Data processing method, device and electronic equipment

Abstract

The present invention discloses a data processing method, device and electronic device. The method comprises: receiving target data sent by a second terminal, wherein the target data comprises target original data and target signature data, the target signature data is data obtained after signing the target original data according to a target private key, and the target private key is stored in a security chip of the second terminal; according to the target original data, obtaining a target public key corresponding to the target private key, verifying the target signature data according to the target public key, and obtaining a first verification result; when the first verification result is a verification pass, sending the target original data to an application layer corresponding to the first terminal to perform an operation corresponding to the target original data. The present invention solves the technical problem that the overall security process of V2X is set in the related art, and the existing local settings are imperfect, resulting in low security.

Description

Technical Field

[0001] The present invention relates to the field of autonomous driving, and in particular to a data processing method, device and electronic equipment. Background Art

[0002] In various data interaction scenarios, such as C-V2X (Internet of Vehicles) application scenarios, the vehicle OBU (onboard unit) implements the encapsulation, parsing and management of V2X messages through the V2X protocol stack. At present, in order to ensure the security and reliability of V2X communication, the V2X protocol stack adds a security layer on the traditional basis, which can be divided into application layer, security layer, network layer and access layer from top to bottom according to function. In the related technology, the overall security process of V2X is set, and the existing local settings are imperfect, resulting in technical problems with low security.

[0003] To address the above-mentioned problems, no effective solution has been proposed yet. Summary of the invention

[0004] The embodiments of the present invention provide a data processing method, device and electronic device to at least solve the technical problem that the overall security process of V2X is set in the related art, and the local settings are imperfect, resulting in low security.

[0005] According to one aspect of an embodiment of the present invention, there is provided a data processing method, which is applied to a security layer corresponding to a first terminal, and includes: receiving target data sent by a second terminal, wherein the target data includes target original data and target signature data, and the target signature data is data obtained by signing the target original data according to a target private key, and the target private key is stored in a security chip of the second terminal; based on the target original data, obtaining a target public key corresponding to the target private key, and verifying the target signature data according to the target public key to obtain a first verification result; when the first verification result is verification passed, sending the target original data to an application layer corresponding to the first terminal to perform an operation corresponding to the target original data.

[0006] Optionally, based on the target original data, a target public key corresponding to the target private key is obtained, including: when the target data also includes a target security certificate, based on the target security certificate, determining the public key of the third-party certification authority; verifying the target security certificate based on the public key of the third-party certification authority to obtain a second verification result; when the second verification result is verification passed, obtaining the target public key corresponding to the target private key.

[0007] According to one aspect of an embodiment of the present invention, there is provided a data processing method, which is applied to a security layer corresponding to a second terminal, and includes: obtaining target original data and a target private key, wherein the target private key is stored in a security chip of the second terminal; signing the target original data according to the target private key to obtain target signature data; obtaining target data, wherein the target data includes the target signature data and the target original data; sending the target data to a first terminal, so that the first terminal obtains a target public key corresponding to the target private key according to the target original data, and verifies the target signature data according to the target public key to obtain a first verification result.

[0008] Optionally, the acquiring target data includes: acquiring a target security certificate; acquiring target data, wherein the target data includes the target signature data, the target original data and the target security certificate.

[0009] Optionally, the acquiring the target security certificate further includes: determining a certificate status of the security certificate; and acquiring the target security certificate when the certificate status is certificate missing and / or certificate expired.

[0010] Optionally, obtaining the target security certificate also includes: obtaining security information, wherein the security information includes the second terminal identity information and the target public key; sending the security information to a third-party certification agency; accepting the target security certificate sent by the third-party certification agency, wherein the target security certificate is obtained by the third-party certification agency based on the third-party certification agency private key and the security information.

[0011] According to one aspect of an embodiment of the present invention, there is provided a data processing device, which is applied to a security layer corresponding to a first terminal, and includes: a receiving module, which is used to receive target data sent by a second terminal, wherein the target data includes target original data and target signature data, and the target signature data is data obtained by signing the target original data according to a target private key, and the target private key is stored in a security chip of the second terminal; a first acquisition module, which is used to acquire a target public key corresponding to the target private key according to the target original data; a verification module, which is used to verify the target signature data according to the target public key to obtain a first verification result; and a first sending module, which is used to send the target original data to an application layer corresponding to the first terminal when the first verification result is verification passed, so as to execute an operation corresponding to the target original data.

[0012] According to one aspect of an embodiment of the present invention, there is provided a data processing device, which is applied to a security layer corresponding to a second terminal, and includes: a second acquisition module, used to acquire target original data and a target private key, wherein the target private key is stored in a security chip of the second terminal; a signature module, used to sign the target original data according to the target private key to obtain target signature data; a third acquisition module, used to acquire target data, wherein the target data includes the target signature data and the target original data; and a second sending module, used to send the target data to a first terminal, so that the first terminal acquires a target public key corresponding to the target private key according to the target original data, and verifies the target signature data according to the target public key to obtain a first verification result.

[0013] According to one aspect of an embodiment of the present invention, there is provided an electronic device, comprising: a processor; and a memory for storing instructions executable by the processor; wherein the processor is configured to execute the instructions to implement any of the above-mentioned data processing methods.

[0014] According to one aspect of an embodiment of the present invention, a computer-readable storage medium is provided. When instructions in the computer-readable storage medium are executed by a processor of an electronic device, the electronic device is enabled to execute any of the above-mentioned data processing methods.

[0015] In an embodiment of the present invention, the target data sent by the second terminal is received at the security layer corresponding to the first terminal, wherein the target data includes target original data and target signature data, and the target signature data is the data obtained after signing the target original data according to the target private key, so as to obtain the target public key corresponding to the target private key according to the target original data, and verify the target signature data according to the target public key to obtain the first verification result. When the first verification result is that the verification is passed, the target original data is sent to the application layer corresponding to the first terminal to perform the operation corresponding to the target original data. Among them, the target private key is stored in the security chip of the second terminal, and the security chip is used to ensure the security of the signature verification, thereby improving the efficiency, reliability and security of the verification. Through the above steps, the protection operation in the security layer is executed, which solves the technical problem of low security caused by the imperfect local settings in the related technology for the overall security process of V2X. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] The drawings described herein are used to provide a further understanding of the present invention and constitute a part of this application. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the drawings:

[0017] Figure 1is a flowchart of a data processing method 1 according to an embodiment of the present invention;

[0018] Figure 2 is a flowchart of a second data processing method according to an embodiment of the present invention;

[0019] Figure 3 It is a module schematic diagram of a V2X protocol stack and a security stack provided in an optional embodiment of the present invention;

[0020] Figure 4 is a method flow chart provided by an optional embodiment of the present invention;

[0021] Figure 5 is a structural block diagram of a data processing device 1 according to an embodiment of the present invention;

[0022] Figure 6 is a structural block diagram of a data processing device 2 according to an embodiment of the present invention. DETAILED DESCRIPTION

[0023] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0024] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0025] First, some nouns or terms that appear in the description of the embodiments of the present application are subject to the following explanations:

[0026] V2X: The so-called V2X is exactly the same as the popular B2B and B2C, which means vehicle to everything, that is, the information exchange between the vehicle and the outside world. The Internet of Vehicles has laid a new direction for the development of automobile technology by integrating global positioning system (GPS) navigation technology, vehicle-to-vehicle communication technology, wireless communication and remote sensing technology, and has achieved the compatibility of manual driving and autonomous driving.

[0027] Security Data Processing Function (SDPF): responsible for handling security operations related to specific applications, that is, generating and processing security messages based on specific Internet of Vehicles application logic.

[0028] Security Credential Management Function SCMF: SCMF is responsible for interacting with the security credential management entity in the Internet of Vehicles to obtain relevant public key certificates, CRLs and other security credentials or data. SCMF needs to interact with SSF to complete operations such as importing and exporting security credentials and data, as well as generating and exporting keys.

[0029] Security Service Function SSF: SSF is located in the connected vehicle device and is responsible for providing storage and cryptographic operations for security credentials and security data. SSF provides security services such as signing, verification, encryption and decryption for connected vehicle devices by generating and processing SPDU.

[0030] Security Protocol Data Unit SPDU: A basic data unit that provides security protection for communication data in the Internet of Vehicles.

[0031] Example 1

[0032] According to an embodiment of the present invention, an embodiment of a data processing method is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0033] Figure 1 is a flow chart of a data processing method 1 according to an embodiment of the present invention. Figure 1 As shown, the method comprises the following steps:

[0034] Step S102, receiving target data sent by the second terminal, wherein the target data includes target original data and target signature data, the target signature data is data obtained by signing the target original data according to the target private key, and the target private key is stored in the security chip of the second terminal;

[0035] Step S104, obtaining a target public key corresponding to a target private key according to the target original data;

[0036] Step S106, verifying the target signature data according to the target public key to obtain a first verification result;

[0037] Step S108, when the first verification result is verification passed, the target original data is sent to the application layer corresponding to the first terminal to perform an operation corresponding to the target original data.

[0038] Through the above steps, for the first terminal side, the target data sent by the second terminal is received through the security layer corresponding to the first terminal, wherein the target data includes the target original data and the target signature data, and the target signature data is the data obtained after signing the target original data according to the target private key, so as to obtain the target public key corresponding to the target private key according to the target original data, and verify the target signature data according to the target public key to obtain the first verification result. When the first verification result is that the verification is passed, the target original data is sent to the application layer corresponding to the first terminal to perform the operation corresponding to the target original data. Among them, the target private key is stored in the security chip of the second terminal, and the security chip is used to ensure the security of the signature verification, thereby improving the efficiency, reliability and security of the verification. Through the above steps, the protection operation in the security layer is executed, which solves the technical problem of low security caused by the imperfect local settings in the related technology for the overall security process of V2X.

[0039] It should be noted that in the C-V2X application scenario, the vehicle OBU (on-board unit) implements the encapsulation, parsing and management of V2X messages through the V2X protocol stack. The V2X protocol stack is divided into four layers: application layer, security layer, network layer and access layer. This application is applied to the security layer in the above-mentioned V2X protocol stack, which solves the technical problem that the overall security process of V2X is set in the related technology, and the existing local settings are imperfect, resulting in low security.

[0040] Among them, the first terminal and the second terminal can be devices involved in the C-V2X scenario, or can be vehicle-side devices, or roadside devices, etc. The first terminal and the second terminal are devices that can interact with each other. The number of the first terminal and the second terminal can be multiple, that is, one terminal device can receive and send multiple data at the same time.

[0041] It should also be noted that the first terminal and the second terminal each have a corresponding key pair, and the terminal includes a security chip that stores the respective key pairs, wherein the key pair is obtained by generating corresponding key factors by the terminal and then performing a derivation operation.

[0042] This application is explained by taking the second terminal sending data to the first terminal as an example. The data interaction between other terminals is the same as the principle of this example and will not be repeated here.

[0043] As an optional embodiment, target data sent by the second terminal is received, wherein the target data includes target original data and target signature data, and the target original data may include some required data and data of the signer, etc. The target signature data is data obtained by signing the target original data according to the target private key, and the target private key is stored in the security chip of the second terminal. By receiving the target data sent by the second terminal, it is possible to verify whether the target original data has been tampered with during the transmission process according to the target signature data, thereby ensuring the security of the transmission.

[0044] As an optional embodiment, a target public key corresponding to a target private key is obtained based on the target original data. Optionally, there are multiple ways to obtain the target public key, which can be carried in the target data or obtained from other platforms storing the target public key, and can be customized according to actual applications and scenarios.

[0045] As an optional embodiment, in order to further enhance the security of the verification process, in the process of obtaining the target public key corresponding to the target private key based on the target original data, it is also possible to check whether the second terminal is safe, and the verification can be performed by means of a target security certificate, and the steps are as follows: when the target data also includes a target security certificate, the public key of a third-party certification authority is determined based on the target security certificate, and the target security certificate is verified based on the public key of the third-party certification authority to obtain a second verification result. When the second verification result is that the verification is passed, that is, the identity is passed and the second terminal is verified to be safe, the target public key corresponding to the target private key is obtained. The processing is performed by obtaining a security certificate, because the certificate is authenticated, the accuracy and security of the verification process can be guaranteed.

[0046] As an optional embodiment, the target signature data is verified according to the target public key to obtain a first verification result, that is, the target signature data can be verified according to the target public key to see whether it is consistent with the target original data. If they are consistent, a first verification result of passing the verification is obtained, and if they are inconsistent, a first verification result of failing the verification is obtained. In the case of inconsistency, it may be that the data transmission process has been tampered with. Therefore, it can effectively prevent data tampering, which may cause system disorder.

[0047] As an optional embodiment, when the first verification result is passed, the target original data is sent to the application layer of the first terminal, completing the protection and verification of the security layer and sending it to the application layer. The application layer then interacts with the access layer, network layer, etc. to perform operations corresponding to the target original data, thereby achieving the purpose of the second terminal sending the target original data and realizing the entire operation process.

[0048] As an optional embodiment, when the first verification result is verification failure, it proves that the received target original data has been tampered with, that is, it is not the target original data sent by the second terminal. In this case, the target original data and the target signature data can be directly deleted to prevent dangerous phenomena such as intrusion that may be caused by processing tampered data.

[0049] Figure 2 is a flow chart of a second data processing method according to embodiment 1 of the present invention. Figure 2 As shown, the method comprises the following steps:

[0050] Step S202, obtaining target original data and a target private key, wherein the target private key is stored in a security chip of the second terminal;

[0051] Step S204, signing the target original data according to the target private key to obtain target signature data;

[0052] Step S206, obtaining target data, wherein the target data includes target signature data and target original data;

[0053] Step S208, sending the target data to the first terminal, so that the first terminal obtains the target public key corresponding to the target private key according to the target original data, and verifies the target signature data according to the target public key to obtain a first verification result.

[0054] Through the above steps, for the second terminal side, the target original data and the target private key are obtained, and the target original data is signed according to the target private key to obtain the target signature data, and the target data including the target original data and the target signature data are sent to the first terminal, so that the first terminal obtains the target public key corresponding to the target private key, and verifies the target signature data according to the target public key to obtain the first verification result, wherein the target private key is stored in the security chip of the second terminal, and the security of the signature verification is guaranteed by the security chip, thereby improving the efficiency, reliability and security of the verification. Through the above steps, the protection operation within the security layer is executed, and the technical problem of low security caused by the imperfect local settings in the related technology for the overall security process of V2X is solved.

[0055] As an optional embodiment, target original data is obtained, wherein the target original data is used to send to the first terminal to realize information interaction between the first terminal and the second terminal. Therefore, the target original data may be interaction data, instruction data, etc. with the first terminal. In addition to interaction data, instruction data, etc., target original data processing may also include signer information data of the signer, so that the first terminal receives and responds to the target original data to realize information interaction between the first terminal and the second terminal.

[0056] As an optional embodiment, when acquiring the target data, the target data may also include a target security certificate to implement the verification operation on the second terminal, for example, it may be implemented by the following steps: acquiring the target security certificate, acquiring the target data including the target signature data, the target original data and the target security certificate. This can better ensure security.

[0057] Optionally, when obtaining the target security certificate, the following method can be used: determine the certificate status of the security certificate, and when the certificate status is normal use, confirm that the security certificate is the target security certificate; when the certificate status is certificate missing and / or certificate expired, obtain the target security certificate. Among them, the target security certificate can verify the identity security of the second terminal. By obtaining the security certificate, because the certificate is authenticated, the accuracy and security of the verification process can be guaranteed.

[0058] As an optional embodiment, the process of obtaining the target security certificate may include the following steps: obtaining security information, wherein the security information includes the identity information of the second terminal and the target public key, so that the third-party certification agency can verify the identity based on the identity information, and the first terminal can obtain the verification by carrying the target public key. After obtaining the security information, the security information is sent to the third-party certification agency, so that the third-party agency obtains the target security certificate based on the third-party certification agency private key and the security information. The security of the process is further guaranteed.

[0059] As an optional embodiment, the target original data is signed according to the target private key to obtain the target signature data. In the process of signing the target original data, the target original data can also be processed by other encryption algorithms to further enhance the security of the data.

[0060] It should be noted that the present application can also separate the security layer and use it as a security stack. The application layer, network layer, and access layer are retained in the V2X protocol stack to perform the operations described in the present application. By deploying an independent, quickly deployable, and flexible calling interface on the security stack, various functions and interactions with the security stack that retains the application layer, network layer, and access layer are realized. Therefore, an optional implementation method is provided. This optional implementation method is described by taking the system of the V2X protocol stack and security stack that retains the application layer, network layer, and access layer as an example. By independently deploying the security stack, the flexibility of the deployment of this system can be enhanced. The following is a detailed description:

[0061] An optional implementation of the present invention provides a security verification method, Figure 3 is a module diagram of a V2X protocol stack and a security stack provided in an optional embodiment of the present invention, such as Figure 3As shown, the security stack module is an improvement made in an optional implementation mode of the present invention, which separates the security layer as a security stack, implements security verification of the security layer, and realizes security services such as identity authentication.

[0062] 1) The V2X protocol stack is divided into three layers from top to bottom: application layer, network layer, and access layer;

[0063] 2) The security stack includes a message module, a certificate management module, and a cryptographic algorithm module.

[0064] It should be noted that the above-mentioned V2X protocol stack and security stack run in the on-board unit (OBU), and a security chip is installed in the OBU. The security chip is used to realize functions such as key generation, storage and cryptographic operations.

[0065] The following is a description of the multiple modules in the security stack:

[0066] Message module: used to implement the security data processing function (SDPF) and provide protocol data (SPDU) construction and verification functions for the upper message layer;

[0067] Certificate management module: used to implement the security credential management function (SCMF), establish a connection with the cloud-based certificate management system, and implement functions such as downloading and managing files such as certificates and certificate destruction lists;

[0068] Cryptographic algorithm module: used to implement the security service function (SSF), interact with the security chip to realize functions such as secure storage and calculation of keys and management of certificates.

[0069] Figure 4 is a flow chart of a method provided by an optional embodiment of the present invention, wherein the improved steps are as follows Figure 4 As shown, the optional implementation manner of the present invention is described in detail below.

[0070] A-side:

[0071] S1, after the security stack is powered on, the private key and public key of end A are stored in the security chip corresponding to end A;

[0072] S2, when the security stack is enabled, calls the security stack signature interface;

[0073] S3, the security stack message module determines the initial target raw data;

[0074] S4, the security stack cryptographic algorithm module uses the private key in the security chip to sign the target original data to obtain the target signature data;

[0075] S5, the security stack message module encapsulates the target original data and the target signature data to obtain a target data packet, and returns the data packet to the protocol stack;

[0076] S6, the protocol stack applies for network layer and access layer services based on the target data packet and sends the target data packet to end B.

[0077] B-side:

[0078] S1, the protocol stack receives the target data packet, and when the security stack is enabled, calls the security stack signature verification interface to send the target data packet to the security stack;

[0079] S2, the security stack message module decapsulates the target data packet to obtain the target original data and target signature data;

[0080] S3, the security stack cryptographic algorithm module obtains the public key corresponding to end A based on the target original data, which can be obtained through the PC certificate (pseudonym certificate);

[0081] S4, the security stack cryptographic algorithm module verifies the target signature data according to the public key, and if the verification is successful, sends the target original data to the protocol stack to perform operations corresponding to the target original data;

[0082] S5, in case of inconsistency, delete the target original data and the target signature data.

[0083] Through the above optional implementation, at least the following beneficial effects can be achieved:

[0084] (1) By implementing key generation, storage, and cryptographic operations based on a security chip, the security of data transmission authentication is increased.

[0085] (2) Provide a universal development interface and a rapidly deployable security module to provide authentication and other security services for V2X communications.

[0086] It should be noted that, for the above-mentioned method embodiments, for the sake of simplicity, they are all described as a series of action combinations, but those skilled in the art should know that the present invention is not limited by the described action sequence, because according to the present invention, certain steps can be performed in other sequences or simultaneously. Secondly, those skilled in the art should also know that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the present invention.

[0087] Through the description of the above implementation methods, those skilled in the art can clearly understand that the method according to the above embodiment can be implemented by means of software plus a necessary general hardware platform, and of course can also be implemented by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, a magnetic disk, or an optical disk), and includes a number of instructions for a terminal device (which can be a mobile phone, a computer, a server, or a network device, etc.) to execute the methods of various embodiments of the present invention.

[0088] Example 2

[0089] According to an embodiment of the present invention, a device for implementing the above data processing method is also provided. Figure 5 is a structural block diagram of a data processing device according to an embodiment of the present invention. Figure 5 As shown, the device includes: a receiving module 502, a first obtaining module 504, a verification module 506 and a first sending module 508. The device is described in detail below.

[0090] The receiving module 502 is used to receive the target original data and the target signature data sent by the second terminal, wherein the target signature data is the data obtained by signing the target original data according to the target private key, and the target private key is stored in the security chip of the second terminal; the first acquisition module 504 is connected to the above-mentioned receiving module 502, and is used to obtain the target public key corresponding to the target private key according to the target original data; the verification module 506 is connected to the above-mentioned first acquisition module 504, and is used to verify the target signature data according to the target public key to obtain a first verification result; the first sending module 508 is connected to the above-mentioned verification module 506, and is used to send the target original data to the application layer corresponding to the first terminal when the first verification result is verification passed, so as to execute the operation corresponding to the target original data.

[0091] It should be noted here that the above-mentioned receiving module 502, the first acquisition module 504, the verification module 506 and the first sending module 508 correspond to steps S102 to S108 in the implementation of the data processing method, and the instances and application scenarios implemented by the multiple modules and the corresponding steps are the same, but are not limited to the contents disclosed in the above-mentioned embodiment 1.

[0092] Example 3

[0093] According to an embodiment of the present invention, a device for implementing the above data processing method is also provided. Figure 6 is a structural block diagram of a data processing device according to an embodiment of the present invention. Figure 6As shown, the device includes: a second acquisition module 602, a signature module 604 and a second sending module 606. The device is described in detail below.

[0094] The second acquisition module 602 is used to obtain the target original data and the target private key; the signature module 604 is connected to the above-mentioned second acquisition module 602, and is used to sign the target original data according to the target private key to obtain the target signature data; the second sending module 606 is connected to the above-mentioned signature module 604, and is used to send the target original data and the target signature data to the first terminal, so that the first terminal obtains the target public key corresponding to the target private key according to the target original data, verifies the target signature data according to the target public key to obtain a first verification result, and the target private key is stored in the security chip of the second terminal.

[0095] It should be noted here that the above-mentioned second acquisition module 602, signature module 604 and second sending module 606 correspond to steps S202 to S206 in the implementation of the data processing method, and the instances and application scenarios implemented by multiple modules and corresponding steps are the same, but are not limited to the contents disclosed in the above-mentioned embodiment 1.

[0096] Example 4

[0097] According to another aspect of an embodiment of the present invention, there is provided an electronic device, comprising: a processor; and a memory for storing instructions executable by the processor, wherein the processor is configured to execute the instructions to implement any one of the above data processing methods.

[0098] Example 5

[0099] According to another aspect of an embodiment of the present invention, a computer-readable storage medium is provided. When instructions in the computer-readable storage medium are executed by a processor of an electronic device, the electronic device can execute any of the above data processing methods.

[0100] The serial numbers of the above embodiments of the present invention are only for description and do not represent the advantages or disadvantages of the embodiments.

[0101] In the above embodiments of the present invention, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0102] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of the units can be a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0103] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0104] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0105] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, magnetic disk or optical disk and other media that can store program codes.

[0106] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principle of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A data processing method, characterized in that: The method is applied to a vehicle-mounted unit, wherein the vehicle-mounted unit includes a security stack and a V2X stack, wherein the security stack includes a security layer, and the V2X stack includes an application layer, a network layer, and an access layer. An independent interface is deployed on the security stack to implement interaction with the V2X stack, and includes: Receive target data sent by the second terminal, wherein the target data includes target original data and target signature data, the target signature data is data obtained by signing the target original data according to a target private key, the target private key is stored in the security chip of the second terminal, the target data also includes a target security certificate, the target security certificate is sent to the second terminal by a third-party certification agency, the third-party certification agency determines the target security certificate according to security information, the security information includes the second terminal identity information and the target public key, and the target security certificate is obtained by the third-party certification agency according to the third-party certification agency private key and the security information; According to the target original data, obtaining a target public key corresponding to the target private key; Verifying the target signature data according to the target public key to obtain a first verification result; When the first verification result is that the verification is passed, sending the target original data to the on-board unit to perform an operation corresponding to the target original data; Wherein, obtaining a target public key corresponding to the target private key according to the target original data includes: In a case where the target data also includes a target security certificate, determining a third-party certification authority public key based on the target security certificate; Verifying the target security certificate according to the public key of the third-party certification authority to obtain a second verification result; When the second verification result is that the verification is passed, a target public key corresponding to the target private key is obtained.

2. A data processing method, characterized in that: The security layer applied to the second terminal includes: Acquire target original data and a target private key, wherein the target private key is stored in a security chip of the second terminal; Signing the target original data according to the target private key to obtain target signature data; Acquire target data, wherein the target data includes the target signature data and the target original data; Send the target data to the on-board unit, so that the on-board unit obtains the target public key corresponding to the target private key according to the target original data, verifies the target signature data according to the target public key to obtain a first verification result, and enables the on-board unit to determine the third-party certification authority public key according to the target security certificate when the target data also includes a target security certificate; verify the target security certificate according to the third-party certification authority public key to obtain a second verification result; when the second verification result is that the verification is passed, obtain the target public key corresponding to the target private key, the on-board unit includes a security stack and a V2X stack, the security stack includes a security layer, the V2X stack includes an application layer, a network layer, and an access layer, and an independent interface is deployed on the security stack to realize interaction with the V2X stack; Wherein, the acquiring target data comprises: acquiring a target security certificate; acquiring target data, wherein the target data comprises the target signature data, the target original data and the target security certificate; Among them, the obtaining of the target security certificate also includes: obtaining security information, wherein the security information includes the second terminal identity information and the target public key; sending the security information to a third-party certification agency; accepting the target security certificate sent by the third-party certification agency, wherein the target security certificate is obtained by the third-party certification agency based on the third-party certification agency private key and the security information.

3. The method according to claim 2, characterized in that The obtaining of the target security certificate further includes: Determining the certificate status of a security certificate; When the certificate status is certificate missing and / or certificate expired, a target security certificate is obtained.

4. A data processing device, characterized in that: The device is located in a vehicle-mounted unit, the vehicle-mounted unit includes a security stack and a V2X stack, the security stack includes a security layer, the V2X stack includes an application layer, a network layer, and an access layer, and an independent interface is deployed on the security stack to implement interaction with the V2X stack, including: A receiving module, used to receive target data sent by the second terminal, wherein the target data includes target original data and target signature data, the target signature data is data obtained by signing the target original data according to a target private key, the target private key is stored in the security chip of the second terminal, the target data also includes a target security certificate, the target security certificate is sent to the second terminal by a third-party certification agency, the third-party certification agency determines the target security certificate according to security information, the security information includes the second terminal identity information, the target public key, and the target security certificate is obtained by the third-party certification agency according to the third-party certification agency private key and the security information; A first acquisition module is used to acquire a target public key corresponding to the target private key according to the target original data. A verification module, used to verify the target signature data according to the target public key to obtain a first verification result; A first sending module, configured to send the target original data to the on-board unit to execute an operation corresponding to the target original data when the first verification result is a passed verification; Among them, the first acquisition module is also used to determine the public key of a third-party certification agency based on the target security certificate when the target data also includes a target security certificate; verify the target security certificate based on the public key of the third-party certification agency to obtain a second verification result; and when the second verification result is that the verification is passed, obtain the target public key corresponding to the target private key.

5. A data processing device, characterized in that: The security layer applied to the second terminal includes: A second acquisition module, used to acquire target original data and a target private key, wherein the target private key is stored in a security chip of the second terminal; A signature module, used to sign the target original data according to the target private key to obtain target signature data; A third acquisition module is used to acquire target data, wherein the target data includes the target signature data and the target original data; a second sending module, used for sending the target data to the on-board unit, so that the on-board unit obtains the target public key corresponding to the target private key according to the target original data, verifies the target signature data according to the target public key to obtain a first verification result, and enables the on-board unit to determine the third-party certification authority public key according to the target security certificate when the target data also includes a target security certificate; verifies the target security certificate according to the third-party certification authority public key to obtain a second verification result; and obtains the target public key corresponding to the target private key when the second verification result is that the verification is passed, the on-board unit includes a security stack and a V2X stack, the security stack includes a security layer, the V2X stack includes an application layer, a network layer, and an access layer, and an independent interface is deployed on the security stack to realize interaction with the V2X stack; Wherein, the third acquisition module is further used to acquire a target security certificate; acquire target data, wherein the target data includes the target signature data, the target original data and the target security certificate; Among them, the second sending module is also used to obtain security information, wherein the security information includes the second terminal identity information and the target public key; send the security information to a third-party certification agency; accept the target security certificate sent by the third-party certification agency, wherein the target security certificate is obtained by the third-party certification agency based on the third-party certification agency private key and the security information.

6. An electronic device, characterized in that: include: processor; a memory for storing instructions executable by the processor; The processor is configured to execute the instructions to implement the data processing method according to any one of claims 1 to 3.

7. A computer-readable storage medium, characterized in that: When the instructions in the computer-readable storage medium are executed by a processor of an electronic device, the electronic device is enabled to execute the data processing method as claimed in any one of claims 1 to 3.

Images