so that the vehicle Internet communication terminal can receive the plurality of short-term certificates. By receiving the plurality of short-term certificates generated in batches, the efficiency of issuing the short-term certificate is further improved.

[0016] In a second aspect, the embodiments of the present application further provide a certificate processing method for a vehicle networking, which is applied to a vehicle communication system, the vehicle communication system comprising a vehicle networking communication terminal and a plurality of short-term certificate issuing servers belonging to different regions, and the method comprising: receiving, by a first short-term certificate issuing server, a first certificate obtaining request sent by the vehicle networking communication terminal, the first certificate obtaining request comprising a long-term certificate of the vehicle networking communication terminal and a region to which a short-term certificate issuing server belongs; when the region to which the short-term certificate issuing server belongs matches the first short-term certificate issuing server, verifying, by the first short-term certificate issuing server, the long-term certificate according to a long-term certificate issuing server certificate; and when the long-term certificate is verified, sending, by the first short-term certificate issuing server, a short-term certificate to the vehicle networking communication terminal.

[0017] In the embodiments of the present application, the vehicle networking communication terminal sends a first certificate obtaining request to a first short-term certificate issuing server, the first certificate obtaining request comprising a long-term certificate of the vehicle networking communication terminal and a region to which a short-term certificate issuing server belongs. After receiving the first certificate obtaining request sent by the vehicle networking communication terminal, the first short-term certificate issuing server can verify whether the region to which the short-term certificate issuing server belongs matches the first short-term certificate issuing server. When the region to which the short-term certificate issuing server belongs matches the first short-term certificate issuing server, the first short-term certificate issuing server verifies the long-term certificate according to a long-term certificate issuing server certificate. When the long-term certificate is verified, the first short-term certificate issuing server sends a short-term certificate to the vehicle networking communication terminal. Therefore, the vehicle networking communication terminal receives the short-term certificate sent by the first short-term certificate issuing server. In the embodiments of the present application, the first short-term certificate issuing server can verify the long-term certificate of the vehicle networking communication terminal and the region to which the short-term certificate issuing server belongs according to the first certificate obtaining request. Therefore, the first short-term certificate issuing server no longer needs to verify the long-term certificate issuing server, and the efficiency of issuing the short-term certificate is improved.

[0018] In a possible implementation manner of the second aspect, the vehicle communication system comprises a plurality of abnormal behavior detection servers, the plurality of abnormal behavior detection servers respectively correspond to different regions where the vehicle Internet communication terminals are located; after the first short-term certificate issuing server sends the short-term certificate to the vehicle Internet communication terminal, the method further comprises: the first short-term certificate issuing server sends an address of a first abnormal behavior detection server to the vehicle Internet communication terminal, the first abnormal behavior detection server belongs to the plurality of abnormal behavior detection servers. In the embodiment of the application, the first short-term certificate issuing server can further generate the address of the first abnormal behavior detection server, and then send the address of the first abnormal behavior detection server to the vehicle Internet communication terminal, so that the vehicle Internet communication terminal can obtain the address of the first abnormal behavior detection server. Further, the first short-term certificate issuing server determines the first abnormal behavior detection server from the plurality of abnormal behavior detection servers, and the first abnormal behavior detection server corresponds to the same region as the first short-term certificate issuing server.

[0019] In a possible implementation manner of the second aspect, when the first short-term certificate issuing server sends a plurality of short-term certificates, the method further comprises: the first short-term certificate issuing server generates an association value corresponding to the plurality of short-term certificates, and saves the corresponding relationship between the association value and the plurality of short-term certificates. Wherein, the first short-term certificate issuing server can generate short-term certificates in batches, generate corresponding association values, and save the corresponding relationship between the association values and the plurality of short-term certificates. By generating short-term certificates in batches, the efficiency of issuing short-term certificates is further improved. The association value generated by the first short-term certificate issuing server can be used to query all short-term certificates of the vehicle Internet communication terminal.

[0020] In a possible implementation manner of the second aspect, the vehicle communication system further includes a plurality of abnormal behavior detection servers, and the method further includes: the first short-term certificate issuing server receiving a certificate query request sent by a first abnormal behavior detection server, the certificate query request including a first short-term certificate of the vehicle networking communication terminal, and the first abnormal behavior detection server belonging to the plurality of abnormal behavior detection servers; the first short-term certificate issuing server obtaining an association value corresponding to the first short-term certificate according to the first short-term certificate; and the first short-term certificate issuing server sending a plurality of short-term certificates determined according to the association value to the first abnormal behavior detection server. In this way, the first short-term certificate issuing server obtains the first short-term certificate of the vehicle networking communication terminal from a vehicle networking message sent by the vehicle networking communication terminal, can obtain the association value corresponding to the first short-term certificate according to the first short-term certificate, and stores a corresponding relationship between the association value and the plurality of short-term certificates in the first short-term certificate issuing server. Therefore, the first short-term certificate issuing server determines the plurality of short-term certificates of the vehicle networking communication terminal according to the association value, and sends the plurality of short-term certificates to the first abnormal behavior detection server, so that the first abnormal behavior detection server can query the plurality of short-term certificates of the vehicle networking communication terminal, and can detect whether the vehicle networking communication terminal has abnormal behavior according to the plurality of short-term certificates of the vehicle networking communication terminal. The first abnormal behavior detection server can also revoke the plurality of short-term certificates of the vehicle networking communication terminal.

[0021] In a possible implementation manner of the second aspect, after the first short-term certificate issuing server sends the plurality of short-term certificates to the first abnormal behavior detection server, the method further includes: the first short-term certificate issuing server receiving a revocation request sent by the first abnormal behavior detection server; and the first short-term certificate issuing server revoking the plurality of short-term certificates according to the revocation request. In this way, after the first abnormal behavior detection server queries the plurality of short-term certificates of the vehicle networking communication terminal, the first abnormal behavior detection server can request the first short-term certificate issuing server to revoke the plurality of short-term certificates of the vehicle networking communication terminal, and the first short-term certificate issuing server revokes the plurality of short-term certificates according to the revocation request, so as to achieve revoking the plurality of short-term certificates of the vehicle networking communication terminal, and solve the certificate management problem when the vehicle networking communication terminal has abnormal behavior.

[0022] In a third aspect, the embodiments of the present application provide a certificate processing method for a vehicle networking, which is applied to a vehicle communication system. The vehicle communication system comprises a vehicle networking communication terminal and a plurality of abnormal behavior detection servers. The plurality of abnormal behavior detection servers correspond to different regions where the vehicle networking communication terminal is located respectively. The method comprises the following steps: a first abnormal behavior detection server receives a report message sent by the vehicle networking communication terminal. The report message comprises a current region of the vehicle networking communication terminal and the first abnormal behavior detection server belongs to the plurality of abnormal behavior detection servers. When the current region does not match the first abnormal behavior detection server, the first abnormal behavior detection server sends an address of a second abnormal behavior detection server which matches the current region to the vehicle networking communication terminal. The second abnormal behavior detection server belongs to the plurality of abnormal behavior detection servers.

[0023] In the embodiments of the present application, if the current region of the vehicle networking communication terminal is different from the home region of the first abnormal behavior detection server, the first abnormal behavior detection server determines the abnormal behavior detection server which matches the current region of the vehicle networking communication terminal from the plurality of abnormal behavior detection servers, i.e. determines the address of the second abnormal behavior detection server, and then the first abnormal behavior detection server sends the address of the second abnormal behavior detection server. Therefore, the vehicle networking communication terminal can determine the address of the second abnormal behavior detection server which matches the current region, and the vehicle networking communication terminal can further send the report message to the second abnormal behavior detection server. Therefore, the second abnormal behavior detection server can provide abnormal behavior detection for the vehicle networking communication terminal, and abnormal behavior processing in the switching scenario of the abnormal behavior detection server according to the home region is realized.

[0024] In a possible implementation manner of the third aspect, the method further includes: receiving, by the first abnormal behavior detection server, an update request sent by the vehicle Internet communication terminal, the update request including: a region to which the vehicle Internet communication terminal switches; and sending, by the first abnormal behavior detection server, an address of a third abnormal behavior detection server matched with the switched region to the vehicle Internet communication terminal. Wherein the vehicle Internet communication terminal can detect whether the region to which the vehicle Internet communication terminal is located is switched regularly. For example, the region of the vehicle Internet communication terminal is switched from Guangdong to Guangxi. Since the abnormal behavior detection server corresponds to different regions. When the vehicle Internet communication terminal determines that the region is switched, the vehicle Internet communication terminal sends an update request to the first abnormal behavior detection server, the update request including: the region to which the vehicle Internet communication terminal switches, the region to which the vehicle Internet communication terminal switches being different from the home region of the first abnormal behavior detection server. The first abnormal behavior detection server determines the abnormal behavior detection server matched with the region to which the vehicle Internet communication terminal switches from a plurality of abnormal behavior detection servers, that is, determines the address of the third abnormal behavior detection server. Then the first abnormal behavior detection server sends the address of the third abnormal behavior detection server. Therefore, the vehicle Internet communication terminal can determine the address of the third abnormal behavior detection server matched with the switched region. The vehicle Internet communication terminal can further send a report message to the third abnormal behavior detection server. Therefore, the third abnormal behavior detection server can provide abnormal behavior detection for the vehicle Internet communication terminal, and abnormal behavior processing in the switching scenario according to the home region of the abnormal behavior detection server is realized.

[0025] In a possible implementation manner of the third aspect, the vehicle communication system further includes a plurality of short-term certificate issuing servers belonging to different regions, and the method further includes: when the current region matches the first abnormal behavior detection server, the first abnormal behavior detection server sends a certificate query request to a first short-term certificate issuing server, the certificate query request including: a first short-term certificate of the vehicle Internet communication terminal, and the first abnormal behavior detection server belonging to the plurality of abnormal behavior detection servers; and the first abnormal behavior detection server receives a plurality of short-term certificates sent by the first short-term certificate issuing server. The first short-term certificate issuing server obtains the first short-term certificate of the vehicle Internet communication terminal from a vehicle Internet message sent by the vehicle Internet communication terminal, and can obtain an association value corresponding to the first short-term certificate according to the first short-term certificate. The first short-term certificate issuing server stores a correspondence between the association value and the plurality of short-term certificates, and thus determines the plurality of short-term certificates of the vehicle Internet communication terminal according to the association value. After that, the first short-term certificate issuing server sends the plurality of short-term certificates to the first abnormal behavior detection server, so that the first abnormal behavior detection server can query the plurality of short-term certificates of the vehicle Internet communication terminal.

[0026] In a possible implementation manner of the third aspect, after the first abnormal behavior detection server receives the plurality of short-term certificates sent by the first short-term certificate issuing server, the method further includes: when the first abnormal behavior detection server determines that the vehicle Internet communication terminal has abnormal behavior according to the plurality of short-term certificates, the first abnormal behavior detection server revokes the plurality of short-term certificates of the vehicle Internet communication terminal, or the first abnormal behavior detection server sends a revocation request to the first short-term certificate issuing server, the revocation request being used to instruct the first short-term certificate issuing server to revoke the plurality of short-term certificates. The first abnormal behavior detection server can determine whether the vehicle Internet communication terminal has abnormal behavior according to the plurality of short-term certificates of the vehicle Internet communication terminal. The first abnormal behavior detection server can also revoke the plurality of short-term certificates of the vehicle Internet communication terminal. After the first abnormal behavior detection server queries the plurality of short-term certificates of the vehicle Internet communication terminal, the first abnormal behavior detection server can request the first short-term certificate issuing server to revoke the plurality of short-term certificates of the vehicle Internet communication terminal. The first short-term certificate issuing server revokes the plurality of short-term certificates according to the revocation request, so as to revoke the plurality of short-term certificates of the vehicle Internet communication terminal, and solve the certificate management problem when the vehicle Internet communication terminal has abnormal behavior.

[0027] In a fourth aspect, an embodiment of the present application provides a vehicle communication system, comprising: an Internet of Vehicles communication terminal, a plurality of short-term certificate issuing servers, and a plurality of abnormal behavior detection servers, wherein the plurality of short-term certificate issuing servers belong to different regions; the plurality of abnormal behavior detection servers correspond to different regions where the Internet of Vehicles communication terminal is located respectively; the Internet of Vehicles communication terminal and a first short-term certificate issuing server of the plurality of short-term certificate issuing servers establish a communication connection; and the Internet of Vehicles communication terminal and a first abnormal behavior detection server of the plurality of abnormal behavior detection servers establish a communication connection.

[0028] In a fifth aspect, an embodiment of the present application provides a computer readable storage medium, which stores instructions, and when the instructions are run on a computer, the computer executes the method in the first aspect.

[0029] In a sixth aspect, an embodiment of the present application provides a computer readable storage medium, which stores instructions, and when the instructions are run on a computer, the computer executes the method in the second aspect.

[0030] In a seventh aspect, an embodiment of the present application provides a computer readable storage medium, which stores instructions, and when the instructions are run on a computer, the computer executes the method in the third aspect.

[0031] In an eighth aspect, an embodiment of the present application provides a computer program product containing instructions, and when the instructions are run on a computer, the computer executes the method in the first aspect.

[0032] In a ninth aspect, an embodiment of the present application provides a computer program product containing instructions, and when the instructions are run on a computer, the computer executes the method in the second aspect.

[0033] In a tenth aspect, an embodiment of the present application provides a computer program product containing instructions, and when the instructions are run on a computer, the computer executes the method in the third aspect.

[0034] In an eleventh aspect, an embodiment of the present application provides an Internet of Vehicles communication device, comprising: a processor and a memory; the memory is used to store instructions; and the processor is used to execute the instructions in the memory, so that the Internet of Vehicles communication device executes the method in any one of the first aspect.

[0035] In a twelfth aspect, an embodiment of the present application provides a short-term certificate issuing apparatus, the short-term certificate issuing apparatus comprising: a processor, a memory; the memory is configured to store instructions; the processor is configured to execute the instructions in the memory, so that the short-term certificate issuing apparatus performs the method in any one of the preceding second aspects.

[0036] In a thirteenth aspect, an embodiment of the present application provides an abnormal behavior detection apparatus, the abnormal behavior detection apparatus comprising: a processor, a memory; the memory is configured to store instructions; the processor is configured to execute the instructions in the memory, so that the abnormal behavior detection apparatus performs the method in any one of the preceding third aspects.

[0037] In a fourteenth aspect, the present application provides a chip system, which comprises a processor configured to support the vehicle-to-everything communication apparatus, or the short-term certificate issuing apparatus, or the abnormal behavior detection apparatus to implement the functions involved in the above aspects, for example, to send or process the data and / or information involved in the above methods. In a possible design, the chip system further comprises a memory, and the memory is configured to store the necessary program instructions and data of the vehicle-to-everything communication apparatus, or the short-term certificate issuing apparatus, or the abnormal behavior detection apparatus. The chip system can be composed of a chip, or can comprise a chip and other discrete devices. BRIEF DESCRIPTION OF DRAWINGS

[0038] Figure 1 A schematic diagram of an architecture of a vehicle communication system provided by an embodiment of the present application;

[0039] Figure 2 A schematic diagram of another architecture of a vehicle communication system provided by an embodiment of the present application;

[0040] Figure 3 A schematic diagram of another architecture of a vehicle communication system provided by an embodiment of the present application;

[0041] Figure 4 A schematic diagram of an interaction process between a vehicle-to-everything communication terminal and a first short-term certificate issuing server in an embodiment of the present application;

[0042] Figure 5 A schematic diagram of an interaction process between a vehicle-to-everything communication terminal and a first abnormal behavior detection server in an embodiment of the present application;

[0043] Figure 6 A schematic diagram of an architecture of an application scenario of a vehicle-to-everything communication system provided by an embodiment of the present application;

[0044] Figure 7-a A schematic diagram of an interaction process between multiple components in a vehicle-to-everything communication system provided by an embodiment of the present application;

[0045] Figure 7-b This is a schematic diagram illustrating another interaction process between multiple components in a vehicle-to-everything (V2X) communication system provided in an embodiment of this application.

[0046] Figure 8 This is a schematic diagram illustrating the interaction process between the vehicle network communication terminal and the EA server provided in an embodiment of this application.

[0047] Figure 9 This is a schematic diagram illustrating the interaction process between the vehicle network communication terminal and the AA server provided in an embodiment of this application.

[0048] Figure 10 This is a schematic diagram illustrating the interaction process between the vehicle network communication terminal and the MA server provided in an embodiment of this application.

[0049] Figure 11 This is a schematic diagram illustrating the interaction process between the MA server and the AA server provided in an embodiment of this application.

[0050] Figure 12 This is a schematic diagram illustrating the interaction process between two vehicle-to-everything (V2X) communication terminals provided in an embodiment of this application.

[0051] Figure 13 This is a schematic diagram of the composition structure of a vehicle-to-everything (V2X) communication device provided in an embodiment of this application;

[0052] Figure 14 A schematic diagram of the composition structure of a short-term certificate issuance device provided in this application embodiment;

[0053] Figure 15 This is a schematic diagram of the composition structure of an abnormal behavior detection device provided in an embodiment of this application;

[0054] Figure 16 This is a schematic diagram of the composition structure of another vehicle-to-everything (V2X) communication device provided in an embodiment of this application;

[0055] Figure 17 A schematic diagram illustrating the composition of another short-term certificate issuance device provided in this application embodiment;

[0056] Figure 18 This is a schematic diagram of the composition structure of another abnormal behavior detection device provided in an embodiment of this application. Detailed Implementation

[0057] This application provides a certificate processing method, apparatus, and system for vehicle networking, which improves the efficiency of issuing short-term certificates.

[0058] The terms "first," "second," etc., used in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such terms are interchangeable where appropriate; this is merely a way of distinguishing objects with the same attributes in the embodiments of this application. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion, so that a process, method, system, product, or apparatus that comprises a series of elements is not necessarily limited to those elements but may include other elements not explicitly listed or inherent to those processes, methods, products, or apparatuses.

[0059] First, the communication process between vehicle-to-everything (V2X) communication terminals in the field of V2X provided in this application embodiment is described. In a vehicle communication system, two V2X communication terminals communicate through V2X messages. For example, one V2X communication terminal can send a V2X message to another V2X communication terminal. The terminal sending the message can be called the V2X sending terminal, and the terminal receiving the message can be called the V2X receiving terminal. In this application embodiment, the method of sending messages between V2X communication terminals can include broadcast, unicast, or multicast, etc. In the following embodiments, the V2V broadcast method is used as an example for description. Specifically, the V2X message can be a proximity communication fifth interface (PC5) message.

[0060] In this embodiment, the vehicle-to-everything (V2X) communication terminal can be an on-board unit (OBD) or a roadside unit (RSU). It can also be an intelligent transport system station (ITS-S). When V2X communication terminals communicate with each other, any one of them may engage in malicious behavior; therefore, V2X communication terminals need to carry a short-term certificate when sending V2X messages.

[0061] The architecture of the vehicle communication system provided in the embodiments of this application will be described next. Figure 1 As shown, the vehicle communication system 100 includes: a vehicle network communication terminal 101, multiple short-term certificate issuing servers 102, and multiple abnormal behavior detection servers 103.

[0062] In this embodiment, the short-term certificate issuing server can be a short-term certificate (authorization authority, AA) server, which will be referred to as AA in subsequent embodiments. The AA is responsible for vehicle business authorization management and issuing short-term certificates. In this embodiment, the short-term certificate issuing server can also be called a short-term certificate management server. Multiple short-term certificate issuing servers belong to different regions; that is, in this embodiment, the short-term certificate issuing servers are set up according to their geographical location, for example, they can be divided according to provinces. The short-term certificate does not change depending on the real-time location of the vehicle-to-everything (V2X) communication terminal. The short-term certificate is bound to the registration location of the V2X communication terminal. For example, if the V2X communication terminal is registered with an AA server in Guangdong Province, the V2X communication terminal needs to apply for a short-term certificate from the AA server in Guangdong Province.

[0063] In this embodiment, the vehicle-to-everything (V2X) communication terminal may be configured with short-term certificate issuance server (SPC) attribution information, which includes the SPC's region and address. The V2X communication terminal establishes a communication connection with a first SPC among multiple SPCs based on the SPC address.

[0064] The misbehavior authority (MA) server is used to detect abnormal behavior of the vehicle-to-everything (V2X) communication terminal. Specifically, the misbehavior authority server can be an Internet of Things (IoT) platform. In this embodiment, multiple misbehavior authority servers correspond to different regions where the V2X communication terminal is located; that is, the misbehavior authority servers are set up according to the region where the V2X communication terminal is located, for example, by province. When the V2X communication terminal is in different regions, the misbehavior authority server needs to be switched. The multiple misbehavior authority servers can be multiple misbehavior authority servers divided by region. Alternatively, a central misbehavior authority server can be set up to manage the misbehavior authority servers in multiple regions.

[0065] In this embodiment, the vehicle-to-everything (V2X) communication terminal (i.e., the V2X message receiver) stores an abnormal behavior detection strategy. This strategy is used to detect whether another V2X communication terminal (V2X message sender) exhibits abnormal behavior based on vehicle data collected from that other V2X communication terminal. This abnormal behavior can also be referred to as malicious behavior. Abnormal behavior refers to the act of a V2X message sender sending abnormal messages to interfere with the normal traffic participation of other V2X communication terminals (i.e., the V2X message receiver). The V2X message receiver can determine that the V2X message sender has abnormal behavior based on preset judgment conditions. These conditions can be determined based on the content of the V2X messages sent by the V2X message sender, the V2X message sender's certificate, or the V2X message sender's events. The V2X communication terminal (i.e., the V2X message receiver) establishes a communication connection with a first abnormal behavior detection server among multiple abnormal behavior detection servers. When the first abnormal behavior detection server matches the current region of the V2X communication terminal, the V2X communication terminal sends a report message to the first abnormal behavior detection server. The first abnormal behavior detection server then detects malicious behavior of the V2X message sender based on the report message. When the first abnormal behavior detection server does not match the current region of the vehicle network communication terminal, after receiving the report message, the first abnormal behavior detection server first determines the second abnormal behavior detection server that matches the current region of the vehicle network receiving terminal. Then, the first abnormal behavior detection server sends the address of the second abnormal behavior detection server to the vehicle network communication terminal, and the vehicle network communication terminal can send a report message to the second abnormal behavior detection server.

[0066] It should be noted that, in some embodiments of this application, there may be one or more vehicle network communication terminals in the vehicle network communication system, so that each vehicle network communication terminal can detect whether the received vehicle network message is an abnormal message according to the abnormal behavior detection strategy after receiving the vehicle network message.

[0067] In some embodiments of this application, such as Figure 2As shown, the vehicle communication system 100 may further include a long-term certificate issuing server 104, which can also be called a long-term certificate management server. The long-term certificate issuing server is responsible for vehicle identity management and issuing long-term certificates. This server stores the address of a short-term certificate issuing server, the identifier of the vehicle network communication terminal, and the vehicle manufacturer's certificate. For example, the short-term certificate issuing server address could be the Internet Protocol (IP) address of the AA (Autonomous Automobile Manufacturer). The long-term certificate issuing server can be a long-term certificate (enrollment authority, EA) server; in subsequent embodiments, the EA server will be simply referred to as EA. The long-term certificate issuing server 104 is used to issue long-term certificates to the vehicle network communication terminal and manage the issued long-term certificates. Furthermore, there can be one or more long-term certificate issuing servers in the vehicle network communication system.

[0068] In some embodiments of this application, such as Figure 3 As shown, relative to Figure 2 As shown, the vehicle communication system 100 may further include a certificate revocation server 105, which can revoke certificates issued for vehicle-to-everything (V2X) communication terminals. For example, the certificate revocation server may be a certificate revocation list (CRL) server.

[0069] The certificate processing method for the Internet of Vehicles provided in this application is applied to a vehicle communication system. The vehicle communication system includes: an Internet of Vehicles communication terminal and multiple short-term certificate issuing servers. The multiple short-term certificate issuing servers belong to different regions, and the region of the first short-term certificate issuing server is consistent with the vehicle registration location of the Internet of Vehicles communication terminal.

[0070] Please see Figure 4 As shown, the interaction process between the vehicle network communication terminal and the first short-term certificate issuing server in this application embodiment is illustrated first. The certificate processing method for the vehicle network provided in this application embodiment mainly includes the following process:

[0071] 401. The vehicle-to-everything (V2X) communication terminal sends a first certificate acquisition request to the first short-term certificate issuing server. The first certificate acquisition request includes: the long-term certificate of the V2X communication terminal and the geographical region of the short-term certificate issuing server.

[0072] In this embodiment, the vehicle-to-everything (V2X) communication terminal stores its long-term certificate, which can be issued to the V2X communication terminal by a long-term certificate issuing server. The V2X communication terminal also stores the geographic region of a short-term certificate issuing server, which indicates the geographic region corresponding to that short-term certificate issuing server. In this embodiment, when the V2X communication terminal needs a short-term certificate, it can first determine which short-term certificate issuing server in the V2X communication system it needs to communicate with. For example, the V2X communication terminal can determine that it needs to communicate with a first short-term certificate issuing server. At this time, the V2X communication terminal can send a first certificate retrieval request, which carries the V2X communication terminal's long-term certificate and the geographic region of the short-term certificate issuing server.

[0073] In some embodiments of this application, the vehicle communication system further includes a long-term certificate issuance server, and the method provided in this application embodiment further includes the following steps:

[0074] The vehicle-to-everything (V2X) communication terminal obtains the attribution information of long-term and short-term certificate issuing servers from the long-term certificate issuing server. The attribution information of the short-term certificate issuing server includes: the region where the short-term certificate issuing server is located and the address of the short-term certificate issuing server.

[0075] For example, the vehicle-to-everything (V2X) communication terminal also stores an initial certificate. This initial certificate is configured for the terminal by its manufacturer (i.e., the vehicle manufacturer). The V2X communication terminal also has an identifier that distinguishes different V2X communication terminals. When the V2X communication terminal requires a long-term certificate, it can establish a communication connection with a long-term certificate issuing server in the vehicle communication system. The V2X communication terminal sends a second certificate retrieval request to the long-term certificate issuing server. This request carries the initial certificate and the V2X communication terminal's identifier. The long-term certificate issuing server first verifies the initial certificate sent by the V2X communication terminal against a pre-installed vehicle manufacturer certificate. If the initial certificate verification is successful, the long-term certificate issuing server issues the corresponding long-term certificate to the V2X communication terminal. In addition to sending long-term certificates, the long-term certificate issuing server can also send short-term certificate issuing server attribution information. This short-term certificate issuing server attribution information includes the short-term certificate issuing server's geographical region and address. The short-term certificate issuing server address refers to the IP address of the short-term certificate issuing server.

[0076] For example, there are several ways to deploy an EA server. If the EA is deployed by a government platform, the EA server will pre-install the initial certificate issued by the vehicle manufacturer's platform, the identifier of the vehicle-to-everything (V2X) communication terminal, the AA address, and the EA certificate. After receiving a long-term certificate acquisition request from the V2X communication terminal, the EA server can include pre-installed AA attribution information in the credential issuance message to the vehicle. This AA attribution information may include the AA's geographic region and AA address.

[0077] In some embodiments of this application, when a vehicle-to-everything (V2X) communication terminal requires a long-term certificate, the V2X communication terminal can also establish a communication connection with a long-term certificate issuing server in the vehicle communication system. The long-term certificate issuing server then issues the corresponding long-term certificate to the V2X communication terminal. In addition to sending long-term certificates, the long-term certificate issuing server can also send short-term certificate issuing server attribution information, which includes the short-term certificate issuing server's geographic location and address. The short-term certificate issuing server address refers to its IP address.

[0078] For example, there are several ways to deploy an EA server. If the EA server is deployed on a vehicle manufacturer's platform, it will have pre-installed long-term certificates, the identifier of the vehicle-to-everything (V2X) communication terminal, the AA's (Autonomous Assistance) geographic region, and the AA's address. In this case, the V2X communication terminal does not need to initiate a certificate acquisition request; the long-term certificate issuing server will send the long-term certificate to the V2X communication terminal using the pre-installed long-term certificate.

[0079] In some embodiments of this application, before step 401 where the vehicle-to-everything (V2X) communication terminal sends a first certificate acquisition request to the first short-term certificate issuing server, the method provided in this application embodiment further includes:

[0080] The vehicle-to-everything (V2X) communication terminal determines the first short-term certificate issuing server from multiple short-term certificate issuing servers based on the short-term certificate issuing server information.

[0081] In this system, the vehicle-to-everything (V2X) communication terminal can obtain the address of a short-term certificate authority (SMA) from a long-term certificate authority (LTA) server. The V2X communication system also has multiple SMA servers. Based on the SMA server address, the V2X communication terminal can determine which SMA server to send the initial certificate acquisition request to. For example, the SMA server address could be the IP address of AA.

[0082] 402. The first short-term certificate issuing server receives the first certificate acquisition request sent by the vehicle network communication terminal. The first certificate acquisition request includes: the long-term certificate of the vehicle network communication terminal and the geographical region of the short-term certificate issuing server.

[0083] In this embodiment of the application, the first short-term certificate issuing server can establish a communication connection with the vehicle network communication terminal. The first short-term certificate issuing server receives the first certificate acquisition request sent by the vehicle network communication terminal, and then parses the first certificate acquisition request. From the first certificate acquisition request, the long-term certificate of the vehicle network communication terminal and the region to which the short-term certificate issuing server belongs can be obtained. Then, step 403 is executed.

[0084] 403. When the region of the short-term certificate issuing server matches that of the first short-term certificate issuing server, the first short-term certificate issuing server verifies the long-term certificate based on the certificate of the long-term certificate issuing server.

[0085] In this embodiment, the first short-term certificate issuing server first verifies whether the region of the short-term certificate issuing server carried in the first certificate acquisition request is the same as the region of the first short-term certificate issuing server. If the region of the short-term certificate issuing server carried in the first certificate acquisition request is the same as the region of the first short-term certificate issuing server, it is determined whether the region of the short-term certificate issuing server matches the first short-term certificate issuing server. If the region of the short-term certificate issuing server carried in the first certificate acquisition request is different from the region of the first short-term certificate issuing server, it is determined whether the region of the short-term certificate issuing server does not match the first short-term certificate issuing server. In this case, the short-term certificate is not generated for the vehicle network communication terminal, and the first certificate acquisition request sent by the vehicle network communication terminal is not responded to.

[0086] For example, if the short-term certificate issuing server in the first certificate retrieval request is located in Guangdong, then the region of origin of the short-term certificate issuing server in the first certificate retrieval request is confirmed to be the same as the region of origin of the short-term certificate issuing server. If the region of origin of the short-term certificate issuing server is located in Guangxi, then the region of origin of the short-term certificate issuing server in the first certificate retrieval request is confirmed to be different from the region of origin of the short-term certificate issuing server, and in this case, the short-term certificate issuing server can refuse to provide services to the vehicle-to-everything (V2X) communication terminal.

[0087] In this embodiment, the first short-term certificate issuing server locally stores the long-term certificate issuing server certificate. Since the first certificate acquisition request carries the long-term certificate of the vehicle network communication terminal, the first short-term certificate issuing server verifies the long-term certificate based on the long-term certificate issuing server certificate. The first short-term certificate issuing server does not need to interact with the long-term certificate issuing server again to obtain the verification result of the long-term certificate. Therefore, it is no longer necessary to verify with the long-term certificate issuing server. The first short-term certificate issuing server directly executes the subsequent step 404, thereby improving the issuance efficiency of short-term certificates.

[0088] 404. When the long-term certificate is verified, the first short-term certificate issuing server sends a short-term certificate to the vehicle network communication terminal.

[0089] In this embodiment of the application, if the short-term certificate issuing server passes the verification of its home region and the long-term certificate passes the verification, it means that the first short-term certificate issuing server can provide a short-term certificate for the vehicle network communication terminal. At this time, the first short-term certificate issuing server sends the short-term certificate to the vehicle network communication terminal.

[0090] In some embodiments of this application, step 404, where the first short-term certificate issuing server sends a short-term certificate to the vehicle-to-everything (V2X) communication terminal, includes:

[0091] The first short-term certificate issuing server sends multiple short-term certificates to the vehicle-to-everything (V2X) communication terminal.

[0092] The first short-term certificate issuing server can generate short-term certificates in batches, generate corresponding linkage values ​​(LA), and save the correspondence between linkage values ​​and multiple short-term certificates. By generating short-term certificates in batches, the efficiency of short-term certificate issuance is further improved.

[0093] In some embodiments of this application, the vehicle communication system includes: multiple abnormal behavior detection servers, each corresponding to a different geographical region where the vehicle-to-everything (V2X) communication terminal is located. After step 404, where the first short-term certificate issuing server sends a short-term certificate to the V2X communication terminal, the method provided in this application embodiment further includes the following steps:

[0094] The first short-term certificate issuing server sends the address of the first abnormal behavior detection server to the vehicle network communication terminal. The first abnormal behavior detection server belongs to multiple abnormal behavior detection servers.

[0095] The first short-term certificate issuing server can also generate the address of the first abnormal behavior detection server and then send this address to the vehicle-to-everything (V2X) communication terminal, enabling the V2X communication terminal to obtain the address of the first abnormal behavior detection server. Furthermore, the first short-term certificate issuing server determines the first abnormal behavior detection server from multiple abnormal behavior detection servers, and this first abnormal behavior detection server corresponds to the same geographical region as the first short-term certificate issuing server. For example, if the geographical region of the first short-term certificate issuing server is Guangdong, then the first short-term certificate issuing server can determine that the abnormal behavior detection server in the Guangdong region is the first abnormal behavior detection server.

[0096] In some embodiments of this application, when the first short-term certificate issuing server sends multiple short-term certificates, the method provided in this application further includes:

[0097] The first short-term certificate issuing server generates association values ​​corresponding to multiple short-term certificates and saves the correspondence between the association values ​​and multiple short-term certificates.

[0098] The first short-term certificate issuing server can generate short-term certificates in batches, generate corresponding associated values, and save the correspondence between the associated values ​​and multiple short-term certificates. By generating short-term certificates in batches, the efficiency of short-term certificate issuance is further improved. The associated values ​​generated by the first short-term certificate issuing server can be used to query all short-term certificates of the vehicle-to-everything (V2X) communication terminal.

[0099] In some embodiments of this application, the vehicle communication system further includes: multiple abnormal behavior detection servers; the method provided in the embodiments of this application further includes:

[0100] The first short-term certificate issuing server receives a certificate query request sent by the first abnormal behavior detection server. The certificate query request includes: the first short-term certificate of the vehicle network communication terminal. The first abnormal behavior detection server belongs to multiple abnormal behavior detection servers.

[0101] The first short-term certificate issuing server obtains the associated value corresponding to the first short-term certificate based on the first short-term certificate;

[0102] The first short-term certificate issuing server sends multiple short-term certificates determined based on the association value to the first abnormal behavior detection server.

[0103] The first short-term certificate issuing server obtains the first short-term certificate of the vehicle-to-everything (V2X) communication terminal from the V2X messages sent by the V2X communication terminal. The first short-term certificate issuing server can obtain the associated value corresponding to the first short-term certificate. The first short-term certificate issuing server stores the correspondence between the associated value and multiple short-term certificates. Therefore, the first short-term certificate issuing server determines multiple short-term certificates of the V2X communication terminal based on the associated value. Then, the first short-term certificate issuing server sends multiple short-term certificates to the first abnormal behavior detection server, so that the first abnormal behavior detection server can query the multiple short-term certificates of the V2X communication terminal. The first abnormal behavior detection server can detect whether the V2X communication terminal has abnormal behavior based on the multiple short-term certificates. The first abnormal behavior detection server can also revoke the multiple short-term certificates of the V2X communication terminal.

[0104] Furthermore, in some embodiments of this application, after the first short-term certificate issuing server sends multiple short-term certificates to the first abnormal behavior detection server, the method provided in this application embodiment further includes:

[0105] The first short-term certificate issuing server receives a revocation request sent by the first abnormal behavior detection server;

[0106] The first short-term certificate issuing server revoked multiple short-term certificates based on the revocation request.

[0107] In this system, after the first abnormal behavior detection server finds multiple short-term certificates for the vehicle-to-everything (V2X) communication terminal, it can request the first short-term certificate issuing server to revoke the multiple short-term certificates for the V2X communication terminal. The first short-term certificate issuing server then revokes the multiple short-term certificates according to the revocation request, thereby revoking the multiple short-term certificates for the V2X communication terminal and solving the certificate management problem when the V2X communication terminal exhibits abnormal behavior.

[0108] 405. The vehicle-to-everything (V2X) communication terminal receives a short-term certificate sent by the first short-term certificate issuing server.

[0109] In this embodiment, the first short-term certificate issuing server sends a short-term certificate to the vehicle-to-everything (V2X) communication terminal, and thus the V2X communication terminal receives the short-term certificate sent by the first short-term certificate issuing server. In this embodiment, the first short-term certificate issuing server can verify the long-term certificate of the V2X communication terminal and the geographical region of the short-term certificate issuing server in the first certificate acquisition request, thus eliminating the need for verification with the long-term certificate issuing server and improving the efficiency of short-term certificate issuance.

[0110] In some embodiments of this application, step 405, where the vehicle-to-everything (V2X) communication terminal receives a short-term certificate sent by the first short-term certificate issuing server, includes:

[0111] The vehicle-to-everything (V2X) communication terminal receives multiple short-term certificates sent by the first short-term certificate issuing server.

[0112] The first short-term certificate issuing server can generate short-term certificates in batches, and then send multiple short-term certificates to the vehicle network communication terminal at the same time, so that the vehicle network communication terminal can receive multiple short-term certificates. By receiving multiple short-term certificates generated in batches, the efficiency of short-term certificate issuance is further improved.

[0113] In some embodiments of this application, the vehicle communication system further includes: multiple abnormal behavior detection servers, each corresponding to a different geographical region where the vehicle-to-everything (V2X) communication terminal is located. The multiple abnormal behavior detection servers correspond to different geographical regions where the V2X communication terminal is located; that is, in this embodiment, the abnormal behavior detection servers are set up according to the geographical region where the V2X communication terminal is located, for example, the abnormal behavior detection servers can be divided according to provinces. When the V2X communication terminal is located in different geographical regions, it is necessary to switch between abnormal behavior detection servers. The method provided in this embodiment further includes the following steps:

[0114] The vehicle-to-everything (V2X) communication terminal receives the address of the first abnormal behavior detection server sent by the first short-term certificate issuing server. The first abnormal behavior detection server belongs to multiple abnormal behavior detection servers.

[0115] The first short-term certificate issuing server can also generate the address of the first abnormal behavior detection server and then send this address to the vehicle-to-everything (V2X) communication terminal, enabling the V2X communication terminal to obtain the address of the first abnormal behavior detection server. Furthermore, the first short-term certificate issuing server determines the first abnormal behavior detection server from multiple abnormal behavior detection servers, and this first abnormal behavior detection server corresponds to the same geographical region as the first short-term certificate issuing server. For example, if the geographical region of the first short-term certificate issuing server is Guangdong, then the first short-term certificate issuing server can determine that the abnormal behavior detection server in the Guangdong region is the first abnormal behavior detection server.

[0116] In this embodiment, the abnormal behavior detection server is a server that provides abnormal behavior detection for the vehicle-to-everything (V2X) communication terminal. After the V2X communication terminal receives the address of the first abnormal behavior detection server sent by the first short-term certificate issuing server, the method provided in this embodiment further includes the following steps:

[0117] The vehicle-to-everything (V2X) communication terminal sends a report message to the first abnormal behavior detection server. The report message includes: the current location of the V2X communication terminal.

[0118] The vehicle-to-everything (V2X) communication terminal receives the address of a second abnormal behavior detection server that matches the current region from the first abnormal behavior detection server. The second abnormal behavior detection server belongs to multiple abnormal behavior detection servers.

[0119] In this process, after the vehicle-to-everything (V2X) communication terminal obtains its current location, it sends a report message to the first abnormal behavior detection server. The first abnormal behavior detection server first checks whether the current location of the V2X communication terminal is the same as its own location. If the current location of the V2X communication terminal is different from the own location of the first abnormal behavior detection server, the first abnormal behavior detection server determines the abnormal behavior detection server that matches the current location of the V2X communication terminal from multiple abnormal behavior detection servers, that is, it determines the address of the second abnormal behavior detection server. Then, the first abnormal behavior detection server sends the address of the second abnormal behavior detection server, so that the V2X communication terminal can determine the address of the second abnormal behavior detection server that matches its current location. The V2X communication terminal can then send a report message to the second abnormal behavior detection server, so that the second abnormal behavior detection server can provide abnormal behavior detection for the V2X communication terminal, realizing the abnormal behavior handling in the scenario of switching according to the home region.

[0120] In some embodiments of this application, the method provided in this application further includes the following steps:

[0121] When the vehicle-to-everything (V2X) communication terminal determines that a regional switch has occurred, the V2X communication terminal sends an update request to the first abnormal behavior detection server. The update request includes: the region of the V2X communication terminal after the switch.

[0122] The vehicle-to-everything (V2X) communication terminal receives the address of a third abnormal behavior detection server that matches the switched region from the first abnormal behavior detection server. The third abnormal behavior detection server belongs to multiple abnormal behavior detection servers.

[0123] The vehicle-to-everything (V2X) communication terminal can periodically detect whether its location has changed. For example, if the V2X communication terminal changes its location from Guangdong to Guangxi, the abnormal behavior detection server corresponds to a different region. When the V2X communication terminal determines that a region change has occurred, it sends an update request to the first abnormal behavior detection server. The update request includes the location of the V2X communication terminal after the change, which is different from the location of the first abnormal behavior detection server. The first abnormal behavior detection server then determines the address of the third abnormal behavior detection server from among multiple abnormal behavior detection servers, thus identifying the address of the third abnormal behavior detection server that matches the changed region. The V2X communication terminal can then send a report message to the third abnormal behavior detection server, enabling the third abnormal behavior detection server to provide abnormal behavior detection for the V2X communication terminal. This achieves abnormal behavior handling based on the changing region scenario.

[0124] As illustrated by the foregoing embodiments, the vehicle-to-everything (V2X) communication terminal sends a first certificate acquisition request to a first short-term certificate issuing server. This request includes the V2X communication terminal's long-term certificate and the geographic region of the short-term certificate issuing server. Upon receiving the request, the first short-term certificate issuing server verifies whether its geographic region matches the long-term certificate issuing server's. If the long-term certificate is verified, the server verifies the long-term certificate based on the long-term certificate issuing server's certificate. If the long-term certificate is verified successfully, the server sends a short-term certificate to the V2X communication terminal, thus enabling the V2X communication terminal to receive the short-term certificate. In this embodiment, the first short-term certificate issuing server can verify the long-term certificate and the geographic region of the short-term certificate issuing server from the first certificate acquisition request, eliminating the need for verification with the long-term certificate issuing server and improving the efficiency of short-term certificate issuance.

[0125] Please see Figure 5 As shown, the interaction process between the vehicle network communication terminal and the first abnormal behavior detection server in this application embodiment is illustrated first. The vehicle network certificate processing method provided in this application embodiment mainly includes the following process:

[0126] 501. The vehicle-to-everything (V2X) communication terminal sends a report message to the first abnormal behavior detection server. The report message includes: the current location of the V2X communication terminal.

[0127] After obtaining its current location, the vehicle-to-everything (V2X) communication terminal sends a report message to the first abnormal behavior detection server. This report message includes the V2X communication terminal's current location. For example, the report message might indicate that the V2X communication terminal is currently located in Guangdong province.

[0128] 502. The first abnormal behavior detection server receives a report message sent by the vehicle network communication terminal. The report message includes: the current region of the vehicle network communication terminal. The first abnormal behavior detection server belongs to multiple abnormal behavior detection servers.

[0129] The first abnormal behavior detection server receives a report message sent by the vehicle network communication terminal and determines the current region of the vehicle network communication terminal from the report message. For example, it determines that the vehicle network communication terminal is currently located in Guangdong Province based on the report message.

[0130] 503. When the current region does not match the first abnormal behavior detection server, the first abnormal behavior detection server sends the address of the second abnormal behavior detection server that matches the current region to the vehicle network communication terminal. The second abnormal behavior detection server belongs to multiple abnormal behavior detection servers.

[0131] After obtaining the current location of the vehicle-to-everything (V2X) communication terminal, the V2X communication terminal sends a report message to the first abnormal behavior detection server. The first abnormal behavior detection server first checks whether the current location of the V2X communication terminal is the same as the location of the first abnormal behavior detection server. If the current location of the V2X communication terminal is the same as the location of the first abnormal behavior detection server, the first abnormal behavior detection server performs abnormal behavior detection based on the report message.

[0132] 504. The vehicle-to-everything (V2X) communication terminal receives the address of the second abnormal behavior detection server, which matches the current region, sent by the first abnormal behavior detection server.

[0133] If the current region of the vehicle-to-everything (V2X) communication terminal is different from the region of the first abnormal behavior detection server, the first abnormal behavior detection server determines the abnormal behavior detection server that matches the current region of the V2X communication terminal from among multiple abnormal behavior detection servers, that is, determines the address of the second abnormal behavior detection server. Then, the first abnormal behavior detection server sends the address of the second abnormal behavior detection server, so that the V2X communication terminal can determine the address of the second abnormal behavior detection server that matches its current region. The V2X communication terminal can further send a report message to the second abnormal behavior detection server, so that the second abnormal behavior detection server can provide abnormal behavior detection for the V2X communication terminal, realizing the abnormal behavior handling of abnormal behavior in the scenario of switching the home region of the abnormal behavior detection server.

[0134] Furthermore, in some embodiments of this application, the method provided by the embodiments of this application further includes:

[0135] The first abnormal behavior detection server receives an update request sent by the vehicle network communication terminal. The update request includes: the region after the vehicle network communication terminal switches.

[0136] The first abnormal behavior detection server sends the address of the third abnormal behavior detection server, which matches the switched region, to the vehicle network communication terminal.

[0137] The vehicle-to-everything (V2X) communication terminal can periodically detect whether its location has changed. For example, if the V2X communication terminal changes its location from Guangdong to Guangxi, the abnormal behavior detection server corresponds to a different region. When the V2X communication terminal determines that a region change has occurred, it sends an update request to the first abnormal behavior detection server. The update request includes the location of the V2X communication terminal after the change, which is different from the location of the first abnormal behavior detection server. The first abnormal behavior detection server then determines the address of the third abnormal behavior detection server from among multiple abnormal behavior detection servers, thus identifying the address of the third abnormal behavior detection server that matches the changed region. The V2X communication terminal can then send a report message to the third abnormal behavior detection server, enabling the third abnormal behavior detection server to provide abnormal behavior detection for the V2X communication terminal. This achieves abnormal behavior handling based on the changing region scenario.

[0138] In some embodiments of this application, the vehicle communication system further includes: multiple short-term certificate issuance servers, which belong to different geographical regions; the method provided in this application also includes:

[0139] When the current region matches the first abnormal behavior detection server, the first abnormal behavior detection server sends a certificate query request to the first short-term certificate issuing server. The certificate query request includes: the first short-term certificate of the vehicle network communication terminal. The first abnormal behavior detection server belongs to multiple abnormal behavior detection servers.

[0140] The first abnormal behavior detection server receives multiple short-term certificates sent by the first short-term certificate issuing server.

[0141] Specifically, the first short-term certificate issuing server obtains the first short-term certificate of the vehicle-to-everything (V2X) communication terminal from the V2X messages sent by the V2X communication terminal. The first short-term certificate issuing server can obtain the association value corresponding to the first short-term certificate. The first short-term certificate issuing server stores the correspondence between the association value and multiple short-term certificates. Therefore, the first short-term certificate issuing server determines multiple short-term certificates of the V2X communication terminal based on the association value. Then, the first short-term certificate issuing server sends multiple short-term certificates to the first abnormal behavior detection server, so that the first abnormal behavior detection server can query the multiple short-term certificates of the V2X communication terminal.

[0142] Furthermore, in some embodiments of this application, after the first abnormal behavior detection server receives multiple short-term certificates sent by the first short-term certificate issuing server, the method provided in this application embodiment further includes:

[0143] The first abnormal behavior detection server determines that the vehicle network communication terminal has abnormal behavior based on multiple short-term certificates.

[0144] The first abnormal behavior detection server revokes multiple short-term certificates for the vehicle-to-everything (V2X) communication terminal; or,

[0145] The first abnormal behavior detection server sends a revocation request to the first short-term certificate issuing server. The revocation request is used to instruct the first short-term certificate issuing server to revoke multiple short-term certificates of the vehicle-to-everything (V2X) communication terminal.

[0146] The first abnormal behavior detection server can detect whether the vehicle-to-everything (V2X) communication terminal exhibits abnormal behavior based on its multiple short-term certificates. The first abnormal behavior detection server can also revoke these short-term certificates. After querying the multiple short-term certificates of the V2X communication terminal, the first abnormal behavior detection server can request the first short-term certificate issuing server to revoke them. The first short-term certificate issuing server then revokes the short-term certificates according to the revocation request, thereby resolving the certificate management issue when the V2X communication terminal exhibits abnormal behavior.

[0147] As illustrated by the examples in the foregoing embodiments, if the current region of the vehicle-to-everything (V2X) communication terminal is different from the region of the first abnormal behavior detection server, the first abnormal behavior detection server determines from among multiple abnormal behavior detection servers the abnormal behavior detection server that matches the current region of the V2X communication terminal, i.e., determines the address of the second abnormal behavior detection server. Then, the first abnormal behavior detection server sends the address of the second abnormal behavior detection server, so that the V2X communication terminal can determine the address of the second abnormal behavior detection server that matches its current region. The V2X communication terminal can further send a report message to the second abnormal behavior detection server, so that the second abnormal behavior detection server can provide abnormal behavior detection for the V2X communication terminal, realizing abnormal behavior processing in scenarios where the abnormal behavior detection server switches according to the region of origin.

[0148] To facilitate a better understanding and implementation of the above-described solutions in the embodiments of this application, specific examples of corresponding application scenarios are provided below.

[0149] like Figure 6The diagram shown illustrates the architecture of a vehicle-to-everything (V2X) communication system provided in this application embodiment. For V2X certificate issuance, the public key infrastructure (PKI) architecture provided in this application embodiment is used. This PKI architecture supports certificate issuance and management in V2X communication. The overall architecture adopts a layered approach, mainly including: a root certificate authority (Root CA), multiple Expert Providers (EAs), multiple Accounting Providers (AAs), multiple Management Authorities (MAs), multiple CRL libraries, and multiple V2X communication terminals. Specifically, the V2X communication terminals can be ITS-S or RSUs; in subsequent embodiments, they are simply referred to as vehicles. For example, AAs are deployed at the provincial level, such as Beijing AA and Guangdong AA. EAs are deployed by car manufacturers or governments, such as Toyota EA and Volkswagen EA; each EA can be an IoT platform. MAs are deployed using a central MA and provincial MAs. The functional difference between the central MA and provincial MAs is that the central MA has the function of a complete database, while the provincial MAs have the function of a subset of the database. The actual execution of abnormal behavior detection is performed by the provincial MAs. In addition, the CRL database adopts a central CRL and provincial CRL deployment method.

[0150] Next Figure 6 The functions and preset information of each structural node in the illustrated architecture are explained with examples, as shown in Table 1 below:

[0151]

[0152] The AA and EA certificates are issued by the RootCA and serve as credentials to verify the authority of the AA and EA public keys. These certificates differ from the short-term and long-term certificates issued to vehicles by the AA and EA. Long-term certificates primarily identify the vehicle and can be used as identity credentials to request short-term certificates from the AA. Short-term certificates provide credentials for legitimacy verification when sending V2X messages during vehicle communication.

[0153] like Figure 7-a This is a schematic diagram illustrating an interaction process between multiple components in a vehicle-to-everything (V2X) communication system provided in an embodiment of this application. The following will discuss... Figure 6 The interaction relationships between the nodes in the architecture shown are illustrated with examples. Figure 6 The structural nodes in the architecture shown include: vehicle A, vehicle B, EA, province AA, and MA.

[0154] The long-term certificate application process involves interaction between Vehicle B and EA. For example, EA interacts with ITS-S to issue a long-term certificate to ITS-S.

[0155] The short-term certificate application process involves interaction between vehicle B, EA, and provincial MA. For example, AA and ITS-S, thereby issuing a short-term certificate to ITS-S.

[0156] The vehicle-to-vehicle communication process involves interaction between vehicle A and vehicle B. For example, ITS-S1 and ITS-S2 interact, with ITS-S1 sending PC5 information.

[0157] The malicious behavior reporting process involves interaction between vehicle B, provincial AA, and MA. For example, ITS-S interacts with AA, and AA then interacts with MA, thus enabling ITS-S to report malicious behavior.

[0158] The certificate revocation process involves interaction between the provincial AA (Agency Authorization Unit) and MA (Management Authority). For example, the MA can query the AA for certificate information, and the AA can revoke the certificate. Furthermore, the MA or AA can also interact with the CRL (Certificate Revocation List) database, allowing the MA / AA to write malicious certificates into the CRL database.

[0159] Please see Figure 7-b The diagram shown illustrates another interaction flow between multiple components in the vehicle-to-everything (V2X) communication system provided in this application embodiment. It mainly involves the interaction between the vehicle, Guangdong MA, Guangxi MA, and AA, and the interaction flow is as follows:

[0160] When the vehicle's position changes, the MA (Manual of Action) needs to be switched. There are two main implementation methods:

[0161] Example 1: Passive switching.

[0162] S01, the vehicle reported the abnormal behavior to Guangdong MA.

[0163] The messages reporting abnormal behavior include: the vehicle's location in Guangxi, the reporter's ID, and the reported party's ID.

[0164] S02. Determine if the vehicle's position has changed.

[0165] Among them, Guangdong MA determined that the car's position had changed.

[0166] S03, Guangdong MA sends a reporting response to the vehicle.

[0167] The Guangdong MA's reported response included the Guangxi MA address.

[0168] Example 2: Active switching.

[0169] S11, The vehicle sends an MA handover request to the Guangdong MA.

[0170] In this scenario, the vehicle's location changes, and the vehicle actively sends an MA handover request to the Guangdong MA. The MA handover request carries the vehicle's location as Guangxi.

[0171] S12, Guangdong MA query Guangxi MA address.

[0172] Among them, the Guangdong MA retrieves the Guangxi MA address based on the location of the vehicle carried by the MA handover request.

[0173] S13, Guangdong MA sends an MA handover response to the vehicle.

[0174] The MA handover response includes the Guangxi MA address.

[0175] S4. The vehicle reported the abnormal behavior to Guangxi MA.

[0176] The messages reporting abnormal behavior include: the vehicle's location is in Guangxi, the reporter's ID, and the reported party's ID.

[0177] S5, Guangxi MA has identified the associated short-term certificates of malicious vehicles.

[0178] S6. Guangxi MA sends a certificate association request to AA.

[0179] The associated certificate request contained a malicious ID.

[0180] S7 and AA retrieve the list of associated certificates by querying the local database using associated parameters.

[0181] S8 and AA sent a response to Guangxi MA. The response included multiple short-term certificates of the malicious terminal.

[0182] The next step is to revoke the certificate of the malicious terminal. There are two main implementation methods:

[0183] Example 1: MA revocation.

[0184] S09, Guangxi MA's list of certificates to be revoked in bulk.

[0185] Example 2: AA revocation.

[0186] S19. Guangxi MA sent a revocation request to AA.

[0187] S20, AA Batch Revocation of Certificates in the Associated Certificate List.

[0188] The following detailed examples illustrate the interaction methods between multiple components in a vehicle-to-everything (V2X) communication system.

[0189] like Figure 8 This is a schematic diagram illustrating the interaction process between the vehicle network communication terminal and the EA server provided in this application embodiment. Taking the interaction between the vehicle and the EA as an example, the main processes include the following:

[0190] EA can be deployed by the government or by automakers.

[0191] S81. Vehicles have an ownership relationship with EAs, meaning that vehicles only interact with EAs within their own management domain. Here, a management domain refers to a government or a car manufacturer as a domain.

[0192] S82. If the EA is deployed by the government, the vehicle will send the initial certificate issued by the pre-installed car manufacturer and the vehicle ID to the EA according to the pre-installed EA address to apply for credentials.

[0193] S83. EA verifies the initial certificate issued by the vehicle manufacturer based on the pre-set vehicle manufacturer certificate. If the verification is successful, it issues the corresponding long-term certificate to the vehicle. The certificate issuance message to the vehicle contains the pre-set AA attribution information, which includes: AA region and AA address.

[0194] If the EA is deployed by the automaker, there is no credential application process; credentials are issued using pre-installed long-term certificates.

[0195] like Figure 9 The diagram shown illustrates the interaction process between the vehicle-to-everything (V2X) communication terminal and the AA server provided in this embodiment of the application, taking the interaction between a vehicle and the AA as an example. The AA is deployed by the government and mainly includes the following process:

[0196] S91. The vehicle applies for a short-term certificate from the AA based on the AA information (region + address) obtained from the EA or pre-set, and through the corresponding long-term certificate.

[0197] S92. AA verifies the geographic information in the credentials and verifies the legitimacy of the long-term certificate based on the pre-set EA certificate. If the verification is successful, AA generates short-term certificates in batches, generates the corresponding Linkage Value, and saves the correspondence between the Linkage Value and the short-term certificate.

[0198] S93 and AA issue short-term certificates to vehicles and distribute pre-set MA addresses.

[0199] like Figure 10 The diagram shown illustrates the interaction process between the vehicle-to-everything (V2X) communication terminal and the vehicle-to-everything (MA) server provided in this embodiment of the application. Taking the interaction between the vehicle and the MA as an example, the main processes include the following:

[0200] S101. The vehicle reports abnormal behavior to the MA based on the MA address obtained from the AA. The reported V2X message contains location information.

[0201] S102 and MA determine the vehicle's current location based on the location information. If an MA switch occurs, the new MA address is returned.

[0202] Optionally, if a vehicle detects that it has undergone a region switch, it will proactively request a new MA address from its original MA.

[0203] S103 and MA determine whether the whistleblower or the reported party has engaged in any abnormal or malicious behavior based on V2X messages and the vehicle's short-term certificate.

[0204] like Figure 11 The diagram shown illustrates the interaction process between the MA server and the AA server provided in this embodiment of the application. Taking the interaction between MA and AA as an example, the main processes include the following:

[0205] S111, MA returns the short-term certificate of the malicious party to AA.

[0206] S112, AA finds the corresponding association value based on the certificate information, and then finds all associated short-term certificates corresponding to the association value.

[0207] S113, AA will return the batch of short-term certificates to MA.

[0208] S114, MA will revoke short-term certificates in bulk. Alternatively, MA will notify AA to revoke short-term certificates in bulk.

[0209] like Figure 12 The diagram shown is a schematic representation of the interaction process between two vehicle-to-everything (V2X) communication terminals provided in this embodiment of the application. Taking vehicle-to-vehicle interaction as an example, the main processes include the following:

[0210] S121, Vehicle 2 retrieves the provincial AA information that issued the short-term certificate from the short-term certificate in the PC5 message, compares it with the pre-set provincial AA certificate, finds the corresponding provincial AA certificate, and verifies the legality of the short-term certificate. First, it finds the pre-set provincial AA certificate to verify the short-term certificate signed by that provincial AA certificate contained in the received V2X message.

[0211] S122 and Vehicle 2 determine whether there is malicious behavior based on PC5 messages, and report to MA periodically in batches or immediately.

[0212] This application proposes an architecture where the MA, AA, and CRL are deployed at the provincial level, and the EA is deployed at the enterprise or government level. In this application, the EA returns a message to the vehicle carrying the AA address and regional information. The AA generates association values ​​and saves the corresponding relationships for batch short-term certificates to the vehicle, and simultaneously returns the MA address. If a vehicle or MA detects a change in the vehicle's region, the original MA returns the new MA address. The MA requests batch certificate revocation information from the AA. The vehicle has all provincial AA certificates pre-installed. As illustrated by the foregoing examples, in this application, the EA and AA are decoupled, making deployment more flexible. The AA is responsible for the generation and revocation of batch certificates, ensuring certificate anonymity while facilitating batch revocation. Short-term certificates have a short lifespan, and vehicles frequently replace them, thus ensuring their anonymity. The MA of the corresponding province is used based on the vehicle's location, and the MA address is updated according to the driving location, effectively matching the regionality of malicious behavior detection and improving detection efficiency. Pre-installing all provincial AA certificates reduces the length of the certificate chain sent by the vehicle, saving communication overhead. In this system, the short-term certificate is issued by the AA and signed with the AA's private key, while the corresponding public key certificate is issued by the ROOT CA and signed with the ROOT CA's private key. If we further consider the hierarchical setup of the AA and ROOT CA, then a relatively long certificate chain can be formed, used to verify the legitimacy of a specific certificate itself.

[0213] It should be noted that, for the sake of simplicity, the foregoing method embodiments are all described as a series of actions. However, those skilled in the art should understand that this application is not limited to the described order of actions, as some steps may be performed in other orders or simultaneously according to this application. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are preferred embodiments, and the actions and modules involved are not necessarily essential to this application.

[0214] To facilitate better implementation of the above-described solutions in the embodiments of this application, related apparatus for implementing the above-described solutions is also provided below.

[0215] Please see Figure 13 The diagram shown is a schematic representation of the structural composition of a vehicle-to-everything (V2X) communication device according to an embodiment of this application. The V2X communication device can be the hardware structure of a V2X communication terminal or a software device deployed within a V2X communication terminal. The V2X communication device 1300 includes: a receiving module 1301, a transmitting module 1302, and a processing module 1303.

[0216] Processing module 1303 is used to send a first certificate acquisition request to a first short-term certificate issuing server through generation module 1302. The first certificate acquisition request includes: the long-term certificate of the vehicle network communication terminal and the geographical region of the short-term certificate issuing server.

[0217] The processing module 1303 is used to receive the short-term certificate sent by the first short-term certificate issuing server through the receiving module 1301.

[0218] In some embodiments of this application, the processing module 1303 is also used to execute the vehicle network certificate processing method executed by the aforementioned vehicle network communication terminal.

[0219] Please see Figure 14 The diagram shown is a schematic representation of the structural composition of a short-term certificate issuance device according to an embodiment of this application. The short-term certificate issuance device can be the hardware structure of a first short-term certificate issuance server, or a software device deployed within the first short-term certificate issuance server. The short-term certificate issuance device 1400 includes: a receiving module 1401, a sending module 1402, and a processing module 1403.

[0220] Processing module 1403 is used to receive a first certificate acquisition request sent by the vehicle network communication terminal through receiving module 1401. The first certificate acquisition request includes: the geographical location of the long-term certificate and short-term certificate issuing server of the vehicle network communication terminal.

[0221] Processing module 1403 is used to verify the long-term certificate based on the long-term certificate issuing server certificate when the geographical region of the short-term certificate issuing server matches the first short-term certificate issuing server.

[0222] The processing module 1403 is used to send a short-term certificate to the vehicle network communication terminal through the sending module 1402 when the long-term certificate is verified.

[0223] In some embodiments of this application, the processing module 1403 is also used to execute the vehicle network certificate processing method executed by the aforementioned first short-term certificate issuing server.

[0224] Please see Figure 15 The diagram shown is a schematic representation of the structural composition of an abnormal behavior detection device provided in an embodiment of this application. The abnormal behavior detection device can be the hardware structure of a first abnormal behavior detection server, or a software device deployed within the first abnormal behavior detection server. The abnormal behavior detection device 1500 includes: a receiving module 1501, a sending module 1502, and a processing module 1503.

[0225] The processing module 1503 is used to receive a report message sent by the vehicle network communication terminal through the receiving module 1501. The report message includes: the current location of the vehicle network communication terminal, and the first abnormal behavior detection server belongs to the plurality of abnormal behavior detection servers.

[0226] The processing module 1503 is used to send the address of a second abnormal behavior detection server that matches the current region to the vehicle network communication terminal via the sending module 1502 when the current region does not match the first abnormal behavior detection server. The second abnormal behavior detection server belongs to the plurality of abnormal behavior detection servers.

[0227] In some embodiments of this application, the processing module 1503 is also used to execute the vehicle network certificate processing method executed by the aforementioned abnormal behavior detection server.

[0228] It should be noted that the information interaction and execution process between the modules / units of the above-mentioned device are based on the same concept as the method embodiments of this application, and the resulting technical effects are the same as those of the method embodiments of this application. For details, please refer to the description in the method embodiments shown above in this application, and will not be repeated here.

[0229] This application also provides a computer storage medium storing a program that performs some or all of the steps described in the above method embodiments.

[0230] The following describes another vehicle-to-everything (V2X) communication device provided in the embodiments of this application. Please refer to [link to relevant documentation]. Figure 16 As shown, the vehicle-to-everything (V2X) communication device 1600 includes:

[0231] Receiver 1601, transmitter 1602, processor 1603, and memory 1604 (wherein the number of processors 1603 in the vehicle networking communication device 1600 can be one or more). Figure 16 (Taking a processor as an example). In some embodiments of this application, the receiver 1601, transmitter 1602, processor 1603, and memory 1604 can be connected via a bus or other means, wherein, Figure 16 Taking the example of a connection between China and Israel via a bus.

[0232] Memory 1604 may include read-only memory and random access memory, and provides instructions and data to processor 1603. A portion of memory 1604 may also include non-volatile random access memory (NVRAM). Memory 1604 stores operating system and operation instructions, executable modules or data structures, or subsets thereof, or extended sets thereof, wherein the operation instructions may include various operation instructions for implementing various operations. The operating system may include various system programs for implementing various basic business functions and handling hardware-based tasks.

[0233] Processor 1603 controls the operation of the vehicle-to-everything (V2X) communication device. Processor 1603 can also be referred to as a central processing unit (CPU). In specific applications, the various components of the V2X communication device are coupled together through a bus system. This bus system includes not only a data bus but also a power bus, control bus, and status signal bus. However, for clarity, all buses are referred to as the bus system in the diagram.

[0234] The methods disclosed in the embodiments of this application can be applied to or implemented by the processor 1603. The processor 1603 can be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by the integrated logic circuit of the hardware in the processor 1603 or by instructions in the form of software. The processor 1603 can be a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the methods disclosed in the embodiments of this application can be directly embodied in the execution of a hardware decoding processor, or can be executed by a combination of hardware and software modules in the decoding processor. The software modules can be located in random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, or other mature storage media in the art. The storage medium is located in memory 1604. Processor 1603 reads the information in memory 1604 and, in conjunction with its hardware, completes the steps of the above method.

[0235] The receiver 1601 can be used to receive input digital or character information and generate signal inputs related to the settings and function control of the vehicle network communication device. The transmitter 1602 may include display devices such as a display screen and can be used to output digital or character information through an external interface.

[0236] In this embodiment of the application, processor 1603 is used to execute a vehicle network certificate processing method that is also executed by the aforementioned vehicle network communication terminal.

[0237] The following describes another short-term certificate issuance device provided in the embodiments of this application. Please refer to [link to relevant documentation]. Figure 17As shown, the short-term certificate issuing device 1700 includes:

[0238] Receiver 1701, transmitter 1702, processor 1703, and memory 1704 (wherein the number of processors 1703 in the short-term certificate issuing device 1700 can be one or more, Figure 17 (Taking a processor as an example). In some embodiments of this application, the receiver 1701, transmitter 1702, processor 1703, and memory 1704 can be connected via a bus or other means, wherein... Figure 17 Taking the example of a connection between China and Israel via a bus.

[0239] Memory 1704 may include read-only memory and random access memory, and provides instructions and data to processor 1703. A portion of memory 1704 may also include NVRAM. Memory 1704 stores operating system and operation instructions, executable modules or data structures, or subsets thereof, or extended sets thereof, wherein the operation instructions may include various operation instructions for implementing various operations. The operating system may include various system programs for implementing various basic business functions and handling hardware-based tasks.

[0240] Processor 1703 controls the operation of the Short-Term Certificate Issuance Device (STCC). Processor 1703 can also be referred to as a CPU. In specific applications, the various components of the STCC are coupled together through a bus system. This bus system includes not only a data bus but also a power bus, control bus, and status signal bus. However, for clarity, all buses are referred to as the bus system in the diagram.

[0241] The methods disclosed in the embodiments of this application can be applied to or implemented by processor 1703. Processor 1703 can be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by the integrated logic circuit of the hardware in processor 1703 or by instructions in the form of software. The processor 1703 can be a general-purpose processor, DSP, ASIC, FPGA or other programmable logic device, discrete gate or transistor logic device, or discrete hardware component. It can implement or execute the methods, steps and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the methods disclosed in the embodiments of this application can be directly embodied as being executed by a hardware decoding processor, or executed by a combination of hardware and software modules in the decoding processor. The software modules can be located in random access memory, flash memory, read-only memory, programmable read-only memory or electrically erasable programmable memory, registers and other mature storage media in the art. The storage medium is located in memory 1704, and processor 1703 reads the information in memory 1704 and completes the steps of the above method in combination with its hardware.

[0242] In this embodiment of the application, the processor 1703 is also used to execute the vehicle network certificate processing method executed by the aforementioned first short-term certificate issuing server.

[0243] Next, we will introduce another abnormal behavior detection device provided in the embodiments of this application. Please refer to [link to relevant documentation]. Figure 18 As shown, the abnormal behavior detection device 1800 includes:

[0244] Receiver 1801, transmitter 1802, processor 1803, and memory 1804 (wherein the abnormal behavior detection device 1800 may contain one or more processors 1803). Figure 18 (Taking a processor as an example). In some embodiments of this application, the receiver 1801, transmitter 1802, processor 1803, and memory 1804 can be connected via a bus or other means, wherein... Figure 18 Taking the example of a connection between China and Israel via a bus.

[0245] Memory 1804 may include read-only memory and random access memory, and provides instructions and data to processor 1803. A portion of memory 1804 may also include NVRAM. Memory 1804 stores operating system and operation instructions, executable modules or data structures, or subsets thereof, or extended sets thereof, wherein the operation instructions may include various operation instructions for implementing various operations. The operating system may include various system programs for implementing various basic business functions and handling hardware-based tasks.

[0246] Processor 1803 controls the operation of the abnormal behavior detection device; processor 1803 can also be referred to as CPU. In specific applications, the various components of the abnormal behavior detection device are coupled together through a bus system. This bus system includes not only a data bus but also a power bus, control bus, and status signal bus, etc. However, for clarity, all buses are referred to as the bus system in the diagram.

[0247] The methods disclosed in the embodiments of this application can be applied to or implemented by processor 1803. Processor 1803 can be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by the integrated logic circuit of the hardware in processor 1803 or by instructions in software form. The processor 1803 can be a general-purpose processor, DSP, ASIC, FPGA or other programmable logic device, discrete gate or transistor logic device, or discrete hardware component. It can implement or execute the methods, steps and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the methods disclosed in the embodiments of this application can be directly embodied as being executed by a hardware decoding processor, or executed by a combination of hardware and software modules in the decoding processor. The software modules can be located in random access memory, flash memory, read-only memory, programmable read-only memory or electrically erasable programmable memory, registers and other mature storage media in the art. The storage medium is located in memory 1804, and processor 1803 reads the information in memory 1804 and completes the steps of the above method in combination with its hardware.

[0248] In this embodiment of the application, the processor 1803 is also used to execute the certificate processing method for the Internet of Vehicles executed by the aforementioned abnormal behavior detection server.

[0249] In another possible design, when the aforementioned device is a chip, the chip includes a processing unit and a communication unit. The processing unit may be, for example, a processor, and the communication unit may be, for example, an input / output interface, pins, or circuits. The processing unit can execute computer execution instructions stored in a storage unit to cause the chip within the device to perform any of the wireless communication methods described in the first aspect above. Optionally, the storage unit can be an internal storage unit within the chip, such as a register or cache. Alternatively, the storage unit can be an external storage unit within the device, such as a read-only memory (ROM) or other types of static storage devices capable of storing static information and instructions, such as random access memory (RAM).

[0250] The processor mentioned above can be a general-purpose central processing unit, a microprocessor, an ASIC, or one or more integrated circuits used to control the execution of a program in the first aspect of the method.

[0251] It should also be noted that the device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. In addition, in the device embodiment drawings provided in this application, the connection relationship between modules indicates that they have a communication connection, which can be implemented as one or more communication buses or signal lines.

[0252] Through the above description of the embodiments, those skilled in the art can clearly understand that this application can be implemented by means of software plus necessary general-purpose hardware, or it can be implemented by special-purpose hardware including application-specific integrated circuits, special-purpose CPUs, special-purpose memory, special-purpose components, etc. Generally, any function performed by a computer program can be easily implemented by corresponding hardware, and the specific hardware structure used to implement the same function can also be diverse, such as analog circuits, digital circuits, or special-purpose circuits. However, for this application, software program implementation is more often the preferred implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a readable storage medium, such as a computer floppy disk, USB flash drive, mobile hard disk, ROM, RAM, magnetic disk, or optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments of this application.

[0253] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented in software, it can be implemented, in whole or in part, as a computer program product.

[0254] The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions may be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium may be any available medium that a computer can store or a data storage device such as a server or data center that integrates one or more available media. The available medium may be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., solid-state disk (SSD)).

Claims

1. A certificate processing method for vehicle networking, characterized in that, The method is applied to a vehicle communication system, which includes a vehicle-to-everything (V2X) communication terminal and multiple short-term certificate issuance servers, wherein the multiple short-term certificate issuance servers belong to different regions, and the method includes: The vehicle network communication terminal sends a first certificate acquisition request to the first short-term certificate issuing server. The first certificate acquisition request includes: the long-term certificate of the vehicle network communication terminal and the geographical region of the short-term certificate issuing server. The first certificate acquisition request is used to instruct the first short-term certificate issuing server to verify whether the first short-term certificate issuing server matches the vehicle network communication terminal based on the region of the first short-term certificate issuing server and the long-term certificate issuing server certificate stored locally by the first short-term certificate issuing server. The first certificate acquisition request is also used to instruct the first short-term certificate issuing server to send a short-term certificate to the vehicle network communication terminal when the first short-term certificate issuing server matches the vehicle network communication terminal. The vehicle-to-everything (V2X) communication terminal receives a short-term certificate sent by the first short-term certificate issuing server.

2. The method according to claim 1, characterized in that, The vehicle communication system further includes: a long-term certificate issuance server, and the method further includes: The vehicle-to-everything (V2X) communication terminal obtains the attribution information of the long-term certificate and the short-term certificate issuance server from the long-term certificate issuance server. The attribution information of the short-term certificate issuance server includes the region to which the short-term certificate issuance server belongs and the address of the short-term certificate issuance server.

3. The method according to any one of claims 1 to 2, characterized in that, The vehicle communication system further includes: multiple abnormal behavior detection servers, each of which corresponds to a different geographical location where the vehicle network communication terminal is located; the method further includes: The vehicle-to-everything (V2X) communication terminal receives the address of the first abnormal behavior detection server sent by the first short-term certificate issuing server, wherein the first abnormal behavior detection server belongs to the plurality of abnormal behavior detection servers.

4. The method according to claim 3, characterized in that, After the vehicle-to-everything (V2X) communication terminal receives the address of the first abnormal behavior detection server sent by the first short-term certificate issuing server, the method further includes: The vehicle-to-everything (V2X) communication terminal sends a report message to the first abnormal behavior detection server. The report message includes the current location of the V2X communication terminal. The vehicle-to-everything (V2X) communication terminal receives the address of a second abnormal behavior detection server that matches the current region from the first abnormal behavior detection server. The second abnormal behavior detection server belongs to the plurality of abnormal behavior detection servers.

5. The method according to claim 3, characterized in that, The method further includes: When the vehicle-to-everything (V2X) communication terminal determines that a regional switch has occurred, the V2X communication terminal sends an update request to the first abnormal behavior detection server. The update request includes the region of the V2X communication terminal after the switch. The vehicle-to-everything (V2X) communication terminal receives the address of a third abnormal behavior detection server that matches the switched region from the first abnormal behavior detection server. The third abnormal behavior detection server belongs to the plurality of abnormal behavior detection servers.

6. The method according to any one of claims 1, 2, 4, and 5, characterized in that, The vehicle-to-everything (V2X) communication terminal receives a short-term certificate sent by the first short-term certificate issuing server, including: The vehicle-to-everything (V2X) communication terminal receives multiple short-term certificates sent by the first short-term certificate issuing server.

7. A certificate processing method for vehicle networking, characterized in that, The method is applied to a vehicle communication system, which includes a vehicle-to-everything (V2X) communication terminal and multiple short-term certificate issuance servers, wherein the multiple short-term certificate issuance servers belong to different regions, and the method includes: The first short-term certificate issuing server receives a first certificate acquisition request sent by the vehicle network communication terminal. The first certificate acquisition request includes: the long-term certificate of the vehicle network communication terminal and the geographical region of the short-term certificate issuing server. When the region of the short-term certificate issuing server matches the region of the first short-term certificate issuing server, the first short-term certificate issuing server verifies the long-term certificate based on the long-term certificate issuing server certificate. The first short-term certificate issuing server has the long-term certificate issuing server certificate stored locally. When the long-term certificate is verified, the first short-term certificate issuing server sends a short-term certificate to the vehicle network communication terminal.

8. The method according to claim 7, characterized in that, The vehicle communication system includes: multiple abnormal behavior detection servers, each of which corresponds to a different geographical location of the vehicle network communication terminal; After the first short-term certificate issuing server sends a short-term certificate to the vehicle-to-everything (V2X) communication terminal, the method further includes: The first short-term certificate issuing server sends the address of the first abnormal behavior detection server to the vehicle network communication terminal. The first abnormal behavior detection server belongs to the plurality of abnormal behavior detection servers.

9. The method according to claim 7, characterized in that, When the first short-term certificate issuing server sends multiple short-term certificates, the method further includes: The first short-term certificate issuing server generates an association value corresponding to the plurality of short-term certificates and saves the correspondence between the association value and the plurality of short-term certificates.

10. The method according to claim 9, characterized in that, The vehicle communication system further includes: multiple abnormal behavior detection servers, and the method further includes: The first short-term certificate issuing server receives a certificate query request sent by the first abnormal behavior detection server. The certificate query request includes: the first short-term certificate of the vehicle network communication terminal. The first abnormal behavior detection server belongs to the plurality of abnormal behavior detection servers. The first short-term certificate issuing server obtains the associated value corresponding to the first short-term certificate based on the first short-term certificate; The first short-term certificate issuing server sends multiple short-term certificates determined based on the association value to the first abnormal behavior detection server.

11. The method according to claim 10, characterized in that, After the first short-term certificate issuing server sends the plurality of short-term certificates to the first abnormal behavior detection server, the method further includes: The first short-term certificate issuing server receives the revocation request sent by the first abnormal behavior detection server; The first short-term certificate issuing server revokes the plurality of short-term certificates according to the revocation request.

12. A vehicle communication system, characterized in that, The vehicle communication system includes: a vehicle-to-everything (V2X) communication terminal, multiple short-term certificate issuance servers, and multiple abnormal behavior detection servers, wherein, The vehicle-to-everything (V2X) communication terminal is used to execute the method according to any one of claims 1 to 6; The short-term certificate issuing server is used to perform the method of any one of claims 7 to 11.

13. A vehicle-to-everything (V2X) communication device, characterized in that, The vehicle-to-everything (V2X) communication device includes: a processor and a memory; the processor and the memory communicate with each other. The memory is used to store instructions; The processor is configured to execute the instructions in the memory, performing the method as described in any one of claims 1 to 6.

14. A short-term certificate issuance device, characterized in that, The short-term certificate issuing device includes: a processor and a memory; the processor and the memory communicate with each other; The memory is used to store instructions; The processor is configured to execute the instructions in the memory, performing the method as described in any one of claims 7 to 11.

15. A computer-readable storage medium, characterized in that, Includes instructions that, when executed on a computer, cause the computer to perform the method as claimed in any one of claims 1 to 6, or any one of claims 7 to 11.

Images