A vehicle networking communication method, system, device and storage medium

Abstract

The present application discloses a vehicle networking communication method, system, device and storage medium, which relates to the field of vehicle networking, including: an initialization module, which is used to issue certificates to unmanned mining trucks and cloud control platforms respectively through a pre-built cryptographic service platform; an authentication request message acquisition module, which is used to encrypt and sign through the vehicle-side OBU of the unmanned mining truck and the certificate information of the cloud control platform using the national secret algorithm to obtain an identity authentication request message; an authentication message acquisition module, which is used to perform vehicle verification and target session key generation through the cloud control platform and based on the certificate information corresponding to the unmanned mining truck and the identity authentication request message to obtain an authentication message; a key negotiation completion module, which is used to decrypt and platform verify through the vehicle-side OBU and the authentication message to obtain the target session key; and a business communication module, which is used to perform business communication through the vehicle-side OBU, the target session key and the cloud control platform. Effectively improve communication efficiency and security.

Description

Technical Field

[0001] The present invention relates to the field of vehicle networking, and in particular to a vehicle networking communication method, system, device and storage medium. Background Art

[0002] At present, in the Internet of Vehicles scenario, the MQTT (Message Queuing Telemetry Transport) protocol or the MQTTS protocol (which is based on the MQTT protocol and encapsulates a layer of encryption protocol based on SSL / TLS (Secure Sockets Layer / Transport Layer Security)) is usually used to transmit the vehicle data of unmanned mining vehicles to the cloud for communication between the mine workshop or between the mining vehicle and the cloud control platform.

[0003] However, the traditional MQTT protocol has anonymous connections that lead to information leakage, unencrypted data transmission that leads to man-in-the-middle attacks, and weak authentication passwords that lead to username and password cracking, which in turn leads to attacks on the entire system. In addition, due to the complex design of the SSL / TLS protocol, it is difficult to fully refer to the RFC (Request For Comments) standards during the implementation process, resulting in many problems in actual applications. There are still many security risks, such as HeartBleed, FREAK (Factoring RSA Export Keys), Sweet32 attacks and other vulnerabilities. These protocol-level vulnerabilities often have a huge impact on communication security. Summary of the invention

[0004] In view of this, the purpose of the present invention is to provide a vehicle network communication method, system, device and storage medium, which can improve communication efficiency and security while ensuring the confidentiality and integrity of data, and avoid malicious behaviors such as data theft, tampering, and replay, as well as the resulting instruction tampering and attack spreading to the cloud. The specific scheme is as follows:

[0005] In a first aspect, the present application provides a vehicle networking communication system, including:

[0006] The initialization module is used to issue certificates to the unmanned mining truck and the cloud control platform through the pre-built cryptographic service platform to complete the corresponding initialization operations;

[0007] The authentication request message acquisition module is used to encrypt and sign the vehicle-side OBU of the unmanned mining truck using the national secret algorithm, the certificate information corresponding to the cloud control platform, and the vehicle number corresponding to the unmanned mining truck to obtain the corresponding identity authentication request message;

[0008] An authentication message acquisition module is used to perform corresponding vehicle verification and target session key generation through the cloud control platform based on the cryptographic service platform, the certificate information corresponding to the unmanned mining card, and the received identity authentication request message to obtain a corresponding authentication message;

[0009] The key negotiation completion module is used to complete the corresponding key negotiation operation through the vehicle-side OBU of the unmanned mining truck and use the received authentication message for decryption and platform verification to obtain the corresponding target session key;

[0010] The business communication module is used to encrypt, report and send business data through the vehicle-side OBU, the target session key and the cloud control platform to complete the corresponding business communication operations.

[0011] Optionally, the initialization module includes:

[0012] The certificate request receiving unit is used to receive the certificate application requests sent by the vehicle-side OBU of the unmanned mining truck and the cloud control platform respectively after initializing itself through the pre-built cryptographic service platform;

[0013] The certificate issuing unit is used to issue corresponding certificate information to the vehicle-side OBU of the unmanned mining truck and the cloud control platform based on the received certificate application requests, so as to complete the initialization operation corresponding to the vehicle-side OBU of the unmanned mining truck and the cloud control platform.

[0014] Optionally, the authentication request message acquisition module includes:

[0015] A random number acquisition unit, used to obtain a corresponding random number through the vehicle-side OBU of the unmanned mining truck and based on a random number generator;

[0016] A first string connection unit is used to connect the vehicle number corresponding to the unmanned mining truck and the string of the random number based on a preset operator after performing a hash operation on the random number based on the SM3 national secret algorithm to obtain a corresponding first connection result;

[0017] The message generation unit is used to perform corresponding encryption, signing, and data assembly based on the certificate information corresponding to the cloud control platform, the SM4 national encryption algorithm, the first connection result, and the local private key to obtain a corresponding identity authentication request message.

[0018] Optionally, the message generating unit includes:

[0019] A first encryption subunit, used to encrypt the first connection result based on the certificate information corresponding to the cloud control platform and the SM4 national encryption algorithm to obtain a corresponding first encryption result;

[0020] A first signature subunit, configured to obtain a hash value of the first connection result by calculation, and sign the hash value of the first connection result based on a local private key and an SM2 national encryption algorithm to obtain a corresponding first signature result;

[0021] The message generation subunit is used to obtain the corresponding identity authentication request message by assembling the first encryption result and the first signature result.

[0022] Optionally, the authentication message acquisition module includes:

[0023] A message receiving unit, used for receiving, through the cloud control platform, an identity authentication request message sent by the vehicle-side OBU of the corresponding unmanned mining truck;

[0024] The vehicle verification unit is used to call the preset vehicle verification interface provided by the password service platform through the cloud control platform to authenticate the vehicle-side OBU to obtain a corresponding identity authentication result;

[0025] A target session key generation unit, configured to, when the identity authentication result indicates that the verification is passed, call the cryptographic service platform through the cloud control platform to complete a corresponding key generation operation and obtain a corresponding target session key;

[0026] A first string connection unit is used to connect the platform number corresponding to itself and the string of the target session key based on a preset operator to obtain a corresponding second connection result;

[0027] The authentication message acquisition unit is used to perform corresponding encryption, signing, and data assembly based on the certificate information corresponding to the unmanned mining card, the SM4 national encryption algorithm, the second connection result, and the local private key to obtain a corresponding authentication message.

[0028] Optionally, the authentication message obtaining unit includes:

[0029] A second encryption subunit is used to encrypt the second connection result based on the certificate information corresponding to the unmanned mining card and the SM4 national encryption algorithm to obtain a corresponding second encryption result;

[0030] A second signature subunit, configured to obtain a hash value of the second connection result by calculation, and sign the hash value of the second connection result based on a local private key and an SM2 national encryption algorithm to obtain a corresponding second signature result;

[0031] The authentication message acquisition subunit is used to obtain the corresponding authentication message by assembling the second encryption result and the second signature result.

[0032] Optionally, the key negotiation completion module includes:

[0033] An authentication message receiving unit, used to receive the authentication message sent by the cloud control platform through the vehicle-side OBU of the unmanned mining truck;

[0034] A message decryption unit, used to decrypt the authentication message based on a local private key to obtain a corresponding decryption result;

[0035] A platform verification unit, configured to authenticate the identity of the cloud control platform by calling a preset platform verification interface provided by the cryptographic service platform and the decryption result, and obtain a corresponding target session key;

[0036] The verification result returning unit is used to encrypt the random number using the target session key when the verification is passed, and return the verification result obtained by encapsulating the encrypted random number to the cloud control platform.

[0037] In a second aspect, the present application provides a vehicle networking communication method, including:

[0038] The pre-built cryptographic service platform is used to issue certificates to the unmanned mining truck and the cloud control platform to complete the corresponding initialization operations;

[0039] Through the vehicle-side OBU of the unmanned mining truck, the corresponding identity authentication request message is obtained by encrypting and signing using the national secret algorithm, the certificate information corresponding to the cloud control platform, and the vehicle number corresponding to the unmanned mining truck;

[0040] Through the cloud control platform, corresponding vehicle verification and target session key generation are performed based on the cryptographic service platform, the certificate information corresponding to the unmanned mining card, and the received identity authentication request message to obtain a corresponding authentication message;

[0041] Through the vehicle-side OBU of the unmanned mining truck, the received authentication message is used for decryption and platform verification to complete the corresponding key negotiation operation and obtain the corresponding target session key;

[0042] Business data encryption, data reporting and data sending are performed through the vehicle-side OBU, the target session key and the cloud control platform to complete the corresponding business communication operations.

[0043] In a third aspect, the present application provides an electronic device, including:

[0044] Memory, used to store computer programs;

[0045] The processor is used to execute the computer program to implement the steps of the aforementioned vehicle network communication method.

[0046] In a fourth aspect, the present application provides a computer-readable storage medium for storing a computer program, which, when executed by a processor, implements the steps of the aforementioned vehicle network communication method.

[0047] It can be seen that in this application, the initialization module is used to issue certificates to the unmanned mining card and the cloud control platform respectively through the pre-built cryptographic service platform to complete the corresponding initialization operation; the authentication request message acquisition module is used to encrypt and sign through the vehicle-side OBU of the unmanned mining card, and use the national secret algorithm, the certificate information corresponding to the cloud control platform, and the vehicle number corresponding to the unmanned mining card to obtain the corresponding identity authentication request message; the authentication message acquisition module is used to perform corresponding vehicle verification and target session key generation through the cloud control platform, and based on the cryptographic service platform, the certificate information corresponding to the unmanned mining card, and the received identity authentication request message to obtain the corresponding authentication message; the key negotiation completion module is used to decrypt and platform verify the received authentication message through the vehicle-side OBU of the unmanned mining card to complete the corresponding key negotiation operation and obtain the corresponding target session key; the business communication module is used to encrypt, report, and send business data through the vehicle-side OBU, the target session key, and the cloud control platform to complete the corresponding business communication operation. That is, before communication is carried out in this application, both parties of communication, the unmanned mining truck and the cloud control platform, will undergo identity authentication. In this way, a two-way authentication and two-pass identity authentication mode is adopted to realize two-way identity authentication between the unmanned mining truck and the cloud control platform, and ensure the identity security between the mining truck and the cloud control platform. At the same time, the negotiation key is completed based on the national secret algorithm and the corresponding certificate information, and communication is carried out based on the negotiated session key after the negotiation is completed. In this way, while improving communication efficiency and security, it can ensure the confidentiality and integrity of the data, and avoid malicious behaviors such as data theft, tampering, and replay, as well as the occurrence of command tampering and attacks spreading to the cloud. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0049] Figure 1 A schematic diagram of the structure of a vehicle networking communication system provided for this application;

[0050] Figure 2 A specific vehicle networking communication process diagram provided for this application;

[0051] Figure 3 A flow chart of a vehicle networking communication method provided by this application;

[0052] Figure 4 A structural diagram of an electronic device provided for this application. DETAILED DESCRIPTION

[0053] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0054] At present, the traditional MQTT protocol has anonymous connections that lead to information leakage, unencrypted data transmission that leads to man-in-the-middle attacks, and weak authentication passwords that lead to username and password blasting, which in turn leads to attacks on the entire system. In addition, due to the complex design of the SSL / TLS protocol, it is difficult to refer to all RFC standards during the implementation process, resulting in many problems in actual applications. There are still many security risks, such as HeartBleed, FREAK, Sweet32 attack vulnerabilities, and these protocol-level vulnerabilities often have a huge impact on communication security. To this end, the present application provides a vehicle networking communication solution that can improve communication efficiency and security while ensuring the confidentiality and integrity of data, and avoid malicious behaviors such as data theft, tampering, and replay, as well as the resulting instruction tampering, attacks spreading to the cloud, and other situations.

[0055] See also Figure 1 As shown, the embodiment of the present application also discloses a vehicle networking communication system, including:

[0056] The initialization module 11 is used to issue certificates to the unmanned mining truck and the cloud control platform respectively through a pre-built cryptographic service platform to complete the corresponding initialization operation.

[0057] Combination Figure 2 As shown, in this embodiment, the system initially consists of a cloud control platform, a communication link, and an unmanned mining card (i.e., an unmanned mining card). The cryptographic operation module (i.e., an on-board unit) embedded in the OBU (i.e., an on-board unit) on the unmanned mining card side is used to Figure 2 The cryptographic module in the cloud control platform provides the national secret cryptographic computing capability for the unmanned mining card, and accesses the unified cryptographic service platform (i.e. the pre-built cryptographic service platform, which includes X509CA, V2XCA, key management system, server cryptographic machine, etc.) in the cloud control platform center to provide cryptographic computing services for the entire system. The entire communication process can be divided into three processes: key initialization, key negotiation, and business security communication.

[0058] Regarding key initialization, the initialization module 11 may include: a certificate request receiving unit, which is used to receive the certificate application requests sent by the vehicle-side OBU of the unmanned mining truck and the cloud control platform respectively after initializing itself through the pre-built cryptographic service platform; a certificate issuing unit, which is used to issue corresponding certificate information to the vehicle-side OBU of the unmanned mining truck and the cloud control platform respectively based on the received certificate application requests, so as to complete the initialization operation corresponding to the vehicle-side OBU of the unmanned mining truck and the cloud control platform. In other words, the key initialization process mainly completes the initialization of the vehicle-side OBU, the cloud control platform, and the cryptographic service platform, and relies on the V2XCA and X509CA of the cryptographic service platform background to complete the application and issuance of the vehicle-side OBU and cloud control platform certificates. Among them, the vehicle-side OBU calls its own cryptographic module to generate a certificate request. After registering through the initialized cryptographic service platform, the cloud control platform generates a request and calls the API (Application Programming Interface) to apply.

[0059] The authentication request message acquisition module 12 is used to encrypt and sign the vehicle-side OBU of the unmanned mining truck using the national secret algorithm, the certificate information corresponding to the cloud control platform, and the vehicle number corresponding to the unmanned mining truck to obtain the corresponding identity authentication request message.

[0060] Specifically, in this embodiment, the authentication request message acquisition module 12 may include: a random number acquisition unit, used to obtain a corresponding random number, R1, through the vehicle-side OBU of the unmanned mining truck and based on a random number generator; a first string connection unit, used to connect the vehicle number (expressed by vid) corresponding to the unmanned mining truck and the string of the random number based on a preset operator after performing a hash operation on the random number based on the SM3 national secret algorithm, to obtain a corresponding first connection result, S1 (S1=vid⊕R1); a message generation unit, used to perform corresponding encryption, signing, and data assembly based on the certificate information corresponding to the cloud control platform, the SM4 national secret algorithm, the first connection result, and the local private key, to obtain a corresponding identity authentication request message.

[0061] Furthermore, in this embodiment, the message generation unit includes: a first encryption subunit, used to encrypt the first connection result based on the certificate information corresponding to the cloud control platform and the SM4 national encryption algorithm to obtain a corresponding first encryption result, ES1; a first signature subunit, used to obtain a hash value (represented by HS1) of the first connection result by calculation, and to sign the hash value of the first connection result based on a local private key and the SM2 national encryption algorithm to obtain a corresponding first signature result; a message generation subunit, used to obtain the corresponding identity authentication request message by assembling the first encryption result and the first signature result.

[0062] The authentication message acquisition module 13 is used to perform corresponding vehicle verification and target session key generation through the cloud control platform based on the cryptographic service platform, the certificate information corresponding to the unmanned mining card and the received identity authentication request message to obtain the corresponding authentication message.

[0063] Specifically, in this embodiment, the authentication message acquisition module 13 may include: a message receiving unit, which is used to receive the identity authentication request message sent by the vehicle-side OBU of the corresponding unmanned mining truck through the cloud control platform; a vehicle verification unit, which is used to call the preset vehicle verification interface provided by the cryptographic service platform through the cloud control platform to authenticate the vehicle-side OBU to obtain a corresponding identity authentication result; a target session key generation unit, which is used to call the cryptographic service platform through the cloud control platform when the identity authentication result indicates that the verification is passed, complete the corresponding key generation operation, and obtain the corresponding target session key, R; a first string connection unit, which is used to connect the platform number corresponding to itself (expressed by cid) and the string of the target session key based on a preset operator to obtain a corresponding second connection result, S2 (S2=cid⊕R); an authentication message acquisition unit, which is used to perform corresponding encryption, signing, and data assembly based on the certificate information corresponding to the unmanned mining truck, the SM4 national secret algorithm, the second connection result, and the local private key to obtain a corresponding authentication message.

[0064] Furthermore, in this embodiment, the authentication message acquisition unit includes: a second encryption subunit, used to encrypt the second connection result based on the certificate information corresponding to the unmanned mining card and the SM4 national encryption algorithm to obtain a corresponding second encryption result, ES2; a second signature subunit, used to obtain the hash value HS2 of the second connection result by calculation, and sign the hash value of the second connection result based on the local private key and the SM2 national encryption algorithm to obtain a corresponding second signature result; an authentication message acquisition subunit, used to assemble the second encryption result and the second signature result to obtain the corresponding authentication message. Figure 2 It can be seen that the encapsulation of the authentication message is completed by the cloud control platform using the cryptographic service platform.

[0065] The key negotiation completion module 14 is used to complete the corresponding key negotiation operation through the vehicle-side OBU of the unmanned mining truck and use the received authentication message to perform decryption and platform verification to obtain the corresponding target session key.

[0066] Specifically, in this embodiment, the key negotiation completion module 14 may include: an authentication message receiving unit, which is used to receive the authentication message sent by the cloud control platform through the vehicle-side OBU of the unmanned mining truck; a message decryption unit, which is used to decrypt the authentication message based on the local private key to obtain a corresponding decryption result, and the decryption result includes cid⊕R. A platform verification unit, which is used to authenticate the cloud control platform by calling the preset platform verification interface provided by the cryptographic service platform and the decryption result, and obtain the corresponding target session key, R; a verification result returning unit, which is used to encrypt a random number using the target session key when the verification is passed, and return the verification result obtained based on the encrypted random number encapsulation to the cloud control platform. Among them, the identity of the cloud control platform is verified by verifying the signature of HS2 obtained by decryption.

[0067] The business communication module 15 is used to encrypt, report and send business data through the vehicle-side OBU, the target session key and the cloud control platform to complete the corresponding business communication operations.

[0068] In this embodiment, after the two communicating parties, the vehicle-side OBU and the cloud control platform, obtain the target session key, they can use the target session key to perform encryption and decryption operations on the service data. The specific encryption and decryption operation process is as follows: Figure 2As shown in the business security communication section, the vehicle-side OBU encrypts the business data based on the target session key, and then reports the encrypted data to the cloud control platform. After that, the cloud control platform decrypts based on the cryptographic service platform to obtain the data in plain text. Then, the business data to be returned is encrypted based on the target session key, and the encrypted data is sent to the vehicle-side OBU so that the vehicle-side OBU can decrypt it after receiving it to complete this communication operation.

[0069] In addition, in order to further improve the security of data in this embodiment, the communication message can be Base64 encoded. Combined with the following Table 1, about the secure communication message:

[0070] Key negotiation message: Base64(id⊕E_pubr(id⊕r)⊕S_pri(hash(id⊕r)))

[0071] Secure communication message: Base64(id⊕E_r(content) ⊕ hash(id⊕E_r(content)))

[0072] Table 1

[0073]

[0074] In summary, in this embodiment, (1) base64 encoding is used to shield the differences in transmission of communication data, so that the bytecode data of communication transmission can be correctly parsed on the OBU device, cloud control platform, and handheld device. (2) A dynamic key negotiation mechanism based on the SM2 / 3 / 4 cryptographic algorithm is adopted. Before each work of the mining card, the mining card will complete the key negotiation with the cloud control platform in advance. During the negotiation process, the SM3 algorithm is used to perform a hash operation on the data to ensure the integrity of the data, and the SM4 algorithm is used to encrypt the data to ensure the confidentiality of the data. The SM2 algorithm completes the signature of the data to ensure the non-repudiation of the data and ensure the safety and reliability of the whole process. (3) Based on the SM2 national secret algorithm, a two-way authentication and two-pass identity authentication mode is adopted to realize the two-way identity authentication between the mining car and the cloud control platform, and ensure the identity security between the unmanned mining card and the cloud control platform. (4) The communication service data is encrypted using the SM4 national secret algorithm, and the SM3 cryptographic algorithm is used to perform a hash operation on the data to ensure the confidentiality and integrity of the data. (5) The key negotiation process uses the SM3 cryptographic algorithm to perform hash operations on the plaintext before encryption to prevent data tampering, and signs the hash value to prevent data repudiation. The plaintext is encrypted using an asymmetric algorithm to ensure the confidentiality of the plaintext data.

[0075] It should be understood that in this embodiment, a dynamic key negotiation mechanism is adopted. Before each work of the mining card, the key negotiation will be completed with the cloud control platform in advance. After the work is completed, the key is destroyed, which can effectively prevent the key from being cracked. The use of a custom protocol avoids the problems caused by the security vulnerabilities of the open source protocol itself, and the protocol itself is simple and autonomously controllable. The identity authentication and key negotiation process only requires two messages to complete, which is suitable for scenarios with large delays such as wireless communications.

[0076] It can be seen that in this application, the initialization module is used to issue certificates to the unmanned mining card and the cloud control platform respectively through the pre-built cryptographic service platform to complete the corresponding initialization operation; the authentication request message acquisition module is used to encrypt and sign through the vehicle-side OBU of the unmanned mining card, and use the national secret algorithm, the certificate information corresponding to the cloud control platform, and the vehicle number corresponding to the unmanned mining card to obtain the corresponding identity authentication request message; the authentication message acquisition module is used to perform corresponding vehicle verification and target session key generation through the cloud control platform, and based on the cryptographic service platform, the certificate information corresponding to the unmanned mining card, and the received identity authentication request message to obtain the corresponding authentication message; the key negotiation completion module is used to decrypt and platform verify the received authentication message through the vehicle-side OBU of the unmanned mining card to complete the corresponding key negotiation operation and obtain the corresponding target session key; the business communication module is used to encrypt, report, and send business data through the vehicle-side OBU, the target session key, and the cloud control platform to complete the corresponding business communication operation. That is, before communication is carried out in this application, both parties of communication, the unmanned mining truck and the cloud control platform, will undergo identity authentication. In this way, a two-way authentication and two-pass identity authentication mode is adopted to realize two-way identity authentication between the unmanned mining truck and the cloud control platform, and ensure the identity security between the mining truck and the cloud control platform. At the same time, the negotiation key is completed based on the national secret algorithm and the corresponding certificate information, and communication is carried out based on the negotiated session key after the negotiation is completed. In this way, while improving communication efficiency and security, it can ensure the confidentiality and integrity of the data, and avoid malicious behaviors such as data theft, tampering, and replay, as well as the occurrence of command tampering and attacks spreading to the cloud.

[0077] See also Figure 3 As shown, an embodiment of the present invention discloses a vehicle networking communication method, including:

[0078] Step S11: Use the pre-built cryptographic service platform to issue certificates to the unmanned mining truck and the cloud control platform respectively to complete the corresponding initialization operation.

[0079] Step S12: The vehicle-side OBU of the unmanned mining truck is used to encrypt and sign using the national secret algorithm, the certificate information corresponding to the cloud control platform, and the vehicle number corresponding to the unmanned mining truck to obtain a corresponding identity authentication request message.

[0080] Step S13: Through the cloud control platform, corresponding vehicle verification and target session key generation are performed based on the cryptographic service platform, the certificate information corresponding to the unmanned mining card, and the received identity authentication request message to obtain a corresponding authentication message.

[0081] Step S14: Through the vehicle-side OBU of the unmanned mining truck, the received authentication message is used for decryption and platform verification to complete the corresponding key negotiation operation and obtain the corresponding target session key.

[0082] Step S15: Business data encryption, data reporting, and data distribution are performed through the vehicle-side OBU, the target session key, and the cloud control platform to complete corresponding business communication operations.

[0083] Among them, for more specific working processes of the above steps, reference can be made to the corresponding contents disclosed in the aforementioned embodiments, which will not be repeated here.

[0084] It can be seen that in this application, before communication, both parties of communication, the unmanned mining truck and the cloud control platform, will be authenticated. In this way, a two-way authentication and two-pass identity authentication mode is adopted to realize two-way identity authentication between the unmanned mining truck and the cloud control platform, ensuring the identity security between the mining truck and the cloud control platform. At the same time, the negotiation key is completed based on the national secret algorithm and the corresponding certificate information, and communication is carried out based on the negotiated session key after the negotiation is completed. In this way, while improving communication efficiency and security, it can ensure the confidentiality and integrity of the data, and avoid malicious behaviors such as data theft, tampering, and replay, as well as the occurrence of command tampering and attacks spreading to the cloud.

[0085] Furthermore, the present application also discloses an electronic device. Figure 4 This is a structural diagram of an electronic device 20 according to an exemplary embodiment. The content in the diagram cannot be regarded as any limitation on the scope of use of the present application.

[0086] Figure 4The present invention provides a schematic diagram of the structure of an electronic device 20 provided in an embodiment of the present application. The electronic device 20 may specifically include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 is used to store a computer program, which is loaded and executed by the processor 21 to implement the relevant steps in the vehicle networking communication method disclosed in any of the aforementioned embodiments. In addition, the electronic device 20 in this embodiment may specifically be an electronic computer.

[0087] In this embodiment, the power supply 23 is used to provide working voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and the external device, and the communication protocol it follows is any communication protocol that can be applied to the technical solution of the present application, and is not specifically limited here; the input and output interface 25 is used to obtain external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs and is not specifically limited here.

[0088] In addition, the memory 22, as a carrier for storing resources, can be a read-only memory, a random access memory, a disk or an optical disk, etc. The resources stored thereon can include an operating system 221, a computer program 222, etc., and the storage method can be temporary storage or permanent storage.

[0089] The operating system 221 is used to manage and control the hardware devices and computer programs 222 on the electronic device 20, which can be Windows Server, Netware, Unix, Linux, etc. In addition to the computer program that can be used to complete the Internet of Vehicles communication method performed by the electronic device 20 disclosed in any of the aforementioned embodiments, the computer program 222 can further include computer programs that can be used to complete other specific tasks.

[0090] Furthermore, the present application also discloses a computer-readable storage medium for storing a computer program; wherein the computer program, when executed by a processor, implements the aforementioned disclosed vehicle networking communication method. The specific steps of the method can refer to the corresponding contents disclosed in the aforementioned embodiments, and will not be repeated here.

[0091] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0092] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0093] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0094] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0095] The technical solution provided by the present application is introduced in detail above. Specific examples are used in this article to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea. At the same time, for general technicians in this field, according to the idea of ​​the present application, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A vehicle networking communication system, characterized in that: include: The initialization module is used to issue certificates to the unmanned mining truck and the cloud control platform through the pre-built cryptographic service platform to complete the corresponding initialization operations; The authentication request message acquisition module is used to encrypt and sign the vehicle-side OBU of the unmanned mining truck using the national secret algorithm, the certificate information corresponding to the cloud control platform, and the vehicle number corresponding to the unmanned mining truck to obtain the corresponding identity authentication request message; An authentication message acquisition module is used to perform corresponding vehicle verification and target session key generation through the cloud control platform based on the cryptographic service platform, the certificate information corresponding to the unmanned mining card, and the received identity authentication request message to obtain a corresponding authentication message; The key negotiation completion module is used to complete the corresponding key negotiation operation through the vehicle-side OBU of the unmanned mining truck and use the received authentication message for decryption and platform verification to obtain the corresponding target session key; A business communication module is used to encrypt, report and send business data through the vehicle-side OBU, the target session key and the cloud control platform to complete corresponding business communication operations; The authentication request message acquisition module includes: A first string connection unit is used to connect the vehicle number corresponding to the unmanned mining truck and the string of the random number based on a preset operator after performing a hash operation on the obtained random number based on the SM3 national secret algorithm to obtain a corresponding first connection result; A message generation unit, configured to encrypt, sign, and assemble result data of the first connection result respectively based on the certificate information corresponding to the cloud control platform and the SM4 national secret algorithm, the local private key, and the SM2 national secret algorithm, to obtain a corresponding identity authentication request message; The authentication message acquisition module includes: The vehicle verification unit is used to call the preset vehicle verification interface provided by the password service platform through the cloud control platform to authenticate the vehicle-side OBU to obtain a corresponding identity authentication result; A target session key generation unit, configured to, when the identity authentication result indicates that the verification is passed, call the cryptographic service platform through the cloud control platform to complete a corresponding key generation operation and obtain a corresponding target session key; A first string connection unit is used to connect the platform number corresponding to itself and the string of the target session key based on a preset operator to obtain a corresponding second connection result; An authentication message acquisition unit is used to encrypt, sign and assemble the result data of the second connection result respectively based on the certificate information corresponding to the unmanned mining card, the SM4 national encryption algorithm and the local private key to obtain a corresponding authentication message; The key negotiation completion module includes: A message decryption unit, used to decrypt the authentication message based on the local private key to obtain a corresponding decryption result; The platform verification unit is used to authenticate the identity of the cloud control platform by calling a preset platform verification interface provided by the cryptographic service platform and the decryption result, and obtain the corresponding target session key.

2. The vehicle networking communication system according to claim 1, characterized in that: The initialization module comprises: The certificate request receiving unit is used to receive the certificate application requests sent by the vehicle-side OBU of the unmanned mining truck and the cloud control platform respectively after initializing itself through the pre-built cryptographic service platform; The certificate issuing unit is used to issue corresponding certificate information to the vehicle-side OBU of the unmanned mining truck and the cloud control platform based on the received certificate application requests, so as to complete the initialization operation corresponding to the vehicle-side OBU of the unmanned mining truck and the cloud control platform.

3. The vehicle networking communication system according to claim 1, characterized in that: The authentication request message acquisition module includes: The random number acquisition unit is used to obtain a corresponding random number through the vehicle-side OBU of the unmanned mining truck and based on a random number generator.

4. The vehicle networking communication system according to claim 3, characterized in that: The message generating unit comprises: A first encryption subunit, used to encrypt the first connection result based on the certificate information corresponding to the cloud control platform and the SM4 national encryption algorithm to obtain a corresponding first encryption result; A first signature subunit, configured to obtain a hash value of the first connection result by calculation, and sign the hash value of the first connection result based on a local private key and an SM2 national encryption algorithm to obtain a corresponding first signature result; The message generation subunit is used to obtain the corresponding identity authentication request message by assembling the first encryption result and the first signature result.

5. The vehicle networking communication system according to claim 1, characterized in that: The authentication message acquisition module includes: The message receiving unit is used to receive the identity authentication request message sent by the vehicle-side OBU of the corresponding unmanned mining truck through the cloud control platform.

6. The vehicle networking communication system according to claim 5, characterized in that: The authentication message obtaining unit includes: A second encryption subunit is used to encrypt the second connection result based on the certificate information corresponding to the unmanned mining card and the SM4 national encryption algorithm to obtain a corresponding second encryption result; A second signature subunit, configured to obtain a hash value of the second connection result by calculation, and sign the hash value of the second connection result based on a local private key and an SM2 national encryption algorithm to obtain a corresponding second signature result; The authentication message acquisition subunit is used to obtain the corresponding authentication message by assembling the second encryption result and the second signature result.

7. The vehicle networking communication system according to any one of claims 1 to 6, characterized in that: The key negotiation completion module includes: An authentication message receiving unit, used to receive the authentication message sent by the cloud control platform through the vehicle-side OBU of the unmanned mining truck; The verification result returning unit is used to encrypt the random number using the target session key when the verification is passed, and return the verification result obtained by encapsulating the encrypted random number to the cloud control platform.

8. A vehicle networking communication method, characterized in that: Applied to the Internet of Vehicles communication system according to any one of claims 1 to 7; the method comprises: The pre-built cryptographic service platform is used to issue certificates to the unmanned mining truck and the cloud control platform to complete the corresponding initialization operations; Through the vehicle-side OBU of the unmanned mining truck, the corresponding identity authentication request message is obtained by encrypting and signing using the national secret algorithm, the certificate information corresponding to the cloud control platform, and the vehicle number corresponding to the unmanned mining truck; Through the cloud control platform, corresponding vehicle verification and target session key generation are performed based on the cryptographic service platform, the certificate information corresponding to the unmanned mining card, and the received identity authentication request message to obtain a corresponding authentication message; Through the vehicle-side OBU of the unmanned mining truck, the received authentication message is used for decryption and platform verification to complete the corresponding key negotiation operation and obtain the corresponding target session key; Business data encryption, data reporting, and data distribution are performed through the vehicle-side OBU, the target session key, and the cloud control platform to complete corresponding business communication operations; Among them, the corresponding vehicle verification and target session key generation are performed through the cloud control platform based on the cryptographic service platform, the certificate information corresponding to the unmanned mining card and the received identity authentication request message to obtain the corresponding authentication message, including: Through the cloud control platform, the preset vehicle verification interface provided by the password service platform is called to authenticate the vehicle-side OBU to obtain the corresponding authentication result; When the identity authentication result indicates that the verification is passed, the cryptographic service platform is called by the cloud control platform to complete the corresponding key generation operation and obtain the corresponding target session key; Connecting the platform number corresponding to itself and the character string of the target session key based on a preset operator to obtain a corresponding second connection result; Based on the certificate information corresponding to the unmanned mining card, the SM4 national secret algorithm, and the local private key, the second connection result is encrypted, signed, and the result data is assembled to obtain a corresponding authentication message; The method of using the received authentication message to perform decryption and platform verification to complete the corresponding key negotiation operation and obtain the corresponding target session key includes: Decrypting the authentication message based on the local private key to obtain a corresponding decryption result; By calling the preset platform verification interface provided by the cryptographic service platform and the decryption result, the cloud control platform is authenticated and the corresponding target session key is obtained.

9. An electronic device, characterized in that: include: Memory, used to store computer programs; A processor is used to execute the computer program to implement the vehicle network communication method as claimed in claim 8.

10. A computer-readable storage medium, characterized in that: Used to store a computer program, which, when executed by a processor, implements the vehicle network communication method as claimed in claim 8.

Images