A road parking identification method and system for PDA device with integrated encryption chip

Abstract

The present invention discloses a road parking identification method and system of an integrated encryption chip PDA device. The method performs an encryption operation on first identification data of an image of a road parking position to form second identification data. The road parking identification data processing work is run in a virtual cache container, and a request for performing an encryption operation is received through an integrated encryption chip and decrypted and compared. After decrypting and comparing the second identification data, parking identification authority is allocated. The encryption transmission does not require additional software to implement, and encryption, classification, and secure data identification upload and other operations can be completed directly during identification. At the same time, the processing capacity of the encryption chip is amplified through container technology, so that all logic codes of business programs and algorithms are run in a protected secure container, thereby implementing the security of algorithms and codes and executable modules, and ensuring data security and financial security.

Description

Technical Field

[0001] The invention relates to the technical field of encrypted data processing, in particular to a road parking identification method and a system thereof for an integrated encryption chip PDA device. Background Art

[0002] In the current road parking management business, vehicles entering and exiting parking spaces rely on high-positioned license plate recognition cameras or administrators holding PDA devices to take photos and identify license plates. During the photo recognition process, the PDA device will directly associate and identify the vehicle's license plate, owner information and other related information to form the user's parking recognition record and perform subsequent operations. However, the front and back ends of the current road parking handheld PDA devices do not perform data encryption transmission. In particular, during the process of parking space detection, recognition and matching, the PDA device often directly transmits the collected and recognized image information to the corresponding road parking management business. The encrypted transmission is implemented based on software. This will not only cause the leakage of user information, which is not conducive to ensuring the data security of information transmission, but also may be cracked, bringing unnecessary financial risks to users. For this reason, we propose a road parking recognition method and system for PDA devices with integrated encryption chips. Summary of the invention

[0003] In view of the problems existing in the above-mentioned existing devices in road parking recognition, the present invention is proposed.

[0004] Therefore, one of the objects of the present invention is to provide a road parking identification method and system for an integrated encryption chip PDA device, which realizes high-security parking identification by integrating the national secret 7 encryption chip on the PDA hardware motherboard, and improves the data transmission method. Through container technology, the processing power of the encryption chip is amplified, so that all logical codes of business programs and their algorithms are run in a protected secure container, thereby realizing the security of the algorithms and their codes as well as the executable modules, and further encrypting the software system and data transmission from the hardware layer to ensure data security and financial security.

[0005] In order to solve the above technical problems, the present invention provides the following technical solutions:

[0006] In one aspect, the present invention provides a road parking identification method of a PDA device with an integrated encryption chip, comprising:

[0007] The detection and recognition of road parking spaces are completed by collecting, analyzing and processing images of road parking positions through the PDA device, and the first recognition data is formed.

[0008] The PDA device generates a virtual cache container for encryption by an integrated encryption chip, the integrated encryption chip responds to the first identification data and performs an encryption operation on the first identification data based on the virtual cache container to form second identification data;

[0009] The main control chip receives the second identification data, the road parking identification data processing work is executed in the virtual cache container, and the request for performing the encryption operation is received through the integrated encryption chip and the decryption comparison is performed;

[0010] After decrypting and comparing the second identification data, the parking identification authority is allocated, and the pre-set data is searched and allocated in the policy library according to the access permission level, and a data classification policy matching the access permission level is obtained, and the data classification policy is used to characterize the data content securely accessed by the encrypted second identification data corresponding to the access permission level, and the data content securely accessed in the second identification data is allocated according to the data classification policy, and the data content securely accessed is responded to and the interactive list information of the second identification data file is generated according to the data classification policy;

[0011] The data content of the secure access in the second identification data is identified according to the interaction list information and uploaded to the road parking cloud management system.

[0012] As a preferred solution of the present invention, when allocating parking recognition authority after decrypting and comparing the second recognition data, it also includes:

[0013] The virtual cache container with integrated encryption chip takes isolation measures to the outside and determines the internal trust authentication, performs image data encryption processing to ensure the information security of road parking recognition business; and

[0014] The cryptographic operation requested by the road parking identification PDA device system is performed by the integrated encryption chip, which responds to and determines that the road parking identification PDA device system identity information matches the key of the virtual cache container, and performs the cryptographic operation requested by the road parking identification PDA device system based on the key information stored in the virtual cache container.

[0015] As a preferred solution of the present invention, the virtual cache container for encryption is generated by the integrated encryption chip, and a virtual cache container for encryption is generated in the embedded road parking identification PDA device system using the key of the integrated encryption chip based on the container technology, so that the road parking identification data processing work of the road parking identification PDA device system is run in the virtual cache container, as follows:

[0016] Image building: First, developers need to package the road parking recognition PDA device system application and its dependencies into an image, which is done through the Dockerfile text file. Dockerfile is a text file containing instructions for building a Docker image.

[0017] Image push: After the image is built, it is pushed to the Docker repository through the Docker client;

[0018] Container operation: Use the Docker command to pull the image from the Docker repository and run the virtual cache container.

[0019] As a preferred solution of the present invention, the integrated encryption chip receives a request to perform an encryption operation and performs decryption comparison, the integrated encryption chip receives a random code generated by the main control chip and a plain text sent by the main control chip, encrypts the plain text by an encryption algorithm to generate a cipher text, and returns the generated decrypted cipher text for comparison, as follows:

[0020] The random code is generated by the main control chip;

[0021] The main control chip sends plain text to the encryption chip;

[0022] The integrated encryption chip encrypts the plaintext to generate ciphertext through the encryption algorithm, and the encryption chip returns the ciphertext to the main control chip;

[0023] The main control chip decrypts the ciphertext to generate a decryption value;

[0024] The main control chip compares the decrypted value with the previous plain text. If the comparison value is consistent, the authentication is passed. If the authentication fails to reach a preset threshold, it will then determine whether it is a malicious request operation. The malicious request operation is a number that exceeds the number of consecutive authentication failures or key mismatches.

[0025] When it is determined to be a malicious request operation, the integrated encryption chip clears the identity information and key information from the virtual cache container;

[0026] The encryption algorithm adopts the national secret SM7 block cipher algorithm, the block length is 128 bits, and the key length is 128 bits; the integrated encryption chip adopts EEPROM memory.

[0027] As a preferred solution of the present invention, wherein: the integrated encryption chip is trustedly authenticated, specifically the virtual cache container in the integrated encryption chip uses the kernel-level signature CA verification technology to write the encryption key into the integrated encryption chip of the virtual cache container to be encrypted, and add a token to bind the LUKS key slot to the integrated encryption chip, the token stores the encryption key written into the integrated encryption chip and the LUKS key slot associated with it, the integrated encryption chip stores the encryption key, and the virtual cache container is signed and authenticated by the encryption key when it is started;

[0028] Unsigned processes or processes with inconsistent signatures, that is, forged processes, cannot run and are judged as trusted authentication failures. The virtual cache container uses kernel-level signature CA verification technology to perform signature authentication on system applications in the container, ensuring that unsigned processes or processes with inconsistent signatures, that is, forged processes, cannot run.

[0029] As a preferred solution of the present invention, the virtual cache container of the integrated encryption chip takes isolation measures to the outside, wherein the isolation measures are the scene whitelist configuration of the integrated encryption chip, specifically based on the virtual cache container, the identity information, key information and the associated scene information are matched and configured as a whitelist, and through the whitelist setting, a whitelist scene associated with programs and files is formed, operations outside the scene are prohibited, and file protection is performed at the same time; even system administrator permissions are strictly restricted; the file protection is designed according to the principle of minimizing permissions, and the reading, writing, modification and storage of data in the virtual cache container are encrypted and authenticated, and the specified road parking identification service application is allowed to read and write the specified files to ensure the security of file information in the road parking identification service.

[0030] As a preferred solution of the present invention, it also includes: identifying the user of the PDA device, specifically obtaining the user's biometric verification information, matching and verifying the biometric verification information through a preset user authority library, generating a user verification result, the user verification result includes the user authority level of the user, and taking the minimum value of the user authority level and the PDA device authority level to assign the access permission level, and generating device identification information, matching the corresponding whitelist scenario according to the device identification information.

[0031] As a preferred solution of the present invention, a data classification strategy matching the access permission level is obtained, wherein the classification strategy is analyzed and matched by constructing a classification model, specifically as follows:

[0032] ;

[0033] in, for The status classification evaluation value of the classification strategy task data, is a preset parameter and is used to distribute the classification value in the interval (0-1). For the The number of items of hierarchical strategy task data, for The attribute value of the hierarchical strategy task data status, for The weight of the data in the hierarchical strategy task is assigned based on the sensitivity, importance and value of the data. For analysis security access data, namely, hierarchical strategy task data, To analyze the classification strategy and judge the status evaluation standard cloud hierarchical strategy task data.

[0034] As a preferred solution of the present invention, the encryption operation on the first identification data includes: vehicle identification information, vehicle owner information, vehicle stay time and location information, vehicle payment information, and vehicle parking space identification information;

[0035] The requested cryptographic operation includes one of an encryption operation, a decryption operation, a signature authentication operation, an external isolation operation, or a file protection operation.

[0036] On the one hand, a road parking identification system with an integrated encryption chip PDA device is provided, the system is an embedded road parking identification PDA device system, the road parking identification PDA device system comprises an integrated encryption chip unit and a main control chip unit; the integrated encryption chip unit comprises a cache container generation module, a data receiving module, a data encryption module, a signature authentication module, and an execution module;

[0037] A cache container generation module, used to generate a virtual cache container for encryption in the embedded road parking identification PDA device system using a key of the integrated encryption chip unit based on the container technology, so that the road parking identification data processing work of the road parking identification PDA device system can be run in the virtual cache container;

[0038] A data receiving module, configured to respond to the first identification data and perform an encryption operation on the first identification data based on the virtual cache container to form second identification data, and for the integrated encryption chip unit to receive the random code generated by the main control chip unit and the plain text sent by the main control chip unit to the integrated encryption chip unit;

[0039] The data encryption module, the integrated encryption chip unit receives the request for performing the encryption operation and performs decryption comparison, wherein the integrated encryption chip unit receives the random code generated by the main control chip unit and the plain text sent by the main control chip unit to the integrated encryption chip unit, and then encrypts the plain text by the encryption algorithm to generate cipher text and returns the generated decrypted cipher text for comparison;

[0040] The signature authentication module is used to integrate the virtual cache container of the encryption chip unit to take isolation measures for the outside and determine the internal as trusted authentication, and perform data encryption processing to ensure the information security of the road parking identification business;

[0041] An execution module, used to respond to and determine that the road parking identification PDA device system identity information matches the key of the virtual cache container that is allowed to request the cryptographic operation, and the integrated encryption chip executes the cryptographic operation requested by the road parking identification PDA device system based on the key information stored in the virtual cache container;

[0042] The main control chip unit includes an image acquisition and processing module, a parking recognition authority allocation module, a data upload module, and a biometric verification module;

[0043] The image acquisition and processing module is used to collect, analyze and process the image of the road parking position through the PDA device to complete the detection and recognition of the road parking space and form the first recognition data

[0044] a parking identification authority allocation module, configured to allocate parking identification authority after decrypting and comparing the second identification data, to search for pre-set data according to the access permission level and allocate a policy library, to obtain a data classification policy matching the access permission level, the data classification policy being used to characterize the data content securely accessed by the encrypted second identification data corresponding to the access permission level, to allocate the data content securely accessed in the second identification data according to the data classification policy, to respond to the data content securely accessed and to generate interactive list information of the second identification data file according to the data classification policy;

[0045] A data uploading module, used to identify the data content of the secure access in the second identification data according to the interaction list information and upload it to the road parking cloud management system;

[0046] The biometric verification module is used to match and verify the biometric verification information through a preset user authority library to generate a user verification result, which includes the user authority level of the user, and assigns the access permission level as the minimum value of the user authority level and the PDA device authority level, and generates device identification information, and matches the corresponding whitelist scenario according to the device identification information.

[0047] Beneficial effects of the present invention: The present invention integrates the national secret 7 encryption chip on the PDA hardware motherboard and optimizes the data transmission method, specifically by encrypting the first recognition data, and then allocating parking recognition authority to the encrypted data, matching the appropriate classification strategy to upload the corresponding secure access data content, and its encrypted transmission does not require additional software to implement, and can directly complete encryption, classification and secure data recognition and uploading operations while identifying. At the same time, the processing power of the encryption chip is amplified through container technology, so that all logical codes of business programs and their algorithms are run in a protected secure container, realizing the security of the algorithm and its code and executable module, thereby encrypting the software system and data transmission from the hardware layer to ensure data security and financial security.

[0048] To sum up, the PDA device of the present invention that integrates the national secret SM7 encryption chip, during road parking recognition, uses the ID, key and algorithm of the encryption chip of the encryption chip enhancement module, leverages the computing power of the main control chip CPU, and uses container technology to achieve the security of the algorithm and its code as well as the executable module. It can not only prevent copying boards, but also prevent decompilation and cracking, as well as algorithm modification and hacker attacks, to ensure data security and financial security. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for describing the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative labor. Among them:

[0050] Figure 1 is a flow chart of the method of the present invention;

[0051] Figure 2 It is a schematic diagram of the modular structure of the system of the present invention;

[0052] Figure 3 The present invention is a flowchart of an integrated encryption chip receiving a request for performing an encryption operation and performing a decryption comparison. DETAILED DESCRIPTION

[0053] In order to make the purpose, technical solution and advantages of the embodiment of the present invention clearer, the technical solution of the embodiment of the present invention will be clearly and completely described below in conjunction with the drawings of the embodiment of the present invention. Obviously, the described embodiment is a part of the embodiment of the present invention, not all of the embodiments. Based on the described embodiment of the present invention, all other embodiments obtained by ordinary technicians in this field belong to the scope of protection of the present invention.

[0054] like Figure 1and Figure 3 As shown in FIG. 1 , an embodiment of the present invention is provided, which provides a road parking recognition method for a PDA device with an integrated encryption chip, comprising the following steps:

[0055] The detection and recognition of road parking spaces are completed by collecting, analyzing and processing images of road parking positions through the PDA device, and the first recognition data is formed.

[0056] The PDA device generates a virtual cache container for encryption by an integrated encryption chip, and the integrated encryption chip responds to the first identification data and performs an encryption operation on the first identification data based on the virtual cache container to form second identification data;

[0057] The main control chip receives the second identification data, the road parking identification data processing work is run in the virtual cache container, and the request for performing the encryption operation is received through the integrated encryption chip and the decryption comparison is performed;

[0058] After decrypting and comparing the second identification data, the parking identification authority is allocated. The pre-set data is searched and the policy library is allocated according to the access permission level, and a data classification strategy matching the access permission level is obtained. The data classification strategy is used to characterize the data content of the encrypted second identification data that is securely accessed corresponding to the access permission level. According to the data classification strategy, the data content of secure access in the second identification data is responded to and the interactive list information of the second identification data file is generated according to the data classification strategy; the data classification strategy matching the access permission level is obtained, wherein the analysis of the classification strategy is analyzed and matched by constructing a classification model, as follows:

[0059] ;

[0060] in, for The status classification evaluation value of the classification strategy task data, is a preset parameter and is used to distribute the classification value in the interval (0-1). For the The number of items of hierarchical strategy task data, for The attribute value of the hierarchical strategy task data status, for The weight of the data in the hierarchical strategy task is assigned based on the sensitivity, importance and value of the data. For analysis security access data, namely, hierarchical strategy task data, To analyze the classification strategy and judge the status evaluation standard cloud Hierarchical strategy task data;

[0061] The data content of the secure access in the second identification data is identified according to the interaction list information and uploaded to the road parking cloud management system.

[0062] like Figure 3 As shown, the integrated encryption chip of this embodiment receives a request for performing an encryption operation and performs a decryption comparison, as follows:

[0063] The random code is generated by the main control chip;

[0064] The main control chip sends plain text to the encryption chip;

[0065] The integrated encryption chip encrypts the plaintext to generate ciphertext through the encryption algorithm, and the encryption chip returns the ciphertext to the main control chip;

[0066] The main control chip decrypts the ciphertext to generate a decryption value;

[0067] The main control chip compares the decrypted value with the previous plain text. If the comparison value is consistent, the authentication is passed. If the authentication fails and reaches the preset threshold, it will then determine whether it is a malicious request operation. A malicious request operation is a number that exceeds the number of consecutive authentication failures or key mismatches.

[0068] When a malicious request operation is determined, the integrated encryption chip clears the identity information and key information from the virtual cache container.

[0069] The key of the integrated encryption chip is used to generate a virtual cache container for encryption in the system, allowing the road parking identification business system to run in the container. The running data is the road parking encrypted content information, and the road parking encrypted content information is stored in the virtual cache container. At the same time, the virtual cache container is isolated from the outside and determined to be trusted internally. Data encryption processing is performed to ensure the information security of the road parking identification business system to prevent copying and reverse analysis.

[0070] This embodiment uses the key of the integrated encryption chip based on the container technology to generate a virtual cache container for encryption in the embedded road parking recognition PDA device system, as follows:

[0071] Image building: First, developers need to package the road parking recognition PDA device system application and its dependencies into an image, which is done through the Dockerfile text file. Dockerfile is a text file containing instructions for building a Docker image.

[0072] Image push: After the image is built, it is pushed to the Docker repository through the Docker client;

[0073] Container operation: Use the Docker command to pull the image from the Docker repository and run the virtual cache container.

[0074] To further explain, the encrypted virtual cache container uses the encryption chip's key to encrypt and generate a container when the road parking recognition business system is started, and allows the business program to run in the container. The business data is stored in the container, and the container is isolated from the outside, and the program files and data files in the container cannot be accessed from the outside. Without access to the executable file entity, it is naturally impossible to reverse analyze. The container key comes from the encryption chip, so it cannot be copied or copied.

[0075] It should be noted that the encryption algorithm of this embodiment adopts the national SM7 block cipher algorithm, the block length is 128 bits, and the key length is 128 bits; the integrated encryption chip adopts EEPROM memory.

[0076] Preferably, the present embodiment integrates trusted authentication of the encryption chip. Specifically, the virtual cache container in the integrated encryption chip uses the kernel-level signature CA verification technology to write the encryption key into the integrated encryption chip of the virtual cache container to be encrypted, and add a token to bind the LUKS key slot to the integrated encryption chip. The token stores the encryption key in the integrated encryption chip and the LUKS key slot associated with it. The encryption key is stored in the integrated encryption chip, and the encryption key is used for signature authentication when the virtual cache container is started.

[0077] In addition, unsigned processes or processes with inconsistent signatures, that is, forged processes, cannot run and are judged as trusted authentication failures. The virtual cache container uses kernel-level signature CA verification technology to perform signature authentication on system applications in the container, ensuring that unsigned processes or processes with inconsistent signatures, that is, forged processes, cannot run.

[0078] Among them, the virtual cache container of the integrated encryption chip takes isolation measures to the outside, wherein the isolation measures are the scene whitelist configuration of the integrated encryption chip, specifically based on the virtual cache container, the identity information, key information and the associated scene information are matched and configured as a whitelist, wherein the whitelist mechanism can be used for the restricted test account of the integrated encryption chip key, the user's control function online range, and the user's restricted access rights, etc. This embodiment forms a whitelist scene associated with programs and files through whitelist settings. Operations outside the scene are prohibited from running, and file protection is performed at the same time; even system administrator permissions are strictly restricted; at the same time, file protection is designed according to the principle of minimizing permissions, and encryption and authentication are performed on the reading, writing, modification, and storage of data in the virtual cache container, and limited to allow specified road parking identification business applications to read and write specified files to ensure the security of file information in the road parking identification business.

[0079] It also includes the identification of the user of the PDA device, specifically obtaining the user's biometric verification information, matching and verifying the biometric verification information through a preset user authority library, and generating a user verification result. The user verification result includes the user's user authority level, and taking the minimum value of the user authority level and the PDA device authority level to assign the access permission level, and generating device identification information, and matching the corresponding whitelist scenario according to the device identification information.

[0080] Specifically, in this embodiment, the encryption operation on the first identification data includes: vehicle identification information, vehicle owner information, vehicle stay time and location information, vehicle payment information, and vehicle parking space identification information;

[0081] The requested cryptographic operation includes one of an encryption operation, a decryption operation, a signature authentication operation, an external isolation operation, or a file protection operation.

[0082] Based on the above, this embodiment integrates the National Secret 7 encryption chip on the PDA hardware motherboard and improves the data transmission method. Through container technology, the processing power of the encryption chip is amplified, so that all the logical codes of the business program and its algorithm are run in a protected secure container, thereby achieving the security of the algorithm and its code as well as the executable module, and then encrypting the software system and data transmission from the hardware layer to ensure data security and financial security.

[0083] like Figure 2 As shown, it is an embodiment of the present invention. This embodiment provides a road parking recognition system with an integrated encryption chip PDA device. The system is an embedded road parking recognition PDA device system. The road parking recognition PDA device system includes an integrated encryption chip unit and a main control chip unit. The integrated encryption chip unit includes a cache container generation module, a data receiving module, a data encryption module, a signature authentication module, and an execution module.

[0084] A cache container generation module is used to generate a virtual cache container for encryption in the embedded road parking identification PDA device system using the key of the integrated encryption chip unit based on the container technology, so that the road parking identification data processing work of the road parking identification PDA device system runs in the virtual cache container;

[0085] A data receiving module, configured to respond to the first identification data and perform an encryption operation on the first identification data based on the virtual cache container to form second identification data, and receive, by the integrated encryption chip unit, a random code generated by the main control chip unit and a plain text sent by the main control chip unit to the integrated encryption chip unit;

[0086] The data encryption module, the integrated encryption chip unit receives the request for performing the encryption operation and performs decryption comparison, wherein the integrated encryption chip unit receives the random code generated by the main control chip unit and the plain text sent by the main control chip unit to the integrated encryption chip unit, and then encrypts the plain text through the encryption algorithm to generate cipher text and returns the generated decrypted cipher text for comparison;

[0087] The signature authentication module is used to integrate the virtual cache container of the encryption chip unit to take isolation measures for the outside and determine the internal as trusted authentication, and perform data encryption processing to ensure the information security of the road parking identification business;

[0088] An execution module, used to respond and determine that the road parking identification PDA device system identity information matches the key of the virtual cache container that is allowed to request the cryptographic operation, and the integrated encryption chip executes the cryptographic operation requested by the road parking identification PDA device system based on the key information stored in the virtual cache container;

[0089] The main control chip unit includes an image acquisition and processing module, a parking recognition authority allocation module, a data upload module, and a biometric verification module;

[0090] The image acquisition and processing module is used to collect, analyze and process the image of the road parking position through the PDA device to complete the detection and recognition of the road parking space and form the first recognition data

[0091] a parking identification authority allocation module, for allocating parking identification authority after decrypting and comparing the second identification data, for searching pre-set data and allocating a policy library according to the access permission level, for obtaining a data classification policy matching the access permission level, the data classification policy being used to characterize the data content securely accessed by the encrypted second identification data corresponding to the access permission level, for allocating the data content securely accessed in the second identification data according to the data classification policy, for responding to the data content securely accessed and generating interactive list information of the second identification data file according to the data classification policy;

[0092] A data uploading module, used to identify the data content of the secure access in the second identification data according to the interaction list information and upload it to the road parking cloud management system;

[0093] The biometric verification module is used to match and verify the biometric verification information through the preset user authority library to generate a user verification result. The user verification result includes the user authority level of the user, and the minimum value of the user authority level and the PDA device authority level is assigned the access permission level, and the device identification information is generated, and the corresponding whitelist scenario is matched according to the device identification information.

[0094] In summary, the PDA device integrated with the national secret SM7 encryption chip of the present invention, during road parking identification, uses the encryption chip ID, key and algorithm of the encryption chip of the encryption chip enhancement module, and uses the computing power of the main control chip CPU to encrypt the first identification data, and then allocates parking identification authority to the encrypted data, and matches the appropriate grading strategy to upload the corresponding secure access data content. Its encrypted transmission does not require additional software to implement, and can directly complete encryption, grading and secure data identification and uploading operations during identification. At the same time, through container technology, the security of the algorithm and its code as well as the executable module is achieved, which not only prevents copying, but also prevents decompilation and cracking, as well as algorithm modification and hacker attacks, to ensure data security and financial security.

[0095] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function according to the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium.

[0096] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present application. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art may combine and combine different embodiments or examples described in this specification and the features of different embodiments or examples, unless they are contradictory.

[0097] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of technical features indicated. Therefore, a feature defined as "first" or "second" may explicitly or implicitly include at least one of the features. In the description of this application, the meaning of "plurality" is two or more, unless otherwise clearly and specifically defined.

[0098] Any process or method description in the flow chart or otherwise described herein can be understood to represent a module, fragment or portion of a code including one or more executable instructions for implementing the steps of a specific logical function or process. And the scope of the preferred embodiment of the present application includes other implementations, in which the functions may not be performed in the order shown or discussed, including in a substantially simultaneous manner or in a reverse order according to the functions involved.

[0099] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing logical functions, which can be embodied in any computer-readable medium for use by an instruction execution system, apparatus or device (such as a computer-based system, a system including a processor or other system that can fetch instructions from an instruction execution system, apparatus or device and execute instructions), or used in combination with these instruction execution systems, apparatuses or devices.

[0100] It should be understood that the various parts of the present application can be implemented with hardware, software, firmware or a combination thereof. In the above embodiments, multiple steps or methods can be implemented with software or firmware stored in a memory and executed by a suitable instruction execution system. All or part of the steps of the above embodiment method can be completed by instructing the relevant hardware through a program, which can be stored in a computer-readable storage medium, and when the program is executed, it includes one of the steps of the method embodiment or a combination thereof.

[0101] In addition, each functional unit in each embodiment of the present application can be integrated into a processing module, or each unit can exist physically separately, or two or more units can be integrated into one module. The above-mentioned integrated module can be implemented in the form of hardware or in the form of a software functional module. If the above-mentioned integrated module is implemented in the form of a software functional module and sold or used as an independent product, it can also be stored in a computer-readable storage medium. The storage medium can be a read-only memory, a disk or an optical disk, etc.

[0102] The above are only specific implementations of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of various changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A road parking identification method for a PDA device with an integrated encryption chip, characterized in that: include: The detection and recognition of road parking spaces are completed by collecting, analyzing and processing images of road parking positions through the PDA device, and the first recognition data is formed. The PDA device generates a virtual cache container for encryption by an integrated encryption chip, the integrated encryption chip responds to the first identification data and performs an encryption operation on the first identification data based on the virtual cache container to form second identification data; The main control chip receives the second identification data, the road parking identification data processing work is executed in the virtual cache container, and the request for performing the encryption operation is received through the integrated encryption chip and the decryption comparison is performed; After decrypting and comparing the second identification data, the parking identification authority is allocated. The pre-set data is searched and the policy library is allocated according to the access permission level to obtain the data classification policy that matches the access permission level. The classification policy is analyzed and matched by building a classification model, which is as follows: ; in, for The status classification evaluation value of the classification strategy task data, is a preset parameter and is used to distribute the classification value in the interval (0-1). For the The number of items of hierarchical strategy task data, for The attribute value of the hierarchical strategy task data status, for The weight of the data in the hierarchical strategy task is assigned based on the sensitivity, importance and value of the data. For analysis security access data, namely, hierarchical strategy task data, To analyze the classification strategy and judge the status evaluation standard cloud Task data; The data classification strategy is used to characterize the data content securely accessed by the encrypted second identification data corresponding to the access permission level, extract the data content securely accessed in the second identification data according to the data classification strategy, and generate the interactive list information of the second identification data file in response to the securely accessed data content and according to the data classification strategy; The data content of the secure access in the second identification data is identified according to the interaction list information and uploaded to the road parking cloud management system.

2. A road parking identification method for a PDA device with an integrated encryption chip as claimed in claim 1, characterized in that: When allocating parking recognition authority after decrypting and comparing the second recognition data, the method further includes: The virtual cache container with integrated encryption chip takes isolation measures to the outside and determines the internal trust authentication, performs image data encryption processing to ensure the information security of road parking recognition business; and The cryptographic operation requested by the road parking identification PDA device system is performed by the integrated encryption chip, which responds to and determines that the road parking identification PDA device system identity information matches the key of the virtual cache container, and performs the cryptographic operation requested by the road parking identification PDA device system based on the key information stored in the virtual cache container.

3. A road parking identification method for a PDA device with an integrated encryption chip as claimed in claim 1, characterized in that: The integrated encryption chip generates a virtual cache container for encryption, and uses the key of the integrated encryption chip based on the container technology to generate a virtual cache container for encryption in the embedded road parking identification PDA device system, so that the road parking identification data processing work of the road parking identification PDA device system runs in the virtual cache container, as follows: Image building: First, developers need to package the road parking recognition PDA device system application and its dependencies into an image, which is done through the Dockerfile text file. Dockerfile is a text file containing instructions for building a Docker image. Image push: After the image is built, it is pushed to the Docker repository through the Docker client; Container operation: Use the Docker command to pull the image from the Docker repository and run the virtual cache container.

4. A road parking identification method for a PDA device with an integrated encryption chip as claimed in claim 1, characterized in that: The integrated encryption chip receives the request to perform the encryption operation and performs decryption comparison. The integrated encryption chip receives the random code generated by the main control chip and the plain text sent by the main control chip, encrypts the plain text through the encryption algorithm to generate cipher text and returns the generated decrypted cipher text for comparison, as follows: The random code is generated by the main control chip; The main control chip sends plain text to the encryption chip; The integrated encryption chip encrypts the plaintext to generate ciphertext through the encryption algorithm, and the encryption chip returns the ciphertext to the main control chip; The main control chip decrypts the ciphertext to generate a decryption value; The main control chip compares the decrypted value with the previous plain text. If the comparison value is consistent, the authentication is passed. If the authentication fails to reach a preset threshold, it will then determine whether it is a malicious request operation. The malicious request operation is a number that exceeds the number of consecutive authentication failures or key mismatches. When it is determined to be a malicious request operation, the integrated encryption chip clears the identity information and the key information from the virtual cache container; The encryption algorithm adopts the national secret SM7 block cipher algorithm, the block length is 128 bits, and the key length is 128 bits; the integrated encryption chip adopts EEPROM memory.

5. A road parking identification method for a PDA device with an integrated encryption chip as claimed in claim 2, characterized in that: The integrated encryption chip is trusted for authentication. Specifically, the virtual cache container in the integrated encryption chip uses the kernel-level signature CA verification technology to write the encryption key into the integrated encryption chip of the virtual cache container to be encrypted, and add a token to bind the LUKS key slot to the integrated encryption chip. The token stores the encryption key in the integrated encryption chip and the LUKS key slot associated with it. The encryption key is stored in the integrated encryption chip. When the virtual cache container is started, the encryption key is used for signature authentication; Unsigned processes or processes with inconsistent signatures, that is, forged processes, cannot run and are judged as having failed trusted authentication.

6. A road parking identification method for a PDA device with an integrated encryption chip as claimed in claim 2, characterized in that: The virtual cache container of the integrated encryption chip takes isolation measures for the outside, wherein the isolation measures are the scene whitelist configuration of the integrated encryption chip, specifically, based on the virtual cache container, identity information, key information and associated scene information are matched and configured as a whitelist, and through the whitelist setting, a whitelist scene associated with programs and files is formed, and operations outside the scene are prohibited from running, while file protection is performed; The file protection is designed based on the principle of minimizing permissions, and encrypts and authenticates the reading, writing, modification, and storage of data in the virtual cache container, limiting the reading and writing of specified files by specified road parking identification business applications.

7. A road parking identification method for a PDA device with an integrated encryption chip as claimed in claim 6, characterized in that: It also includes identifying the user of the PDA device, specifically obtaining the user's biometric verification information, matching and verifying the biometric verification information through a preset user authority library, and generating a user verification result. The user verification result includes the user authority level of the user, and taking the minimum value of the user authority level and the PDA device authority level to assign the access permission level, and generating device identification information, and matching the corresponding whitelist scenario according to the device identification information.

8. A road parking identification method for a PDA device with an integrated encryption chip as claimed in claim 1, characterized in that: The encryption operation of the first identification data includes: vehicle identification information, vehicle owner information, vehicle stay time and location information, vehicle payment information, and vehicle parking space identification information; The requested cryptographic operation includes one of an encryption operation, a decryption operation, a signature authentication operation, an external isolation operation, or a file protection operation.

9. A system for road parking identification method applied to the PDA device with integrated encryption chip as claimed in claim 7, characterized in that: The system is an embedded road parking identification PDA device system, and the road parking identification PDA device system includes an integrated encryption chip unit and a main control chip unit; the integrated encryption chip unit includes a cache container generation module, a data receiving module, a data encryption module, a signature authentication module, and an execution module; A cache container generation module, used to generate a virtual cache container for encryption in the embedded road parking identification PDA device system using a key of the integrated encryption chip unit based on the container technology, so that the road parking identification data processing work of the road parking identification PDA device system can be run in the virtual cache container; A data receiving module, configured to respond to the first identification data and perform an encryption operation on the first identification data based on the virtual cache container to form second identification data, and for the integrated encryption chip unit to receive the random code generated by the main control chip unit and the plain text sent by the main control chip unit to the integrated encryption chip unit; The data encryption module, the integrated encryption chip unit receives the request for performing the encryption operation and performs decryption comparison, wherein the integrated encryption chip unit receives the random code generated by the main control chip unit and the plain text sent by the main control chip unit to the integrated encryption chip unit, and then encrypts the plain text by the encryption algorithm to generate cipher text and returns the generated decrypted cipher text for comparison; The signature authentication module is used to integrate the virtual cache container of the encryption chip unit to take isolation measures for the outside and determine the internal as trusted authentication, and perform data encryption processing to ensure the information security of the road parking identification business; an execution module, for responding to and determining that the road parking identification PDA device system identity information matches the key of the virtual cache container that is allowed to request the cryptographic operation, and the integrated encryption chip executes the cryptographic operation requested by the road parking identification PDA device system based on the key information stored in the virtual cache container; The main control chip unit includes an image acquisition and processing module, a parking recognition authority allocation module, a data upload module, and a biometric verification module; The image acquisition and processing module is used to collect, analyze and process the image of the road parking position through the PDA device to complete the detection and recognition of the road parking space and form the first recognition data a parking identification authority allocation module, configured to allocate parking identification authority after decrypting and comparing the second identification data, to search for pre-set data according to the access permission level and allocate a policy library, to obtain a data classification policy matching the access permission level, the data classification policy being used to characterize the data content securely accessed by the encrypted second identification data corresponding to the access permission level, to allocate the data content securely accessed in the second identification data according to the data classification policy, to respond to the data content securely accessed and to generate interactive list information of the second identification data file according to the data classification policy; A data uploading module, used to identify the data content of the secure access in the second identification data according to the interaction list information and upload it to the road parking cloud management system; The biometric verification module is used to match and verify the biometric verification information through a preset user authority library to generate a user verification result, which includes the user authority level of the user, and assigns the access permission level as the minimum value of the user authority level and the PDA device authority level, and generates device identification information, and matches the corresponding whitelist scenario according to the device identification information.

Images