A communication method, device and equipment

Abstract

The present application provides a communication method, apparatus and device that can be applied to the Internet of Vehicles. The communication method may include: a first device acquires business data and processes the business data securely; the first device sends business data and indication information to a second device, wherein the indication information is used to indicate the security mechanism used for secure processing of the business data or the protocol layer used to indicate secure processing of the business data. The present application can reduce the risk of information leakage and improve the security of V2X end-to-end communication.

Description

Technical Field

[0001] The present application relates to the field of Internet of Vehicles, and in particular to a communication method, device and equipment. Background Art

[0002] With the continuous development of society, the popularity of automobiles is increasing. Vehicles can obtain road condition information in a timely manner through vehicle-to-vehicle communication (V2V), vehicle-to-roadside infrastructure communication (V2I), vehicle-to-pedestrian communication (V2P) or vehicle-to-network communication (V2N), thereby improving driving safety, reducing congestion and improving traffic efficiency. These communication methods can be collectively referred to as "V2X (vehicle to everything)" communication (where X stands for everything), and the network used for V2X communication is called the Internet of Vehicles. Among them, Internet of Vehicles communication based on cellular networks is currently an important means of communication, such as V2X (LTE-V2X) communication based on long-term evolution (LTE) communication technology or V2X communication based on the fifth generation (5 th V2X (5G-V2X) communication based on the new generation, 5G) communication technology.

[0003] At present, due to the continuous development of V2X services, V2X communication is no longer limited to business data supporting broadcast services, such as vehicles broadcasting their basic information, such as location, speed, and vehicle head direction, to other vehicles or devices, and is also seeking to support business data for unicast services, such as the interaction of sensor data between vehicles or between vehicles and roadside units, and communication between vehicles and roadside units for unicast services such as near-field charging or identity information query management. However, since the current V2X security mechanism is for broadcast services, it is known to different receiving ends. Therefore, if the current security mechanism is still used to securely process the business data of unicast services, there may be a risk of information leakage, and the security is poor. Summary of the invention

[0004] The present application provides a communication method, apparatus and device for improving the security of V2X end-to-end communication.

[0005] In the first aspect, the present application provides a communication method, which can be applied to a first device in a vehicle network, the first device being, for example, an on-board unit (OBU) or a road side unit (RSU). The method comprises: the first device acquires service data and performs security processing on the service data; the first device sends service data and first indication information to the second device; wherein the first indication information is used to indicate the security mechanism used for the security processing of the service data or the protocol layer for the security processing of the service data.

[0006] In the present application, the first device may use different security mechanisms to process the business data securely. Exemplarily, the first device may use the first security mechanism to process the business data securely, may use the second security mechanism to process the business data securely, or may use both the first security mechanism and the second security mechanism to process the business data securely.

[0007] In some possible implementations, the first security mechanism can be understood as a general security mechanism, which can be applicable to V2X services of different service types, such as broadcast services and unicast services; the second security mechanism can be understood as a dedicated security mechanism, which can be applicable to V2X services of preset service types, such as unicast services or specific services in unicast services, such as near-field payment, electronic toll collection, vehicle identity management, or motor vehicle electronic identification management.

[0008] In some possible implementations, the first security mode can be understood as a V2X-based security mechanism (such as an LTE-V2X security mechanism), for example, a security mechanism provided by a security layer in the LTE-V2X protocol stack; the second security mode can be understood as a security mechanism set for a service type, for example, a security mechanism provided by an application layer or a message layer in the LTE-V2X protocol stack for a unicast service or a specific service in a unicast service.

[0009] In some possible implementations, the first security mechanism may be understood as a security mechanism used for security processing at a security layer, and the second security mechanism may be understood as a security mechanism used for security processing at an application layer or a message layer.

[0010] In the present application, the first device can also process the service data securely at different protocol layers. Exemplarily, the first device can process the service data securely at the security layer (such as the security layer in the V2X protocol stack); or, the first device can also process the service data securely at the application layer (such as the application layer in the V2X protocol stack) or the message layer (such as the message layer in the V2X protocol stack); or, the first device can process the service data securely at the application layer and the security layer; or, the first device can process the service data securely at the message layer and the security layer.

[0011] In the present application, the first device indicates to the second device the security mechanism or protocol layer used for secure processing of service data, so that the second device can use the corresponding security mechanism to securely process the service data according to the instructions of the first indication information, thereby reducing the risk of information leakage, thereby improving the security of V2X end-to-end communication. Furthermore, the first device indicates to the second device the security mechanism or protocol layer used for secure processing of service data, so that the second device can use the corresponding security mechanism to securely process the service data according to the instructions of the first indication information, thereby reducing the situation where the first device and the second device cannot communicate due to the use of different security mechanisms, thereby improving the reliability of V2X end-to-end communication.

[0012] In some possible implementations, the above method may further include: the first device sending identification information to the second device, where the identification information is used to identify a service type of the service data.

[0013] It is understandable that, in addition to sending the service data and the first indication information to the second device, the first device may also send identification information to the second device to indicate the service type of the service data to the second device. Then, if the first indication information indicates that the service data is to be securely processed at the application layer, the second device may securely process the service data according to the service type indicated by the identification information and using the security processing method corresponding to the service type.

[0014] Optionally, the business type may be: near-field payment, electronic toll collection, vehicle identity management or motor vehicle electronic identification management, etc.

[0015] In some possible implementations, the method may further include: the first device sending second indication information to the second device, the second indication information being used to indicate the content of the security processing. Here, the content of the security processing may be understood as a specific processing method corresponding to a certain security mechanism.

[0016] In the present application, the first indication information and the second indication information may exist in different messages; or, the first indication information and the second indication information may be located in two different information fields in the same message.

[0017] Specifically, if the first indication information and the second indication information can be located in two different information domains in the same message, then an N-bit string can be used to carry the first indication information and the second indication information, where the first K bits can be used to indicate the security mechanism used for secure processing of business data, and the last NK bits can be used to indicate the content of secure processing of business data, where N is a positive integer and K is a positive integer less than N.

[0018] In some possible implementations, when the security mechanism used for security processing is the first security mechanism, the content of the security processing may include: no encryption and no signing, only signing without encryption, or signing and encryption.

[0019] In some possible implementations, when the second security mechanism used in the security processing is used, the content of the above security processing may include: a first part and a second part associated with the first part; wherein the first part includes: supporting security authentication, not supporting security authentication, supporting security authentication but not requiring encrypted communication, or supporting security authentication and requiring encrypted communication; the second part includes: asymmetric encryption, symmetric encryption, XOR two-way authentication, XOR one-way authentication, or symmetric encryption one-way authentication.

[0020] Here, the first part can be understood as the security mode, and the second part can be understood as the security function. The security mode and the security function are related. The security mode is used to indicate the security processing capability of the V2X service, and the security function is used to indicate the use in a specific security mode. The security mode and the security function can work together to indicate what kind of security processing is performed on the service data, so that the second device can perform corresponding security processing on the service data, thereby realizing V2X end-to-end secure communication.

[0021] In some possible implementations, the first device sends service data and indication information to the second device, which may specifically include: the first device sends a data frame to the second device, wherein the data frame includes: a frame header and a payload; the indication information is carried in the frame header, and the service data is carried in the payload; the indication information may be only the first indication information, or may be the first indication information and the second indication information.

[0022] In some possible implementations, the frame header includes: an extension field and extension field indication information; when the above indication information is carried in the extension field, the extension field indication information is used to indicate that the data frame carries the indication information.

[0023] In some possible implementations, the frame header further includes: association indication information, where the association indication information is used to indicate whether the above indication information is associated with the service data in the payload.

[0024] When the association indication information takes a true value, the association indication information is used to indicate that the indication information is associated with the business data in the payload; when the association indication information takes a false value, the association indication information is used to indicate that the indication information is not associated with the business data in the payload.

[0025] In some possible implementations, before the first device sends a data frame to the second device, the method further includes: the first device transmits business data and indication information to the network layer at the message layer; and the first device encapsulates the business data and indication information into a data frame at the network layer.

[0026] In a second aspect, the present application also provides a communication method, which can be applied to a second device in a vehicle network, the second device being, for example, an OBU or an RSU. The method may include: the second device receiving service data and first indication information from the first device; the second device securely processing the service data according to the first indication information. The first indication information is used to indicate the security mechanism used for securely processing the service data.

[0027] In some possible implementations, the method further includes: the second device receiving identification information from the first device, where the identification information is used to identify a service type of the service data.

[0028] It is understandable that, in addition to sending the service data and the first indication information to the second device, the first device may also send identification information to the second device to indicate to the second device the service type of the service data and the protocol layer for securely processing the service data. Then, if the first indication information indicates that the service data is securely processed at the application layer, the second device may securely process the service data according to the service type indicated by the identification information and using the security processing method corresponding to the service type.

[0029] Optionally, the business type may be near-field payment, electronic toll collection, vehicle identity management, or motor vehicle electronic identification management.

[0030] In some possible implementations, the indication information received by the second device from the first device includes, in addition to the first indication information, second indication information for indicating the content of the security processing. Here, the content of the security processing can be understood as a specific processing method corresponding to a certain security mechanism.

[0031] In the present application, the first indication information and the second indication information may exist in different messages; or, the first indication information and the second indication information may be located in two different information fields in the same message.

[0032] Specifically, if the first indication information and the second indication information can be located in two different information domains in the same message, then an N-bit string can be used to carry the indication information including the first indication information and the second indication information, where the first K bits are used to indicate the security mechanism used for security processing, and the last NK bits of the string are used to indicate the content of the security processing, where N is a positive integer, and K is a positive integer less than N.

[0033] In some possible implementations, when the security mechanism used for security processing is the first security mechanism, the content of security processing may be: unencrypted and unsigned, signed but not encrypted, or signed and encrypted.

[0034] In some possible implementations, when the security mechanism used for security processing is a second security mechanism, the content of the security processing may include: a first part and a second part associated with the first part; wherein the first part includes: supporting security authentication, not supporting security authentication, supporting security authentication but not requiring secure communication, or supporting security authentication and requiring secure communication; the second part includes: asymmetric encryption, symmetric encryption, XOR two-way authentication, XOR one-way authentication, and symmetric encryption one-way authentication.

[0035] Here, the first part can be understood as the security mode, and the second part can be understood as the security function. The security mode and the security function are related. The security mode is used to indicate the security processing capability of the V2X service, and the security function is used to indicate the use in a specific security mode. The security mode and the security function can work together to indicate what kind of security processing is performed on the service data, so that the second device can perform corresponding security processing on the service data, thereby realizing V2X end-to-end secure communication.

[0036] In some possible implementations, the second device receives the service data and indication information from the first device, which may specifically include: the second device receives a data frame from the first device, wherein the data frame includes: a frame header and a payload; the indication information is carried in the frame header, and the service data is carried in the payload. The indication information may be only the first indication information, or may be the first indication information and the second indication information.

[0037] In some possible implementations, the frame header includes: an extension field and extension field indication information; when the indication information is carried in the extension field, the extension field indication information is used to indicate that the data frame carries the indication information.

[0038] In some possible implementations, the frame header further includes: association indication information, where the association indication information is used to indicate whether the indication information is associated with the service data in the payload.

[0039] When the associated indication information takes a true value, the associated indication information is used to indicate that the indication information is associated with the business data in the payload; when the associated indication information takes a false value, the associated indication information is used to indicate that the indication information is not associated with the business data in the payload.

[0040] In some possible implementations, after the second device receives the data frame from the first device, the above method may also include: the second device obtains the business data and indication information in the data frame at the network layer; the second device transmits the business data and indication information to the message layer at the network layer; the second device securely processes the business data at the message layer according to the indication of the indication information.

[0041] In some possible implementations, the second device performs secure processing of the business data at the message layer according to the instruction of the first indication information, which may include: if the first indication information indicates that the secure processing uses the first security mechanism, the second device transmits the business data to the security layer at the message layer, and uses the first security mechanism to perform secure processing of the business data at the security layer; or, if the first indication information indicates that the secure processing uses the second security mechanism, the second device transmits the business data to the application layer at the message layer, and uses the second security mechanism to perform secure processing of the business data at the application layer. Optionally, if the first indication information indicates that the secure processing uses the second security mechanism, the second device uses the second security mechanism to perform secure processing of the business data at the message layer.

[0042] In some other possible implementations, the second device performs secure processing of the business data at the message layer according to the instruction of the first indication information, and may also include: if the first indication information indicates that the secure processing uses the first security mechanism and the second security mechanism, the second device transmits the business data to the security layer at the message layer; the second device uses the first security mechanism at the security layer to perform secure processing on the business data; the second device transmits the processed business data to the message layer at the security layer; the second device performs secure processing on the processed business data at the message layer according to the second security mechanism. Optionally, the second device may transmit the processed business data to the application layer at the message layer, and perform secure processing on the processed business data using the second security mechanism at the application layer; or the second device may perform secure processing on the processed business data using the second security mechanism at the message layer.

[0043] In some possible implementations, the second device securely processes the business data at the message layer according to the indication of the first indication information, which may include: if the first indication information indicates that the business data is to be securely processed at the security layer, the second device transmits the business data to the security layer at the message layer, and securely processes the business data at the security layer; or, if the first indication information indicates that the business data is to be securely processed at the application layer, the second device transmits the business data to the application layer at the message layer, and securely processes the business data at the application layer; or, if the first indication information indicates that the business data is to be securely processed at the message layer, the second device securely processes the business data at the message layer.

[0044] In some other possible implementations, the second device securely processes the business data at the message layer according to the instructions of the first indication information, and may also include: if the first indication information indicates to securely process the business data at the security layer and the application layer, the second device transmits the business data to the security layer at the message layer; the second device securely processes the business data at the security layer; the second device transmits the processed business data to the message layer at the security layer; the second device transmits the processed business data to the application layer at the message layer, and securely processes the processed business data at the application layer.

[0045] Optionally, the second device securely processes the business data at the message layer according to the indication of the first indication information, and may also include: if the first indication information indicates to securely process the business data at the security layer and the message layer, the second device transmits the business data to the security layer at the message layer; the second device securely processes the business data at the security layer; the second device transmits the processed business data from the security layer to the message layer; the second device securely processes the processed business data at the message layer.

[0046] In a third aspect, the present application provides a communication device, which may be a first device in a vehicle network or a chip or system on chip in the first device, or a functional module in the first device for implementing the method described in the first aspect or any possible implementation of the first aspect. The communication device can implement the functions performed by the first device in the above aspects or in each possible implementation, and the functions can be implemented by hardware executing corresponding software. The hardware or software includes one or more modules corresponding to the above functions. The communication device includes: a processing module for acquiring business data and performing secure processing on the business data; a sending module for sending business data and indication information to a second device; wherein the indication information is used to indicate the security mechanism used for secure processing of business data or to indicate the protocol layer for secure processing of business data.

[0047] In some possible implementations, the sending module is further used to send identification information to the second device, where the identification information is used to identify the service type of the service data.

[0048] In some possible implementations, the indication information is also used to indicate the content of the security processing.

[0049] In some possible implementations, the indication information is an N-bit string, the first K bits of the string are used to indicate the security mechanism used for security processing; the last NK bits of the string are used to indicate the content of the security processing, N is a positive integer, and K is a positive integer less than N.

[0050] In some possible implementations, the indication information is used to indicate a first security mechanism used for security processing, or to indicate a second security mechanism used for security processing, or to indicate a first security mechanism and a second security mechanism used for security processing; or, the indication information is used to indicate security processing of business data at the application layer, at the security layer, or at both the application layer and the security layer.

[0051] In some possible implementations, the first security mechanism is a V2X-based security mechanism, and the second security mechanism is a security mechanism set for a service type.

[0052] In some possible implementations, when the security mechanism used for security processing is the first security mechanism, the content of security processing includes: no encryption and no signing, only signing without encryption, or signing and encryption.

[0053] In some possible implementations, when the security mechanism used for security processing is a second security mechanism, the content of the security processing includes: a first part and a second part associated with the first part; wherein the first part includes: supporting security authentication, not supporting security authentication, supporting security authentication but not requiring encrypted communication, or supporting security authentication and requiring encrypted communication; the second part includes: asymmetric encryption, symmetric encryption, XOR two-way authentication, XOR one-way authentication, or symmetric encryption one-way authentication.

[0054] In some possible implementations, the first device sends service data and indication information to the second device, including: the first device sends a data frame to the second device, the data frame includes: a frame header and a payload; the indication information is carried in the frame header, and the service data is carried in the payload.

[0055] In some possible implementations, the frame header includes: an extension field and extension field indication information; when the indication information is carried in the extension field, the extension field indication information is used to indicate that the data frame carries the indication information.

[0056] In some possible implementations, the frame header further includes: association indication information, where the association indication information is used to indicate whether the indication information is associated with the service data in the payload.

[0057] In some possible implementations, the processing module is further used to: before the sending module sends the data frame to the second device, transfer the business data and indication information to the network layer at the message layer; and encapsulate the business data and indication information into a data frame at the network layer.

[0058] In a fourth aspect, the present application provides a communication device, which may be a second device in the Internet of Vehicles or a chip or system on chip in the second device, or a functional module in the second device for implementing the method described in the second aspect or any possible implementation of the second aspect. The communication device can implement the functions performed by the second device in the above aspects or in each possible implementation, and the functions can be implemented by hardware executing corresponding software. The hardware or software includes one or more modules corresponding to the above functions. The communication device includes: a receiving module for receiving a data frame from a first device, the data frame including business data and indication information; a processing module for securely processing the business data according to the indication information; wherein the indication information is used to indicate the security mechanism used for secure processing of the business data or to indicate the protocol layer for secure processing of the business data.

[0059] In some possible implementations, the receiving module is further used to receive identification information from the first device, where the identification information is used to identify a service type of the service data.

[0060] In some possible implementations, the indication information is also used to indicate the content of the security processing.

[0061] In some possible implementations, the indication information is an N-bit string, the first K bits of the string are used to indicate the security mechanism used for security processing; the last NK bits of the string are used to indicate the content of the security processing, N is a positive integer, and K is a positive integer less than N.

[0062] In some possible implementations, the indication information is used to indicate a first security mechanism used for security processing, or to indicate a second security mechanism used for security processing, or to indicate a first security mechanism and a second security mechanism used for security processing; or, the indication information is used to indicate security processing of business data at the application layer, at the security layer, or at both the application layer and the security layer.

[0063] In some possible implementations, the first security mechanism is a V2X-based security mechanism, and the second security mechanism is a security mechanism set for a service type.

[0064] In some possible implementations, when the security mechanism used for security processing is the first security mechanism, the content of security processing includes: no encryption and no signing, only signing without encryption, or signing and encryption.

[0065] In some possible implementations, when the security mechanism used for security processing is a second security mechanism, the content of the security processing includes: a first part and a second part associated with the first part; wherein the first part includes: supporting security authentication, not supporting security authentication, supporting security authentication but not requiring secure communication, or supporting security authentication and requiring secure communication; the second part includes: asymmetric encryption, symmetric encryption, XOR two-way authentication, XOR one-way authentication, and symmetric encryption one-way authentication.

[0066] In some possible implementations, the receiving module is specifically used to receive a data frame from the first device, where the data frame includes: a frame header and a payload; wherein the indication information is carried in the frame header, and the service data is carried in the payload.

[0067] In some possible implementations, the frame header includes: an extension field and extension field indication information; when the indication information is carried in the extension field, the extension field indication information is used to indicate that the data frame carries the indication information.

[0068] In some possible implementations, the frame header further includes: association indication information, the association indication information is used to indicate whether the indication information is associated with the service data in the payload. When the association indication information takes a true value, the association indication information is used to indicate that the indication information is associated with the service data in the payload; when the association indication information takes a false value, the association indication information is used to indicate that the indication information is not associated with the service data in the payload.

[0069] In some possible implementations, after the second device receives the data frame sent by the first device, the apparatus further includes: a processing module, configured to: obtain business data and indication information in the data frame at the network layer; transmit business data and indication information to the message layer at the network layer; and perform security processing on the business data at the message layer according to the indication of the indication information.

[0070] In a fifth aspect, the present application provides a communication device, such as a first device in a vehicle network. The communication device may include: a processor and a memory; the processor is coupled to the memory; the processor is configured to read and execute instructions in the memory to implement the communication method as described in any of the first aspect and possible implementations thereof.

[0071] In a sixth aspect, the present application provides a communication device, such as a second device in a vehicle network. The communication device includes: a processor and a memory; the processor is coupled to the memory; the processor is used to read and execute instructions in the memory to implement the communication method as described in any of the above second aspects and possible implementations thereof.

[0072] In a seventh aspect, the present application provides a computer-readable storage medium, in which instructions are stored; when the instructions are executed on a computer, the communication method described in any one of the first and second aspects is executed.

[0073] In an eighth aspect, the present application provides a computer program or a computer program product. When the computer program product is executed on a computer, it enables the computer to implement the communication method as described in any one of the first and second aspects above.

[0074] It should be understood that the third to eighth aspects of the present application are consistent with the technical solutions of the first and second aspects of the present application, and the beneficial effects achieved by each aspect and the corresponding feasible implementation methods are similar and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0075] In order to more clearly illustrate the technical solution of the embodiments of the present application, the drawings required for use in the embodiments of the present application will be described below.

[0076] Figure 1 A schematic diagram of communication between vehicles and communication between a vehicle and roadside infrastructure in an embodiment of the present application;

[0077] Figure 2 A schematic diagram of a V2X deployment scenario in an embodiment of the present application;

[0078] Figure 3 A schematic diagram of an end-to-end protocol stack of V2X in an embodiment of the present application;

[0079] Figure 4 Schematic diagram of a V2X communication system in an embodiment of the present application;

[0080] Figure 5 A flow chart of a communication method in an embodiment of the present application;

[0081] Figure 6 A schematic diagram of indication information in an embodiment of the present application;

[0082] Figure 7 A schematic diagram of a data frame in an embodiment of the present application;

[0083] Figure 8 A flow chart of another communication method in an embodiment of the present application;

[0084] Fig. 9 A schematic diagram of the structure of a communication device in an embodiment of the present application;

[0085] Fig.10 It is a structural schematic diagram of another communication device in an embodiment of the present application;

[0086] Fig.11 A schematic diagram of the structure of a communication device in an embodiment of the present application. DETAILED DESCRIPTION

[0087] The following is a description of the embodiments of the present application in conjunction with the drawings in the embodiments of the present application. In the following description, reference is made to the drawings that form a part of the present application and show the specific aspects of the embodiments of the present application or the specific aspects of the embodiments of the present application in an illustrative manner. It should be understood that the embodiments of the present application can be used in other aspects and may include structural or logical changes not depicted in the drawings. Therefore, the following detailed description should not be understood in a restrictive sense, and the scope of the present application is defined by the appended claims. For example, it should be understood that the disclosure of the described method can be equally applicable to the corresponding device or system for performing the method, and vice versa. For example, if one or more specific method steps are described, the corresponding device may include one or more units such as functional units to perform the one or more method steps described (for example, one unit performs one or more steps, or multiple units, each of which performs one or more of the multiple steps), even if such one or more units are not explicitly described or illustrated in the drawings. On the other hand, for example, if a specific device is described based on one or more units such as functional units, the corresponding method may include a step to perform the functionality of the one or more units (e.g., a step to perform the functionality of the one or more units, or multiple steps, each of which performs the functionality of one or more of the multiple units), even if such one or more steps are not explicitly described or illustrated in the drawings. Further, it should be understood that, unless otherwise explicitly stated, the features of the various exemplary embodiments and / or aspects described herein may be combined with each other.

[0088] In the embodiments of the present application, Figure 1 Schematic diagram of communication between vehicles and communication between vehicles and roadside infrastructure in an embodiment of the present application, see Figure 1 As shown, vehicles can obtain road condition information in a timely manner or communicate with other devices through V2V communication or V2I communication to improve driving safety, reduce congestion, and improve traffic efficiency. Vehicles can also communicate with other devices to obtain more abundant services, such as through V2P communication, vehicle-to-device (V2D), or V2N communication to communicate in a timely manner to obtain more services. The above communication methods can be collectively referred to as V2X communication, and the network used by V2X communication is called the Internet of Vehicles.

[0089] For example, see Figure 1As shown, taking V2V communication and V2I communication as examples, vehicle 11a can broadcast its own information to surrounding vehicles (such as vehicle 11b) through V2V communication. The information includes at least one of the following information: vehicle speed, driving direction, vehicle position, whether the emergency brake is pressed, etc. By obtaining such information, the driver can better perceive the traffic conditions beyond the visual range, so as to make early predictions of dangerous conditions and make avoidance. As for V2I communication, in addition to the above-mentioned interaction of safety information, the roadside infrastructure 12 can also provide vehicle 11a with various service information and access to data networks, such as non-stop toll collection, in-car entertainment and other functions, which greatly improves the intelligentization of transportation.

[0090] At present, dedicated short range communications (DSRC) and cellular-based V2X (C-V2X) communications are important means of communication for the Internet of Vehicles. For example, C-V2X communications use long-term evolution (LTE) communications technology to build V2X (LTE-V2X) or fifth-generation (5G) communications to build V2X. th V2X communication (5G-V2X) based on 5G (5G generation) communication technology. Figure 2 This is a schematic diagram of a V2X deployment scenario in an embodiment of the present application, see Figure 2 As shown in the figure, from the deployment scenario, it can be divided into network coverage scenario ( Figure 2 (a)) and no network coverage scenario ( Figure 2 In the scenario with network coverage, the transmission resources in the Internet of Vehicles can be allocated by the base station 21, and the terminal (such as the on board unit (OBU) 221 or the road side unit (RSU) 222) can transmit data on the transmission resources allocated by the base station 21; in the scenario without network coverage, the terminal (such as OBU 221a, OBU 221b or RSU 222) can obtain the configuration of the transmission resource pool through pre-configuration information, and then independently select resources in the corresponding transmission resource pool, and then directly communicate between terminals through the independently selected transmission resources.

[0091] In some possible implementations, Figure 3 This is a schematic diagram of a V2X end-to-end protocol stack in an embodiment of the present application, see Figure 3 As shown, the protocol stack 300 may include: an application layer 31 , a security layer 32 , a message layer 33 , a network layer 34 and an access layer 35 .

[0092] The application layer 31 can provide or define applications for communication and provide an interface for the underlying network of information transmission. The application layer 31 can provide protocols followed by application processes during communication for various applications or services, thereby achieving communication and collaborative work between application processes in different devices.

[0093] The message layer 33 may provide or define the format and / or content of the message, such as the format and / or content of the message frame. The message layer 33 may define the format and / or content of the message in the form of a message set, in which the format and content of the message body are defined for various services or contents, so that the information or data from the application layer 31 is packaged or encapsulated into a message frame specified in the message set and submitted to the network layer 34. The message layer 33 may serve as an independent protocol layer between the application layer 31 and the network layer 34, or the message layer 33 may serve as a sublayer of the application layer 31, that is, the function is integrated into the application layer 31. The message layer 33 is connected to the network layer 34 downward and supports specific user applications upward.

[0094] The security layer 32 may provide or define a security mechanism. For example, the security mechanism for message layer data may be defined to include at least one of the following security processing: signing, signature verification, encryption, decryption, integrity protection and other services.

[0095] The network layer 34 can provide or define a network transmission protocol to support access layer transmission technology, thereby providing data network transmission services. For example, in one implementation, the network layer 34 can include a management sublayer and a data sublayer. The data sublayer mainly defines an adaptation layer, an Internet protocol (IP), a user datagram protocol (UDP) / transmission control protocol (TCP), and a dedicated short message protocol (DSMP); the data sublayer can transmit data streams between application layers, and can also transmit data streams between management sublayer entities of different devices or between management sublayer entities and application layers. The management sublayer mainly completes functions such as system configuration and maintenance. The management sublayer transmits management data streams between different devices by using data sublayer services, wherein a dedicated management entity (DME) is a general set of management services, and DME provides a management interface for data sublayer entities, including the DSMP protocol.

[0096] The access layer 35 can provide or define the protocol and transmission mechanism of wireless transmission. For example, when the C-V2X transmission mechanism is adopted, the access layer can match the access layer protocol of the cellular network. For example, when the DSRC transmission mechanism is adopted, the access layer can match the communication protocol adopted by DSRC.

[0097] In the embodiment of the present application, the different protocol layers in the above-mentioned protocol stack may be a collection of one or more protocol sublayers. For example, the application layer may include one or more service protocols (also understood as application protocols) corresponding to different service types, and the security layer may include the LTE-V2X security protocol or the 5G-V2X security protocol, which is not specifically limited in the embodiment of the present application.

[0098] Combined with the above protocol stack, the application layer of the sending end can pass the vehicle information (or business data) to the message layer, and the message layer will pass the vehicle information to the security layer by default. After the security layer processes the vehicle information securely, it will be processed by the message layer, network layer and access layer in turn, and finally the vehicle information of the vehicle itself will be broadcast to the surrounding vehicles, so that when the receiving end detects a possible collision risk, it can notify the driver in time to avoid accidents. The vehicle information includes, for example, at least one of the following information: vehicle speed, driving direction, vehicle location, whether the emergency brake is pressed, etc.

[0099] However, with the continuous development of V2X services, V2X is no longer limited to business data supporting broadcast services (such as the above-mentioned vehicle information), and is also seeking to support business data for unicast services (such as the interaction of sensor data between vehicles or between vehicles and roadside units, or communication between vehicles and roadside units for near-field charging or identity information query management, etc.). For unicast services, considering the confidentiality of end-to-end communication, the sender also securely processes the business data of unicast services when sending these data. However, since the security mechanism of the V2X security layer is for broadcast services and is known to different receiving ends, if the security mechanism of the V2X security layer is used to securely process the business data of unicast services, there may be a risk of information leakage and poor security.

[0100] Taking the near-field payment service as an example, the application layer is usually responsible for the security mechanism. However, when LTE-V2X is used to carry unicast services such as near-field payment, the security mechanism can also be the responsibility of the security layer. It can be seen that for V2X unicast services, there are multiple options for the protocol layer responsible for the security mechanism. And the encapsulation format and interaction process used by different protocol layers when performing security processing are different. If the security mechanism is responsible for a protocol layer different from the security layer, after receiving the service data, the receiving end may use a security mechanism different from that of the sending end to perform security processing on the service data, resulting in the receiving end being unable to perform security processing such as signature verification and decryption on the service data, making it impossible for the sending end and the receiving end to communicate, and the reliability is poor.

[0101] In order to solve the above problems, an embodiment of the present application provides a communication method, which can be applied to a vehicle network communication system to achieve V2X end-to-end secure communication.

[0102] In one possible implementation, Figure 4 This is a schematic diagram of a V2X communication system in an embodiment of the present application, see Figure 4 As shown in (a), the vehicle network communication system may include: OBU 41 and RSU 42, wherein OBU 41 may include a positioning system 411, a processing unit 412 and a radio communication subsystem 413, and RSU 42 may include a positioning system 421, a processing unit 422 and a radio communication subsystem 423; see Figure 4 As shown in (b), the Internet of Vehicles communication system 400 may include: OBU 41 and OBU 43, wherein OBU 43 may include a positioning system 431, a processing unit 432 and a radio communication subsystem 433. The OBU 41 is described above and will not be described in detail.

[0103] In the above communication system, one or more RSUs and one or more OBUs may be included, wherein direct communication may be performed between OBUs, direct communication may be performed between RSUs, and direct communication may be performed between OBUs and RSUs. Here, direct communication refers to communication between RSUs or OBUs through radio transmission to achieve direct communication and information exchange between vehicles, vehicles and roadside infrastructure, and vehicles and people. Direct communication may also be called sidelink or bypass communication.

[0104] In V2X, the above OBU can be called a vehicle-mounted unit, or a vehicle-mounted device, a vehicle control unit or a vehicle control device. The OBU can be located in the vehicle, or built into the vehicle as a component of the vehicle. In some possible implementations, the OBU can also be a third-party device, which is not specifically limited in the embodiments of this application. The above RSU can be called a roadside unit, which is generally deployed by the roadside operator and can transmit traffic light information, traffic control information, road sign information, etc. This type of information has high reliability requirements.

[0105] The communication method is described below using a detailed embodiment.

[0106] First of all, it should be noted that the first device (i.e., the transmitting device) and the second device (i.e., the receiving device) involved in the following embodiments may be different types of devices in the Internet of Vehicles. For example, the above-mentioned V2X communication system includes an OBU and an RSU, then the first device may be an OBU and the second device may be an RSU; or the first device may be an RSU and the second device may be an OBU; or the above-mentioned V2X communication system includes an OBU and an OBU, then the first device may be an OBU and the second device may be an OBU.

[0107] Figure 5 This is a flow chart of a communication method in an embodiment of the present application, see Figure 5 As shown, the above communication method may include:

[0108] S501: The first device obtains business data and performs security processing on the business data.

[0109] It can be understood that when the V2X service needs to send service data to the second device, the first device obtains the service data of the V2X service and processes the service data securely.

[0110] Optionally, the V2X service may be a unicast service or a broadcast service. Exemplarily, the service types of the V2X service may include but are not limited to: near-field payment, electronic toll collection (such as electronic toll collection (ETC)), vehicle identity management, motor vehicle electronic identification management, etc.

[0111] In the embodiment of the present application, the first device may use different security mechanisms to securely process the business data.

[0112] Exemplarily, the first device may use the first security mechanism to securely process the business data, may use the second security mechanism to securely process the business data, or may use both the first security mechanism and the second security mechanism to securely process the business data.

[0113] Alternatively, the first security mechanism can be understood as a general security mechanism, which can be applicable to V2X services of different business types; the second security mechanism can be understood as a dedicated security mechanism, which can be applicable to V2X services of preset business types, such as near-field payment, electronic toll collection, vehicle identity management, or motor vehicle electronic identification management.

[0114] Furthermore, the first security mechanism can be understood as a V2X-based security mechanism (such as the LTE-V2X security mechanism), for example, the security mechanism provided by the security layer in the LTE-V2X protocol stack; the second security mechanism can be understood as a security mechanism set for a service type, such as the security mechanism provided by the application layer or message layer in the LTE-V2X protocol stack for a specific service.

[0115] In addition, the first security mechanism may be understood as a security mechanism used for security processing at the security layer, and the second security mechanism may be understood as a security mechanism used for security processing at the application layer or the message layer.

[0116] S502, the first device sends business data (ie, business data after security processing) and indication information to the second device.

[0117] In one embodiment, the indication information may be used to indicate the security mechanism used for secure processing of the business data. Exemplarily, the indication information may indicate the first security mechanism, the second security mechanism, or the first security mechanism and the second security mechanism used for secure processing of the business data.

[0118] In some possible implementations, the above indication information may also be used to indicate the content of the security processing. It is understandable that the content of the security processing may be a specific processing method of a certain security processing.

[0119] In practical applications, the security mechanism and the content of the security processing can be indicated respectively through different information fields in the same message. Of course, in other implementations, the security mechanism and the content of the security processing can also be indicated respectively through multiple different indication messages.

[0120] Exemplarily, when the security mechanism indicated by the indication information is the first security mechanism, the corresponding security processing content may include: one of the mechanisms of no encryption and no signature, only signature without encryption, signature and encryption, etc. Alternatively, when the security mechanism indicated by the indication information is the second security mechanism, the corresponding security processing content may include: security mode (i.e., the first part) and / or security function (i.e., the second part). The above-mentioned security mode and security function are associated. The security mode is used to indicate the security processing capability of the V2X service, and the security function is used to indicate the security function used in a specific security mode. The security mode and security function can jointly indicate what kind of security processing is performed on the above-mentioned service data.

[0121] In practical applications, the above security modes may include but are not limited to: support security authentication, do not support security authentication, support security authentication but do not need encrypted communication, support security authentication and require encrypted communication, etc.; the above security functions may include but are not limited to: asymmetric encryption, symmetric encryption, XOR two-way authentication, XOR one-way authentication, symmetric encryption one-way authentication, etc. For example, when the security mode is to support security authentication, the associated security function may be XOR two-way authentication, XOR one-way authentication, or symmetric encryption one-way authentication; or, when the security mode is to support security authentication and require encrypted communication, the associated security function may include: one of XOR two-way authentication, XOR one-way authentication, or symmetric encryption one-way authentication, and one of asymmetric encryption or symmetric encryption.

[0122] In the specific implementation process, the above indication information can be implemented in the form of a bitmap. The indication information can be a string of N bits, the first K bits of which are used to indicate the security mechanism used for secure processing of business data, such as the first security mechanism and / or the second security mechanism; the last NK bits of the string are used to indicate the content of the security processing, such as the security mode and / or the security function associated with the security mode, N is a positive integer, and K is a positive integer less than N. For example, Figure 6 This is a schematic diagram of an indication information in an embodiment of the present application, see Figure 6 As shown in (a), assuming that the indication information is a 16-bit string, the first 4 bits (ie, K=4) are used to indicate the security mechanism 61a used for secure processing of business data, and the last 12 bits are used to indicate the content 62 of the security processing.

[0123] In another embodiment, the indication information may be used to indicate the protocol layer for securely processing the service data. Exemplarily, the indication information may indicate that the service data is securely processed at the security layer, at the application layer, or at the security layer and the application layer. That is, the first device may securely process the service data at the security layer (such as the security layer in the V2X protocol stack); or, the first device may also securely process the service data at the application layer (such as the application layer in the V2X protocol stack); or, the first device may securely process the service data at the application layer and the security layer.

[0124] In practical applications, different information fields in the above indication information can be used to indicate the content of the protocol layer and the security processing respectively. Of course, in other implementations, the content of the protocol layer and the security processing can also be indicated respectively by multiple independent messages.

[0125] Exemplarily, when the protocol layer indicated by the indication information is a security layer, the corresponding security processing content may include: one of the mechanisms of no encryption and no signature, signature without encryption, signature and encryption, etc. Alternatively, when the protocol layer indicated by the indication information is an application layer or a message layer, the corresponding security processing content may include: a security mode (i.e., the first part) and / or a security function (i.e., the second part). The above-mentioned security mode and security function are associated. The security mode is used to indicate the security processing capability for the V2X service, and the security function is used to indicate the security function used in a specific security mode. The security mode and security function can collaboratively indicate what kind of security processing is specifically performed on the above-mentioned service data.

[0126] In practical applications, the above security modes may include but are not limited to: support security authentication, do not support security authentication, support security authentication but do not need encrypted communication, support security authentication and require encrypted communication, etc.; the above security functions may include but are not limited to: asymmetric encryption, symmetric encryption, XOR two-way authentication, XOR one-way authentication, symmetric encryption one-way authentication, etc. For example, when the security mode is to support security authentication, the associated security function may be XOR two-way authentication, XOR one-way authentication, or symmetric encryption one-way authentication; or, when the security mode is to support security authentication and require encrypted communication, the associated security function may include: one of XOR two-way authentication, XOR one-way authentication, or symmetric encryption one-way authentication, and one of asymmetric encryption or symmetric encryption.

[0127] In the specific implementation process, the above indication information can be implemented in the form of a bitmap. The indication information can be a string of N bits, the first K bits of which are used to indicate the protocol layer for secure processing of business data, such as the security layer and / or the application layer / message layer; the last NK bits of the string are used to indicate the content of the security processing, such as the security mode and / or the security function associated with the security mode, N is a positive integer, and K is a positive integer less than N. For example, see Figure 6 As shown in (b), assuming that the indication information is a 16-bit string, the first 4 bits (ie, K=4) are used to indicate the protocol layer 61b for secure processing of business data, and the last 12 bits are used to indicate the content 62 of the secure processing.

[0128] The number of bits of the above indication information is only an example, and other numbers of bits may also be used for indication, for example, the first two bits indicate the security mechanism used for secure processing of service data or the protocol layer for secure processing of service data.

[0129] In some possible implementations, the above method may further include: the first device sends identification information to the second device, where the identification information is used to identify a service type of the service data.

[0130] In addition to sending the service data and indication information to the second device, the first device may also send identification information to the second device to indicate the service type of the service data to the second device. Then, if the indication information indicates that the service data is to be securely processed at the application layer, the second device may securely process the service data according to the service type indicated by the identification information and using a security processing method corresponding to the service type.

[0131] In an embodiment of the present application, through the above-mentioned indication information, the second device can obtain the security mechanism used for secure processing of business data, and then can use the corresponding security mechanism for secure processing, reduce the risk of information leakage, and thus improve the security of V2X end-to-end communication; further, reduce the occurrence of situations where the first device and the second device cannot communicate due to the use of different security mechanisms, and improve the reliability of V2X end-to-end communication.

[0132] S503: The second device performs security processing on the business data according to the instruction information.

[0133] It can be understood that after receiving the service data and the indication information from the first device, the second device can perform security processing on the service data according to the security mechanism or protocol layer indicated by the indication information.

[0134] In one embodiment, if the security mechanism indicated by the indication information is a first security mechanism, the second device uses the first security mechanism to securely process the business data; or, if the security mechanism indicated by the indication information is a second security mechanism, the second device uses the second security mechanism to securely process the business data; or, if the security mechanism indicated by the indication information is both the first security mechanism and the second security mechanism, the second device uses the first security mechanism and the second security mechanism to securely process the business data.

[0135] Furthermore, the above indication information is also used to indicate the content of security processing. Then, the second device can perform security processing on the business data according to the security mechanism indicated by the indication information and the content of security processing. Exemplarily, if the security mechanism indicated by the indication information is the first security mechanism and the content of security processing is the first content (such as encryption and no signature), the second device uses the first security mechanism and the first content to securely process the business data; or, if the security mechanism indicated by the indication information is the second security mechanism and the content of security processing is the second content (such as supporting security authentication and using XOR two-way authentication), the second device uses the second security mechanism and the second content to securely process the business data.

[0136] In another embodiment, if the protocol layer indicated by the indication information is a security layer, the second device securely processes the business data at the security layer; or, if the protocol layer indicated by the indication information is an application layer or a message layer, the second device securely processes the business data at the application layer or the message layer; or, if the protocol layer indicated by the indication information is a security layer and an application layer, the second device securely processes the business data at the security layer and the application layer; or, if the protocol layer indicated by the indication information is a security layer and a message layer, the second device securely processes the business data at the security layer and the message layer.

[0137] Furthermore, the above-mentioned indication information is also used to indicate the content of security processing. Then, the second device can perform security processing on the business data according to the protocol layer indicated by the indication information and the content of security processing. Exemplarily, if the protocol layer indicated by the indication information is the security layer and the content of security processing is the first content, the second device uses the first content to perform security processing on the business data at the security layer; if the protocol layer indicated by the indication information is the application layer or the message layer and the content of security processing is the second content, the second device uses the second content to perform security processing on the business data at the application layer or the message layer.

[0138] In some possible implementations, S502 may be implemented in the following manner: the first device sends a data frame to the second device, the data frame may include a frame header and a payload, wherein the above indication information is carried in the frame header, and the service data is carried in the payload.

[0139] For example, Figure 7 This is a schematic diagram of a data frame in an embodiment of the present application, see Figure 7 As shown in (a) and (b) of FIG. 8 , the structure of the data frame may include: a frame header 71 and a payload 72 . The indication information may be carried in the frame header 71 , and the service data may be carried in the payload 72 .

[0140] Further, see Figure 7 As shown in (a), the frame header 71 may also include an extension (header extension) field 711 and an extension field indication information (header extension indicator) 712. When the first device encapsulates the data frame, the indication information may be carried in the extension field 711. At this time, the extension field indication information 712 may be set to a true value (TRUE) to indicate that the extension field of the data frame carries the indication information. At this time, the indication information carried in the default extension field 711 is associated with the service data carried in the payload 72.

[0141] In some possible implementations, the first device may also carry the above identification information in the data frame, that is, the application identification corresponding to the service data. Figure 7 As shown in (a) and (b) in FIG. 7 , the identification information may be carried in the application ID (AID) field 713 in the frame header 71. Optionally, the association indication information 714 may also be used to indicate whether there is an association relationship between the indication information and the identification information. If the association indication information 714 is set to a true value (TRUE), it indicates that the indication information is associated with the identification information; if the association indication information 714 is set to a false value (FALSE), it indicates that there is no association relationship between the indication information and the identification information.

[0142] Exemplarily, the above-mentioned data frame may be a network layer data frame such as a dedicated short message (DSM) frame, a dedicated service advertisement frame, etc., and the embodiments of the present application do not make specific limitations.

[0143] In combination with the above-mentioned V2X protocol stack, the above-mentioned communication method is explained below by taking the indication information used to indicate the security mechanism used for secure processing of business data and the indication information is carried in the data frame as an example.

[0144] Figure 8 This is a flow chart of another communication method in the embodiment of the present application, see Figure 8 As shown, the above communication method may include:

[0145] S801, the first device obtains service data of a V2X service (ie, a first service) and performs security processing on the service data.

[0146] S802: The first device sends a data frame to the second device, where the data frame carries service data and indication information corresponding to the service data.

[0147] Here, the indication information is used to indicate the security mechanism used for secure processing of business data.

[0148] Exemplarily, the indication information may indicate that the security mechanism used for secure processing of the service data is the security mechanism of LTE-V2X (which may be understood as the security mechanism provided by the LTE-V2X security layer in the above protocol stack), or the indication information may indicate that the service data uses the security mechanism corresponding to near-field payment (which may be understood as the security mechanism provided by the service protocol corresponding to near-field payment), or the indication information may indicate that the service data uses the security mechanism corresponding to identity management (which may be understood as the security mechanism provided by the service protocol corresponding to identity management), etc. Since different types of V2X services correspond to different service protocols, the security mechanisms used by the service data of these V2X services may be provided by different service protocols.

[0149] In some possible implementations, in addition to indicating the security mechanism used for the service data, the indication information can also be used to indicate the content of the security processing. It can be understood that the content of the security processing can be the specific processing content corresponding to a certain security mechanism. For example, when the security mechanism used by the service data is the security mechanism of LTE-V2X, the corresponding processing content may include: one of the mechanisms of no encryption and no signature, only signature without encryption, signature and encryption, etc. When the security mechanism used by the service data is the security mechanism corresponding to the V2X service, the corresponding processing content may include: security mode (i.e., the first part) and security function (i.e., the second part). The above security mode and security function are associated. The security mode is used to indicate the security processing capability of the V2X service, and the security function is used to indicate the security function used in a specific security mode. The security mode and security function can collaboratively indicate what kind of security processing is specifically performed on the above service data, so that the second device can perform corresponding security processing on the service data, thereby improving the reliability of V2X end-to-end communication.

[0150] In practical applications, the above security modes may include but are not limited to: support security authentication, do not support security authentication, support security authentication but do not need encrypted communication, support security authentication and require encrypted communication, etc.; the above security functions may include but are not limited to: asymmetric encryption, symmetric encryption, XOR two-way authentication, XOR one-way authentication, symmetric encryption one-way authentication, etc. For example, when the security mode is to support security authentication, the associated security function may be XOR two-way authentication, XOR one-way authentication, or symmetric encryption one-way authentication; or, when the security mode is to support security authentication and require encrypted communication, the associated security function may include: one of XOR two-way authentication, XOR one-way authentication, or symmetric encryption one-way authentication, and one of asymmetric encryption or symmetric encryption.

[0151] Exemplarily, the above-mentioned indication information can be implemented in the form of a bitmap. The indication information can be a string of N bits, the first K bits of which are used to indicate that the business data uses the security mechanism provided by the protocol layer; the last NK bits of the string are used to indicate the specific mechanism used by the business data (i.e., the content of security processing under the security mechanism), N is a positive integer, and K is a positive integer less than N.

[0152] For example, see Figure 6As shown, assuming that the indication information is a 16-bit string, the first 4 bits (i.e., K=4) are used to indicate that the service data uses the security mechanism provided by the protocol layer, and the last 12 bits are used to indicate the specific mechanism (i.e., the content of security processing under the security mechanism). Then, if the indication information indicates that the service data uses the security mechanism of LTE-V2X, the first 4 bits can be 0000; if the indication information indicates that the service data uses the security mechanism provided by the application layer corresponding to ETC, the first 4 bits can be 0001; if the indication information indicates that the service data uses the security mechanism provided by the application layer corresponding to identity management, the first 4 bits can be 0010.

[0153] Accordingly, in one implementation, if the first 4 bits are 0000, the next 12 bits represent from low to high: no encryption and no signature (bit 1), only signature without encryption (bit 2), signature and encryption (bit 3). Among them, if a certain bit is 1, it means that the specific mechanism corresponding to the bit is used, and vice versa, if a certain bit is 0, it means that the specific mechanism corresponding to the bit is not used. It can be understood that if the last 12 bit string is 000000000001, it means that the specific mechanism is no encryption and no signature; if the last 12 bit string is 000000000010, it means that the specific mechanism is only signature without encryption; if the last 12 bit string is 000000000100, it means that the specific mechanism is signature and encryption.

[0154] Alternatively, if the first 4 bits are 0010, then in the following 12 bits: the 11th bit to the 12th bit represent the security mode, wherein 00 indicates that security authentication is not supported, 01 indicates that security authentication is supported, 10 indicates that security authentication is supported but encrypted communication is not required, and 11 indicates that security authentication is supported and encrypted communication is required; the 1st bit to the 7th bit represent the security function, wherein the 1st bit represents that the OBU supports XOR single-item authentication of the RSU, the 2nd bit represents that the OBU supports symmetric encryption single-item authentication of the RSU, the 3rd bit represents that the RSU supports XOR single-item authentication of the OBU, the 4th bit represents that the RSU supports symmetric encryption single-item authentication of the OBU, the 5th bit represents XOR bidirectional authentication, the 6th bit represents symmetric encryption, and the 7th bit represents encrypted communication. Similarly, if a bit from the 1st bit to the 7th bit is 1, it means that the specific security function corresponding to the bit is used, otherwise, if a bit from the 1st bit to the 7th bit is 0, it means that the specific security function corresponding to the bit is not used.

[0155] Of course, the implementation of the indication information is not limited to the above examples. Those skilled in the art can set it according to their own needs, and the embodiments of the present application do not make specific limitations.

[0156] In some possible implementations, before S802, the first device obtains business data (the business data has been securely processed) and corresponding indication information at the message layer. Then, the first device transmits the business data and the corresponding indication information to the network layer at the message layer. Finally, the first device encapsulates the business data and the corresponding indication information in a data frame at the network layer, and sends it to the second device through the access layer. After receiving the data frame, the second device can determine the security mechanism used by the business data based on the indication information in the data frame, and then can perform corresponding security processing on the business data, thereby improving the reliability of V2X end-to-end communication.

[0157] In the specific implementation process, the first device can transfer the service data to the message layer after performing security processing on the service data at the application layer. Then, the first device can determine at the message layer what security mechanism is used to securely process the service data according to the encapsulation format of the service data, and then determine the indication information corresponding to the service data. Alternatively, the first device can transfer the corresponding indication information while transferring the service data from the application layer to the message layer, and then obtain the service data and the corresponding indication information at the message layer.

[0158] In some possible implementations, before S802, the first device can also obtain an application identifier corresponding to the business data at the message layer, and the application identifier is used to indicate the business type corresponding to the business data. Similar to the above-mentioned method of obtaining the indication information, the application identifier can be passed from the first device to the message layer at the application layer, or it can be determined by the first device at the message layer according to the encapsulation format of the business data. The first device can also pass the application identifier while passing the business data and indication information to the network layer at the message layer. Then, the first device can encapsulate the business data, the indication information corresponding to the business data, and the application identifier in a data frame at the network layer, and then send it to the second device through the access layer.

[0159] Next, after S802, S803 is executed, and the second device parses the data frame to obtain service data and indication information.

[0160] It can be understood that the second device receives the data frame from the network layer of the first device at the network layer, and then decapsulates the data frame at the network layer to extract the service data and indication information from the data frame. Then, the second device transmits the service data and indication information to the message layer at the network layer.

[0161] In some possible implementations, if the data frame also carries an application identifier corresponding to the service data, the second device can also extract the application identifier when decapsulating the data frame at the network layer. Then, the second device can also pass the application identifier corresponding to the service data to the message layer at the network layer to indicate the service type corresponding to the service data.

[0162] S804: The second device securely processes the business data according to the security mechanism indicated by the instruction information.

[0163] It can be understood that the second device receives the service data and indication information transmitted by the network layer at the message layer. Then, the second device determines the security mechanism used by the service data at the message layer according to the indication of the indication information. Finally, the second device performs security processing on the service data at the message layer according to the security mechanism indicated by the indication information.

[0164] Exemplarily, when the indication information indicates that the business data uses the security mechanism A of LTE-V2X, the second device transmits the business data to the security layer at the message layer, and securely processes the business data in accordance with the security mechanism A at the security layer; or, when the indication information indicates that the business data uses the security mechanism B corresponding to near-field payment, the second device securely processes the business data in accordance with the security mechanism B at the message layer; further, when the indication information indicates that the business data uses the security mechanism C corresponding to identity management, the second device securely processes the business data in accordance with the security mechanism C at the message layer.

[0165] It should be noted that if the application layer supports the security mechanism corresponding to the V2X service, the second device can pass the service data to the application layer at the message layer, so that the second device uses the security mechanism corresponding to the V2X service to securely process the service data at the application layer; if the message layer supports the security mechanism corresponding to the V2X service, the second device can use the security mechanism corresponding to the V2X service at the message layer to securely process the service data.

[0166] In another possible implementation, if the indication information indicates that the service data uses the security mechanism A of V2X and the security mechanism C corresponding to the identity management service, the second device can pass the service data to the security layer at the message layer, so that the security layer first securely processes the service data according to the security mechanism A, and then the second device can pass the processed service data to the message layer at the security layer, and the second device can securely process the service data processed by the security layer again according to the security mechanism C at the message layer.

[0167] At this point, the first device and the second device achieve V2X end-to-end secure communication.

[0168] The above communication method is described below through specific examples.

[0169] Assuming that the first device sends service data of service D to the second device, the above communication method may include:

[0170] In the first step, the first device transmits the service data of service D and corresponding indication information to the message layer at the application layer; wherein the indication information indicates that the service data uses the security mechanism d provided by the application layer service D.

[0171] In the second step, the first device transmits the service data and corresponding indication information to the network layer at the message layer;

[0172] In the third step, the first device encapsulates the service data and the corresponding indication information into a data frame at the network layer;

[0173] In the fourth step, the first device sends a data frame to the second device at the network layer;

[0174] Step 5: The second device extracts the service data and corresponding indication information from the data frame at the network layer;

[0175] Step 6: The second device transmits the service data and corresponding indication information to the message layer at the network layer;

[0176] In step 7, the second device transmits the service data and the corresponding indication information to the application layer at the message layer according to the indication of the indication information;

[0177] In the eighth step, the second device uses the security mechanism d at the application layer to securely process the service data of service D.

[0178] As can be seen from the above, in the embodiment of the present application, the first device indicates to the second device the security mechanism or protocol layer used for secure processing of service data, so that the second device can use the corresponding security mechanism to securely process the service data according to the instruction of the first indication information, thereby reducing the risk of information leakage, thereby improving the security of V2X end-to-end communication. Furthermore, the first device indicates to the second device the security mechanism or protocol layer used for secure processing of service data, so that the second device can use the corresponding security mechanism to securely process the service data according to the instruction of the first indication information, thereby reducing the situation where the first device and the second device cannot communicate due to the use of different security mechanisms, thereby improving the reliability of V2X end-to-end communication.

[0179] Based on the same inventive concept, an embodiment of the present application further provides a communication device, which may be a first device in the Internet of Vehicles or a chip or system on chip in the first device, or a functional module in the first device for implementing the method described in the first aspect or any possible implementation of the first aspect. The communication device may implement the functions performed by the first device in the above aspects or in each possible implementation, and the functions may be implemented by hardware executing corresponding software. The hardware or software includes one or more modules corresponding to the above functions. Fig. 9 This is a schematic diagram of the structure of a communication device in an embodiment of the present application, see Fig. 9As shown, the communication device 900 includes: a processing module 901, used to obtain business data and securely process the business data; a sending module 902, used to send business data and indication information to a second device; wherein the indication information is used to indicate the security mechanism used for secure processing of business data or to indicate the protocol layer for secure processing of business data.

[0180] In some possible implementations, the sending module is further used to send identification information to the second device, where the identification information is used to identify a service type of the service data.

[0181] In some possible implementations, the indication information is also used to indicate content of security processing.

[0182] In some possible implementations, the indication information is an N-bit string, the first K bits of the string are used to indicate the security mechanism used for secure processing of business data; the last NK bits of the string are used to indicate the content of the security processing, N is a positive integer, and K is a positive integer less than N.

[0183] In some possible implementations, the indication information is used to indicate a first security mechanism used for security processing, or to indicate a second security mechanism used for security processing, or to indicate a first security mechanism and a second security mechanism used for security processing; or, the indication information is used to indicate security processing of business data at the application layer, at the security layer, or at both the application layer and the security layer.

[0184] In some possible implementations, the first security mechanism is a V2X-based security mechanism, and the second security mechanism is a security mechanism set for a service type.

[0185] In some possible implementations, when the security mechanism used for security processing is the first security mechanism, the content of security processing includes: no encryption and no signing, only signing without encryption, or signing and encryption.

[0186] In some possible implementations, when the security mechanism used for security processing is a second security mechanism, the content of the security processing includes: a first part and a second part associated with the first part; wherein the first part includes: supporting security authentication, not supporting security authentication, supporting security authentication but not requiring encrypted communication, or supporting security authentication and requiring encrypted communication; the second part includes: asymmetric encryption, symmetric encryption, XOR two-way authentication, XOR one-way authentication, or symmetric encryption one-way authentication.

[0187] In some possible implementations, the sending module is specifically used to send a data frame to the second device, where the data frame includes: a frame header and a valid load; wherein the indication information is carried in the frame header, and the service data is carried in the valid load.

[0188] In some possible implementations, the frame header includes: an extension field and extension field indication information; when the indication information is carried in the extension field, the extension field indication information is used to indicate that the data frame carries the indication information.

[0189] In some possible implementations, the frame header also includes: association indication information, the association indication information is used to indicate whether the indication information is associated with the business data in the payload; when the association indication information takes a true value, the association indication information is used to indicate that the indication information is associated with the business data in the payload; when the association indication information takes a false value, the association indication information is used to indicate that the indication information is not related to the business data in the payload.

[0190] In some possible implementations, the processing module 901 is further used to: transmit business data and indication information to the network layer at the message layer before the sending module 902 sends the data frame to the second device; and encapsulate the business data and indication information into a data frame at the network layer.

[0191] It should be noted that the specific implementation process of the processing module 901 and the sending module 902 can be referred to Figures 5 to 8 For the sake of brevity, the detailed description of the embodiments will not be repeated here.

[0192] The sending module 902 mentioned in the embodiment of the present application may be a sending interface, a sending circuit or a transmitter, etc.; the processing module 901 may be one or more processors.

[0193] Based on the same inventive concept, an embodiment of the present application further provides a communication device, which may be a second device in the Internet of Vehicles or a chip or system on chip in the second device, or a functional module in the second device for implementing the method described in the second aspect or any possible implementation of the second aspect. The communication device may implement the functions performed by the second device in the above aspects or in each possible implementation, and the functions may be implemented by hardware executing corresponding software. The hardware or software includes one or more modules corresponding to the above functions. Fig.10 This is a schematic diagram of the structure of another communication device in the embodiment of the present application, see Fig.10 As shown, the communication device 1000 includes: a receiving module 1001, used to receive business data and indication information from a first device; a processing module 1002, used to securely process the business data according to the indication information; wherein the indication information is used to indicate the security mechanism used for secure processing of the business data or to indicate the protocol layer for secure processing of the business data.

[0194] In some possible implementations, the receiving module 1001 is further configured to receive identification information from the first device, where the identification information is used to identify a service type of the service data.

[0195] In some possible implementations, the indication information is also used to indicate the content of the security processing.

[0196] In some possible implementations, the indication information is an N-bit string, the first K bits of the string are used to indicate the security mechanism used for secure processing of business data; the last NK bits of the string are used to indicate the content of the security processing, N is a positive integer, and K is a positive integer less than N.

[0197] In some possible implementations, the indication information is used to indicate a first security mechanism used for security processing, or to indicate a second security mechanism used for security processing, or to indicate a first security mechanism and a second security mechanism used for security processing; or, the indication information is used to indicate security processing of business data at the application layer, at the security layer, or at both the application layer and the security layer.

[0198] In some possible implementations, the first security mechanism is a V2X-based security mechanism, and the second security mechanism is a security mechanism set for a service type.

[0199] In some possible implementations, when the security mechanism used for security processing is the first security mechanism, the content of security processing includes: no encryption and no signing, only signing without encryption, or signing and encryption.

[0200] In some possible implementations, when the security mechanism used for security processing is a second security mechanism, the content of the security processing includes: a first part and a second part associated with the first part; wherein the first part includes: supporting security authentication, not supporting security authentication, supporting security authentication but not requiring secure communication, or supporting security authentication and requiring secure communication; the second part includes: asymmetric encryption, symmetric encryption, XOR two-way authentication, XOR one-way authentication, and symmetric encryption one-way authentication.

[0201] In some possible implementations, the receiving module 1001 is specifically configured to receive a data frame from a first device, where the data frame includes a frame header and a payload; wherein the indication information is carried in the frame header, and the service data is carried in the payload.

[0202] In some possible implementations, the frame header includes: an extension field and extension field indication information; when the indication information is carried in the extension field, the extension field indication information is used to indicate that the data frame carries the indication information.

[0203] In some possible implementations, the frame header also includes: association indication information, the association indication information is used to indicate whether the indication information is associated with the business data in the payload; when the association indication information takes a true value, the association indication information is used to indicate that the indication information is associated with the business data in the payload; when the association indication information takes a false value, the association indication information is used to indicate that the indication information is not associated with the business data in the payload.

[0204] In some possible implementations, the processing module 1002 is also used to obtain business data and indication information in the data frame at the network layer after the receiving module receives the data frame from the first device; transmit the business data and indication information to the message layer at the network layer; and perform security processing on the business data at the message layer according to the indication information.

[0205] In some possible implementations, the processing module 1002 is specifically used to: if the protocol layer indicated by the indication information is a security layer, then pass the business data to the security layer at the message layer, and securely process the business data at the security layer; or, if the protocol layer indicated by the indication information is an application layer or a message layer, then securely process the business data at the application layer or the message layer.

[0206] In some possible implementations, the processing module 1002 is specifically used to: if the protocol layer indicated by the indication information is a security layer and an application layer, then pass the business data from the message layer to the security layer; perform secure processing on the business data at the security layer; pass the processed business data from the security layer to the message layer; and perform secure processing on the processed business data at the message layer.

[0207] It should be noted that the specific implementation process of the receiving module 1001 and the processing module 1002 can be referred to Figures 5 to 8 For the sake of brevity, the detailed description of the embodiments will not be repeated here.

[0208] The receiving module 1001 mentioned in the embodiment of the present application may be a receiving interface, a receiving circuit or a receiver, etc.; the processing module 1002 may be one or more processors.

[0209] Based on the same inventive concept, an embodiment of the present application provides a communication device, which may be the first device or the second device described in one or more of the above embodiments. Fig.11 This is a schematic diagram of the structure of a communication device in an embodiment of the present application, see Fig.11 As shown, the communication device 1100 adopts general computer hardware, including a processor 1101 , a memory 1102 , a bus 1103 , an input device 1104 , and an output device 1105 .

[0210] In some possible implementations, the memory 1102 may include computer storage media in the form of volatile and / or non-volatile memory, such as read-only memory and / or random access memory. The memory 1102 may store an operating system, application programs, other program modules, executable code, program data, user data, etc.

[0211] Input device 1104 can be used to input commands and information to the communication device, such as a keyboard or pointing device, such as a mouse, trackball, touch pad, microphone, joystick, game pad, satellite TV antenna, scanner or similar device. These input devices can be connected to processor 1101 via bus 1103.

[0212] The output device 1105 can be used to output information to the communication device. In addition to the monitor, the output device 1105 can also be other peripheral output devices, such as speakers and / or printing devices. These output devices can also be connected to the processor 1101 through the bus 1103.

[0213] The communication device may be connected to a network, such as a local area network (LAN), through the network interface 1106. In a networked environment, the computer-executable instructions stored in the control device may be stored in a remote storage device, rather than being limited to local storage.

[0214] When the processor 1101 in the communication device executes the executable code or application stored in the memory 1102, the communication device executes the communication method on the first device side or the second device side in the above embodiments. The specific execution process refers to the above embodiments and will not be repeated here.

[0215] In addition, the memory 1102 stores the Fig. 9 Computer execution instructions for the functions of the processing module 901 and the sending module 902. Fig. 9 The functions / implementation processes of the processing module 901 and the sending module 902 can be realized by Fig.11 The processor 1101 in the embodiment calls the computer execution instructions stored in the memory 1102 to implement the above-mentioned implementation process and functions.

[0216] Alternatively, the memory 1102 stores information for implementing Fig.10 Computer-executable instructions for the functions of the receiving module 1001 and the processing module 1002. Fig.10 The functions / implementation processes of the receiving module 1001 and the processing module 1002 can be realized by Fig.11 The processor 1101 in the embodiment calls the computer execution instructions stored in the memory 1102 to implement the above-mentioned implementation process and functions.

[0217] Based on the same inventive concept, an embodiment of the present application also provides a computer-readable storage medium, in which instructions are stored; when the instructions are executed on a computer, they are used to execute the communication method on the first device side or the second device side described in one or more of the above embodiments.

[0218] Based on the same inventive concept, an embodiment of the present application also provides a computer program or a computer program product. When the computer program product is executed on a computer, it enables the computer to implement the communication method on the first device side or the second device side described in one or more of the above embodiments.

[0219] Those skilled in the art will appreciate that the functions described in conjunction with the various illustrative logic blocks, modules, and algorithm steps disclosed herein can be implemented in hardware, software, firmware, or any combination thereof. If implemented in software, the functions described in the various illustrative logic blocks, modules, and steps can be stored or transmitted as one or more instructions or codes on a computer-readable medium and executed by a hardware-based processing unit. Computer-readable media may include computer-readable storage media, which corresponds to tangible media, such as data storage media, or includes any communication media that facilitates the transfer of computer programs from one place to another (e.g., according to a communication protocol). In this manner, computer-readable media may generally correspond to (1) non-temporary tangible computer-readable storage media, or (2) communication media, such as signals or carrier waves. Data storage media may be any available media that can be accessed by one or more computers or one or more processors to retrieve instructions, codes, and / or data structures for implementing the techniques described in this application. A computer program product may include computer-readable media.

[0220] As an example and not limitation, such computer-readable storage media may include RAM, ROM, EEPROM, CD-ROM or other optical disk storage, magnetic disk storage or other magnetic storage, flash memory, or any other medium that can be used to store the desired program code in the form of instructions or data structures and can be accessed by a computer. Also, any connection is properly referred to as a computer-readable medium. For example, if instructions are transmitted from a website, server or other remote source using a coaxial cable, fiber optic cable, twisted pair, digital subscriber line (DSL), or wireless technologies such as infrared, radio and microwave, then the coaxial cable, fiber optic cable, twisted pair, DSL, or wireless technologies such as infrared, radio and microwave are included in the definition of media. However, it should be understood that the computer-readable storage media and data storage media do not include connections, carrier waves, signals or other temporary media, but are actually directed to non-temporary tangible storage media. As used herein, disks and optical disks include compact disks (CDs), laser optical disks, optical optical disks, digital versatile disks (DVDs), and Blu-ray disks, where disks typically reproduce data magnetically, while optical disks reproduce data optically using lasers. Combinations of the above should also be included within the scope of computer-readable media.

[0221] Instructions may be executed by one or more processors, such as one or more digital signal processors (DSPs), general purpose microprocessors, application specific integrated circuits (ASICs), field programmable logic arrays (FPGAs), or other equivalent integrated or discrete logic circuits. Thus, the term "processor" as used herein may refer to any of the aforementioned structures or any other structures suitable for implementing the techniques described herein. Additionally, in some aspects, the functions described by the various illustrative logic blocks, modules, and steps described herein may be provided within dedicated hardware and / or software modules configured for encoding and decoding, or incorporated in a combined codec. Moreover, the techniques may be fully implemented in one or more circuits or logic elements.

[0222] The techniques of the present application may be implemented in a variety of described devices or apparatuses, including a wireless handset, an integrated circuit (IC), or a set of ICs (e.g., a chipset). Various components, modules, or units are described in this application to emphasize functional aspects of the devices described for performing the disclosed techniques, but do not necessarily need to be implemented by different hardware units. In fact, as described above, the various units may be combined in a codec hardware unit in conjunction with appropriate software and / or firmware, or provided by interoperating hardware units (including one or more processors as described above).

[0223] In the above embodiments, the description of each embodiment has different emphases. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0224] The above is only an exemplary embodiment of the present application, but the protection scope of the present application is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed in the present application should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A communication method, characterized in that: include: The first device obtains the business data and performs security processing on the business data; The first device sends the service data and indication information to the second device, wherein the indication information is used to indicate a security mechanism used for securely processing the service data, the security mechanism includes a first security mechanism and a second security mechanism, the first security mechanism is a V2X-based security mechanism, the second security mechanism is a security mechanism set for a service type, and the used security mechanism is at least one of the security mechanisms; The first device sends identification information to the second device, where the identification information is used to identify a service type of the service data.

2. The method according to claim 1, characterized in that The indication information is also used to indicate the content of the security processing.

3. The method according to claim 2, characterized in that The indication information is an N-bit string, the first K bits of the string are used to indicate the security mechanism of the security processing; the last NK bits of the string are used to indicate the content of the security processing, N is a positive integer, and K is a positive integer less than N.

4. The method according to claim 1, characterized in that: The indication information is used to indicate the first security mechanism used by the security processing, or to indicate the second security mechanism used by the security processing, or to indicate both the first security mechanism and the second security mechanism used by the security processing.

5. The method according to claim 4, characterized in that When the security mechanism used in the security processing is the first security mechanism, the content of the security processing includes: encryption without signing, signing without encryption, or signing and encryption.

6. The method according to claim 4, characterized in that When the security mechanism used by the security processing is the second security mechanism, the content of the security processing includes: a first part and a second part associated with the first part; Among them, the first part includes: supporting security authentication, not supporting security authentication, supporting security authentication but not requiring encrypted communication, or supporting security authentication and requiring encrypted communication; the second part includes: asymmetric encryption, symmetric encryption, XOR two-way authentication, XOR one-way authentication, or symmetric encryption one-way authentication.

7. The method according to claim 1, characterized in that The first device sending the service data and the indication information to the second device includes: The first device sends a data frame to the second device, wherein the data frame includes: a frame header and a valid payload; wherein the indication information is carried in the frame header, and the service data is carried in the valid payload.

8. The method according to claim 7, characterized in that The frame header includes: an extension field and extension field indication information; when the indication information is carried in the extension field, the extension field indication information is used to indicate that the data frame carries the indication information.

9. The method according to claim 7 or 8, characterized in that: The frame header further includes: association indication information, where the association indication information is used to indicate whether the indication information is associated with the service data in the effective load.

10. A communication method, characterized in that: include: The second device receives the service data and indication information from the first device; The second device receives identification information from the first device, where the identification information is used to identify a service type of the service data; The second device securely processes the service data according to the indication information; Among them, the indication information is used to indicate the security mechanism used for secure processing of the business data, the security mechanism includes a first security mechanism and a second security mechanism, the first security mechanism is a V2X-based security mechanism, the second security mechanism is a security mechanism set for the business type, and the security mechanism used is at least one of the security mechanisms.

11. The method according to claim 10, characterized in that The indication information is also used to indicate the content of the security processing.

12. The method according to claim 10, characterized in that The indication information is used to indicate the first security mechanism used by the security processing, or to indicate the second security mechanism used by the security processing, or to indicate both the first security mechanism and the second security mechanism used by the security processing.

13. The method according to claim 12, characterized in that When the security mechanism used in the security processing is the first security mechanism, the content of the security processing includes: encryption without signing, signing without encryption, or signing and encryption.

14. The method according to claim 12, characterized in that When the security mechanism used by the security processing is the second security mechanism, the content of the security processing includes: a first part and a second part associated with the first part; Among them, the first part includes: supporting security authentication, not supporting security authentication, supporting security authentication but not requiring encrypted communication, or supporting security authentication and requiring encrypted communication; the second part includes: asymmetric encryption, symmetric encryption, XOR two-way authentication, XOR one-way authentication, or symmetric encryption one-way authentication.

15. The method according to claim 10, characterized in that The second device receives service data and indication information from the first device, including: The second device receives a data frame from the first device, wherein the data frame includes: a frame header and a valid payload; wherein the indication information is carried in the frame header, and the service data is carried in the valid payload.

16. The method according to claim 15, characterized in that The frame header includes: an extension field and extension field indication information; when the indication information is carried in the extension field, the extension field indication information is used to indicate that the data frame carries the indication information.

17. The method according to claim 15 or 16, characterized in that The frame header further includes: association indication information, where the association indication information is used to indicate whether the indication information is associated with the service data in the effective load.

18. A communication device, characterized in that: include: A processing module, used to obtain business data and perform security processing on the business data; A sending module, used to send service data and indication information to the second device; The indication information is used to indicate a security mechanism used for securely processing the service data, the security mechanism including a first security mechanism and a second security mechanism, the first security mechanism is a V2X-based security mechanism, the second security mechanism is a security mechanism set for a service type, and the used security mechanism is at least one of the security mechanisms; The sending module is further used to send identification information to the second device, where the identification information is used to identify the service type of the service data.

19. The device according to claim 18, characterized in that The indication information is also used to indicate the content of the security processing.

20. The device according to claim 18, characterized in that The indication information is used to indicate the first security mechanism used by the security processing, or to indicate the second security mechanism used by the security processing, or to indicate both the first security mechanism and the second security mechanism used by the security processing.

21. The device according to claim 20, characterized in that When the security mechanism used in the security processing is the first security mechanism, the content of the security processing includes: no encryption and no signing, only signing without encryption, or signing and encryption.

22. The device according to claim 20, characterized in that When the security mechanism used by the security processing is the second security mechanism, the content of the security processing includes: a first part and a second part associated with the first part; Among them, the first part includes: supporting security authentication, not supporting security authentication, supporting security authentication but not requiring encrypted communication, or supporting security authentication and requiring encrypted communication; the second part includes: asymmetric encryption, symmetric encryption, XOR two-way authentication, XOR one-way authentication, or symmetric encryption one-way authentication.

23. The device according to claim 18, characterized in that The sending module is specifically used to send a data frame to the second device, and the data frame includes: a frame header and a valid load; wherein the indication information is carried in the frame header, and the service data is carried in the valid load.

24. The device according to claim 23, characterized in that The frame header includes: an extension field and extension field indication information; when the indication information is carried in the extension field, the extension field indication information is used to indicate that the data frame carries the indication information.

25. The device according to claim 23 or 24, characterized in that The frame header further includes: association indication information, where the association indication information is used to indicate whether the indication information is associated with the service data in the effective load.

26. A communication device, characterized in that: include: A receiving module, used to receive service data and indication information from the first device; A processing module, used for performing security processing on the business data according to the indication information; The receiving module is further used to receive identification information from the first device, where the identification information is used to identify the service type of the service data; Among them, the indication information is used to indicate the security mechanism used for secure processing of the business data, the security mechanism includes a first security mechanism and a second security mechanism, the first security mechanism is a V2X-based security mechanism, the second security mechanism is a security mechanism set for the business type, and the security mechanism used is at least one of the security mechanisms.

27. The device according to claim 26, characterized in that The indication information is also used to indicate the content of the security processing.

28. The device according to claim 26, characterized in that The indication information is used to indicate the first security mechanism used by the security processing, or to indicate the second security mechanism used by the security processing, or to indicate both the first security mechanism and the second security mechanism used by the security processing.

29. The device according to claim 28, characterized in that When the security mechanism used in the security processing is the first security mechanism, the content of the security processing includes: no encryption and no signing, only signing without encryption, or signing and encryption.

30. The device according to claim 28, characterized in that When the security mechanism used by the security processing is the second security mechanism, the content of the security processing includes: a first part and a second part associated with the first part; Among them, the first part includes: supporting security authentication, not supporting security authentication, supporting security authentication but not requiring secure communication, or supporting security authentication and requiring secure communication; the second part includes: asymmetric encryption, symmetric encryption, XOR two-way authentication, XOR one-way authentication, and symmetric encryption one-way authentication.

31. The device according to claim 26, characterized in that The receiving module is specifically used to receive a data frame from the first device, and the data frame includes: a frame header and a valid load; wherein the indication information is carried in the frame header, and the service data is carried in the valid load.

32. The device according to claim 31, characterized in that The frame header includes: an extension field and extension field indication information; when the indication information is carried in the extension field, the extension field indication information is used to indicate that the data frame carries the indication information.

33. The device according to claim 31 or 32, characterized in that The frame header further includes: association indication information, where the association indication information is used to indicate whether the indication information is associated with the service data in the effective load.

34. A communication device, characterized in that: include: Processor and memory; The processor is coupled to the memory; The processor is used to read and execute instructions in the memory to implement the communication method according to any one of claims 1 to 9.

35. A communication device, characterized in that: include: Processor and memory; The processor is coupled to the memory; The processor is used to read and execute instructions in the memory to implement the communication method according to any one of claims 10 to 17.

36. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores instructions; when the instructions are executed on a computer, the instructions are used to execute the communication method according to any one of claims 1 to 9 and claims 10 to 17.

Images