Access control method, terminal, chip, readable storage medium and computer program product

Abstract

The invention provides an access control method, a terminal, a chip, a readable storage medium and a computer program product. The method comprises the steps that a first terminal determines the permission of a second terminal to the first terminal according to first position information and access control information of the second terminal; wherein the first position information is used for indicating the position relation of the user equipment relative to the vehicle equipment. Based on the access control information, the first terminal can determine the permission of the second terminal to the first terminal according to the relative position of the second terminal. And based on the permission, the first terminal executes a corresponding access control strategy, so that differentiated access control of the second terminal on the first terminal at different relative positions can be realized.

Description

Access control method, terminal, chip, readable storage medium and computer program product Technical Field

[0001] The present application relates to the field of communication technologies, and more particularly, to an access control method, a terminal, a chip, a readable storage medium, and a computer program product. Background Art

[0002] A first terminal and a second terminal can communicate with each other. When the second terminal accesses the first terminal, the first terminal can perform access control, i.e., allow or deny the access. Related technologies can implement access control based on information such as terminal identification and secure channel verification type.

[0003] Summary of the Invention

[0004] The present application provides an access control method, a terminal, a chip, a readable storage medium, and a computer program product.

[0005] In a first aspect, a method for access control is provided, comprising: a first terminal determining the authority of the second terminal to the first terminal based on the first location information of the second terminal and access control information; wherein the first location information is used to indicate the position relationship of the user device relative to the vehicle device.

[0006] In a second aspect, a method for access control is provided, comprising: based on the authority of the second terminal to the first terminal, the second terminal accesses the first terminal; wherein, the authority is determined based on the first location information of the second terminal and access control information, and the first location information is used to indicate the position relationship of the user device relative to the vehicle device.

[0007] In a third aspect, a terminal is provided, which is a first terminal and includes: a determination unit for determining the authority of the second terminal to the first terminal based on the first location information and access control information of the second terminal; wherein the first location information is used to indicate the position relationship of the user device relative to the vehicle device.

[0008] In a fourth aspect, a terminal is provided, which is a second terminal and includes: an access unit for accessing the first terminal based on the second terminal's authority to the first terminal; wherein the authority is determined based on the first location information and access control information of the second terminal, and the first location information is used to indicate the position relationship of the user device relative to the vehicle device.

[0009] In a fifth aspect, a terminal device is provided, comprising a processor, a memory, and a communication interface, wherein the memory is used to store one or more computer programs, and the processor is used to call the computer program in the memory so that the terminal device executes the method described in the first aspect and / or the second aspect.

[0010] In a sixth aspect, a communication system is provided, the system including the first terminal and / or the second terminal described above. In another possible design, the system may further include other devices that interact with the first terminal and / or the second terminal in the solution provided in the embodiment of the present application.

[0011] In the seventh aspect, an embodiment of the present application provides a computer-readable storage medium, which stores a computer program, and the computer program enables the terminal device to execute part or all of the steps in the method of the first aspect and / or the second aspect above.

[0012] In an eighth aspect, embodiments of the present application provide a computer program product, wherein the computer program product includes a non-transitory computer-readable storage medium storing a computer program, wherein the computer program is operable to cause a terminal to perform some or all of the steps of the method of the first and / or second aspects described above. In some implementations, the computer program product may be a software installation package.

[0013] In the ninth aspect, an embodiment of the present application provides a chip comprising a memory and a processor, wherein the processor can call and run a computer program from the memory to implement some or all of the steps described in the methods of the first aspect and / or the second aspect above.

[0014] In a tenth aspect, a computer program product is provided, comprising a program, wherein the program enables a computer to execute the method described in the first aspect and / or the second aspect.

[0015] In an eleventh aspect, a computer program is provided, which enables a computer to execute the first aspect and / or the method described.

[0016] Based on the access control information, the first terminal can determine the second terminal's authority over the first terminal based on the second terminal's relative location (i.e., the indication of the first location information). Based on this authority, the first terminal executes the corresponding access control policy, thereby achieving differentiated access control for the first terminal at different relative locations of the second terminal. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] FIG1 is an example diagram of a scenario in which an embodiment of the present application is applied.

[0018] FIG2 is a schematic flowchart of an access control method provided in an embodiment of the present application.

[0019] FIG3 is a schematic flowchart of another access control method provided in an embodiment of the present application.

[0020] FIG4 is a schematic flowchart of another access control method provided in an embodiment of the present application.

[0021] FIG5 is a schematic flowchart of another access control method provided in an embodiment of the present application.

[0022] FIG6 is a schematic structural diagram of a terminal provided in an embodiment of the present application.

[0023] FIG7 is a schematic structural diagram of another terminal provided in an embodiment of the present application.

[0024] FIG8 is a schematic structural diagram of a device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0025] The technical solution in this application will be described below with reference to the accompanying drawings.

[0026] FIG1 is an example diagram of a scenario in which an embodiment of the present application is applied, wherein terminal 110 may be a device communicating with terminal 120 .

[0027] The terminal in the embodiments of the present application may also be referred to as a node, user equipment (UE), access terminal, user unit, user station, mobile station, mobile station (MS), mobile terminal (MT), remote station, remote terminal, mobile device, user terminal, terminal device, wireless communication device, user agent or user device. The terminal device in the embodiments of the present application may refer to a device that provides voice and / or data connectivity to a user and can be used to connect people, objects and machines. For example, the terminal may be a handheld device, a vehicle-mounted device, etc. with a wireless connection function. Alternatively, the terminal may be a car, home appliance, home system, etc. with a wireless connection function. The terminal device in the embodiments of the present application can be a mobile phone, a tablet computer, a laptop computer, a PDA, a mobile internet device (MID), a wearable device, a virtual reality (VR) device, an augmented reality (AR) device, a wireless terminal in industrial control, a wireless terminal in an Internet of Things device, a wireless terminal in a self-driving car, a wireless terminal in remote medical surgery, a wireless terminal in a smart grid, a wireless terminal in transportation safety, a wireless terminal in a smart city, a wireless terminal in a smart home, etc. Optionally, the terminal can be used to act as a base station. For example, the terminal can act as a scheduling entity that provides sidelink signals between terminals in V2X or D2D, etc. For example, a cellular phone and a car communicate with each other using sidelink signals. The cellular phone and smart home devices communicate with each other without relaying the communication signal through a base station.

[0028] The terminal can be deployed on land, including indoors or outdoors, handheld or vehicle-mounted; it can also be deployed on the water; it can also be deployed in the air on an aircraft, balloon, or satellite. The embodiments of this application do not limit the scenario in which the terminal is located.

[0029] It should be understood that all or part of the functions of the communication device in this application can also be implemented through software functions running on hardware, or through virtualization functions instantiated on a platform (such as a cloud platform).

[0030] It should be understood that the technical solutions of the embodiments of the present application can be applied to various communication systems, such as: fifth generation (5G) system or new radio (NR), long term evolution (LTE) system, LTE frequency division duplex (FDD) system, LTE time division duplex (TDD), cellular Internet of Things, WIFI communication system, Bluetooth communication system, etc. The technical solutions provided in this application can also be applied to future communication systems, such as the sixth generation mobile communication system, etc.

[0031] Terminal 110 can access the resources of terminal 120. In one implementation, terminal 110 can be a mobile phone and terminal 120 can be a car. Users can control car resources through operations on their mobile phone. For example, terminal 110 can implement a digital car key function to replace a traditional car key.

[0032] In some embodiments, the digital car key can implement a senseless unlocking function, namely a passive entry and start system (PEPS). To facilitate the description of the digital car key function, the terminal 120 in FIG1 is hereinafter referred to as the car 120.

[0033] In PEPS technology, when a user carrying a terminal 110 enters a certain range around a car 120, the car 120 can identify the location of the terminal 110 and the authorized user of the car 120. If the identification is successful, the car 120 can automatically open the door. Alternatively, when the user carrying the terminal 110 leaves a certain range of the car, the car 120 can identify the location of the terminal 110 and control the door locks and / or window locks of the car 120 to automatically lock and / or enter anti-theft mode.

[0034] PEPS can be implemented based on Bluetooth low energy (BLE) wireless communication and / or ultra wide band (UWB) technology. For example, the car 120 and the terminal 110 can broadcast discovery via BLE wireless communication. When the terminal 110 enters the discovery area, the terminal 110 can discover the car 120, and the terminal 110 can launch the car manufacturer's application (APP) background unlocking service to verify the user information and / or digital key validity of the terminal 110. Furthermore, the terminal 110 can establish a BLE connection with the car 120. The car 120 can determine the distance between the terminal 110 and the car 120 based on the BLE connection (for example, via UWB). When the user brings the terminal 110 closer to the car, the car 120 can determine whether the terminal 110 is in a keyless entry (PE) area. If the terminal 110 is in the PE area, the car 120 can enter the unlocking allowed state. At this time, the user can open the door of the car 120.

[0035] The following will detail the digital car key technology based on BLE and UWB technologies. The car unlocking method based on a digital car key may include steps S110 to S150. The method may be executed by a terminal 110 and a car 120.

[0036] In step S110 , the car 120 and / or the terminal 110 performs broadcast discovery via BLE wireless communication.

[0037] In step S120 , the car 120 and the terminal 110 perform two-way authentication.

[0038] In step S130 , the car 120 and the terminal 110 negotiate to start a UWB ranging channel on the BLE channel.

[0039] In step S140 , the car 120 and / or the terminal 110 measures the distance between the car 120 and the terminal 110 via UWB.

[0040] In step S150, the car 120 determines whether the terminal 110 is in the PE area based on the distance between the car 120 and the terminal 110. If the terminal 110 is in the PE area, the car 120 may enter the unlocking permission state.

[0041] It is understood that with the PEPS digital car key described above, users do not need to operate on their phones. The car can automatically access the car lock (unlock or lock) based on the phone's location. In other words, the digital car key can achieve seamless access to the car lock resource based on location information.

[0042] In one implementation, terminal 120 can control terminal 110's access to resources of terminal 120. Terminal 120 can either allow or deny access. For example, a mobile phone's access to a car lock resource can be controlled by the car itself; that is, the car can control whether the mobile phone is allowed to lock or unlock the lock. Access control can be implemented based on an access control list (ACL).

[0043] An ACL can include one or more access control entries (ACEs). An ACE can define permissions for one or more specific nodes (or accounts) for one or more resources. An ACE can include one or more pieces of information. For example, an ACE can include one or more pieces of information related to permissions, identities, functional units, etc. Each piece of information can be carried in fields within the ACE. In other words, an ACE can include one or more fields.

[0044] As an implementation, an ACE can include one or more fields such as permission level, authentication type, source subject, target, and extensions. Different protocols or standards may have different configurations for fields with the same or similar information. This application does not impose any restrictions on this, and the following is merely an example. The fields that can be included in an ACE are described in detail below.

[0045] The Targets field can be used to describe the target resources to which the ACE entry applies. The target resources can, for example, include one or more target functional units. The value type of the Targets field can be a list type. The Targets field can include a structure (struct) of one or more target functional units. In some embodiments, the EndPoints field can also be used to describe the target resources to which the ACE entry applies.

[0046] The Privilege field can be used to describe the privilege level that can be granted by this ACE entry. The value type of the Privilege field can be an enumeration type. The values ​​of the Privilege field can include: view privilege, proxy view privilege, operate privilege, manage privilege, administrator privilege, etc.

[0047] View permissions may include permissions to read and observe all resources except access-controlled resources and non-proxy resources.

[0048] Delegate permissions can include permissions to read and view all delegate resources. Delegate view permissions can implicitly include view permissions.

[0049] Operation permissions can include viewing permissions and permissions to perform the primary functions of the target resource. Primary functions can include functions other than accessing the control unit. Operation permissions can implicitly include viewing permissions.

[0050] Management rights may include operation rights and the ability to modify the persistent configuration of a node (except for access control functional units). Management rights may implicitly include operation rights and / or viewing rights.

[0051] Administrator rights may include management rights and observation and modification access control functional units. Administrator rights may implicitly include one or more of management rights, operation rights, agent viewing rights, and viewing rights.

[0052] The Source Subjects field can be used to describe one or more subjects. A subject can be used to describe the source of an operation using a given authentication method provided by the secure channel architecture. The Source Subjects field can have a value of list type. The Source Subjects field can include the identifiers (e.g., IDs) of one or more subjects. A subject can be one of the following three types:

[0053] Case 1: An initiator node interacting through a configuration channel (PASE) session during the commissioning phase. This node can be implicitly identified by the fact that the two peers in the PASE session have locally authenticated each other.

[0054] Case 2: The initiator node interacting through an operation channel (CASE) session during the operation phase. This node can be identified using a distinguished name (e.g., node ID) in the operation certificate (NOC) shared during session establishment.

[0055] Case 3: An initiator node interacting through a message group. This node can be identified by the group ID. This node can be verified by the operating group key.

[0056] The Authentication Type (AuthMode) field can be used to describe the type of secure channel authentication method (also known as the secure channel authentication type or connection type) applied to the subject of this ACE entry. The value type of the Authentication Type field can be an enumeration type. The value of the Authentication Type field can include CASE, PASE, or GROUP as described above.

[0057] The Extension field can be an optional extension payload and can be used for cryptographic signatures, vendor-specific ACL content, or other metadata.

[0058] As an implementation manner, the fields included in ACE may be as shown in Table 1.

[0059] Table 1

[0060]

[0061]

[0062] Therefore, the first terminal can implement access control based on the second terminal's ID, the secure channel authentication type between the first and second terminals, the target resource, etc. It is understandable that related technologies have difficulty implementing access control based on location information.

[0063] Figure 2 illustrates an access control method provided by an embodiment of the present application to address the aforementioned issues. The method illustrated in Figure 2 can be performed by a first terminal and a second terminal. This application does not limit the types of the first and second terminals; for example, they can be any of the terminals described above. For example, the first terminal can be a car, and the second terminal can be a mobile phone used by a user.

[0064] The method shown in FIG. 2 may include step S210 and step S220 .

[0065] Step S210: The first terminal determines the authority of the second terminal to the first terminal based on the first location information and access control information of the second terminal.

[0066] The first location information may be used to indicate the positional relationship of the second terminal relative to the first terminal. It is understood that the first location information may be relative location information. For example, the first location information may be determined based on the position of the first terminal, the position of the second terminal, or the distance and / or angle between the first terminal and the second terminal.

[0067] For example, if the first terminal is a car, the first location information can be used to indicate the position of the second terminal relative to the car. For example, the first location information may include one or more of the following: inside the car, outside the car, driver's seat, front passenger seat, passenger seat, left front door, right front door, left rear door, right rear door, and rear of the car. The driver's seat (driver's seat and / or front passenger seat) may not be included in the car.

[0068] It is understood that the representation of the first location information may be related to the accuracy of the positioning mechanism. If a lower-precision positioning mechanism is used, the first location information may include inside the vehicle and / or outside the vehicle. If a higher-precision positioning mechanism is used, the representation of the first location information may be refined. For example, the first location information may include one or more of the following: left front door, right front door, left rear door, right rear door, rear of the vehicle, passenger seat, back seat, etc.

[0069] This application does not limit the positioning mechanism for obtaining the first location information. As an implementation method, the first location information can be obtained based on a close-range positioning method. For example, the first location information can be obtained through one or more of the following positioning methods: UWB positioning, Bluetooth positioning, and 5G positioning. As a real-time method, the first terminal and the second terminal can negotiate a UWB positioning channel and perform UWB positioning. As another implementation method, the first terminal and the second terminal can negotiate to start UWB ranging on a BLE channel.

[0070] This application does not limit the device that obtains the first location information. For example, the first location information can be obtained by the first terminal or the second terminal. After the second terminal obtains the first location information, it can send the first location information to the first terminal.

[0071] The second terminal's authority over the first terminal may include authority over a target resource of the first terminal. The target resource may be represented by a functional unit. For example, the target resource may be one or more functional units.

[0072] The target resource may include resources belonging to the first terminal. Alternatively, the target resource may include resources associated with the first terminal. Taking the first terminal as an example, the target resource may include resources of the car. Taking the first terminal as an example, the target resource may be resources of the car associated with the car terminal. For example, the car's resources may include one or more of: lights (e.g., turn signals, headlights, etc.), doors, windows, display screens, and the like. This application does not limit the specific content of the second terminal's permissions to the first terminal. For example, the permissions may include one or more of the following: no permission, view permission, proxy view permission, operate permission, manage permission, administrator permission, etc. If the second terminal's permission to the first terminal is no permission, the first terminal may deny access to the second terminal. If the second terminal's access to the first terminal matches the permissions, the first terminal may perform the action corresponding to the second terminal's access.

[0073] Access control information can be used to control the access of the first terminal to the second terminal, that is, the access control information can be used to indicate the authority of the second terminal to the first terminal. The access control information can be related to the positional relationship of the second terminal relative to the first terminal. In one implementation, the access control information can be used to record the authority of the second terminal to the first terminal at different locations. For example, the second terminal can have operate authority over the first terminal when it is in the first position, and can have no authority over the first terminal when it is in the second position. In this case, the first terminal may allow the second terminal to access the first terminal only when the second terminal moves to the first position, and allow the second terminal to perform operations related to the operate authority. Alternatively, when the second terminal moves to the second position, the first terminal may deny the second terminal access to the first terminal.

[0074] It is understood that the access control information may also record the permissions of other terminals to the first terminal. The other terminal may be a terminal different from the second terminal. Alternatively, the other terminal may be a terminal with a different login user than the second terminal.

[0075] The content of the access control information can be flexibly modified as needed. For example, if a user obtains permission to modify the access control information, they can modify the access control information through one or more of the first terminal, the second terminal, and the other terminal. As an implementation method, an operation interface can be provided for the user to facilitate the modification of the access control information.

[0076] It is understandable that by modifying the access control information, user-customized access control can be achieved, thereby improving the user experience.

[0077] This application does not limit the storage method of access control information. For example, the access control information can be recorded in the first terminal or in a remote server (such as a cloud platform). When the first terminal needs to control access to the second terminal based on the access control information, the access control information can be obtained from the corresponding storage location.

[0078] The access control information may be included in the first entry for access control. As an implementation, the first entry may be an ACE. One or more ACEs may form an ACL. In other words, the access control information may be recorded in an ACL, which may include one or more ACEs.

[0079] The first entry may include one or more pieces of information related to authority, identity, functional unit, etc. Each piece of information may be carried in a field in the first entry. In other words, the first entry may include one or more fields.

[0080] As an implementation, the first entry may include a first field. The first field may be used to specifically carry the location information corresponding to the access control item. The first field may be called a position field, for example.

[0081] It is understandable that when the first location information of the second terminal matches the content recorded in the first field, the permission corresponding to the first entry is valid. When the first field is empty or a wildcard (such as *), it can be said that the permission corresponding to the first entry is valid when the second terminal is in any position. That is to say, when the first field is empty, the permission corresponding to the first entry may be independent of the location. For example, if the value of the first field of the first entry is inside the car, when the second terminal is inside the car, the permission corresponding to the first entry is valid. Correspondingly, when the second terminal is outside the car, the permission corresponding to the first entry is invalid.

[0082] The type of the first field can be, for example, an enumeration type. Taking the first terminal being a car as an example, the first field can include one or more of the following information: inside the car, outside the car, and driver's seat. Inside the car means the second terminal is inside the car and not in the driver's seat. Outside the car means the second terminal is outside the car and within a certain distance of the car. Alternatively, the first field can be refined to include one or more of the following information: left front door, right front door, left rear door, right rear door, rear of the car, passenger seat, back seat, etc.

[0083] As another implementation, the first entry may include a second field. The second field may be used to carry the connection type of the secure channel established between the first terminal and the second terminal, and one or more of the connection types of the secure channel are associated with the location information corresponding to the access control item. In one embodiment, the second field may be an extension of the authentication type (AuthMode) field. The extended authentication type field may be represented, for example, as the connection type field (ConnMode). The second field may be an enumeration type. Taking the first terminal as an example, the enumeration value may include one or more of the following: configuration channel, off-vehicle operation channel, on-vehicle operation channel, driver's seat operation channel, and cloud connection channel. The configuration channel may indicate that the connection established between the first terminal and the second terminal is for configuring the first terminal. The off-vehicle operation channel may indicate an operational connection established between the second terminal and the vehicle while outside the vehicle. The on-vehicle operation channel may indicate an operational connection established between the second terminal and the vehicle while inside the vehicle (e.g., in a non-driver's seat). The driver's seat operation channel may indicate an operational connection established between the second terminal and the vehicle while in the driver's seat. The cloud connection channel may indicate a remote connection established between the second terminal and the vehicle via a cloud platform.

[0084] It is understandable that the value of the first location information may correspond to the content recorded in the first field or the second field. For example, the value of the first field is one or more of inside the car, outside the car, and the driver's seat. The value of the first location information may also be one or more of inside the car, outside the car, and the driver's seat. Alternatively, when the value of the second field is one or more of the configuration channel, the outside-vehicle operation channel, the inside-vehicle operation channel, the driver's seat operation channel, and the cloud connection channel, the value of the first location information may also be one or more of the configuration channel, the outside-vehicle operation channel, the inside-vehicle operation channel, the driver's seat operation channel, and the cloud connection channel. Therefore, the corresponding first entry can be matched according to the first location information, thereby performing access control on the second terminal according to the permissions recorded in the first entry.

[0085] Optionally, an authenticated secure connection may be established between the first terminal and / or the second terminal. For example, the first terminal may establish an authenticated secure connection with the second terminal. Alternatively, the first terminal and the second terminal may establish a bidirectional authenticated secure connection.

[0086] The method shown in Figure 2 may further include step S205. In step S205, the second terminal may send a control instruction to the first terminal. The control instruction may correspond to a target resource. When the second terminal wishes to access the target resource of the first terminal at a certain location, it may send a control instruction to the first terminal to request access to the target resource. The second terminal may send the control instruction multiple times. For example, the second terminal may send the control instruction multiple times at multiple different locations.

[0087] It is understood that the control instruction can be transmitted through the established secure channel. Before transmitting the control instruction, the first terminal and / or the second terminal can establish an authenticated secure connection. For example, the first terminal and the second terminal can establish a two-way authenticated secure connection.

[0088] The acquisition of the first location information can be triggered by a message received by the first terminal. For example, after receiving a control instruction, the first terminal can trigger positioning to obtain the first location information of the second terminal. Alternatively, the acquisition of the first location information can be triggered by the establishment of a secure connection. In other words, after the secure connection is established, positioning can be triggered to obtain the first location information.

[0089] When a secure connection is established to trigger positioning, the first location information can be updated based on the positioning results. That is, at least one positioning session can be performed, and the first location information can be the location information obtained from the at least one positioning session that was closest to the time the first terminal received the control command. For example, the position of the second terminal can be measured in real time and continuously updated. After the first terminal receives the control command, the first location information is obtained based on the current real-time location of the second terminal.

[0090] It is understood that some positioning mechanisms can achieve continuous positioning, and therefore, continuous positioning can be implemented to continuously update the first location information. For other positioning mechanisms, continuous positioning cannot be implemented, and therefore, positioning can be triggered by a control instruction to obtain the first location information. An appropriate method for obtaining the first location information can be selected based on the terminal's capabilities and the positioning mechanisms that can be implemented.

[0091] After the first terminal obtains the first location information, it can determine whether the second terminal has access rights to the first terminal by searching the access control information. For example, the first terminal can search for a matching first entry based on the first location of the second terminal. In one case, if the second terminal has access rights to the first terminal, the first terminal can perform a corresponding action. Taking the first entry as an ACE as an example, if the first terminal finds a matching ACE and obtains matching permissions, the first terminal can perform the action corresponding to the permission. In another case, if the second terminal does not have access rights to the first terminal, the first terminal can deny the second terminal's access. For example, if the first terminal does not find a matching ACE, the first terminal can deny the second terminal's access.

[0092] After obtaining the first location information, the first terminal can determine the corresponding channel connection type information. Based on the corresponding channel connection type information and access control information, the first terminal can determine the second terminal's access rights to the first terminal. For example, if an ACE includes the second field, the first terminal can compare the channel connection type information with the ACL to determine whether there is an ACE that matches the second field. If there is a matching ACE, the first terminal can perform the action corresponding to the ACE. If there is no matching ACE, the first terminal can deny the second terminal access.

[0093] Optionally, the first terminal may return a response to the second terminal, where the response may be used to inform the second terminal whether the access permission is established.

[0094] In step S220, based on the second terminal's permission to access the first terminal, the second terminal accesses the first terminal. If the second terminal's permission to access the first terminal is satisfied, the second terminal can access the first terminal. If the second terminal's permission to access the first terminal is not satisfied, the second terminal cannot access the first terminal.

[0095] Optionally, the second terminal may access the resources of the first terminal through the client.

[0096] The permissions recorded in the access control information can be related to the location of the second terminal. Based on the access control information, the second terminal can have corresponding permissions at different locations. The permissions corresponding to different locations can be different. Therefore, based on the access control information, the first terminal can implement different access control policies for the first terminal when the second terminal is in different locations, thereby satisfying the second terminal's differentiated execution capabilities for the first terminal in different scenarios.

[0097] The following takes the first terminal as a car and the second terminal as a mobile phone as an example to describe in detail the implementation of the three embodiments provided in this application.

[0098] Example 1

[0099] In the first embodiment, the first entry is an ACE. A first field is added to the ACE. The first field is represented as Position. The fields included in the ACE may be as shown in Table 2.

[0100] Table 2

[0101]

[0102] The position field can be an enumeration type. The enumeration values ​​can include: OutsideCar, InsidCar, DrivingSeat. Among them, InsidCar can indicate a position in the car other than the driving seat.

[0103] A possible ACL configuration measure for a car could be:

[0104]

[0105]

[0106] ACE2 contains Position = InsideCar, indicating that the corresponding permissions for ACE2 are valid when the phone is detected to be inside the car. ACE3 contains Position = DrivingSeat, indicating that the corresponding permissions for ACE are valid when the phone is detected to be in the driving seat. ACE4 contains an empty Position field, indicating that the corresponding permissions for ACE4 are valid regardless of the terminal's location.

[0107] The target resource DeviceType = 0x0000_0023 represents all functional units included in an endpoint with a device type of video player. The functional units included in a player may include, for example, a display screen switch. The target resource Endpoint = 3 and Cluster = 0x0000_0006 may represent the on / off functional unit on endpoint 3. For example, endpoint 3 may be a turn signal.

[0108] Figure 3 is a schematic flow chart of the access control method provided in Example 1. The method shown in Figure 3 may include steps S310 to S390.

[0109] Step S310 may include step S311 and / or step S312. In step S311, the car and the mobile phone establish an authenticated secure connection. In step S312, the mobile phone and the car establish an authenticated secure connection. It is understood that if step S310 includes steps S311 and S312, a two-way authenticated secure connection can be established between the mobile phone and the car.

[0110] In step S320, the mobile phone sends a control command to the vehicle through the established secure channel. For example, the control command may include a command to activate (turn on or off, etc.) a display screen in the vehicle. Alternatively, the control command may include a command to activate a turn signal.

[0111] In step S330, after the car receives the control instruction, it triggers the start of UWB positioning.

[0112] Step S340 may include step S341 and / or step S342. In step S341, the car and the mobile phone negotiate a UWB positioning channel. In step S342, the mobile phone and the car negotiate a UWB positioning channel. It is understood that when step S340 includes steps S341 and S342, the mobile phone and the car may negotiate the UWB positioning channel in an interactive manner.

[0113] Step S351: The car uses UWB positioning to locate the mobile phone.

[0114] In step S352, the car obtains first location information of the mobile phone. The first location information may be, for example, inside the car, outside the car, or at the driver's seat.

[0115] In step S360, the car searches for a matching ACE based on the first location information of the mobile phone. This is explained by taking the car configured with the ACL information described above as an example. Taking the control instruction as an instruction to call the display screen as an example, if the display screen belongs to the functional unit of the player (DeviceType is 0x0000_0023), when the first location information is inside the car, searching for the ACE provided in Example 1 shows that the value of the location field of ACE2 is inside the car, so the matching ACE is ACE2. According to ACE2, it can be obtained that the matching permission is the operate permission. Taking the control instruction as an example of turning on the turn signal, when the first location information is inside the car (non-driving seat), searching for the ACL provided in Example 1 does not find a matching ACE.

[0116] In step S370, the car determines whether the access permission is established. Whether the access permission is established can be determined based on whether a matching ACE is found. When a matching ACE is found and a matching permission is obtained, it can be determined that the access permission is established. Taking the control instruction including calling the in-car display screen as described above as an example, it can be determined that the access permission of the control instruction is established. In the case where no matching ACE is found, it can be determined that the access permission is not established. Taking the control instruction including calling the turn signal light as described above as an example, it can be determined that the access permission is not established. In the case that the access permission is not established, the car can reject the control instruction.

[0117] In step S380, if the access permission is established, the car can execute the control instruction. Continuing with the example of the control instruction including calling the display screen in the car, as described above, if the access permission is established, the car can execute the operation directed to the display screen as instructed by the control instruction.

[0118] In step S390, the car returns a response. If the car executes the instruction, the car may return a response. Alternatively, if the car rejects the instruction, the car may return a response.

[0119] Example 2

[0120] In the second embodiment, the first entry may be an ACE. The car may be configured with the ACL described in the first embodiment.

[0121] Figure 4 is a schematic flow chart of the access control method provided in Example 2. The method shown in Figure 4 may include steps S410 to S490.

[0122] Step S410 may include step S411 and / or step S412. Step S411: The car and the mobile phone establish an authenticated secure connection. Step S412: The mobile phone and the car establish an authenticated secure connection. It is understood that if step S410 includes steps S411 and S412, a two-way authenticated secure connection can be established between the mobile phone and the car.

[0123] Step S420: The car triggers the start of UWB positioning.

[0124] Step S430 may include step S431 and / or step S432. Step S431: The car and the mobile phone negotiate a UWB positioning channel. Step S432: The mobile phone and the car negotiate a UWB positioning channel. It is understood that when step S430 includes steps S431 and S432, the mobile phone and the car may negotiate the UWB positioning channel in an interactive manner.

[0125] In step S441, the car performs UWB positioning on the mobile phone.

[0126] In step S442, the car continuously obtains the location information of the mobile phone and updates the real-time location information of the mobile phone. In other words, the car can obtain the location information of the mobile phone multiple times and update the most recently obtained location information as the real-time location of the mobile phone.

[0127] In step S450, the mobile phone sends a control instruction to the car through the established secure channel. For example, the control instruction may be an instruction to turn on the turn signal. It is understood that the mobile phone can perform step S450 multiple times, thereby sending the control instruction from different locations.

[0128] Step S443: After receiving the control instruction, the car obtains the location information of the mobile phone at the current time and obtains the first location information of the mobile phone.

[0129] Step S460: The car searches for a matching ACE based on the first location information of the mobile phone.

[0130] Taking the control instruction of turning on the turn signal as an example, the user can carry a mobile phone into the passenger seat, and the first location information is inside the car (non-driving seat). The car searches the ACL provided in Example 1 and finds no matching ACE. The user can move with the mobile phone. When the user enters the car and sits in the driver's seat, the first location information may be the driver's seat. The mobile phone can send the control instruction of turning on the turn signal to the car again. The car searches the ACL and can match ACE3, and the matching permission is the operation permission.

[0131] In step S470, the vehicle determines whether the access permission is granted. If a matching ACE is found and matching permissions are obtained, the access permission is determined to be granted. If no matching ACE is found, the access permission is determined to be denied. Taking the example of step S460 involving the control instruction for invoking the turn signal, if the user is in the passenger seat, the access permission is determined to be denied, but if the user is in the driver's seat, the access permission is determined to be granted.

[0132] Step S480: If the access permission is granted, the control instruction is executed. Continuing with the example of the control instruction including invoking the turn signal, as described above, when the user is in the driving seat and the access permission is granted, the car can execute the operation on the turn signal indicated by the control instruction.

[0133] In step S490, the car returns a response. If the car executes the instruction, the car may return a response. Alternatively, if the car rejects the instruction, the car may return a response.

[0134] Example 3

[0135] In Example 3, the first entry is an ACE. The AuthMode field of the ACE is expanded to a connection type (ConnMode) field. The connection type field can be associated with the location information of the mobile phone. The fields included in the ACE can be shown in Table 3.

[0136] Table 3

[0137]

[0138] Among them, the connection type field can be an enumeration type. The enumeration values ​​may include: configuration channel (PASE), outside vehicle operation channel (CASE_OutsideCar), inside vehicle operation channel (CASE_InsideCar), driving seat operation channel (CASE_DrivingSeat), and cloud connection channel. Among them, the outside vehicle operation channel indicates that the client is outside the vehicle and within a certain distance from the vehicle. If a higher-precision positioning mechanism is used, it can be further refined into different locations such as the left front door, right front door, left rear door, right rear door, and rear of the vehicle. The above enumeration values ​​have been introduced in detail in the previous article and will not be repeated here.

[0139] A possible ACL configuration measure for a car could be:

[0140]

[0141] ACE1 contains ConnMode = PASE, indicating that the phone and the car have established a configuration channel. In this case, the phone has administrator privileges for all resources. ACE2 contains ConnMode = CASE_InsideCar, indicating that this privilege is valid when the phone is in the non-driving seat of the car and an operational connection is established. ACE3 contains ConnMode = CASE_DrivingSeat, indicating that this privilege is valid when the phone is in the driving seat and an operational connection is established.

[0142] Figure 5 is a schematic flow chart of the access control method provided in Example 3. The method shown in Figure 5 may include steps S510 to S592.

[0143] Step S510 may include step S511 and / or step S512. Step S511: The car and the mobile phone establish an authenticated secure connection. Step S512: The mobile phone and the car establish an authenticated secure connection. It is understood that if step S510 includes steps S511 and S512, a two-way authenticated secure connection can be established between the mobile phone and the car.

[0144] In step S520, the vehicle determines whether the connection type is an operational connection. Optionally, if the connection type is an operational connection, the steps after step S520 may be performed.

[0145] Step S530: The car triggers the start of UWB positioning.

[0146] Step S540 may include step S541 and / or step S542. In step S541, the car and the mobile phone negotiate a UWB positioning channel. In step S542, the mobile phone and the car negotiate a UWB positioning channel. It is understood that when step S540 includes steps S541 and S542, the mobile phone and the car may negotiate the UWB positioning channel in an interactive manner.

[0147] Step S551: The car performs UWB positioning on the mobile phone.

[0148] In step S552, the car continuously obtains the location information of the mobile phone and updates the channel connection type information based on the location information. For example, when the mobile phone is outside the car, the channel type is CASE_OutsideCar. When the user carries the mobile phone into the back seat of the car, the channel type is updated to CASE_InsideCar.

[0149] In step S560, the mobile phone sends a control instruction to the car through the established secure channel. For example, the control instruction may be an instruction to call a display screen.

[0150] In step S570, the car searches for a matching ACE based on the first location information of the mobile phone. If the channel connection type information of the mobile phone is CASE_InsideCar and the control instruction is to call the display screen, the car searches for a matching ACE based on the ACL in Example 3 and obtains ACE2 with the matching permission of operate.

[0151] In step S580, the car determines whether the access permission is granted. If a matching ACE is found and the matching permission is obtained, the access permission is determined to be granted. If no matching ACE is found, the access permission is determined to be invalid. For example, in step S570, if the control instruction for calling the display screen is matched to ACE2 and the permission provided by the car is "operate," the access permission is determined to be granted.

[0152] Step S590: If the access permission is established, the car may execute the control instruction. If the access permission is not established, the car may reject the control instruction.

[0153] Step S592: The car returns a response. If the car executes the instruction, the car may return a response. Alternatively, if the car rejects the instruction, the car may return a response.

[0154] The method embodiment of the present application is described in detail above in conjunction with Figures 2 to 5 , and the device embodiment of the present application is described in detail below in conjunction with Figures 6 to 8 . It should be understood that the description of the method embodiment corresponds to the description of the device embodiment, and therefore, for portions not described in detail, reference can be made to the above method embodiment.

[0155] FIG6 is a schematic structural diagram of a terminal 600 provided in an embodiment of the present application. The terminal 600 may be a first terminal and may include a determining unit 610.

[0156] The determination unit 610 may be configured to determine the authority of the second terminal to the first terminal based on the first location information of the second terminal and access control information; wherein the first location information is used to indicate the location relationship of the second terminal relative to the first terminal.

[0157] Optionally, the access control information is used to indicate the authority of the second terminal to the first terminal when the second terminal is in a different location.

[0158] Optionally, the first location information includes one or more of the following information: inside the car, outside the car, main driver's seat, co-driver's seat, passenger seat, left front door, right front door, left rear door, right rear door, and rear of the car.

[0159] Optionally, the first location information is obtained by positioning the second terminal, and the positioning is triggered by a control instruction sent by the second terminal to the first terminal.

[0160] Optionally, the first location information is obtained by positioning the second terminal, and the positioning is triggered by establishment of a secure channel between the first terminal and the second terminal.

[0161] Optionally, the first location information is real-time location information of the second terminal, and acquisition of the real-time location information is triggered by a control instruction sent by the second terminal to the first terminal.

[0162] Optionally, the access control information is recorded in an access control list, and the access control list includes one or more access control items.

[0163] Optionally, the access control item includes a first field, and the first field is used to specifically carry location information corresponding to the access control item.

[0164] Optionally, the first field includes one or more of the following information: inside the car, outside the car, and driving seat.

[0165] Optionally, the access control item includes a second field, which is used to carry the connection type of the security channel established between the first terminal and the second terminal, and one or more connection types of the security channel are associated with the location information corresponding to the access control item.

[0166] Optionally, the determining unit is specifically configured to: determine channel connection type information according to the first location information; and determine permission of the second terminal to the first terminal according to the channel connection type information and the access control information.

[0167] Optionally, the second field includes one or more of the following information: configuration channel, external vehicle operation channel, internal vehicle operation channel, driver's seat operation channel, and cloud connection channel.

[0168] Optionally, the first terminal is a car.

[0169] Optionally, the first location information is obtained through one or more of the following positioning methods: ultra-wideband UWB positioning, Bluetooth positioning, and 5G positioning.

[0170] FIG7 is a schematic diagram of the structure of another terminal 700 provided in an embodiment of the present application. The terminal 700 may be a second terminal and may include an access unit 710.

[0171] The access unit 710 can be used to access the first terminal based on the second terminal's authority to the first terminal; wherein the authority is determined based on the first location information of the second terminal and access control information, and the first location information is used to indicate the location relationship of the second terminal relative to the first terminal.

[0172] Optionally, the access control information is used to record the authority of the second terminal to the first terminal when the second terminal is in different locations.

[0173] Optionally, the first location information includes one or more of the following information: inside the car, outside the car, main driver's seat, co-driver's seat, passenger seat, left front door, right front door, left rear door, right rear door, and rear of the car.

[0174] Optionally, the first location information is obtained by positioning the second terminal, and the positioning is triggered by a control instruction sent by the second terminal to the first terminal.

[0175] Optionally, the first location information is obtained by positioning the second terminal, and the positioning is triggered by establishment of a secure channel between the first terminal and the second terminal.

[0176] Optionally, the first location information is real-time location information of the second terminal, and acquisition of the real-time location information is triggered by a control instruction sent by the second terminal to the first terminal.

[0177] Optionally, the access control information is recorded in an access control list, and the access control list includes one or more access control items.

[0178] Optionally, the access control item includes a first field, and the first field is used to specifically carry location information corresponding to the access control item.

[0179] Optionally, the first field includes one or more of the following information: inside the car, outside the car, and driving seat.

[0180] Optionally, the access control item includes a second field, which is used to carry the connection type of the security channel established between the first terminal and the second terminal, and one or more connection types of the security channel are associated with the location information corresponding to the access control item.

[0181] Optionally, the permission is determined based on the first location information and access control information of the second terminal, including: the permission is determined based on channel connection type information and the access control information, and the channel connection type information is determined based on the first location information.

[0182] Optionally, the second field includes one or more of the following information: configuration channel, external vehicle operation channel, internal vehicle operation channel, driver's seat operation channel, and cloud connection channel.

[0183] Optionally, the first terminal is a car.

[0184] Optionally, the first location information is obtained through one or more of the following positioning methods: ultra-wideband UWB positioning, Bluetooth positioning, and 5G positioning.

[0185] FIG8 is a schematic block diagram of a communication device according to an embodiment of the present application. The dashed lines in FIG8 indicate that the unit or module is optional. The device 800 may be used to implement the method described in the above method embodiment. The device 800 may be a chip or a terminal.

[0186] The device 800 may include one or more processors 810. The processor 810 may support the device 800 to implement the method described in the method embodiment above. The processor 810 may be a general-purpose processor or a special-purpose processor. For example, the processor may be a central processing unit (CPU). Alternatively, the processor may be another general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic device, a discrete gate or transistor logic device, a discrete hardware component, etc. The general-purpose processor may be a microprocessor or the processor may be any conventional processor, etc.

[0187] It should be noted that the determining unit 610 shown in Figure 6 can be executed by the processor 810 shown in Figure 8. The accessing unit 710 shown in Figure 7 can be executed by the processor 810 shown in Figure 8.

[0188] The apparatus 800 may further include one or more memories 820. The memories 820 store programs that can be executed by the processor 810, causing the processor 810 to perform the methods described in the above method embodiments. The memories 820 may be independent of the processor 810 or integrated into the processor 810.

[0189] The apparatus 800 may further include a transceiver 830. The processor 810 may communicate with other devices or chips via the transceiver 830. For example, the processor 810 may transmit and receive data with other devices or chips via the transceiver 830.

[0190] The present application also provides a computer-readable storage medium for storing a program. The computer-readable storage medium can be applied to a terminal or network device provided in the present application, and the program enables a computer to execute the method performed by the terminal or network device in each embodiment of the present application.

[0191] The present application also provides a computer program product. The computer program product includes a program. The computer program product can be applied to a terminal or network device provided in the present application, and the program causes a computer to execute the method performed by the terminal or network device in each embodiment of the present application.

[0192] The embodiments of the present application also provide a computer program. The computer program can be applied to the terminal or network device provided in the embodiments of the present application, and the computer program enables a computer to execute the method performed by the terminal or network device in each embodiment of the present application.

[0193] It should be understood that the terms "system" and "network" in this application can be used interchangeably. In addition, the terms used in this application are only used to explain the specific embodiments of this application and are not intended to limit this application. The terms "first", "second", "third", and "fourth" in the specification and claims of this application and the accompanying drawings are used to distinguish different objects rather than to describe a specific order. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions.

[0194] In the embodiments of this application, the term "indication" may refer to a direct indication, an indirect indication, or an indication of an association. For example, "A indicates B" may refer to a direct indication of B, e.g., B can obtain information through A; it may refer to an indirect indication of B, e.g., A indicates C, e.g., B can obtain information through C; or it may refer to an association between A and B.

[0195] In the embodiment of the present application, "B corresponding to A" means that B is associated with A and B can be determined based on A. However, it should be understood that determining B based on A does not mean determining B based solely on A, but B can also be determined based on A and / or other information.

[0196] In the embodiments of the present application, the term "corresponding" may indicate a direct or indirect correspondence between the two, or an association relationship between the two, or a relationship between indication and indication, configuration and configuration, etc.

[0197] In the embodiments of the present application, "pre-definition" or "pre-configuration" may be implemented by pre-storing corresponding codes, tables, or other methods that can be used to indicate relevant information in a device (e.g., a terminal device and a network device). The present application does not limit the specific implementation method. For example, pre-definition may refer to information defined in a protocol.

[0198] In the embodiments of the present application, the “protocol” may refer to a standard protocol in the communications field, for example, it may include an LTE protocol, an NR protocol, and related protocols used in future communication systems, and the present application does not limit this.

[0199] In the embodiments of this application, the term "and / or" is simply a description of the association relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in this document generally indicates that the related objects are in an "or" relationship.

[0200] In various embodiments of the present application, the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0201] In the several embodiments provided in this application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are merely schematic. For example, the division of the units is merely a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0202] The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected to achieve the purpose of this embodiment according to actual needs.

[0203] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0204] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from one website, computer, server or data center to another website, computer, server or data center via a wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) method. The computer-readable storage medium can be any available medium that can be read by a computer or a data storage device such as a server or data center that includes one or more available media integrated therein. The available medium may be a magnetic medium (eg, a floppy disk, a hard disk, a magnetic tape), an optical medium (eg, a digital versatile disc (DVD)), or a semiconductor medium (eg, a solid state disk (SSD)).

[0205] The above description is merely a specific embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this application should be included in the scope of protection of this application. Therefore, the scope of protection of this application should be based on the scope of protection of the claims.

Claims

1. A method of access control, characterized in that: include: The first terminal determines, based on the first location information and access control information of the second terminal, the authority of the second terminal to access the first terminal; The first location information is used to indicate the location relationship of the second terminal relative to the first terminal.

2. The method according to claim 1, characterized in that The access control information is used to indicate the authority of the second terminal to the first terminal when the second terminal is in a different location.

3. The method according to claim 1 or 2, characterized in that The first location information includes one or more of the following information: inside the car, outside the car, main driver's seat, co-driver's seat, passenger seat, left front door, right front door, left rear door, right rear door, and rear of the car.

4. The method according to any one of claims 1 to 3, characterized in that The first location information is obtained by positioning the second terminal, and the positioning is triggered by a control instruction sent by the second terminal to the first terminal.

5. The method according to any one of claims 1 to 3, characterized in that The first location information is obtained by positioning the second terminal, and the positioning is triggered by establishment of a secure channel between the first terminal and the second terminal.

6. The method according to claim 5, characterized in that The first location information is the real-time location information of the second terminal, and acquisition of the real-time location information is triggered by a control instruction sent by the second terminal to the first terminal.

7. The method according to any one of claims 1 to 6, characterized in that The access control information is recorded in an access control list, which contains one or more access control items.

8. The method according to claim 7, characterized in that The access control item includes a first field, and the first field is used to specifically carry location information corresponding to the access control item.

9. The method according to claim 8, characterized in that The first field includes one or more of the following information: inside the car, outside the car, and driving position.

10. The method according to claim 7, characterized in that The access control item includes a second field, which is used to carry the connection type of the secure channel established between the first terminal and the second terminal, and one or more connection types of the secure channel are associated with the location information corresponding to the access control item.

11. The method according to claim 10, characterized in that The first terminal determining, based on the first location information and access control information of the second terminal, permission of the second terminal to the first terminal includes: The first terminal determines channel connection type information according to the first location information; The first terminal determines the authority of the second terminal to the first terminal according to the channel connection type information and the access control information.

12. The method according to claim 10 or 11, characterized in that The second field includes one or more of the following information: configuration channel, external vehicle operation channel, internal vehicle operation channel, driver's seat operation channel, and cloud connection channel.

13. The method according to any one of claims 1 to 12, characterized in that The first terminal is a car.

14. The method according to any one of claims 1 to 13, characterized in that The first location information is obtained through one or more of the following positioning methods: ultra-wideband UWB positioning, Bluetooth positioning, and 5G positioning.

15. A method of access control, characterized in that: include: Based on the authority of the second terminal to the first terminal, the second terminal accesses the first terminal; The authority is determined based on first location information of the second terminal and access control information, and the first location information is used to indicate a location relationship of the second terminal relative to the first terminal.

16. The method according to claim 15, characterized in that The access control information is used to record the authority of the second terminal to the first terminal when the second terminal is in different locations.

17. The method according to claim 15 or 16, characterized in that The first location information includes one or more of the following information: inside the car, outside the car, main driver's seat, co-driver's seat, passenger seat, left front door, right front door, left rear door, right rear door, and rear of the car.

18. The method according to any one of claims 15 to 17, characterized in that The first location information is obtained by positioning the second terminal, and the positioning is triggered by a control instruction sent by the second terminal to the first terminal.

19. The method according to any one of claims 15 to 17, characterized in that The first location information is obtained by positioning the second terminal, and the positioning is triggered by establishment of a secure channel between the first terminal and the second terminal.

20. The method according to claim 19, characterized in that The first location information is the real-time location information of the second terminal, and acquisition of the real-time location information is triggered by a control instruction sent by the second terminal to the first terminal.

21. The method according to any one of claims 15 to 20, characterized in that The access control information is recorded in an access control list, which contains one or more access control items.

22. The method according to claim 21, characterized in that The access control item includes a first field, and the first field is used to specifically carry location information corresponding to the access control item.

23. The method according to claim 22, characterized in that The first field includes one or more of the following information: inside the car, outside the car, and driving position.

24. The method according to claim 21, characterized in that The access control item includes a second field, which is used to carry the connection type of the secure channel established between the first terminal and the second terminal, and one or more connection types of the secure channel are associated with the location information corresponding to the access control item.

25. The method according to claim 24, characterized in that The permission is determined based on the first location information and access control information of the second terminal, including: the permission is determined based on channel connection type information and the access control information, and the channel connection type information is determined based on the first location information.

26. The method according to claim 24 or 25, characterized in that The second field includes one or more of the following information: configuration channel, external vehicle operation channel, internal vehicle operation channel, driver's seat operation channel, and cloud connection channel.

27. The method according to any one of claims 15 to 26, characterized in that The first terminal is a car.

28. The method according to any one of claims 15 to 27, characterized in that The first location information is obtained through one or more of the following positioning methods: ultra-wideband UWB positioning, Bluetooth positioning, and 5G positioning.

29. An access control terminal, characterized in that: The terminal is a first terminal, and the terminal includes: a determining unit, configured to determine the authority of the second terminal to the first terminal based on the first location information and the access control information of the second terminal; The first location information is used to indicate the location relationship of the second terminal relative to the first terminal.

30. The terminal according to claim 29, characterized in that The access control information is used to indicate the authority of the second terminal to the first terminal when the second terminal is in a different location.

31. The terminal according to claim 29 or 30, characterized in that The first location information includes one or more of the following information: inside the car, outside the car, main driver's seat, co-driver's seat, passenger seat, left front door, right front door, left rear door, right rear door, and rear of the car.

32. The terminal according to any one of claims 29 to 31, characterized in that: The first location information is obtained by positioning the second terminal, and the positioning is triggered by a control instruction sent by the second terminal to the first terminal.

33. The terminal according to any one of claims 29 to 31, characterized in that: The first location information is obtained by positioning the second terminal, and the positioning is triggered by establishment of a secure channel between the first terminal and the second terminal.

34. The terminal according to claim 33, characterized in that The first location information is the real-time location information of the second terminal, and acquisition of the real-time location information is triggered by a control instruction sent by the second terminal to the first terminal.

35. The terminal according to any one of claims 29 to 34, characterized in that: The access control information is recorded in an access control list, which contains one or more access control items.

36. The terminal according to claim 35, characterized in that The access control item includes a first field, and the first field is used to specifically carry location information corresponding to the access control item.

37. The terminal according to claim 36, characterized in that The first field includes one or more of the following information: inside the car, outside the car, and driving position.

38. The terminal according to claim 35, characterized in that The access control item includes a second field, which is used to carry the connection type of the secure channel established between the first terminal and the second terminal, and one or more connection types of the secure channel are associated with the location information corresponding to the access control item.

39. The terminal according to claim 38, characterized in that The determining unit is specifically configured to: determining channel connection type information according to the first location information; The authority of the second terminal to the first terminal is determined according to the channel connection type information and the access control information.

40. The terminal according to claim 38 or 39, characterized in that The second field includes one or more of the following information: configuration channel, external vehicle operation channel, internal vehicle operation channel, driver's seat operation channel, and cloud connection channel.

41. The terminal according to any one of claims 29-40, characterized in that The first terminal is a car.

42. The terminal according to any one of claims 29 to 41, characterized in that: The first location information is obtained through one or more of the following positioning methods: ultra-wideband UWB positioning, Bluetooth positioning, and 5G positioning.

43. A terminal, characterized in that: The terminal is a second terminal, and the terminal includes: an access unit, configured to access the first terminal based on the authority of the second terminal to the first terminal; The authority is determined based on first location information of the second terminal and access control information, and the first location information is used to indicate a location relationship of the second terminal relative to the first terminal.

44. The terminal according to claim 43, characterized in that The access control information is used to record the authority of the second terminal to the first terminal when the second terminal is in different locations.

45. The terminal according to claim 43 or 44, characterized in that The first location information includes one or more of the following information: inside the car, outside the car, main driver's seat, co-driver's seat, passenger seat, left front door, right front door, left rear door, right rear door, and rear of the car.

46. ​​The terminal according to any one of claims 43 to 45, characterized in that: The first location information is obtained by positioning the second terminal, and the positioning is triggered by a control instruction sent by the second terminal to the first terminal.

47. The terminal according to any one of claims 43 to 45, characterized in that: The first location information is obtained by positioning the second terminal, and the positioning is triggered by establishment of a secure channel between the first terminal and the second terminal.

48. The terminal according to claim 47, characterized in that The first location information is the real-time location information of the second terminal, and acquisition of the real-time location information is triggered by a control instruction sent by the second terminal to the first terminal.

49. The terminal according to any one of claims 43 to 48, characterized in that: The access control information is recorded in an access control list, which contains one or more access control items.

50. The terminal according to claim 49, characterized in that The access control item includes a first field, and the first field is used to specifically carry location information corresponding to the access control item. The terminal according to claim 50 , wherein: The first field includes one or more of the following information: inside the car, outside the car, and driving position.

52. The terminal according to claim 49, characterized in that The access control item includes a second field, which is used to carry the connection type of the secure channel established between the first terminal and the second terminal, and one or more connection types of the secure channel are associated with the location information corresponding to the access control item.

53. The terminal according to claim 52, characterized in that The permission is determined based on the first location information and access control information of the second terminal, including: the permission is determined based on channel connection type information and the access control information, and the channel connection type information is determined based on the first location information.

54. The terminal according to claim 52 or 53, characterized in that The second field includes one or more of the following information: configuration channel, external vehicle operation channel, internal vehicle operation channel, driver's seat operation channel, and cloud connection channel.

55. The terminal according to any one of claims 43 to 54, characterized in that: The first terminal is a car.

56. The terminal according to any one of claims 43 to 55, characterized in that: The first location information is obtained through one or more of the following positioning methods: ultra-wideband UWB positioning, Bluetooth positioning, and 5G positioning.

57. A terminal, characterized in that: The system comprises a memory and a processor, wherein the memory is used to store a program, and the processor is used to call the program in the memory to execute the method according to any one of claims 1 to 28.

58. A device, characterized in that The device comprises a processor configured to call a program from a memory to execute the method according to any one of claims 1 to 28.

59. A chip, characterized in that: The device comprises a processor configured to call a program from a memory so that a device equipped with the chip executes the method according to any one of claims 1 to 28.

60. A computer-readable storage medium, characterized in that A program is stored thereon, the program causing a computer to execute the method according to any one of claims 1 to 28.

61. A computer program product, characterized in that The method comprises a program for causing a computer to execute the method according to any one of claims 1 to 28.

62. A computer program, characterized in that The computer program causes a computer to execute the method according to any one of claims 1 to 28.

Images