Service authentication management method, system and automobile based on SOA architecture

Abstract

A service authentication management method, system and automobile based on SOA architecture, wherein the service authentication management objects include the service consumer Client and the service provider Server, and the service authentication management method includes: configuring service security levels corresponding to different service types; configuring authentication granularity based on the service authentication management object; selecting whether to perform service authentication management on the Client and / or the Server based on the service security level; if service authentication management is required, judging whether the Client has access rights and / or whether the Server has access rights based on the authentication granularity. The present invention can perform authorization management on application calls and service access, grant different access rights to different applications, and set SOA interfaces that can only access authorized ones, so as to avoid illegal use and abuse of SOA services and interfaces.

Description

Technical Field

[0001] The present invention belongs to the technical field of automobile service architecture, and specifically relates to a service authentication management method, system and automobile based on SOA architecture. Background Art

[0002] Service-Oriented Architecture (SOA) is a software design and software architecture model that combines different functional units (services) of an application through well-defined interfaces and protocols. Currently, service interactions in the SOA architecture on cars can be dynamically connected. It only requires that the service version (major.minor) information in the offer service and find service messages sent by both parties match during the service discovery process to establish a communication relationship. The consumer can access service instructions and subscribe to related data. This mechanism improves the flexibility of the entire vehicle architecture, and each application can adjust its access to different services based on functional requirements.

[0003] On the other hand, a large number of vehicle services are launched online and gradually opened to upper-layer application calls. Such calls have the characteristics of concurrency, randomness and dynamic scalability. At the same time, with the development of vehicle over-the-air download technology and the improvement of consumer demand, there will be more and more vehicle applications.

[0004] Based on the above factors, if service access rights are not controlled or restricted, SOA services and interfaces may be illegally used or abused, and even serious vehicle safety problems may occur, such as the seat suddenly moving during driving, the handbrake being released when parking, and other dangerous situations. Summary of the invention

[0005] In view of the shortcomings of the prior art mentioned above, the purpose of the present invention is to provide a service authentication management method, system and automobile based on SOA architecture, which can perform authorization management on application calls and service access, grant different access rights for different applications, and set up SOA interfaces that can only access authorized ones, so as to avoid illegal use and abuse of SOA services and interfaces.

[0006] To achieve the above purpose, the present invention adopts the following technical solution.

[0007] The first aspect of the present invention provides a service authentication management method based on SOA architecture, wherein the service authentication management object includes a service consumer Client and a service provider Server, including:

[0008] Configure service security levels corresponding to different service types;

[0009] Configure the authentication granularity based on the service authentication management object;

[0010] Selecting whether to perform service authentication management on the Client and / or the Server based on the service security level;

[0011] If service authentication management is required, it is determined based on the authentication granularity whether the Client has access rights and / or whether the Server has access rights.

[0012] As an implementation mode of the present invention, the configuration corresponds to the service security level of different service types, including:

[0013] Classify services based on the type of service;

[0014] The corresponding service security level is configured based on the service type, and the service security level includes at least a first service security level and a second service security level. The first service security level is that the service does not require authentication, and the second service security level is that the service requires authentication.

[0015] As an implementation mode of the present invention, the configuration is based on the authentication granularity of the authentication information between the service authentication management objects, including:

[0016] Use multiple ClientIDs corresponding to multiple applications as the first type of authentication granularity;

[0017] Multiple source IP+Port corresponding to multiple access sources are used as the second type of authentication granularity.

[0018] As an implementation mode of the present invention, selecting whether to perform service authentication management on the client side and / or the server side based on the service security level includes:

[0019] If the service security level is the first service security level, service authentication management is not performed on the Client side and the Server side.

[0020] As an implementation mode of the present invention, selecting whether to perform service authentication management on the client side and / or the server side based on the service security level includes:

[0021] If the service security level is the second service security level, the Client needs to perform service authentication management.

[0022] As an implementation mode of the present invention, if service authentication management is required, judging whether the client end and / or the server end has the right to access or be accessed based on the authentication granularity includes:

[0023] Deploy a service and application permission configuration management table in the ECU where the application is located;

[0024] When the application requests access, if the Client needs to perform service authentication management, the communication service interface is shielded, and it is determined whether the Client has access rights based on the service and application permission configuration management table and the ClientID.

[0025] As an implementation mode of the present invention, if the client has access rights, the client makes a correct response to a legal request; if the client does not have access rights, the client makes a response of no access rights to an illegal request and records the access result.

[0026] As an implementation mode of the present invention, selecting whether to perform service authentication management on the client side and / or the server side based on the service security level includes:

[0027] If the service security level is the second service security level, the server needs to perform service authentication management.

[0028] As an implementation mode of the present invention, a service and application permission configuration management table based on the server is deployed in the cloud or locally.

[0029] As an implementation mode of the present invention, if service authentication management is required, judging whether the client end and / or the server end has the right to access or be accessed based on the authentication granularity includes:

[0030] When the client requests access, if the server needs to perform service authentication management, the ClientID corresponding to this access will be carried in the payload;

[0031] The server determines whether the client has access rights based on the server's service and application permission configuration management table and the ClientID of the application being accessed.

[0032] As an implementation mode of the present invention, if service authentication management is required, judging whether the client end and / or the server end has the right to access or be accessed based on the authentication granularity includes:

[0033] When the server is accepting access, if the server needs to perform service authentication management, it will determine whether the server has the permission to be accessed based on the service and application permission configuration management table based on the server and the source IP+Port of this access.

[0034] As an implementation mode of the present invention, after determining whether the Client has access rights or the Server has access rights, the Server makes a correct response to a legal request; makes a response of no access rights to an illegal request, and records the access result, wherein the legal request includes whether the Client has access rights and whether the Server has access rights, and the illegal request includes whether the Client does not have access rights and the Server does not have access rights.

[0035] The second aspect of the present invention provides a service authentication management system based on SOA architecture, wherein the service authentication management object includes a service consumer Client and a service provider Server, including:

[0036] A first configuration module, at least used to configure service security levels corresponding to different service types;

[0037] A second configuration module is at least used to configure the authentication granularity based on the service authentication management object;

[0038] A selection module, at least used to select whether to perform service authentication management on the Client side and / or the Server side based on the service security level;

[0039] The judgment module is at least used to judge whether the Client has access authority and / or whether the Server has access authority based on the authentication granularity if service authentication management is required.

[0040] A third aspect of the present invention provides a car, on which a client terminal is configured. When the client terminal is working, it is applied to the service authentication management method based on the SOA architecture as described in the first aspect of the present invention.

[0041] A fourth aspect of the present invention provides a readable storage medium storing a computer program, which, when executed by a processor, implements the steps of the service authentication management method based on the SOA architecture as described in the first aspect of the present invention.

[0042] In summary, compared with the prior art, the present invention includes at least one of the following beneficial technical effects:

[0043] 1. The service authentication management method based on SOA architecture proposed in the present invention improves the security of SOA architecture by configuring the permission list, i.e. the corresponding authentication granularity, and setting the access rights according to different service security levels.

[0044] 2. The present invention deploys and updates the permission configuration management table. The server side verifies and records the visitor and the upper-layer application, and the client side verifies and records the access to the upper-layer application, thereby achieving the purpose of respectively controlling the access rights of the service consumer client and the service provider server. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For those skilled in the art, other drawings can be obtained based on these drawings without creative work.

[0046] Figure 1 It is a flowchart of a service authentication management method based on SOA architecture according to a specific embodiment of the present invention.

[0047] Figure 2 It is a working diagram of an application management module according to a specific embodiment of the present invention.

[0048] Figure 3 It is a working principle diagram of a service authentication management method based on SOA architecture according to a specific embodiment of the present invention.

[0049] Figure 4 It is a module diagram of a service authentication management system based on SOA architecture according to a specific embodiment of the present invention.

[0050] Figure 5 It is a module diagram of another service authentication management system based on SOA architecture according to a specific embodiment of the present invention. DETAILED DESCRIPTION

[0051] The technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present application. In addition, it should be understood that the specific implementation methods described herein are only used to illustrate and explain the present application, and are not used to limit the present application.

[0052] It should be noted that the description order of the following embodiments is not intended to limit the preferred order of the embodiments of the present application. In addition, in the following embodiments, the description of each embodiment has its own emphasis, and for parts not described in detail in one embodiment, reference can be made to the relevant description of other embodiments.

[0053] like Figure 1As shown, the first aspect of the present invention provides a service authentication management method based on SOA architecture, by classifying the authentication implementers, the service authentication management objects include the service consumer Client and the service provider Server, wherein the service authentication management method includes the following steps.

[0054] Step S1: configure service security levels corresponding to different service types;

[0055] Specifically, service types can be divided according to actual access requirements. Due to different service types, the required security levels are also different. For example, for the service of accessing the vehicle speed status, since the vehicle speed information itself will be displayed on the dashboard, the vehicle speed itself can be understood as public information. This service can be divided into a type with weak access requirements or no access requirements, that is, a service type that does not require authentication. For example, the operation of seat adjustment may involve seat adjustment during high-speed driving. If the seat adjustment is performed directly, driving hazards may occur. This service can be classified as a type with high access requirements, that is, a service type that requires authentication.

[0056] Step S2: configuring the authentication granularity based on the service authentication management object;

[0057] Specifically, the authentication granularity needs to express the uniqueness of the service authentication management object and the service authentication management objects in the service authentication process. Therefore, it is necessary to set information that expresses special characteristic identities, such as the unique ID that identifies the client, the port number used to identify the sender in network communication, etc.

[0058] Step S3: selecting whether to perform service authentication management on the Client and / or the Server based on the service security level;

[0059] Specifically, the service security level classification standard described in step S1 can be used to perform service authentication management based on the authentication path of the service authentication management object.

[0060] Step S4: If service authentication management is required, determine whether the Client has access rights and / or whether the Server has access rights based on the authentication granularity.

[0061] Here, the configuration results generated by steps S1 and S2 of the present invention can be used to deploy and update the service and application permission configuration management table to configure the corresponding service authentication management object, as well as its corresponding service security level and corresponding authentication granularity on the service and application permission configuration management table, thereby improving the architecture security by setting access rights and providing indexes for the service authentication management process.

[0062] In one embodiment of the present application, the configuration corresponds to the service security level of different service types, including:

[0063] Classify services based on the type of service;

[0064] The corresponding service security level is configured based on the service type, and the service security level includes at least a first service security level and a second service security level. The first service security level is that the service does not require authentication, and the second service security level is that the service requires authentication.

[0065] Specifically, for example, the service of accessing the vehicle speed status has a service type with weak or no access requirements, that is, a service type that does not require authentication, and can be configured as the first service security level; for example, the service type of seat adjustment operation can be classified as a service type with high access requirements, that is, a service type that requires authentication, and can be configured as the second service security level. When configured as the first service security level, service authentication management is not required.

[0066] Specifically, the service interface includes instruction interface and event interface. The instruction interface in the service interface needs to pass authentication before it is allowed to be called or called; the event interface needs to pass authentication before it is allowed to subscribe or be subscribed. Whether the service can be accessed is determined by whether the interface in the service is called or subscribed. By configuring service security levels corresponding to different service types, the authentication efficiency can be improved while ensuring the security of the SOA architecture.

[0067] In one embodiment of the present application, the configuration is based on the authentication granularity of authentication information between service authentication management objects, including:

[0068] Using multiple ClientIDs corresponding to multiple applications as the first type of authentication granularity, the multiple applications are upper-layer applications, and by setting the first authentication granularity, different access rights can be authorized for different applications;

[0069] There are multiple access sources between the client and the server, and multiple source IP+Port corresponding to the multiple access sources are used as the second type of authentication granularity. By setting the second type of authentication granularity, service access rights can be set for the client or the service access rights can be set for the server.

[0070] The authentication granularity is unique, expressing the unique confirmation principle for the upper-layer application ID and the access source IP. By configuring a sound granularity, it is possible to provide the client with a verification standard for access verification to the upper-layer application, and it is also possible to provide the server with a verification standard for access verification to the service. This helps when the client and the server need to perform service authentication management, and assists them in completing the corresponding application call and service access authorization management work.

[0071] like Figure 2 and Figure 3 As shown, in one embodiment of the present invention, if service authentication management is required, judging whether the client end and / or the server end has the right to access or be accessed based on the authentication granularity includes:

[0072] Deploy a service and application authority configuration management table based on the client in the ECU where the application is located; an application management module, the application management module includes a new service interface and shields the original service interface;

[0073] When the application requests access, if the Client needs to perform service authentication management, the communication service interface is shielded, and it is determined whether the Client has access rights based on the service and application permission configuration management table and ClientID of the Client.

[0074] Specifically, the client side deploys an application management module in the ECU where the application is located and shields the original service interface provided by the communication layer module in the ECU. The application management module has a new service interface to replace the shielded original service interface. In this way, the application is not allowed to directly call the original service interface, but calls the interface through the application management module. Therefore, authentication of the first service security level with the application's ClientID as the authentication granularity can be implemented on the Client side.

[0075] Furthermore, Table 1 shows a client-based service and application permission configuration management table, which can maintain the client-side permission configuration management of related services and applications locally or in the cloud.

[0076] Table 1

[0077] Case No. Access Check Enable Service ID Instance ID Allowed ClientID Comment 1 Y 12 1 0x0001 0x0022 0x0033 To authenticate, requests that satisfy the ClientID can be made through 2 Y 12 2 0x0033 To authenticate, requests that satisfy the ClientID can be made through 3 N 12 3 0x0056 No authentication is done, all requests are allowed 4 Y 13 1 None Do authentication, all requests cannot pass 5 N 13 2 None No authentication is done, all requests are allowed

[0078] Among them, case No. indicates the sequence number used for arrangement, Access Check Enable is consistent with the service security level, N indicates the first-level service security level, that is, no authentication management is performed, Y indicates the second-level service security level, that is, authentication management is performed, Service ID indicates that each service needs to be assigned an ID number, and Service ID and Instance ID together form a group of numbers, which represent the information in the car to be conveyed. On the basis that Access Check Enable is Y, authentication is performed through AllowedClientID, and requests that meet the ClientID are allowed; on the basis that Access Check Enable is Y, no authentication is performed, and all requests are allowed.

[0079] In one embodiment of the present invention, if the Client has access rights, the Client makes a correct response to a legal request; if the Client does not have access rights, the Client makes a response of no access rights to an illegal request and records the access result. In this way, different access rights are granted to different applications, and only authorized SOA interfaces can be accessed, thereby preventing SOA services and interfaces from being illegally used or abused.

[0080] like Figure 3 As shown, in one embodiment of the present invention, whether to perform service authentication management on the Client and / or the Server based on the service security level includes:

[0081] If the service security level is the second service security level, the server needs to perform service authentication management.

[0082] Specifically, when the Client subscribes to a service message or calls a service instruction, the Server needs to perform service authentication management to determine whether the application has access rights; or when the Server receives an access request, the Server needs to perform service authentication management to determine whether the access source has access rights.

[0083] In one embodiment of the present invention, if service authentication management is required, judging whether the client end and / or the server end has the right to access or be accessed based on the authentication granularity includes:

[0084] When the client requests access, if the server needs to perform service authentication management, the ClientID corresponding to this access will be carried in the payload;

[0085] The server determines whether the client has access rights based on the ClientID of the application being accessed.

[0086] Specifically, Table 2 shows the first service and application permission configuration management table based on the server side. The permission configuration management of related services and applications can be maintained locally or in the cloud, and the specific access rights can be indexed in combination with the first service and application permission configuration management table.

[0087] Table 2

[0088] Case No. Access Check Enable Service ID Instance ID Allowed ClientID Comment 1 Y 12 1 0x0001 0x0022 0x0033 To authenticate, requests that satisfy the ClientID can be made through 2 Y 12 2 0x0033 To authenticate, requests that satisfy the ClientID can be made through 3 N 12 3 0x0056 No authentication is done, all requests are allowed 4 Y 13 1 None Do authentication, all requests cannot pass 5 N 13 2 None No authentication is done, all requests are allowed

[0089] Among them, case No. indicates the sequence number used for arrangement, Access Check Enable is consistent with the service security level, N indicates the first-level service security level, that is, no authentication is performed, Y indicates the second-level service security level, that is, authentication is performed, Service ID indicates that each service needs to be assigned an ID number, and Service ID and Instance ID together form a group of numbers, which represent the information in the car to be conveyed. On the basis that Access Check Enable is Y, authentication is performed through AllowedClientID, and requests that meet the ClientID are allowed; on the basis that Access Check Enable is Y, no authentication is performed, and all requests are allowed.

[0090] When the client subscribes to a message or calls a service instruction, it will carry its ClientID in the payload. When the server receives the request, it needs to determine whether the application has access rights to the service based on Table 2 and the ClientID in the payload, that is, whether the server has access rights.

[0091] In one embodiment of the present invention, if service authentication management is required, judging whether the client end and / or the server end has the right to access or be accessed based on the authentication granularity also includes:

[0092] When the server is receiving access, if the server needs to perform service authentication management, it will determine whether the server has the permission to be accessed based on the source IP+Port of this access.

[0093] Specifically, Table 3 shows the second service and application permission configuration management table based on the server side, which can maintain the permission configuration management of related services and applications locally or in the cloud. Combined with the second service and application permission configuration management table, specific access rights can be indexed.

[0094] Table 3

[0095] Case No. Access Check Enable Service ID Instance ID Allowed Remote IP:Port Comment 1 Y 12 1 172.31.3.48:55567172.31.3.49:55567172.31.3.50:55567 To do authentication, requests that meet IP+Port requirements can be passed 2 Y 12 2 172.31.3.51:55567 To do authentication, requests that meet IP+Port requirements can be passed 3 N 12 3 172.31.3.51:55567 No authentication is done, all requests are allowed 4 Y 13 1 None Do authentication, all requests cannot pass 5 N 13 2 None No authentication is done, all requests are allowed

[0096] Among them, case No. indicates the sequence number used for arrangement, Access Check Enable is consistent with the service security level, N indicates the first-level service security level, that is, no authentication is performed, Y indicates the second-level service security level, that is, authentication is performed, Service ID indicates that each service needs to be assigned an ID number, and Service ID and InstanceID together form a group of numbers, which represent the information in the car to be conveyed. On the basis that Access Check Enable is Y, authentication is performed through Allowed Remote IP:Port, and requests that meet IP+Port can be passed; on the basis that AccessCheck Enable is Y, no authentication is performed, and all requests can be passed.

[0097] When the server receives an access request, it needs to determine whether the source IP+port of this access has the permission to access the service, that is, whether the server has the permission to be accessed.

[0098] In one embodiment of the present invention, after determining that the client has access rights or the server has access rights, the server makes a correct response to the legitimate request;

[0099] A reply of no access right is made to illegal requests, and the access result is recorded. The legal request includes whether the client has access right and the server has access right. The illegal request includes whether the client does not have access right and the server does not have access right.

[0100] The present invention can meet the requirement that existing methods cannot impose permission restrictions on service message subscriptions and instruction calls, has little impact on changes to existing interfaces, can perform authorization management on application calls and service access, and authorize different access rights for different applications.

[0101] In one embodiment of the present invention, a permission configuration management table for related services and applications is maintained locally or in the cloud, including:

[0102] i. Static one-time configuration

[0103] The node where the server or client is located maintains the service and application permission configuration management table locally. The table content is written into the compiled code and can only be updated through OTA or local flashing.

[0104] ii. Local update on the vehicle

[0105] The node where the Server or Client is located maintains the service and application permission configuration management table locally. However, this table supports read and write. When an update is required, you can apply to the vehicle end to change the permission and change the table content.

[0106] iii. Update in the cloud and synchronize to the vehicle

[0107] The cloud maintains the service and application permission configuration management table, which is synchronized to the vehicle in real time. When an update is required, you can apply to the cloud to change the permission. After changing the table content, it will be transmitted to the vehicle through vehicle-cloud synchronization.

[0108] This method can be used to implement updates and maintenance based on the permission configuration table, which can avoid the problem that the existing method cannot timely update permission restriction requests for service message subscriptions and instruction calls. It also supports dynamic updates of the permission configuration table and dynamic expansion, making the service authentication management process smoother.

[0109] The service authentication management method based on SOA architecture proposed in the present invention sets access rights by configuring a permission list, i.e., the corresponding authentication granularity, according to different service security levels, thereby improving the security of SOA architecture. The method in the technical solution also includes deploying and updating the service and application permission configuration management table, and the server side verifies and records the visitor and the upper-layer application, and the client side verifies and records the access to the upper-layer application, thereby achieving the purpose of respectively controlling access rights for the service consumer client and the service provider server.

[0110] like Figure 4 and Figure 5 As shown, the second aspect of the present invention provides a service authentication management system based on SOA architecture, and the service authentication management object includes a service consumer Client and a service provider Server, including:

[0111] A first configuration module, at least used to configure service security levels corresponding to different service types;

[0112] A second configuration module is at least used to configure the authentication granularity based on the service authentication management object;

[0113] A selection module, at least used to select whether to perform service authentication management on the Client side and / or the Server side based on the service security level;

[0114] The judgment module is at least used to judge whether the Client has access authority and / or whether the Server has access authority based on the authentication granularity if service authentication management is required.

[0115] Specifically, the selection module includes a client-side selection module and a server-side selection module. The client-side selection module is used to select service authentication management to be performed on the client side, and the server-side selection module is used to select service authentication management to be performed on the server side.

[0116] Specifically, the judgment module includes an ECU deployment module, a Client-side judgment module and a Server-side judgment module;

[0117] The ECU deploys an application management module, wherein the application management module includes a new service interface;

[0118] The client-side judgment module is used for judging whether the client has access rights based on the ClientID corresponding to the application when the client-side selection module selects to perform service authentication management on the client side and when the application requests access;

[0119] The server-side judgment module is used when the server needs to perform service authentication management. When the client requests access, the ClientID corresponding to this access will be carried in the payload. The server determines whether the client has access rights based on the ClientID of the access application; and / or when the server accepts access, it determines whether the server has access rights based on the source IP+Port of this access.

[0120] Specifically, the service authentication management based on the SOA architecture also includes a permission configuration management table maintenance module, which is at least used to deploy and update the service and application permission configuration management table in the cloud or locally, so as to configure the corresponding service authentication management object, and its corresponding service security level and corresponding authentication granularity on the service and application permission configuration management table, set access rights through the service and application permission configuration management table and provide an index for the service authentication management process;

[0121] Specifically, the service authentication management based on the SOA architecture also includes an access record module, which is used to make a correct response to a legal request, make a response of no access rights to an illegal request, and record the access result.

[0122] The service authentication management system based on SOA architecture proposed in the present invention sets access rights by configuring permission lists, i.e., corresponding authentication granularity, according to different service security levels, thereby improving the security of SOA architecture. The technical solution also includes the deployment and update of service and application permission configuration management tables, the server side verifies and records visitors and upper-layer applications, and the client side verifies and records access to upper-layer applications, thereby achieving the purpose of respectively controlling access rights for the service consumer client side and the service provider server side.

[0123] A third aspect of the present invention provides a car, on which a client terminal is configured. When the client terminal is working, it is applied to the service authentication management method based on the SOA architecture as described in any one of the above embodiments.

[0124] This method can improve the flexibility of the entire vehicle architecture while supporting authentication issues in more and more scenarios as vehicles are OTA-ed. It can also manage access rights to services, ensure vehicle safety, and avoid dangerous situations such as sudden movement of seats during driving and release of the handbrake when parking.

[0125] The fourth aspect of the present invention discloses a readable storage medium, which stores a computer program, and when the computer program is executed by a processor, the steps of the service authentication management method based on the SOA architecture described in the above embodiment are implemented. The computer-readable storage medium may include: any entity or device capable of carrying a computer program, a recording medium, a U disk, a mobile hard disk, a magnetic disk, an optical disk, a computer memory, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), and a software distribution medium, etc. The computer program includes a computer program code. The computer program code may be in source code form, object code form, an executable file, or some intermediate form, etc. The computer-readable storage medium may include: any entity or device capable of carrying a computer program code, a recording medium, a U disk, a mobile hard disk, a magnetic disk, an optical disk, a computer memory, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), and a software distribution medium, etc.

[0126] Any process or method description in a flowchart or otherwise described herein may be understood to represent a module, segment or portion of code that includes one or more executable instructions for implementing the steps of a specific logical function or process, and the scope of the preferred embodiments of the present invention includes alternative implementations in which functions may not be performed in the order shown or discussed, including performing functions in a substantially simultaneous manner or in the reverse order depending on the functions involved, which should be understood by those skilled in the art to which the embodiments of the present invention belong.

[0127] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing logical functions, which can be embodied in any computer-readable medium for use by an instruction execution system, apparatus or device (such as a computer-based system, a system including a processing module or other system that can fetch instructions from an instruction execution system, apparatus or device and execute instructions), or used in combination with these instruction execution systems, apparatuses or devices.

[0128] The above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit the same. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A service authentication management method based on SOA architecture, wherein the service authentication management object includes the service consumer Client and the service provider Server, and is characterized in that: include: Configure service security levels corresponding to different service types; Configure the authentication granularity based on the service authentication management object, wherein multiple ClientIDs corresponding to multiple applications are used as the first type of authentication granularity; there are multiple access sources between the client and the server, and multiple source IP+Ports corresponding to the multiple access sources are used as the second type of authentication granularity; Selecting whether to perform service authentication management on the Client and / or the Server based on the service security level; If service authentication management is required, judging whether the client has access rights and / or whether the server has access rights based on the authentication granularity, including: deploying a service and application rights configuration management table based on the client in the ECU where the application is located; when the application requests access, if the client needs service authentication management, shielding the communication service interface, judging whether the client has access rights based on the service and application rights configuration management table and ClientID of the client; When the client requests access, if the server needs to perform service authentication management, the client ID corresponding to this access will be carried in the payload; the server determines whether the client has access rights based on the first service and application permission configuration management table of the server and the client ID of the application being accessed this time; When the server is accepting access, if the server needs to perform service authentication management, it will determine whether the server has the permission to be accessed based on the second service and application permission configuration management table based on the server and the source IP+Port of this access.

2. The service authentication management method based on SOA architecture according to claim 1 is characterized in that: The configurations correspond to service security levels for different service types, including: Classify services based on the type of service; The corresponding service security level is configured based on the service type, and the service security level includes at least a first service security level and a second service security level. The first service security level is that the service does not require authentication, and the second service security level is that the service requires authentication.

3. The service authentication management method based on SOA architecture according to claim 2 is characterized in that: Selecting whether to perform service authentication management on the client side and / or the server side based on the service security level includes: If the service security level is the first service security level, service authentication management is not performed on the Client side and the Server side.

4. The service authentication management method based on SOA architecture according to claim 1 is characterized in that: Selecting whether to perform service authentication management on the client side and / or the server side based on the service security level includes: If the service security level is the second service security level, the Client needs to perform service authentication management.

5. The service authentication management method based on SOA architecture according to claim 4 is characterized in that: After the client determines whether the client has access rights, if the client has access rights, the client makes a correct response to the legal request; If the client does not have access rights, the client responds to the illegal request with a no-access-rights response and records the access result.

6. The service authentication management method based on SOA architecture according to claim 1 is characterized in that: Selecting whether to perform service authentication management on the client side and / or the server side based on the service security level includes: If the service security level is the second service security level, the server needs to perform service authentication management.

7. The service authentication management method based on SOA architecture according to claim 6 is characterized in that: Deploy the service and application permission configuration management table based on the server side in the cloud or locally.

8. The service authentication management method based on SOA architecture according to claim 6 is characterized in that: After the server determines that the client has access rights or the server has access rights, the server makes a correct response to a legal request; the server responds with a lack of access rights to an illegal request and records the access result.

9. A service authentication management system based on SOA architecture, wherein the service authentication management objects include the service consumer Client and the service provider Server, characterized in that: include: A first configuration module, at least used to configure service security levels corresponding to different service types; The second configuration module is at least used to configure the authentication granularity based on the service authentication management object, wherein multiple ClientIDs corresponding to multiple applications are used as the first type of authentication granularity; there are multiple access sources between the client and the server, and multiple source IP+Ports corresponding to the multiple access sources are used as the second type of authentication granularity; A selection module, at least used to select whether to perform service authentication management on the Client side and / or the Server side based on the service security level; The judgment module is at least used to judge whether the Client has access rights and / or whether the Server has access rights based on the authentication granularity if service authentication management is required, including: deploying a service and application permission configuration management table based on the Client in the ECU where the application is located; when the application requests access, if the Client needs to perform service authentication management, shielding the communication service interface, and judging whether the Client has access rights based on the service and application permission configuration management table and ClientID of the Client; When the client requests access, if the server needs to perform service authentication management, the client ID corresponding to this access will be carried in the payload; the server determines whether the client has access rights based on the first service and application permission configuration management table of the server and the client ID of the application being accessed this time; When the server is accepting access, if the server needs to perform service authentication management, it will determine whether the server has the permission to be accessed based on the second service and application permission configuration management table based on the server and the source IP+Port of this access.

10. A vehicle, on which a client terminal is configured, characterized in that: When the Client is working, it is applied to the service authentication management method based on SOA architecture as described in any one of claims 1-8.

11. A readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the steps of the service authentication management method based on the SOA architecture are implemented as described in any one of claims 1 to 8.

Images