ETC security authentication device authorization method, device and system based on location information

Abstract

The present invention provides a method, device and system for authorizing an ETC security authentication device based on location information, the method comprising: determining whether the self-positioning falls within the preset electronic fence range; initiating an SSL handshake request to a certificate server; sending a pre-generated random number and self-ID information to an online key platform for identity authentication; after the identity authentication is passed, receiving the authorization authentication ciphertext sent by the online key platform and decrypting it using a local key; determining whether the authorization is successful based on the decryption result. The system and method provided in the present application replace the function of the PSAM card in the traditional RSU antenna, and compared with the PSAM card, it is not easy to lose and is adaptable to different network environments. Moreover, a positioning verification link is added to the present method to ensure that the security authentication device is reasonably used in the correct area, avoiding incorrect use or unauthorized change of use.

Description

Technical Field

[0001] The present application belongs to the field of ETC engineering technology, and specifically, relates to a method, device and system for authorizing ETC security authentication equipment based on location information. Background Art

[0002] At present, the security module in the ETC system is a PSAM card, which is a standard SIM card format. In order to enhance the security of security module management, an online authorization method is adopted, that is, authentication is required after power-on or reset to use the key in the security module. During authentication, the random number, card number and other information of the PSAM card are first obtained. The lane or gantry system can connect to the online key platform through the business dedicated network, upload the PSAM card number, random number and other data for authorization application. The online key platform checks the working status of the PSAM card. If it is normal, it performs authorization operation and sends a response message. The PSAM card enters normal working state after completing external authentication. If the PSAM card is lost or stolen, the local management department needs to report the loss to the competent department. The management department will blacklist the lost PSAM card number and will no longer provide authentication services for the PSAM on the blacklist.

[0003] However, the above solution has three main disadvantages:

[0004] 1. When a PSAM card is lost or stolen, the local management department usually determines the PSAM status through abnormal transaction data afterwards, and then applies to the departmental management department. After review, the management department notifies the online key platform to update the blacklist. This process is slow and increases the window length of the risk period after the PSAM is lost.

[0005] 2. In the extended application environment of ETC, due to the uneven security management capabilities, there is even a situation where the ETC RSU antenna is lost as a whole.

[0006] 3. When the safety module is used incorrectly, the local and management departments cannot perceive it, causing management confusion. For example, a management department applied to deploy a gantry system on the XXX section, but due to incorrect use or unauthorized change of purpose, the gantry system was deployed on the YYY section. Summary of the invention

[0007] The present application provides a method, device and system for authorizing an ETC security authentication device based on location information, so as to at least solve the problem that the PSAM card carried in the RSU antenna of the current ETC is easy to be lost and easily changed in use by others without permission.

[0008] According to one aspect of the present application, a method for authorizing an ETC security authentication device based on location information is provided, comprising:

[0009] Determine whether the self-positioning falls within the preset electronic fence range;

[0010] Initiate an SSL handshake request to the certificate server so that the certificate server completes the mutual verification of digital certificates according to the SSL protocol;

[0011] After the digital certificate mutual verification is successful, the pre-generated random number and the own ID information are sent to the online key platform, so that the online key platform can authenticate the ID information according to the pre-stored blacklist;

[0012] After the identity authentication is passed, the authorization authentication ciphertext sent by the online key platform is received and decrypted using the local key; the authorization authentication ciphertext is generated by the online key platform according to the random number and the ID information;

[0013] Determine whether the authorization is successful based on the decryption result. The authorization authentication ciphertext is generated by the online key platform based on the random number and ID information.

[0014] In one embodiment, determining whether to authorize based on the decryption result includes:

[0015] Get the random number in the ciphertext;

[0016] The random number in the ciphertext is compared with the pre-generated random number. If the comparison results are consistent, the authorization is successful and the vehicle information can be decrypted.

[0017] In one embodiment, the ETC security authentication device authorization method based on location information provided by the present application also includes:

[0018] Each time the vehicle information is decrypted, the number of times in the transaction counter is reduced by a certain value, and the initial number of times is preset in the transaction counter;

[0019] When the number of times in the transaction counter is 0, it is necessary to apply for authorization from the online key platform again.

[0020] In one embodiment, the ETC security authentication device authorization method based on location information provided by the present application also includes:

[0021] After being successfully authorized by the online key platform, the transaction counter in the ETC security authentication device will be restored to the initial number.

[0022] According to another aspect of the present application, there is also provided an ETC security authentication device authorization device based on location information, comprising:

[0023] A location verification unit is used to determine whether its own location falls within the preset electronic fence range;

[0024] A digital certificate mutual verification unit, used to initiate an SSL handshake request to a certificate server, so that the certificate server completes the digital certificate mutual verification according to the SSL protocol;

[0025] An identity authentication unit, used to send a pre-generated random number and its own ID information to an online key platform, so that the online key platform authenticates the ID information according to a pre-stored blacklist;

[0026] A ciphertext decryption unit, used to receive the authorization authentication ciphertext sent by the online key platform and decrypt it using a local key; the authorization authentication ciphertext is generated according to the random number and the ID information;

[0027] The authorization unit is used to determine whether the authorization is successful based on the decryption result. The authorization authentication ciphertext is generated based on the random number and ID information.

[0028] In one embodiment, the authorization unit includes:

[0029] A random number acquisition module is used to obtain random numbers in ciphertext;

[0030] The comparison authorization module is used to compare the random number in the ciphertext with the pre-generated random number. If the comparison results are consistent, the authorization is successful and the vehicle information can be decrypted.

[0031] In one embodiment, the ETC security authentication device authorization device based on location information further includes:

[0032] A counting module, for decrypting each pair of vehicle information once, and the number of times in the transaction counter is reduced by a certain value, and the initial number of times is preset in the transaction counter;

[0033] The re-authorization module is used to apply for authorization from the online key platform again when the number of times in the transaction counter is 0.

[0034] In one embodiment, the ETC security authentication device authorization device based on location information further includes:

[0035] The counter recovery module is used to restore the initial number of transaction counters in the ETC security authentication device after being successfully authorized by the online key platform.

[0036] The present application also provides an ETC security authentication device authorization system based on location information applicable to the above method, the system comprising:

[0037] An online key platform and a certificate server in communication connection, the certificate server is also in communication connection with the RSU antenna controller;

[0038] The RSU antenna controller is connected to the ETC safety authentication device through an interface or wireless device;

[0039] The ETC security authentication device includes: a positioning module, a security chip, a storage chip, a communication component, a central processing unit and an information transmission component;

[0040] The positioning module is used to locate the ETC safety authentication device;

[0041] The security chip contains the root key for decrypting vehicle information and the key for external authentication;

[0042] The information transmission component is used to transmit data with the external RSU antenna controller.

[0043] In one embodiment, the ETC security authentication device also includes a transaction counter.

[0044] In one embodiment, the communication component is a 4G communication module.

[0045] In one embodiment, the information transmission component is a USB interface, and the USB interface can be connected to an external RSU antenna controller.

[0046] In one embodiment, the location information-based ETC security authentication device authorization system also includes an electronic signature, which is used to authenticate and authorize the ETC security authentication device through the electronic signature and PIN code when the network signal is poor.

[0047] The system and method provided by the present application replace the function of the PSAM card in the traditional RSU antenna, and compared with the PSAM card, it is not easy to lose and is adaptable to different network environments. In addition, the method also adds a positioning verification link to ensure that the security authentication device is reasonably used in the correct area, avoiding incorrect use or unauthorized change of use. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0049] Figure 1 A schematic diagram of an ETC security authentication device authorization system based on location information provided for this application.

[0050] Figure 2 This is a block diagram of the ETC security authentication device in an embodiment of the present application.

[0051] Figure 3A flow chart of an ETC security authentication device authorization method based on location information provided in this application.

[0052] Figure 4 These are the specific steps in the embodiment of the present application to determine whether to authorize based on the decryption result.

[0053] Figure 5 This is the workflow of the transaction counter in the ETC security authentication device in the embodiment of this application.

[0054] Figure 6 A structural block diagram of an ETC security authentication device authorization device based on location information provided in this application.

[0055] Figure 7 This is a structural block diagram of the authorization unit in an embodiment of the present application.

[0056] Figure 8 This is another structural block diagram of the ETC security authentication device authorization device in an embodiment of the present application.

[0057] Fig. 9 This is a specific implementation of an electronic device in an embodiment of the present application.

[0058] Fig.10 A coordinate diagram for position detection using an electronic fence in an embodiment of the present application. DETAILED DESCRIPTION

[0059] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0060] Currently in the ETC system, the RSU antenna is used to obtain information about passing vehicles. A PSAM card is built into the vehicle-mounted OBU device, which stores information such as license plate and vehicle model. The vehicle information data can be quickly and accurately obtained by simply reading the target vehicle information through the RSU antenna. If the PSAM card is lost or stolen, the local management department needs to report the loss to the competent department. The management department will blacklist the lost PSAM card number and will no longer provide authentication services for the PSAM on the blacklist.

[0061] However, the above solution has three main disadvantages:

[0062] 1. When a PSAM card is lost or stolen, the local management department usually determines the PSAM status through abnormal transaction data afterwards, and then applies to the departmental management department. After review, the management department notifies the online key platform to update the blacklist. This process is slow and increases the window length of the risk period after the PSAM is lost.

[0063] 2. In the extended application environment of ETC, due to the uneven security management capabilities, there is even a situation where the ETC RSU antenna is lost as a whole.

[0064] 3. When the safety module is used incorrectly, the local and management departments cannot perceive it, causing management confusion. For example, a management department applied to deploy a gantry system on the XXX section, but due to incorrect use or unauthorized change of purpose, the gantry system was deployed on the YYY section.

[0065] Based on the shortcomings of the prior art, this application provides an ETC security authentication device authorization system based on location information applicable to the above method, such as Figure 1 As shown, the system includes:

[0066] An online key platform and a certificate server in communication connection, the certificate server is also in communication connection with the RSU antenna controller;

[0067] The RSU antenna controller is connected to the ETC safety authentication device through an interface or wireless device;

[0068] The ETC security authentication device includes: a positioning module, a security chip, a storage chip, a communication component, a central processing unit and an information transmission component;

[0069] The positioning module is used to locate the ETC safety authentication device;

[0070] The security chip contains the root key for decrypting vehicle information and the key for external authentication;

[0071] The information transmission component is used to transmit data with the external RSU antenna controller.

[0072] In one embodiment, the ETC security authentication device also includes a transaction counter.

[0073] In a specific embodiment, the MCU controller is responsible for program and timing control. The SE chip is used to store keys and certificates, including a root key for decrypting vehicle information, an external authentication key for restoring the transaction counter, and a digital certificate for communicating with the online key platform. The positioning module is used to locate the ETC security authentication device and determine whether the security authentication device is within a specified area. The positioning module can be a Beidou chip or a GPS chip, but this application is not limited to this. The transaction counter is stored in the SE security chip and is assigned a preset value. Each time a vehicle information decryption operation is performed, the value of the counter is automatically reduced by 1. Through the authorization operation, that is, after the external authentication process is correctly executed, the value of the counter can be restored to the preset value. The USB interface makes the security module plug-and-play, which is convenient for deployment and operation and maintenance. In extreme conditions such as when the network is completely unreachable, manual authorization can be provided.

[0074] In one embodiment, if Figure 2 As shown, the communication component is a 4G communication module, and the positioning module is a Beidou positioning module.

[0075] The current location information is obtained through the positioning module and compared with the electronic fence data in the SE security chip to see whether the current location is within the electronic fence. If so, the subsequent process continues. If not, the abnormal location information is reported to the management department so that the management department can be informed and deal with it in time.

[0076] In one embodiment, the information transmission component is a USB interface, and the USB interface can be connected to an external RSU antenna controller.

[0077] In one embodiment, the location information-based ETC security authentication device authorization system also includes an electronic signature, which is used to authenticate and authorize the ETC security authentication device through the electronic signature and PIN code when the network signal is poor.

[0078] When performing authorization operation in manual mode, unplug the ETC security authentication device from the USB port of the RSU antenna controller and bring it to a dedicated business network, the Internet or a 4G network environment, and connect the security module to the USB port of a PC or other operating terminal, which is equipped with manual authorization operation software. Insert the electronic signature (UKey) into the USB port of the terminal at the same time, open the manual authorization operation software and enter the PIN code, apply for authorization operation from the online key platform, and after successful authorization, you can work in offline mode.

[0079] When the transaction counter is 0 and the network signal is not good, manual authorization can be used to improve adaptability. The security authentication device (i.e., USB flash drive) and the electronic visa (USB KEY issued to the administrator) need to be inserted into a computer or terminal device with a network. The computer and terminal are installed with manual authorization software, which has two functions: 1. The software contains a certificate that corresponds to the certificate in the administrator's USB KEY. First, the USB KEY certificate is verified for identity verification, and then the administrator must enter the PIN. Only after it is correct can the software be logged in. Therefore, the role of the electronic signature and PIN is to log in to the manual authorization software. 2. After being able to log in to the software, the computer and terminal can connect to the certificate server and the online key platform through the network, and the authorization process is consistent with the automatic authorization method.

[0080] Based on the above ETC security authentication device authorization system, this application also provides an ETC security authentication device authorization method based on location information, such as Figure 3 As shown, including:

[0081] S301: Determine whether the self-positioning falls within the preset electronic fence range.

[0082] S302: Initiate an SSL handshake request to the certificate server, so that the certificate server completes the mutual verification of digital certificates according to the SSL protocol.

[0083] S303: After the digital certificate mutual verification is successful, the pre-generated random number and the own ID information are sent to the online key platform, so that the online key platform can authenticate the ID information according to the pre-stored blacklist.

[0084] S304: After the identity authentication is passed, the authorization authentication ciphertext sent by the online key platform is received and decrypted using the local key.

[0085] S305: Determine whether the authorization is successful based on the decryption result.

[0086] In one embodiment, the authorization authentication ciphertext is generated by the online key platform based on a random number and ID information.

[0087] In one embodiment, whether to authorize is determined based on the decryption result, such as Figure 4 As shown, including:

[0088] S401: Obtain a random number in the ciphertext.

[0089] S402: Compare the random number in the ciphertext with the pre-generated random number. If the comparison results are consistent, the authorization is successful and the vehicle information can be decrypted.

[0090] In a specific embodiment, the ETC security authentication device is connected to the RSU antenna controller through a USB interface. When connecting for the first time, the serial numbers of the security authentication device and the RSU antenna controller need to be bound. The RSU antenna controller connects to the online key platform according to the communication module in the security authentication device and initiates a counter reset request. Before initiating the counter reset request, the current location information is first obtained through the Beidou module and detected against the electronic fence data in the SE chip. As Fig.10 shown, the Beidou system BDS location information BDSinfo is used to save the location information, and its structure is BDSinfo(psamID, lng, lat, addtime). psamID is the security module identifier, lng is the longitude information, of floating-point type, lat is the latitude information, of floating-point type, and addtime is the acquisition time. The electronic fence in this patent uses a rectangular area, and the coordinates of points A, B, C, and D are (x1, y1), (x2, y2), (x3, y3), and (x4, y4) respectively. If the current location E is at (x5, y5), then the method to determine whether point E meets the electronic fence range is: x5 > x3 and x5 < x2, and at the same time, y5 > y3 and y5 < y2 are satisfied. If point E is within the prefabricated electronic fence range, the security authentication device initiates an SSL handshake request to the certificate server. If point E is not within the electronic fence, the security authentication device will be temporarily locked, and the abnormal status code will be uploaded to the online key platform. The security authentication device and the certificate server complete mutual verification of digital certificates according to the SSL protocol, negotiate a session key, and establish a secure channel. After the secure channel is established, the security authentication device uploads the pre-generated random number and its own ID information to the online key platform through its own communication module. The online key platform determines the status of the security authentication device according to the ID information. If the ID information is in the blacklist or status list, no authorization service will be provided. If the status is normal, an authorization service will be provided to it. The online key platform generates an authorization authentication ciphertext based on the random number and ID and returns it to the security authentication device. This process of generating the authorization authentication ciphertext represents the authorization of the security authentication device. Next, the security authentication device decrypts the authorization authentication ciphertext using the locally stored key to obtain the random number in the ciphertext, and then compares it with the previous random number. If they are the same, the online key platform has successfully authorized the security authentication device. At this time, the transaction counter in the security authentication device resumes its original value.

[0091] In an embodiment, as Figure 5 shown, the method for authorizing an ETC security authentication device based on location information provided by this application further includes:

[0092] S501: Each time the vehicle information is decrypted, a certain value is subtracted from the number of times in the transaction counter. The initial number of times is preset in the transaction counter.

[0093] S502: When the number of times in the transaction counter is 0, it is necessary to apply for authorization from the online key platform again.

[0094] In a specific embodiment, since the security authentication device contains a transaction counter with a preset number of times, each time a decryption operation is performed on a vehicle, the number of times in the transaction counter is reduced by 1. When the value in the transaction counter is reduced to a certain threshold (the threshold is usually 0, but this application is not limited to this), the RSU antenna controller can connect to the online key platform of the Ministry of Transport through the 4G module in the PSAM security module and initiate a counter reset request. When the network condition is unstable, the connection to the online key platform will fail for a period of time, and the RSU antenna can continue to try to connect through the security authentication device. At this time, since the transaction counter in the security authentication device is not zero, the working state can continue to be maintained. In the special case that the counter in the security authentication device is zero and the network status is still unavailable, a manual authorization operation mode can be adopted. When the transaction counter is 0 and the network signal is not good, manual authorization can be used to improve adaptability. The security authentication device (i.e., USB flash drive) and the electronic visa (USB KEY issued to the administrator) need to be inserted into a computer or terminal device with a network. The computer and terminal have manual authorization software, which has two functions: 1. The software contains a certificate that corresponds to the certificate in the administrator's USB KEY. First, the USB KEY certificate is verified for identity verification, and then the administrator must enter the PIN. Only after it is correct can the software be logged in. Therefore, the role of the electronic signature and PIN is to log in to the manual authorization software. 2. After being able to log in to the software, the computer and terminal can connect to the certificate server and the online key platform through the network, and the authorization process is consistent with the above authorization method.

[0095] In one embodiment, the ETC security authentication device authorization method based on location information provided by the present application also includes:

[0096] After being successfully authorized by the online key platform, the transaction counter in the ETC security authentication device will be restored to the initial number.

[0097] Based on the same inventive concept, the embodiments of the present application also provide an ETC security authentication device authorization device based on location information, which can be used to implement the method described in the above embodiments, as described in the following embodiments. Since the principle of solving the problem by the ETC security authentication device authorization device based on location information is similar to the ETC security authentication device authorization method based on location information, the implementation of the ETC security authentication device authorization device based on location information can refer to the implementation of the ETC security authentication device authorization method based on location information, and the repetitions will not be repeated. As used below, the terms "unit" or "module" can be a combination of software and / or hardware that implements predetermined functions. Although the system described in the following embodiments is preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceived.

[0098] like Figure 6 As shown, the present application provides an ETC security authentication device authorization device based on location information, including:

[0099] The location checking unit 601 is used to determine whether its own location falls within the preset electronic fence range.

[0100] The digital certificate mutual verification unit 602 is used to initiate an SSL handshake request to the certificate server so that the certificate server completes the digital certificate mutual verification according to the SSL protocol;

[0101] The identity verification unit 603 is used to send the pre-generated random number and its own ID information to the online key platform, so that the online key platform can verify the identity of the ID information according to the pre-stored blacklist;

[0102] The ciphertext decryption unit 604 is used to receive the authorization authentication ciphertext sent by the online key platform and decrypt it using the local key; the authorization authentication ciphertext is generated according to the random number and the ID information;

[0103] The authorization unit 605 is used to determine whether the authorization is successful based on the decryption result.

[0104] In one embodiment, the authorization authentication ciphertext is generated based on a random number and ID information.

[0105] In one embodiment, if Figure 7 As shown, the authorization unit 605 includes:

[0106] A random number acquisition module 701 is used to acquire a random number in a ciphertext;

[0107] The comparison authorization module 702 is used to compare the random number in the ciphertext with the pre-generated random number. If the comparison result is consistent, the authorization is successful and the vehicle information is decrypted.

[0108] In one embodiment, if Figure 8 As shown, the ETC safety authentication device authorization device based on location information also includes:

[0109] The counting module 801 is used for decrypting the vehicle information once each time, and the number of times in the transaction counter is reduced by a certain value, and the initial number of times is preset in the transaction counter;

[0110] The re-authorization module 802 is used to apply for authorization from the online key platform again when the number of times in the transaction counter is 0.

[0111] In one embodiment, the ETC security authentication device authorization device based on location information further includes:

[0112] The counter recovery module is used to restore the transaction counter in the ETC security authentication device to the initial number after being successfully authorized by the online key platform.

[0113] The ETC safety authentication device provided by this application is highly adaptable, can adapt to all ETC usage scenarios, and can facilitate the management platform to monitor the specific location of the safety authentication device in real time, and avoid the safety authentication device from being changed privately. This application takes full account of the diversity and complexity of the deployment environment, and proposes a working method under good network conditions and unstable network conditions, and even loads solutions for extreme situations or special occasions without network conditions. Moreover, compared with the purchase cost of tens of thousands of yuan for a dedicated authorization server, the ETC safety authentication device adopts a security module based on a USB interface, which will greatly reduce costs and promote the rapid development of ETC expansion applications. Finally, due to the portability of the device, it is more convenient to deploy, and the USB interface is plug-and-play, which has a lower installation cost than the configuration server. In terms of security, the security and stability of the ETC safety authentication device (PSAM module) are enhanced from multiple dimensions such as system on chip (COS), software design, and system architecture.

[0114] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0115] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0116] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0117] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0118] The present invention uses specific embodiments to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea. At the same time, for those skilled in the art, according to the idea of ​​the present invention, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on the present invention.

[0119] The embodiments of the present application also provide a specific implementation of an electronic device that can implement all the steps in the method in the above embodiments, see Fig. 9 , the electronic device specifically includes the following contents:

[0120] Processor (processor) 901, memory 902, communication interface (Communications Interface) 903, bus 904 and non-volatile memory 905;

[0121] The processor 901, memory 902, and communication interface 903 communicate with each other via the bus 904;

[0122] The processor 901 is used to call the computer program in the memory 902 and the non-volatile memory 905. When the processor executes the computer program, all the steps in the method in the above embodiment are implemented. For example, when the processor executes the computer program, the following steps are implemented:

[0123] S301: Determine whether the self-positioning falls within the preset electronic fence range.

[0124] S302: Initiate an SSL handshake request to the certificate server, so that the certificate server completes the mutual verification of digital certificates according to the SSL protocol.

[0125] S303: After the digital certificate mutual verification is successful, the pre-generated random number and the own ID information are sent to the online key platform, so that the online key platform can authenticate the ID information according to the pre-stored blacklist.

[0126] S304: After the identity authentication is passed, the authorization authentication ciphertext sent by the online key platform is received and decrypted using the local key.

[0127] S305: Determine whether the authorization is successful based on the decryption result.

[0128] The embodiments of the present application also provide a computer-readable storage medium capable of implementing all the steps of the method in the above embodiments. The computer-readable storage medium stores a computer program. When the computer program is executed by a processor, all the steps of the method in the above embodiments are implemented. For example, when the processor executes the computer program, the following steps are implemented:

[0129] S301: Determine whether the self-positioning falls within the preset electronic fence range.

[0130] S302: Initiate an SSL handshake request to the certificate server, so that the certificate server completes the mutual verification of digital certificates according to the SSL protocol.

[0131] S303: After the digital certificate mutual verification is successful, the pre-generated random number and the own ID information are sent to the online key platform, so that the online key platform can authenticate the ID information according to the pre-stored blacklist.

[0132] S304: After the identity authentication is passed, the authorization authentication ciphertext sent by the online key platform is received and decrypted using the local key.

[0133] S305: Determine whether the authorization is successful based on the decryption result.

[0134] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the hardware + program embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment. Although the embodiment of this specification provides the method operation steps described in the embodiment or flow chart, more or less operation steps can be included based on conventional or non-creative means. The order of steps listed in the embodiment is only one way of executing the order of many steps, and does not represent the only execution order. When the device or terminal product in practice is executed, it can be executed in sequence or in parallel according to the method shown in the embodiment or the accompanying drawings (for example, a parallel processor or a multi-threaded processing environment, or even a distributed data processing environment). The term "include", "include" or any other variant thereof is intended to cover non-exclusive inclusion, so that the process, method, product or device including a series of elements includes not only those elements, but also includes other elements that are not explicitly listed, or also includes elements inherent to such a process, method, product or device. In the absence of more restrictions, it is not excluded that there are other identical or equivalent elements in the process, method, product or device including the elements. For the convenience of description, the above device is described by dividing it into various modules according to its functions. Of course, when implementing the embodiments of this specification, the functions of each module can be implemented in the same one or more software and / or hardware, or the module implementing the same function can be implemented by a combination of multiple sub-modules or sub-units. The device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the coupling or direct coupling or communication connection between each other shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms. The present invention is described with reference to the flowchart and / or block diagram of the method, device (system) and computer program product according to the embodiments of the present invention. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the process and / or box in the flowchart and / or block diagram can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the process Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0135] Those skilled in the art will appreciate that the embodiments of this specification may be provided as methods, systems or computer program products. Therefore, the embodiments of this specification may be in the form of a complete hardware embodiment, a complete software embodiment or an embodiment combining software and hardware. Moreover, the embodiments of this specification may be in the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes. Each embodiment in this specification is described in a progressive manner, and the same and similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts refer to the partial description of the method embodiment. In the description of this specification, the description of the reference term "one embodiment", "some embodiments", "example", "specific example", or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the embodiment of this specification.

[0136] In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. In addition, those skilled in the art may combine and combine the different embodiments or examples described in this specification and the features of the different embodiments or examples, without contradicting each other. The above is only an embodiment of the embodiment of this specification and is not intended to limit the embodiment of this specification. For those skilled in the art, the embodiment of this specification may have various changes and variations. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the embodiment of this specification shall be included in the scope of the claims of the embodiment of this specification.

Claims

1. A method for authorizing an ETC security authentication device based on location information, characterized in that: include: Get location information; Determine whether the location in the positioning information falls within a preset electronic fence; If yes, perform mutual digital certificate verification with the certificate server; After the digital certificate mutual verification is successful, the pre-generated random number and the own ID information are sent to the online key platform, so that the online key platform can authenticate the ID information according to the pre-stored blacklist; After the identity authentication is passed, the authorization authentication ciphertext sent by the online key platform is received and decrypted using the local key; the authorization authentication ciphertext is generated by the online key platform according to the random number and the ID information; Determine whether the authorization is successful based on the decryption result; The step of judging whether the authorization is successful according to the decryption result includes: obtaining a random number in the ciphertext; comparing the random number in the ciphertext with a pre-generated random number, if the comparison result is consistent, the authorization is successful and the vehicle information can be decrypted; The ETC security authentication device authorization method based on location information also includes: after decrypting the vehicle information once, subtracting a certain value from the number of times in the transaction counter, and the initial number of times is pre-set in the transaction counter; when the number of times in the transaction counter is 0, it is necessary to re-apply for authorization from the online key platform; The ETC security authentication device authorization method based on location information also includes: after being successfully authorized by the online key platform, restoring the transaction counter in the ETC security authentication device to an initial number of times.

2. The ETC security authentication device authorization method based on location information according to claim 1, characterized in that: If the location in the positioning information does not fall within the preset electronic fence range, the device will lock itself and report the abnormal location information to the online key platform.

3. An ETC security authentication device authorization device based on location information, characterized in that: include: A location verification unit is used to determine whether its own location falls within the preset electronic fence range; A digital certificate mutual verification unit, used to initiate an SSL handshake request to a certificate server, so that the certificate server completes the digital certificate mutual verification according to the SSL protocol; An identity authentication unit, used to send a pre-generated random number and its own ID information to an online key platform, so that the online key platform authenticates the ID information according to a pre-stored blacklist; A ciphertext decryption unit, used to receive the authorization authentication ciphertext sent by the online key platform and decrypt it using a local key; The authorization authentication ciphertext is generated according to the random number and the ID information; An authorization unit, used to determine whether the authorization is successful based on the decryption result; A counting module, for decrypting each pair of vehicle information once, and the number of times in the transaction counter is reduced by a certain value, and the initial number of times is preset in the transaction counter; The re-authorization module is used to apply for authorization from the online key platform again when the number of times in the transaction counter is 0.

4. The ETC security authentication device authorization device based on location information according to claim 3, characterized in that: The authorization unit comprises: A random number acquisition module is used to obtain random numbers in ciphertext; The comparison authorization module is used to compare the random number in the ciphertext with the pre-generated random number. If the comparison results are consistent, the authorization is successful and the vehicle information can be decrypted.

5. The ETC security authentication device authorization device based on location information according to claim 3, characterized in that: Also includes: The counter recovery module is used to restore the transaction counter in the ETC security authentication device to an initial number of times after being successfully authorized by the online key platform.

6. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the ETC security authentication device authorization method based on location information as described in any one of claims 1 to 2 is implemented.

7. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, it implements the ETC security authentication device authorization method based on location information as described in any one of claims 1 to 2.

8. An ETC security authentication device authorization system based on location information, characterized in that: include: RSU antenna controller, ETC security authentication device, an online key platform and a certificate server in communication with the online key platform; The certificate server is connected to the RSU antenna controller in communication, and the RSU antenna controller is connected to the ETC safety authentication device via an interface or a wireless device; The ETC safety authentication device includes: a positioning module, a storage chip, a security chip, a communication component, a central processing unit and an information transmission component; The positioning module is used to locate the ETC safety authentication device; The security chip stores a root key for decrypting vehicle information and a key for external authentication; The information transmission component is used to transmit data with an external RSU antenna controller; The information transmission component sends the pre-generated random number and its own ID information to the online key platform for identity authentication; After the verification is passed, the communication component receives the authorization authentication ciphertext sent by the online key platform, and the central processor uses the key stored in the security chip to decrypt it; the authorization authentication ciphertext is generated by the online key platform according to the random number and the ID information; the central processor determines whether to authorize according to the decryption result; The ETC security authentication device also includes a transaction counter; The central processing unit is also used to obtain a random number in the ciphertext; compare the random number in the ciphertext with a pre-generated random number. If the comparison results are consistent, the authorization is successful and the vehicle information can be decrypted; after the vehicle information is decrypted once, the number of times in the transaction counter is subtracted by a certain value, and the initial number of times is pre-set in the transaction counter; when the number of times in the transaction counter is 0, it is necessary to re-apply for authorization to the online key platform; when the online key platform is successfully authorized, the transaction counter in the ETC security authentication device is restored to the initial number of times.

9. The ETC security authentication device authorization system based on location information according to claim 8 is characterized in that: The communication component is a 4G communication module, and the positioning module is a Beidou positioning module or a GPS positioning module.

10. The ETC security authentication device authorization system based on location information according to claim 8, characterized in that: The information transmission component is a USB interface, and the USB interface can be connected to an external RSU antenna controller.

11. The ETC security authentication device authorization system based on location information according to claim 10, characterized in that: It also includes an electronic signature, which is used to authenticate and authorize the ETC security authentication device through the electronic signature and PIN code when the network signal is poor.

Images