Vehicle data processing method and system and vehicle

Abstract

The invention discloses a data processing method and system of a vehicle and the vehicle. The method can be at least applied to the field of AI designated driving, and can comprise the steps that in the application service of a vehicle, target data to be processed are determined, the safety level of the target data is higher than a safety level threshold value, and the safety level is used for representing the safety degree of the target data; at least one field identifier of the target data is identified, and the field identifier is used for representing a to-be-operated field annotated in the target data; based on the field identifier, an operation type corresponding to the to-be-operated field is determined, and the operation type is used for representing the type of a to-be-executed security conversion operation on the to-be-operated field; and calling an interceptor to execute a security conversion operation corresponding to the operation type on the to-be-operated field to obtain a target field, the target field being used for executing a data processing operation in the application service. According to the invention, the technical problem of low safety of vehicle data processing is solved.

Description

Technical Field

[0001] The present invention relates to the field of data security, and in particular to a vehicle data processing method, system and vehicle. Background Art

[0002] Currently, in vehicle data processing, special processing or configuration may be required in some places to support complex security conversion operations on sensitive data. For example, to support encryption operations on sensitive data, encryption functions need to be explicitly called in the business code. Similarly, to support decryption operations on sensitive data, decryption functions need to be explicitly called in the business code.

[0003] However, the above-mentioned explicit call of the encryption function or the explicit call of the decryption function will increase the intrusiveness of the business code, thereby causing a technical problem of low security in vehicle processing data.

[0004] Currently, no effective solution has been proposed to the above-mentioned technical problem of low security of vehicle processing data. Summary of the invention

[0005] Embodiments of the present invention provide a vehicle data processing method, system and vehicle, so as to at least solve the technical problem of low security of vehicle data processing.

[0006] According to one aspect of an embodiment of the present invention, a vehicle data processing method is provided. The method may include: determining target data to be processed in an application service of the vehicle, wherein the security level of the target data is higher than a security level threshold, and the security level is used to indicate the security level of the target data; identifying at least one field identifier of the target data, wherein the field identifier is used to indicate the field to be operated annotated in the target data; determining the operation type corresponding to the field to be operated based on the field identifier, wherein the operation type is used to indicate the type of security conversion operation to be performed on the field to be operated; calling an interceptor to perform a security conversion operation corresponding to the operation type on the field to be operated, and obtaining a target field, wherein the target field is used to perform data processing operations in the application service.

[0007] Optionally, identifying at least one field identifier of the target data includes: identifying at least one of a first field identifier and a second field identifier of the target data, wherein the first field identifier is used to represent a field to be encrypted annotated in the target data, and the second field identifier is used to represent a field to be decrypted annotated in the target data.

[0008] Optionally, the security conversion operation includes: encryption operation and decryption operation, and based on the field identifier, determining the operation type corresponding to the field to be operated, including: in response to the field identifier being a first field identifier, determining the encryption operation type corresponding to the field to be encrypted, wherein the encryption operation type is used to indicate the type of encryption operation to be performed on the field to be encrypted; in response to the field identifier being a second field identifier, determining the decryption operation type corresponding to the field to be decrypted, wherein the decryption operation type is used to indicate the type of decryption operation to be performed on the field to be decrypted.

[0009] Optionally, the interceptor is called to perform a security conversion operation corresponding to the operation type on the field to be operated to obtain a target field, including: in response to the operation type being an encryption operation type, the interceptor is called to perform an encryption operation on the field to be encrypted to obtain a first target field, wherein the first target field is used to execute a first data processing operation matching the field to be encrypted in the application service; in response to the operation type being a decryption operation type, the interceptor is called to perform a decryption operation on the field to be decrypted to obtain a second target field, wherein the second target field is used to execute a second data processing operation matching the field to be decrypted in the application service.

[0010] Optionally, in response to the operation type being an encryption operation type, calling an interceptor to perform an encryption operation on the field to be encrypted to obtain a first target field, including: in response to the operation type being an encryption operation type, calling an interceptor to determine an encryption policy, wherein the encryption policy is used to represent the rules for performing encryption operations on the field to be encrypted, and the encryption policy matches the data type and / or security level of the field to be encrypted; using the interceptor to perform an encryption operation on the encrypted field according to the encryption policy to obtain the first target field; in response to the operation type being a decryption operation type, calling an interceptor to perform a decryption operation on the field to be decrypted to obtain a second target field, including: in response to the operation type being a decryption operation type, calling an interceptor to determine a decryption policy, wherein the decryption policy is used to represent the rules for performing decryption operations on the field to be decrypted, and the decryption policy matches the data type and / or security level of the field to be decrypted; using the interceptor to perform a decryption operation on the field to be decrypted according to the decryption policy to obtain the second target field.

[0011] Optionally, an interceptor is used to perform an encryption operation on the encrypted field according to the encryption policy to obtain a first target field, including: using the interceptor to obtain an encryption key from a key management system and storing the encryption key in a target memory; obtaining an encryption key from the target memory according to the encryption policy, and using the obtained encryption key to perform an encryption operation on the encrypted field to obtain the first target field; using the interceptor to perform a decryption operation on the decrypted field according to the decryption policy to obtain a second target field, including: using the interceptor to obtain a decryption key from the key management system and storing the decryption key in the target memory; obtaining a decryption key from the target memory according to the decryption policy, and using the obtained decryption key to perform a decryption operation on the decrypted field to obtain a second target field.

[0012] Optionally, identifying the first field identifier of the target data includes: before executing a first query statement, calling an interceptor to identify the first field identifier of the target data, wherein the first query statement is used to indicate that the data processing operation is a data insertion operation or a data update operation; identifying the second field identifier of the target data includes: after executing a second query statement, calling an interceptor to identify the second field identifier of the target data, wherein the second query statement is used to indicate a data query operation to be performed on the field to be decrypted.

[0013] Optionally, the method further includes: monitoring exception information during the process of performing the security conversion operation on the field to be operated, wherein the exception information is used to indicate that the security conversion operation on the field to be operated has failed.

[0014] According to another aspect of an embodiment of the present invention, a vehicle data processing system is also provided. The system may include: an annotation module, used to annotate at least one field to be operated in the target data to obtain at least one field identifier, wherein the target data comes from the application service of the vehicle, and the security level of the target data is higher than the security level threshold, the security level is used to indicate the security level of the target data, and the field identifier is used to indicate the field to be operated annotated in the target data; an interceptor module, used to identify the field identifier; based on the field identifier, determine the operation type corresponding to the field to be operated, wherein the operation type is used to indicate the type of security conversion operation to be performed on the field to be operated; call the interceptor to perform the security conversion operation corresponding to the operation type on the field to be operated, and obtain the target field, wherein the target field is used to perform the data processing operation in the application service; a monitoring module, used to monitor abnormal information during the process of the interceptor performing the security conversion operation on the field to be operated, wherein the abnormal information is used to indicate the failure of performing the security conversion operation on the field to be operated.

[0015] Optionally, the interceptor module includes: an identification submodule, used to identify at least one of a first field identifier and a second field identifier of the target data, wherein the first field identifier is used to represent a field to be encrypted annotated in the target data, and the second field identifier is used to represent a field to be decrypted annotated in the target data.

[0016] Optionally, the security conversion operation includes: encryption operation and decryption operation, and the interceptor module includes: a first determination submodule, used to determine the encryption operation type corresponding to the field to be encrypted in response to the field identifier being a first field identifier, wherein the encryption operation type is used to indicate the type of encryption operation to be performed on the field to be encrypted; a second determination submodule, used to determine the decryption operation type corresponding to the field to be decrypted in response to the field identifier being a second field identifier, wherein the decryption operation type is used to indicate the type of decryption operation to be performed on the field to be decrypted.

[0017] Optionally, the interceptor module includes: an encryption sub-module, which is used to call the interceptor to perform an encryption operation on the field to be encrypted in response to the operation type being an encryption operation type, and obtain a first target field, wherein the first target field is used to execute a first data processing operation that matches the field to be encrypted in the application service; a decryption sub-module, which is used to call the interceptor to perform a decryption operation on the field to be decrypted in response to the operation type being a decryption operation type, and obtain a second target field, wherein the second target field is used to execute a second data processing operation that matches the field to be decrypted in the application service.

[0018] Optionally, the encryption submodule, in response to the operation type being an encryption operation type, calls the interceptor to perform an encryption operation on the field to be encrypted to obtain a first target field by executing the following steps: in response to the operation type being an encryption operation type, calls the interceptor to determine an encryption policy, wherein the encryption policy is used to represent the rules for performing encryption operations on the field to be encrypted, and the encryption policy matches the data type and / or security level of the field to be encrypted; uses the interceptor to perform encryption operations on the field to be encrypted according to the encryption policy to obtain the first target field; the decryption submodule, in response to the operation type being a decryption operation type, calls the interceptor to perform a decryption operation on the field to be decrypted to obtain a second target field by executing the following steps: in response to the operation type being a decryption operation type, calls the interceptor to determine a decryption policy, wherein the decryption policy is used to represent the rules for performing decryption operations on the field to be decrypted, and the decryption policy matches the data type and / or security level of the field to be decrypted; uses the interceptor to perform a decryption operation on the field to be decrypted according to the decryption policy to obtain the second target field.

[0019] Optionally, the encryption submodule uses the interceptor to perform an encryption operation on the encrypted field according to the encryption policy to obtain a first target field by executing the following steps: using the interceptor to obtain an encryption key from the key management system, and storing the encryption key in the target memory; obtaining the encryption key from the target memory according to the encryption policy, and using the obtained encryption key to perform an encryption operation on the encrypted field to obtain the first target field; the decryption submodule uses the interceptor to perform a decryption operation on the decrypted field according to the decryption policy to obtain a second target field by executing the following steps: using the interceptor to obtain a decryption key from the key management system, and storing the decryption key in the target memory; obtaining the decryption key from the target memory according to the decryption policy, and using the obtained decryption key to perform a decryption operation on the decrypted field to obtain a second target field.

[0020] Optionally, the identification submodule can identify the first field identifier of the target data by performing the following steps: before executing the first query statement, calling the interceptor to identify the first field identifier of the target data, wherein the first query statement is used to indicate that the data processing operation is a data insertion operation or a data update operation; the identification submodule can identify the second field identifier of the target data by performing the following steps: after executing the second query statement, calling the interceptor to identify the second field identifier of the target data, wherein the second query statement is used to indicate the data query operation performed on the field to be decrypted.

[0021] According to another aspect of an embodiment of the present invention, a vehicle is provided, including: a memory storing an executable program; and a processor for running the program, wherein the program executes any one of the above methods when running.

[0022] According to another aspect of an embodiment of the present invention, a computer-readable storage medium is provided, the computer-readable storage medium including a stored executable program, wherein when the executable program runs, the device where the storage medium is located is controlled to execute any one of the above methods.

[0023] According to another aspect of an embodiment of the present invention, a computer program product is provided. The computer program product includes a computer program. When the computer program is executed by a processor, any one of the above methods is implemented.

[0024] In an embodiment of the present invention, when processing vehicle data, the target data to be processed can be determined in the vehicle's application service, and at least one field identifier of the target data can be identified. Based on the identified field identifier, the type of operation corresponding to the field to be operated can be determined, that is, the type of security conversion operation to be performed on the field to be operated can be determined, and the interceptor can be called to perform the security conversion operation corresponding to the operation type on the field to be operated, and the target field can be obtained. Since the embodiment of the present application can determine the type of security conversion operation to be performed on the field to be operated based on the identification of the field to be operated annotated in the target data, and perform the security conversion operation corresponding to the operation type on the field to be operated, the target field can be obtained, thereby achieving the purpose of being able to execute data processing operations in the application service, thereby solving the technical problem of low security of vehicle processing data, and further achieving the technical effect of improving the security of vehicle processing data. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] The drawings described herein are used to provide a further understanding of the present invention and constitute a part of the present invention. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the drawings:

[0026] Figure 1 is a schematic diagram of an application scenario of a vehicle data processing method according to an embodiment of the present invention;

[0027] Figure 2 This is a flow chart of a data encryption and decryption interception method based on MyBatis according to an embodiment of the present invention;

[0028] Figure 3 is a structural block diagram of a vehicle data processing system according to an embodiment of the present invention;

[0029] Figure 4 is a structural block diagram of a vehicle according to an embodiment of the present invention. DETAILED DESCRIPTION

[0030] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0031] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0032] According to an embodiment of the present invention, a vehicle data processing method is provided.

[0033] As an optional implementation, the vehicle data processing method can be applied to, but is not limited to, Figure 1 The application scenario shown. Figure 1 is a schematic diagram of an application scenario of a vehicle data processing method according to an embodiment of the present invention, such as Figure 1 As shown, in the application scenario, the terminal device 10 can communicate with the server 13 through the network 11, but is not limited to, and the server 13 can perform operations on the database, such as writing data operations or reading data operations. The terminal device 10 can include, but is not limited to, a human-computer interaction screen, a processor, and a memory. The human-computer interaction screen can be used to display a virtual machine on the terminal device 10, but is not limited to. The vehicle 12 can be used to respond to the human-computer interaction operation, perform a corresponding operation, or generate a corresponding instruction, and send the generated instruction to the server 13.

[0034] It should be noted that the steps shown in the flowcharts of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and that, although a logical order is shown in the flowcharts, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0035] Figure 1 is a schematic diagram of an application scenario of an image display method for a driving scene according to an embodiment of the present invention, such as Figure 1 As shown, the method comprises the following steps:

[0036] Step S102, in the vehicle application service, determining the target data to be processed.

[0037] In the technical solution provided in the above step S102 of the present invention, the security level of the above target data can be higher than the security level threshold, and can be used to represent sensitive data in the application service of the vehicle. Among them, the security level can be used to represent the degree of security that the target data needs to achieve. For example, the security level threshold can be represented by any of the identifiers A1, A2, A3, A4, A5, A6, A7, A8 and A9, and the values ​​corresponding to A1 to A8 can be less than the value corresponding to A9. If the security level threshold is A9, the security level of the target data can be higher than A9. This is only an example and is not specifically limited.

[0038] Optionally, in this embodiment, the above-mentioned target data to be processed can be used to represent at least one of the following data: sensitive data to be inserted into the database, sensitive data to be updated in the database, and sensitive data to be queried from the database, etc. This is only an example and is not specifically limited.

[0039] Optionally, the above-mentioned sensitive data may include at least: vehicle key information and vehicle key information, etc. The vehicle key information can be used to represent the attributes of the key for encrypting and decrypting the fields to be operated, and the vehicle key information can be used to represent the attributes of the electronic key for starting the vehicle through an application. This is only an example and is not specifically limited.

[0040] In this embodiment, the above application service can be used to represent a service for controlling and managing a vehicle. For example, the above application service can at least include: a vehicle control service and a vehicle management service, etc., which are only given as examples and are not specifically limited.

[0041] In this embodiment, in the application service of the vehicle, the target data to be processed is determined. Optionally, in this embodiment, in the application service of the vehicle, the data involved in the application service is screened to obtain the target data to be processed.

[0042] Optionally, in the application service of the vehicle, the data involved in the application service is screened to obtain the target data to be processed. For example, in the vehicle control service and vehicle management service of the vehicle, the data involved in the vehicle control service and vehicle management service are screened according to the order of the sensitivity of the data, and the key information and key information to be processed can be obtained. Among them, the sensitivity of the key information and the sensitivity of the key information can be higher than the sensitivity of the remaining data except the sensitivity of the key information and the sensitivity of the key information in the above-mentioned data, which is only used as an example here and is not specifically limited.

[0043] It should be noted that the sensitivity of the above data corresponds to the security level of the data. If the security level of the data is high, the data is highly sensitive data, and if the security level of the data is low, the data is low sensitive data. Among them, the ranking of highly sensitive data can be prior to the ranking of low sensitive data, which is only used as an example here and is not specifically limited.

[0044] Step S104, identifying at least one field identifier of the target data.

[0045] In the technical solution provided in the above step S104 of the present invention, the above field identifier can be used to represent the field to be operated annotated in the target data. Among them, the above field identifier can include a first field identifier and a second field identifier, the first field identifier can be used to represent the field to be encrypted annotated in the target data, which can be represented by an encryption annotation (@EncryptField), the second field identifier can be used to represent the field to be decrypted annotated in the target data, which can be represented by a decryption annotation (@DecryptField), the above annotation can be implemented in a programming language (for example, Java), and the above field to be operated can be used to represent the encrypted field to be encrypted and the decrypted field to be decrypted in the target data, which is only used as an example and is not specifically limited.

[0046] In this embodiment, after determining the target data to be processed in the application service of the vehicle, at least one field identifier of the target data is identified. Optionally, based on determining the target data to be processed, this embodiment can identify at least one field identifier from the determined target data. For example, based on determining the sensitive data in the application service of the vehicle, at least one of the following field identifiers can be found from the determined sensitive data: a first field identifier and a second field identifier, which are only used as examples and are not specifically limited.

[0047] It should be noted that the above method for identifying at least one field identifier of target data is only an example and is not specifically limited here. As long as the process and method can identify at least one field identifier of target data, they are within the protection scope of the embodiments of the present application and are not described one by one here.

[0048] Step S106: Determine the operation type corresponding to the field to be operated based on the field identifier.

[0049] In the technical solution provided in the above step S106 of the present invention, the above operation type can be used to indicate the type of security conversion operation to be performed on the field to be operated. The security conversion operation can be used to indicate the encryption operation and decryption operation to be performed on the field to be operated.

[0050] In this embodiment, after identifying at least one field identifier of the target data, the operation type corresponding to the field to be operated is determined based on the field identifier. Optionally, this embodiment judges the relationship between the identified field identifier and the first field identifier and the second field identifier on the basis of identifying at least one field identifier of the target data, and a first judgment result can be obtained. The first judgment result can be that the identified field identifier is the first field identifier, or the identified field identifier is the second field identifier. Based on the obtained first judgment result, the operation type corresponding to the field to be operated can be determined. In other words, based on the obtained first judgment result, it can be determined whether the type of security conversion operation to be performed on the field to be operated is an encryption operation type or a decryption operation type.

[0051] It should be noted that the above method for determining the operation type corresponding to the field to be operated based on the field identifier is only an example and is not specifically limited here. As long as the process and method can determine the operation type corresponding to the field to be operated based on the field identifier, it is within the protection scope of the embodiments of the present application and will not be described one by one here.

[0052] Step S108, calling the interceptor to perform a security conversion operation corresponding to the operation type on the field to be operated, and obtaining a target field.

[0053] In the technical solution provided in step S108 of the present invention, the target field can be used to perform data processing operations in the application service. The data processing operation may include at least one of the following operations: insert operation (INSERT), update operation (UPDATE) and query operation (SELECT), etc., which are only used as examples and are not specifically limited.

[0054] In this embodiment, the interceptor may be a structured query language (SQL) interceptor implemented based on a Java persistence layer framework (MyBatis).

[0055] In this embodiment, after determining the operation type corresponding to the field to be operated based on the field identifier, the interceptor is called to perform a security conversion operation corresponding to the operation type on the field to be operated to obtain a target field. Optionally, this embodiment determines whether the determined operation type is an encryption operation type or a decryption operation type on the basis of determining the operation type corresponding to the field to be operated, and a second judgment result can be obtained, and the second judgment result can be that the determined operation type is an encryption operation type, or that the determined operation type is a decryption operation type. Based on the second judgment result obtained, the interceptor is called to perform an encryption operation or a decryption operation corresponding to the determined operation type on the field to be operated, and the target field can be obtained, thereby achieving the purpose of being able to execute data processing operations in the application service.

[0056] It should be noted that the vehicle data processing method in this application can also be applied to at least the following scenarios: assisted driving scenarios and passive driving scenarios (which can be referred to as human driving scenarios). Among them, the assisted driving scenario can be used to indicate a scenario in which the vehicle's control system provides assistance during driving, but the driver still needs to maintain control and supervision of the driving, and the passive driving scenario can be used to indicate a scenario in which the driver controls the vehicle to complete the driving operation.

[0057] In the artificial intelligence AI driving of autonomous vehicles, commuting mode usually refers to a driving mode designed for commuting or daily commuting. Among them, the AI ​​driving can collect data by learning the user's driving route and driving behavior. When all the learning is completed, the collected data is screened and checked, and then the full segment of data after screening and checking is automatically transmitted back to the cloud server to execute the construction of the cloud map. The next time you drive and choose the same route, the AI ​​driving will be activated, and the vehicle will be driven to the destination of the route according to the constructed cloud map. Among them, matching and complementing the offline map with the constructed cloud map can improve the accuracy of the map.

[0058] In the above steps S102 to S108 of the present application, when the same route as the last time you drove is chosen for this driving, the AI ​​driver can be activated to drive the vehicle according to the acquired navigation information. During the driving of the vehicle, the vehicle data is processed in real time. In the application service of the vehicle, the AI ​​driver can determine the target data to be processed and identify at least one field identifier of the target data. Based on the identified field identifier, the AI ​​driver can determine the type of security conversion operation to be performed on the operation field, and call the interceptor to perform the security conversion operation corresponding to the operation type on the operation field, so as to obtain the target field. Therefore, based on the identification of the annotated field to be operated in the target data, the AI ​​driver can determine the type of security conversion operation to be performed on the operation field, and perform the security conversion operation corresponding to the operation type on the operation field, so as to obtain the target field.

[0059] In the above steps S102 to S108 of the present application, when processing the data of the vehicle, the target data to be processed can be determined in the application service of the vehicle, and at least one field identifier of the target data can be identified. According to the identified field identifier, the type of operation corresponding to the field to be operated can be determined, that is, the type of security conversion operation to be performed on the field to be operated can be determined, and the interceptor can be called to perform the security conversion operation corresponding to the operation type on the field to be operated, and the target field can be obtained. Since the embodiment of the present application can determine the type of security conversion operation to be performed on the field to be operated on the basis of identifying the field to be operated annotated in the target data, and perform the security conversion operation corresponding to the operation type on the field to be operated, the target field can be obtained, thereby achieving the purpose of being able to execute data processing operations in the application service, thereby solving the technical problem of low security of vehicle processing data, and then achieving the technical effect of improving the security of vehicle processing data.

[0060] The above method of this embodiment is further introduced below.

[0061] As an optional implementation manner, step S104, identifying at least one field identifier of the target data, includes: identifying at least one of a first field identifier and a second field identifier of the target data.

[0062] In this embodiment, the first field identifier may be used to indicate a field to be encrypted annotated in the target data, and the second field identifier may be used to indicate a field to be decrypted annotated in the target data.

[0063] In this embodiment, the above-mentioned field to be encrypted can be used to indicate a field in the target data that needs to be encrypted. The above-mentioned field to be decrypted can be used to indicate a field in the target data that needs to be decrypted.

[0064] In this embodiment, in the application service of the vehicle, after the target data to be processed is determined, at least one of the first field identifier and the second field identifier of the target data is identified. Optionally, based on the determination of the target data to be processed, this embodiment can identify at least one of the following field identifiers from the determined target data: the first field identifier and the second field identifier, for example, the first field identifier represented by @EncryptField and the second field identifier represented by @DecryptField can be identified, thereby achieving the purpose of determining the fields to be encrypted and the fields to be decrypted in the target data, and realizing the technical effect of improving the accuracy of locating the fields.

[0065] The method for determining the operation type corresponding to the field to be operated based on the field identifier of the embodiment is further described below.

[0066] As an optional implementation method, step S106, based on the field identifier, determines the operation type corresponding to the field to be operated, including: in response to the field identifier being a first field identifier, determining the encryption operation type corresponding to the field to be encrypted; in response to the field identifier being a second field identifier, determining the decryption operation type corresponding to the field to be decrypted.

[0067] In this embodiment, the above-mentioned security conversion operation may include: an encryption operation to be performed on the encrypted field and a decryption operation to be performed on the decrypted field. The above-mentioned encryption operation type can be used to indicate the type of encryption operation to be performed on the encrypted field, and the above-mentioned decryption operation type can be used to indicate the type of decryption operation to be performed on the decrypted field.

[0068] In this embodiment, after identifying at least one field identifier of the target data, in response to the field identifier being the first field identifier, the encryption operation type corresponding to the field to be encrypted is determined. Optionally, this embodiment, based on identifying at least one field identifier of the target data, determines the relationship between the identified field identifier and the first field identifier and the second field identifier, and can obtain a first judgment result. If the first judgment result obtained is that the field identifier is the first field identifier, it can be determined that the operation type corresponding to the field to be operated is the encryption operation type corresponding to the field to be encrypted, thereby achieving the purpose of determining the operation type corresponding to the field to be operated.

[0069] In this embodiment, after identifying at least one field identifier of the target data, in response to the field identifier being the second field identifier, the decryption operation type corresponding to the field to be decrypted is determined. Optionally, this embodiment, based on identifying at least one field identifier of the target data, determines the relationship between the identified field identifier and the first field identifier and the second field identifier, and can obtain a first judgment result. If the first judgment result obtained is that the field identifier is the second field identifier, it can be determined that the operation type corresponding to the field to be operated is the decryption operation type corresponding to the field to be decrypted, thereby achieving the purpose of determining the operation type corresponding to the field to be operated.

[0070] The following further describes a method in which the call interceptor of this embodiment performs a security conversion operation corresponding to the operation type on the field to be operated to obtain the target field.

[0071] As an optional implementation method, step S108, calls the interceptor to perform a security conversion operation corresponding to the operation type on the operation field to obtain a target field, including: in response to the operation type being an encryption operation type, calling the interceptor to perform an encryption operation on the encrypted field to obtain a first target field; in response to the operation type being a decryption operation type, calling the interceptor to perform a decryption operation on the decrypted field to obtain a second target field.

[0072] In this embodiment, the first target field can be used to execute a first data processing operation that matches the field to be encrypted in the application service, and the second target field can be used to execute a second data processing operation that matches the field to be decrypted in the application service. For example, the first data processing operation can be any one of the following operations: an insert operation (INSERT) and an update operation (UPDATE), etc., and the second data processing operation can be any one of the following operations: a query operation (SELECT) and a read operation, etc., which are only exemplified here and are not specifically limited.

[0073] In this embodiment, after determining the operation type corresponding to the field to be operated based on the field identifier, in response to the operation type being an encryption operation type, the interceptor is called to perform an encryption operation on the field to be encrypted to obtain a first target field. Optionally, this embodiment determines whether the determined operation type is an encryption operation type or a decryption operation type based on the determination of the operation type corresponding to the field to be operated, and a second judgment result can be obtained. If the second judgment result obtained is that the determined operation type is an encryption operation type, the interceptor is called to perform an encryption operation on the field to be encrypted, and the first target field can be obtained, thereby achieving the purpose of being able to execute the first data processing operation that matches the field to be encrypted in the application service.

[0074] In this embodiment, after determining the operation type corresponding to the field to be operated based on the field identifier, in response to the operation type being a decryption operation type, the interceptor is called to perform a decryption operation on the field to be decrypted to obtain a second target field. Optionally, this embodiment determines whether the determined operation type is an encryption operation type or a decryption operation type based on the determination of the operation type corresponding to the field to be operated, and a second judgment result can be obtained. If the second judgment result obtained is that the determined operation type is a decryption operation type, the interceptor is called to perform a decryption operation on the field to be decrypted, and the second target field can be obtained, thereby achieving the purpose of being able to execute the second data processing operation that matches the field to be decrypted in the application service.

[0075] The following further describes the method of calling the interceptor to perform an encryption operation on the encrypted field to obtain the first target field in response to the operation type being an encryption operation type, and the method of calling the interceptor to perform a decryption operation on the decrypted field to obtain the second target field in response to the operation type being a decryption operation type.

[0076] As an optional implementation method, in response to the operation type being an encryption operation type, calling an interceptor to perform an encryption operation on a field to be encrypted to obtain a first target field, including: in response to the operation type being an encryption operation type, calling an interceptor to determine an encryption strategy; using the interceptor to perform an encryption operation on the encrypted field according to the encryption strategy to obtain the first target field; in response to the operation type being a decryption operation type, calling the interceptor to perform a decryption operation on the field to be decrypted to obtain a second target field, including: in response to the operation type being a decryption operation type, calling the interceptor to determine a decryption strategy; using the interceptor to perform a decryption operation on the field to be decrypted according to the decryption strategy to obtain the second target field.

[0077] In this embodiment, the encryption strategy can be used to represent the rules for performing encryption operations on the encrypted field, and the encryption strategy can match the data type and / or security level of the encrypted field. For example, the encryption strategy can be a strategy implemented based on at least one of the following algorithms: Advanced Encryption Standard (AES) algorithm and Rivest-Shamir-Adleman (RSA) algorithm, etc., which are only used as examples and are not specifically limited.

[0078] In this embodiment, the decryption strategy can be used to represent the rules for performing the decryption operation on the field to be decrypted, and the decryption strategy can match the data type and / or security level of the field to be decrypted. For example, the decryption strategy can be a strategy implemented based on at least one of the following algorithms: AES algorithm and RSA algorithm, etc., which are only used as examples and are not specifically limited.

[0079] In this embodiment, after determining the operation type corresponding to the field to be operated based on the field identifier, in response to the operation type being an encryption operation type, the interceptor is called to determine the encryption strategy. Optionally, this embodiment determines whether the determined operation type is an encryption operation type or a decryption operation type based on the determination of the operation type corresponding to the field to be operated, and a second judgment result can be obtained. If the second judgment result obtained is that the determined operation type is an encryption operation type, the interceptor is called to determine the encryption strategy that matches the data type and / or security level of the field to be encrypted, thereby achieving the purpose of determining the encryption strategy.

[0080] In this embodiment, after the encryption strategy is determined, the interceptor is used to perform an encryption operation on the field to be encrypted according to the encryption strategy to obtain the first target field. Optionally, based on the encryption strategy determined, the embodiment uses the interceptor to select an encryption key that is compatible with the determined encryption strategy, and performs an encryption operation on the field to be encrypted to obtain the first target field, thereby achieving the purpose of being able to execute the first data processing operation that matches the field to be encrypted in the application service.

[0081] In this embodiment, after determining the operation type corresponding to the field to be operated based on the field identifier, in response to the operation type being a decryption operation type, the interceptor is called to determine the decryption strategy. Optionally, this embodiment determines whether the determined operation type is an encryption operation type or a decryption operation type based on the determination of the operation type corresponding to the field to be operated, and a second judgment result can be obtained. If the second judgment result obtained is that the determined operation type is a decryption operation type, the interceptor is called to determine the decryption strategy that matches the data type and / or security level of the field to be decrypted, thereby achieving the purpose of determining the decryption strategy.

[0082] In this embodiment, after the decryption strategy is determined, the interceptor is used to perform a decryption operation on the field to be decrypted according to the decryption strategy to obtain the second target field. Optionally, based on the determination of the decryption strategy, the embodiment uses the interceptor to select a decryption key that is compatible with the determined decryption strategy, and performs a decryption operation on the field to be decrypted to obtain the second target field, thereby achieving the purpose of being able to execute the second data processing operation that matches the field to be decrypted in the application service.

[0083] The following further describes the method of using an interceptor to perform an encryption operation on the encrypted field according to the encryption policy to obtain the first target field, and the method of using an interceptor to perform a decryption operation on the decrypted field according to the decryption policy to obtain the second target field.

[0084] As an optional implementation method, an interceptor is used to perform an encryption operation on an encrypted field according to an encryption policy to obtain a first target field, including: using an interceptor to obtain an encryption key from a key management system and storing the encryption key in a target memory; obtaining an encryption key from the target memory according to the encryption policy, and using the obtained encryption key to perform an encryption operation on the encrypted field to obtain the first target field; using an interceptor to perform a decryption operation on the decrypted field according to a decryption policy to obtain a second target field, including: using an interceptor to obtain a decryption key from the key management system and storing the decryption key in the target memory; obtaining a decryption key from the target memory according to the decryption policy, and using the obtained decryption key to perform a decryption operation on the decrypted field to obtain a second target field.

[0085] In this embodiment, the key management system may be implemented based on a key management server (Key Management Service, KMS for short), and the target memory may be an application memory of the vehicle, which is only used as an example here without any specific limitation.

[0086] In this embodiment, after the encryption strategy is determined, the encryption key is obtained from the key management system using an interceptor, and the encryption key is stored in the target memory. Optionally, based on the encryption strategy determined, this embodiment can use an interceptor to search and obtain the encryption key from the key management system, and the obtained encryption key can be stored in the vehicle's application memory, thereby achieving the purpose of real-time storage of the encryption key.

[0087] In this embodiment, after the encryption key is stored in the target memory, the encryption key is obtained from the target memory according to the encryption policy, and the encryption operation is performed on the field to be encrypted using the obtained encryption key to obtain the first target field. Optionally, on the basis of storing the encryption key in the target memory, according to the determined encryption policy, the encryption key adapted to the encryption policy can be selected and obtained from the target memory, and the encryption operation is performed on the field to be encrypted using the encryption key adapted to the encryption policy to obtain the first target field, thereby achieving the purpose of being able to execute the first data processing operation matching the field to be encrypted in the application service.

[0088] In this embodiment, after the decryption strategy is determined, the decryption key is obtained from the key management system using an interceptor, and the decryption key is stored in the target memory. Optionally, based on the determination of the decryption strategy, this embodiment can use an interceptor to search and obtain the decryption key from the key management system, and store the obtained decryption key in the vehicle's application memory, thereby achieving the purpose of storing the decryption key in real time.

[0089] In this embodiment, after the decryption key is stored in the target memory, the decryption key is obtained from the target memory according to the decryption strategy, and the obtained decryption key is used to perform a decryption operation on the field to be decrypted to obtain the second target field. Optionally, on the basis of storing the decryption key in the target memory, according to the determined decryption strategy, the embodiment can select and obtain an encryption key that matches the decryption strategy from the target memory, and use the decryption key that matches the decryption strategy to perform a decryption operation on the field to be decrypted to obtain the second target field, thereby achieving the purpose of being able to execute the second data processing operation that matches the field to be decrypted in the application service.

[0090] It should be noted that the above key management system can also support regular rotation of keys and key backup strategies. Among them, regular rotation of keys can be used to ensure the security and flexibility of keys, and the key backup strategy can be used to ensure that in the event of key anomalies, the same backup key can be obtained from the key management system.

[0091] The method for identifying the first field identifier of target data and the method for identifying the second field identifier of target data of this embodiment are further described below.

[0092] As an optional implementation method, identifying the first field identifier of the target data includes: before executing the first query statement, calling the interceptor to identify the first field identifier of the target data; identifying the second field identifier of the target data includes: after executing the second query statement, calling the interceptor to identify the second field identifier of the target data.

[0093] In this embodiment, the first query statement may be used to indicate that the data processing operation is a data insertion operation or a data update operation, and the second query statement may be used to indicate a data query operation performed on the field to be decrypted. For example, the first query statement may be an INSERT statement or an UPDATE statement, and the second query statement may be a SELECT statement, which is only used as an example and is not specifically limited.

[0094] In this embodiment, before executing the first query statement, the interceptor is called to identify the first field identifier of the target data. Optionally, based on determining the target data to be processed, before executing the data insertion operation or the data update operation, the interceptor is called, and the first field identifier can be identified from the determined target data, for example, the first field identifier represented by @EncryptField can be identified, thereby achieving the purpose of determining the field that needs to be encrypted in the target data.

[0095] In this embodiment, after executing the second query statement, the interceptor is called to identify the second field identifier of the target data. Optionally, this embodiment calls the interceptor before executing the data query operation based on the determination of the target data to be processed, and the second field identifier can be identified from the determined target data, for example, the second field identifier represented by @DecryptField can be identified, thereby achieving the purpose of determining the field that needs to be decrypted in the target data.

[0096] Optionally, before data is inserted or updated, the interceptor is used to check whether the field to be operated is annotated with @EncryptField. If it is annotated with @EncryptField, the encryption method is called to encrypt the data. After data query, the interceptor is used to check whether the field is annotated with @DecryptField. If it is annotated with @DecryptField, the decryption method is called to decrypt the data.

[0097] The data processing method for the vehicle of this embodiment is further described below.

[0098] As an optional implementation manner, the method further includes: monitoring abnormal information during the process of performing the security conversion operation on the field to be operated.

[0099] In this embodiment, the above-mentioned exception information can be used to indicate that the security conversion operation failed to be performed on the field to be operated. The above-mentioned exception information can be used to indicate that the encryption operation failed to be performed on the encrypted field, and can also be used to indicate that the decryption operation failed to be performed on the decrypted field, and can also be used to indicate that the encryption key for performing the encryption operation does not match the encryption key required by the encryption policy, and can be used to indicate that the decryption key for performing the decryption operation does not match the decryption key required by the decryption policy, which is only used as an example here and is not specifically limited.

[0100] In this embodiment, during the process of performing the security conversion operation on the field to be operated, the exception information is monitored. Optionally, this embodiment can monitor whether the encryption fails during the process of performing the encryption operation on the encrypted field, and can also monitor whether the decryption fails during the process of performing the decryption operation on the field to be decrypted, thereby achieving the purpose of improving the security of vehicle processing data.

[0101] The technical solution of the embodiment of the present invention is illustrated below in conjunction with preferred implementation modes.

[0102] Currently, in vehicle data processing, special processing or configuration may be required in some places to support complex security conversion operations on sensitive data. For example, to support encryption of sensitive data, encryption functions need to be explicitly called in business code. Similarly, to support decryption of sensitive data, decryption functions need to be explicitly called in business code.

[0103] However, the above-mentioned explicit call of the encryption function or the explicit call of the decryption function will increase the intrusiveness of the business code, thereby causing a technical problem of low security in vehicle processing data.

[0104] However, an embodiment of the present invention proposes a vehicle data processing method, which realizes the automation of the non-invasive security conversion operation (for example, data encryption and decryption operations) process through the combination of field annotations and interceptors, and encapsulates the logic of the security conversion operation at the framework level, eliminating the need to explicitly call encryption and decryption functions in the business code, thereby reducing the frequency of business code modification, thereby achieving the purpose of executing data processing operations in application services, thereby solving the technical problem of low security of vehicle data processing, and further achieving the technical effect of improving the security of vehicle data processing.

[0105] In this embodiment, through the MyBatis-based data encryption and decryption interception method, the field annotation can be combined with the interceptor to complete the non-intrusive security conversion operation, thereby executing the data processing operation in the application service. Figure 2 is a flow chart of a data encryption and decryption interception method based on MyBatis according to an embodiment of the present invention. Figure 2 As shown, the method may include the following steps:

[0106] Step S202: Create an encryption and decryption annotation class.

[0107] In the technical solution provided in step S202 of the present invention, encryption annotations and decryption annotations are defined. The encryption annotation can be used to mark the fields that need to be encrypted, for example, the encryption annotation can be represented by @EncryptField; the decryption annotation can be used to mark the fields that need to be decrypted, for example, the decryption annotation can be represented by @DecryptField.

[0108] After the encryption and decryption annotation class is created, the process proceeds to step S204 to add annotations to the fields of the objects to be encrypted and decrypted.

[0109] In the technical solution provided in the above step S204 of the present invention, an encryption annotation is added to the field of the object that needs to be encrypted; and a decryption annotation is added to the field of the object that needs to be decrypted.

[0110] In this embodiment, the above-mentioned annotated attributes can also support adding additional attributes to support more complex encryption strategies. For example, the additional attributes may include: the type of encryption algorithm and the key identifier (ID), etc., which are only used as examples here and are not specifically limited.

[0111] In this embodiment, the above steps S202 and S204 may be performed by the annotation module.

[0112] After annotating the fields of the object to be encrypted and decrypted, proceed to step S206 to implement the interceptor interface.

[0113] After the interception interface (Interceptor interface) is implemented, the process proceeds to step S208 to rewrite the interception (Intercept) method by analyzing the type of the SQL statement.

[0114] In the technical solution provided in the above step S208 of the present invention, in the Intercept method, the executed SQL statement type (INSERT / UPDATE / SELECT) is processed separately. That is, for insert and update operations, the parameter object is traversed to find and encrypt the fields marked with @EncryptField; for query operations, the result set is traversed to find and decrypt the fields marked with @DecryptField.

[0115] After rewriting the Intercept method, proceed to step S210 to process the complex object structure by recursively traversing the object graph.

[0116] In the technical solution provided in the above step S210 of the present invention, for the case involving nested objects, the interceptor needs to recursively traverse the object graph, and after finding all fields marked with encryption annotations or decryption annotations, perform corresponding encryption operations or decryption operations on the annotated fields.

[0117] After processing the complex object structure, the process proceeds to step S212 to process the exception information caught by the try-catch block.

[0118] In the technical solution provided in the above step S212 of the present invention, a try-catch block is added to the encryption and decryption logic, so that whether the encryption fails during the encryption operation on the encrypted field can be monitored, and whether the decryption fails during the decryption operation on the decrypted field can be monitored.

[0119] After processing the captured exception information, proceed to step S214 to configure Mybatis and register the interceptor.

[0120] In the technical solution provided in the above step S214 of the present invention, the developed interceptor is registered in the configuration file of MyBatis to ensure that the interceptor can be called before and after the SQL statement is executed. The interceptor can be used to mainly process parameter encryption (prepare) method and result set decryption (resultSet) method.

[0121] After configuring the Mybatis registration interceptor, proceed to step S216 and use the dynamic key to complete data encryption and decryption.

[0122] In the technical solution provided in the above step S216 of the present invention, a secure key management system is used to support dynamic loading of encryption keys and decryption keys. The encryption keys and decryption keys can be stored in an independent, secure key storage service. When the business application is started, the key can be obtained through a security protocol request and the obtained key can be encrypted and stored in the application memory, thereby achieving the purpose of avoiding hard-coding keys in the application code and reducing the risk of key leakage.

[0123] In this embodiment, the above dynamic key can be determined according to the encryption strategy and the decryption strategy. The encryption strategy can match the data type and / or security level of the field to be encrypted, and the decryption strategy can match the data type and / or security level of the field to be decrypted. The encryption strategy and the decryption strategy can both be strategies implemented based on at least one of the following algorithms: AES algorithm and RSA algorithm, etc., which are only used as examples and are not specifically limited.

[0124] Optionally, the updated key can be dynamically obtained from the key management system through the interceptor.

[0125] Optionally, through interceptors, external cryptographic services can be called directly, thus taking advantage of the advanced security features of these cryptographic services.

[0126] In this embodiment, the above steps S206 to S216 can be executed through the interceptor module.

[0127] It should be noted that the above key management system can also support dynamic update, regular rotation and key backup strategy of keys. Among them, dynamic update and regular rotation of keys can be used to ensure the security and flexibility of keys, and the key backup strategy can be used to ensure that in the case of key anomalies, the same backup key can be obtained from the key management system.

[0128] In the process of encrypting and decrypting data using dynamic keys, proceed to step S218 and step S220 to monitor the performance of the interceptor and monitor abnormal information.

[0129] In the technical solution provided in the above step S220 of the present invention, the above exception information can be used to indicate that an encryption operation has failed to be performed on a field to be encrypted, or that a decryption operation has failed to be performed on a field to be decrypted, or that an encryption key used to perform an encryption operation does not match an encryption key required by an encryption policy, or that a decryption key used to perform a decryption operation does not match a decryption key required by a decryption policy. This is merely an example and is not specifically limited.

[0130] In this embodiment, exception handling is added to the encryption and decryption method to ensure that when encryption or decryption fails, the vehicle's data processing system can properly handle it to prevent data loss or system crash.

[0131] In this embodiment, the above steps S218 to S220 may be executed by the monitoring module.

[0132] In this embodiment, through the combination of field annotations and interceptors, the automation of the non-intrusive security conversion operation process (for example, data encryption and decryption operations) is achieved, and the logic of the security conversion operation is encapsulated at the framework level. There is no need to explicitly call encryption and decryption functions in the business code, thereby reducing the frequency of business code modifications. The purpose of executing data processing operations in application services is achieved, thereby solving the technical problem of low security of vehicle processing data, and further achieving the technical effect of improving the security of vehicle processing data.

[0133] According to another aspect of the embodiment of the present invention, corresponding to the embodiment of the vehicle data processing method, the present specification also provides a vehicle data processing system, Figure 3 is a structural block diagram of a data processing system for a vehicle according to an embodiment of the present invention. Figure 3 As shown, the vehicle data processing system 300 may include: an annotation module 302 , an interceptor module 304 , and a monitoring module 306 .

[0134] The annotation module 302 is used to annotate at least one field to be operated in the target data to obtain at least one field identifier, wherein the target data comes from the application service of the vehicle, and the security level of the target data is higher than the security level threshold, the security level is used to indicate the security level of the target data, and the field identifier is used to indicate the field to be operated annotated in the target data.

[0135] The interceptor module 304 is used to identify the field identifier; based on the field identifier, determine the operation type corresponding to the field to be operated, wherein the operation type is used to indicate the type of security conversion operation to be performed on the field to be operated; call the interceptor to perform the security conversion operation corresponding to the operation type on the field to be operated, and obtain the target field, wherein the target field is used to perform data processing operations in the application service.

[0136] The monitoring module 306 is used to monitor exception information during the process in which the interceptor performs a security conversion operation on the operation field, wherein the exception information is used to indicate that the security conversion operation fails to be performed on the operation field.

[0137] Optionally, the interceptor module 304 includes: an identification submodule, used to identify at least one of a first field identifier and a second field identifier of the target data, wherein the first field identifier is used to represent a field to be encrypted annotated in the target data, and the second field identifier is used to represent a field to be decrypted annotated in the target data.

[0138] Optionally, the security conversion operation includes: encryption operation and decryption operation, and the interceptor module 304 includes: a first determination submodule, used to determine the encryption operation type corresponding to the field to be encrypted in response to the field identifier being a first field identifier, wherein the encryption operation type is used to indicate the type of encryption operation to be performed on the field to be encrypted; a second determination submodule, used to determine the decryption operation type corresponding to the field to be decrypted in response to the field identifier being a second field identifier, wherein the decryption operation type is used to indicate the type of decryption operation to be performed on the field to be decrypted.

[0139] Optionally, the interceptor module 304 includes: an encryption submodule, which is used to call the interceptor to perform an encryption operation on the field to be encrypted in response to the operation type being an encryption operation type, and obtain a first target field, wherein the first target field is used to execute a first data processing operation that matches the field to be encrypted in the application service; a decryption submodule, which is used to call the interceptor to perform a decryption operation on the field to be decrypted in response to the operation type being a decryption operation type, and obtain a second target field, wherein the second target field is used to execute a second data processing operation that matches the field to be decrypted in the application service.

[0140] Optionally, the encryption submodule, in response to the operation type being an encryption operation type, calls the interceptor to perform an encryption operation on the field to be encrypted to obtain a first target field by executing the following steps: in response to the operation type being an encryption operation type, calls the interceptor to determine an encryption policy, wherein the encryption policy is used to represent the rules for performing encryption operations on the field to be encrypted, and the encryption policy matches the data type and / or security level of the field to be encrypted; uses the interceptor to perform encryption operations on the field to be encrypted according to the encryption policy to obtain the first target field; the decryption submodule, in response to the operation type being a decryption operation type, calls the interceptor to perform a decryption operation on the field to be decrypted to obtain a second target field by executing the following steps: in response to the operation type being a decryption operation type, calls the interceptor to determine a decryption policy, wherein the decryption policy is used to represent the rules for performing decryption operations on the field to be decrypted, and the decryption policy matches the data type and / or security level of the field to be decrypted; uses the interceptor to perform a decryption operation on the field to be decrypted according to the decryption policy to obtain the second target field.

[0141] Optionally, the encryption submodule uses the interceptor to perform an encryption operation on the encrypted field according to the encryption policy to obtain a first target field by executing the following steps: using the interceptor to obtain an encryption key from the key management system, and storing the encryption key in the target memory; obtaining the encryption key from the target memory according to the encryption policy, and using the obtained encryption key to perform an encryption operation on the encrypted field to obtain the first target field; the decryption submodule uses the interceptor to perform a decryption operation on the decrypted field according to the decryption policy to obtain a second target field by executing the following steps: using the interceptor to obtain a decryption key from the key management system, and storing the decryption key in the target memory; obtaining the decryption key from the target memory according to the decryption policy, and using the obtained decryption key to perform a decryption operation on the decrypted field to obtain a second target field.

[0142] Optionally, the identification submodule can identify the first field identifier of the target data by performing the following steps: before executing the first query statement, calling the interceptor to identify the first field identifier of the target data, wherein the first query statement is used to indicate that the data processing operation is a data insertion operation or a data update operation; the identification submodule can identify the second field identifier of the target data by performing the following steps: after executing the second query statement, calling the interceptor to identify the second field identifier of the target data, wherein the second query statement is used to indicate the data query operation performed on the field to be decrypted.

[0143] In this embodiment, the following modules are provided in the data processing system of the vehicle: an annotation module, used to annotate at least one field to be operated in the target data to obtain at least one field identifier, wherein the target data comes from the application service of the vehicle, and the security level of the target data is higher than the security level threshold, the security level is used to indicate the security level of the target data, and the field identifier is used to indicate the field to be operated annotated in the target data; an interceptor module, used to identify the field identifier; based on the field identifier, determine the operation type corresponding to the field to be operated, wherein the operation type is used to indicate the type of security conversion operation to be performed on the field to be operated; call the interceptor to perform the security conversion operation corresponding to the operation type on the field to be operated to obtain the target field, wherein the target field is used to perform the data processing operation in the application service; a monitoring module, used to monitor exception information during the process of the interceptor performing the security conversion operation on the field to be operated, wherein the exception information is used to indicate the failure of performing the security conversion operation on the field to be operated, thereby achieving the purpose of being able to execute the data processing operation in the application service, thereby solving the technical problem of low security of vehicle processing data, and further achieving the technical effect of improving the security of vehicle processing data.

[0144] According to another aspect of an embodiment of the present invention, a computer-readable storage medium is provided, the computer-readable storage medium including a stored executable program, wherein when the executable program runs, the device where the storage medium is located is controlled to execute any one of the above methods.

[0145] According to another aspect of an embodiment of the present invention, a computer program product is provided. The computer program product includes a computer program. When the computer program is executed by a processor, any one of the above methods is implemented.

[0146] According to another aspect of an embodiment of the present invention, a vehicle is provided, including: a memory storing an executable program; and a processor running the program, wherein the program executes any one of the above methods when running.

[0147] Figure 4 is a structural block diagram of a vehicle according to an embodiment of the present invention. Figure 4 As shown, the components of the vehicle 400 include but are not limited to a memory 410 and a processor 420. The processor 420 is connected to the memory 410 via a bus 430, and the database 450 is used to store data.

[0148] The vehicle 400 may also include an access device 440 that enables the vehicle 400 to communicate via one or more networks 460. Examples of these networks include a Public Switched Telephone Network (PSTN), a Local Area Network (LAN), a Wide Area Network (WAN), a Personal Area Network (PAN), or a combination of communication networks such as the Internet. The access device 440 may include one or more of any type of network interface (e.g., a network interface controller (NIC)) of wired or wireless, such as an IEEE 802.11 wireless local area network (WLAN) wireless interface, a Worldwide Interoperability for Microwave Access (Wi-MAX) interface, an Ethernet interface, a Universal Serial Bus (USB) interface, a cellular network interface, a Bluetooth interface, a Near Field Communication (NFC) interface, and the like.

[0149] In one embodiment of the present disclosure, the above components of the vehicle 400 and Figure 4 Other components not shown in the figure may also be connected to each other, for example, via a bus. It should be understood that Figure 4 The vehicle structure block diagram shown is only for the purpose of illustration, and is not intended to limit the scope of the present disclosure. Those skilled in the art may add or replace other components as needed.

[0150] It should be noted that the serial numbers of the above embodiments of the present invention are only for description and do not represent the advantages or disadvantages of the embodiments.

[0151] In the above embodiments of the present invention, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0152] In the several embodiments provided by the present invention, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic, for example, the division of units can be a logical function division, and there can be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point, the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0153] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed over multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0154] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0155] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a server or a network device, etc.) to perform all or part of the steps of the methods of each embodiment of the present invention. The aforementioned storage medium includes: U disk, read-only memory (ROM, referred to as Read-Only Memory), random access memory (RAM, referred to as Random Access Memory), mobile hard disk, magnetic disk or optical disk, etc., which can store program code.

[0156] The above are only preferred embodiments of the present invention. It should be pointed out that, for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A vehicle data processing method, It is characterized in that include: In an application service of a vehicle, target data to be processed is determined, wherein a security level of the target data is higher than a security level threshold, and the security level is used to indicate a security level of the target data; Identify at least one field identifier of the target data, wherein the field identifier is used to indicate a field to be operated that is annotated in the target data; Based on the field identifier, determining an operation type corresponding to the field to be operated, wherein the operation type is used to indicate a type of security conversion operation to be performed on the field to be operated; The interceptor is called to perform the security conversion operation corresponding to the operation type on the field to be operated to obtain a target field, wherein the target field is used to perform the data processing operation in the application service.

2. The method according to claim 1, It is characterized in that Identifying at least one field identifier of the target data includes: Identify at least one of a first field identifier and a second field identifier of the target data, wherein the first field identifier is used to represent a field to be encrypted annotated in the target data, and the second field identifier is used to represent a field to be decrypted annotated in the target data.

3. The method according to claim 2, It is characterized in that The security conversion operation includes: an encryption operation and a decryption operation. Based on the field identifier, determining the operation type corresponding to the field to be operated includes: In response to the field identifier being the first field identifier, determining an encryption operation type corresponding to the field to be encrypted, wherein the encryption operation type is used to indicate a type of the encryption operation to be performed on the field to be encrypted; In response to the field identifier being the second field identifier, a decryption operation type corresponding to the field to be decrypted is determined, wherein the decryption operation type is used to indicate the type of the decryption operation to be performed on the field to be decrypted.

4. The method according to claim 3, It is characterized in that Calling the interceptor to perform the security conversion operation corresponding to the operation type on the field to be operated to obtain the target field, including: In response to the operation type being the encryption operation type, calling the interceptor to perform the encryption operation on the field to be encrypted to obtain a first target field, wherein the first target field is used to perform a first data processing operation in the application service that matches the field to be encrypted; In response to the operation type being the decryption operation type, the interceptor is called to perform the decryption operation on the field to be decrypted to obtain a second target field, wherein the second target field is used to execute a second data processing operation in the application service that matches the field to be decrypted.

5. The method according to claim 4, It is characterized in that In response to the operation type being the encryption operation type, calling the interceptor to perform the encryption operation on the field to be encrypted to obtain a first target field, including: In response to the operation type being the encryption operation type, calling the interceptor to determine an encryption policy, wherein the encryption policy is used to represent a rule for performing the encryption operation on the field to be encrypted, and the encryption policy matches the data type and / or the security level of the field to be encrypted; Using the interceptor to perform the encryption operation on the field to be encrypted according to the encryption strategy to obtain the first target field; In response to the operation type being the decryption operation type, calling the interceptor to perform the decryption operation on the field to be decrypted to obtain a second target field, including: in response to the operation type being the decryption operation type, calling the interceptor to determine a decryption policy, wherein the decryption policy is used to represent a rule for performing the decryption operation on the field to be decrypted, and the decryption policy matches the data type and / or the security level of the field to be decrypted; using the interceptor to perform the decryption operation on the field to be decrypted according to the decryption policy to obtain the second target field.

6. The method according to claim 5, It is characterized in that Using the interceptor to perform the encryption operation on the to-be-encrypted field according to the encryption strategy to obtain the first target field includes: The interceptor is used to obtain an encryption key from a key management system, and the encryption key is stored in a target memory; the encryption key is obtained from the target memory according to the encryption strategy, and the encryption operation is performed on the field to be encrypted using the obtained encryption key to obtain the first target field; Using the interceptor to perform the decryption operation on the field to be decrypted according to the decryption strategy to obtain the second target field, including: using the interceptor to obtain a decryption key from the key management system, and storing the decryption key in the target memory; obtaining the decryption key from the target memory according to the decryption strategy, and using the obtained decryption key to perform the decryption operation on the field to be decrypted to obtain the second target field.

7. The method according to claim 2, It is characterized in that Identifying a first field identifier of the target data includes: Before executing a first query statement, calling the interceptor to identify the first field identifier of the target data, wherein the first query statement is used to indicate that the data processing operation is a data insertion operation or a data update operation; Identifying the second field identifier of the target data includes: after executing a second query statement, calling the interceptor to identify the second field identifier of the target data, wherein the second query statement is used to represent a data query operation performed on the field to be decrypted.

8. The method according to any one of claims 1 to 7, It is characterized in that The method further comprises: In the process of performing the security conversion operation on the field to be operated, abnormal information is monitored, wherein the abnormal information is used to indicate that the security conversion operation on the field to be operated fails.

9. A data processing system for a vehicle, It is characterized in that include: An annotation module, used for annotating at least one field to be operated in target data to obtain at least one field identifier, wherein the target data comes from an application service of a vehicle, and the security level of the target data is higher than a security level threshold, the security level is used to indicate the security level of the target data, and the field identifier is used to indicate the field to be operated annotated in the target data; An interceptor module is used to identify the field identifier; based on the field identifier, determine the operation type corresponding to the field to be operated, wherein the operation type is used to indicate the type of security conversion operation to be performed on the field to be operated; call the interceptor to perform the security conversion operation corresponding to the operation type on the field to be operated, and obtain a target field, wherein the target field is used to perform the data processing operation in the application service; A monitoring module is used to monitor abnormal information during the process in which the interceptor performs the security conversion operation on the field to be operated, wherein the abnormal information is used to indicate that the security conversion operation on the field to be operated fails.

10. A vehicle, It is characterized in that include: A memory storing a program; A processor, configured to run the program, wherein the program executes the method according to any one of claims 1 to 8 when running.

Images