System for managing vehicle safety monitoring function based on cloud

Abstract

The invention discloses a system for managing a vehicle safety monitoring function based on a cloud end. A safety function component of an equipment end and an equipment safety function configuration management component of the cloud end are constructed; the safety function component of the equipment end comprises a defense detection function module or an intrusion detection function module and a safety function configuration management module; the equipment security function configuration management component of the cloud comprises an equipment security function configuration request processing module, an equipment security function configuration management module, an equipment security function configuration signature module and an equipment security function configuration issuing module. According to the invention, the solution of the system for managing the vehicle safety function based on the cloud is realized, and the function state is changed in real time through the cooperation of the cloud issuing strategy and the safety monitoring component in the vehicle, so that the corresponding safety function module is enabled, closed and managed.

Description

Technical Field

[0001] The present invention belongs to the field of cloud data processing, and in particular relates to a system for managing vehicle safety monitoring functions based on the cloud. Background Art

[0002] With the development of automobile intelligence, vehicle safety monitoring functions are becoming more and more important. The vehicle safety monitoring system collects the relevant status of the vehicle network and vehicle controller, analyzes the collected information, detects abnormal behavior and takes relevant measures to timely discover and eliminate safety hazards, prevent vehicle intrusion, and ensure vehicle driving safety.

[0003] At present, there are two main ways to implement vehicle safety monitoring functions: one is that the vehicle terminal independently implements the vehicle safety monitoring system, and the other is that the vehicle terminal and the cloud collaborate to implement the vehicle safety monitoring system. The vehicle terminal independent vehicle safety monitoring system means that the vehicle safety monitoring functions are all preset in the vehicle equipment, and no cloud interaction is required. It has problems such as high cost, low flexibility, and high maintenance cost. In the prior art, in the vehicle terminal independent vehicle safety monitoring system and the vehicle-cloud collaborative vehicle safety monitoring system, there are multiple functional modules such as security monitoring functions such as host intrusion detection function, network intrusion detection function, firewall blocking function, etc. The enabling, disabling and management of these functions are all preset in the equipment, and the status of the function can only be changed by upgrading the firmware or program of the vehicle terminal. Summary of the invention

[0004] In response to the existing problems, this system proposes that the system includes the following modules: security function components on the device side and device security function configuration management components on the cloud side: the security function components on the device side include defense detection function modules or intrusion detection function modules and security function configuration management modules. The device security function configuration management components on the cloud side include device security function configuration request processing modules, device security function configuration management modules, device security function configuration signature modules and device security function configuration delivery modules; the device-side security function configuration management module and the cloud-side device security function configuration management module are introduced; the request and response data formats of the vehicle-cloud interactive device security function configuration management are defined; the communication efficiency of the vehicle-cloud collaborative vehicle safety monitoring system is improved, and it has the advantages of low cost, high flexibility and low maintenance cost.

[0005] The technical solution adopted by the present invention to solve the above technical problems is: A system for managing vehicle safety monitoring functions based on the cloud, the system includes the following modules: a safety function component on the device side and a device safety function configuration management component on the cloud side: The security function components on the device side include a defense detection function module or an intrusion detection function module and a security function configuration management module. The device security function configuration management component in the cloud includes a device security function configuration request processing module, a device security function configuration management module, a device security function configuration signature module and a device security function configuration delivery module.

[0006] Furthermore, the process of the security function component on the device side and the device security function configuration management component on the cloud includes: S1, the defense detection function module or the intrusion detection function module checks whether the security function is enabled, and if not, executes step S2; S2. The security function configuration management module sends a function status change request to the device security function configuration request processing module, and the device security function configuration request processing module checks whether the function configuration has been changed; S3. The device security function configuration management module checks whether the function status needs to be changed. If not, it directly returns the result to the security function configuration management module; otherwise, it sends the configuration file signature to the device security function configuration signature module. After the device security function configuration signature module verifies the signature, the device security function configuration delivery module delivers the configuration module to the security function configuration management module; S4, the security function configuration management module returns the function status, S5. The defense detection function module or the intrusion detection function module is turned on or off according to the status.

[0007] Furthermore, the safety function configuration information request data format includes: json data format and a first field description, and the field description includes: main vehicle manufacturer ID, vehicle ID, ecu-ID, component type, session challenge value, and configuration information version number.

[0008] Furthermore, the safety function configuration information response data format includes a json data format and a second field description, and the second field description includes: function list, vehicle ID, component type, session challenge value, configuration information version number, and signature information.

[0009] Further, the safety function configuration management module includes a safety function configuration information cache submodule, a safety function configuration polling reading submodule, a safety function configuration file submodule, a safety function configuration polling update submodule, a safety function configuration signature verification submodule, and a safety function vehicle-cloud interaction submodule; The process of reading the device-side security function configuration includes the following steps: S11, the security function configuration information cache submodule reads the configuration file in the security function configuration file submodule when the program is started, and records the version information of the configuration file; S12, the safety function configuration polling reading submodule creates a thread and a timer, polls and reads the configuration file in the safety function configuration file submodule; and reads the current configuration file version information of the safety function configuration information cache submodule, checks the configuration file version number, and executes the update of the configuration file information of the safety function configuration information cache submodule if it is greater than the existing version number; the version information includes the version number; S13. When the machine intrusion detection function module, the host intrusion defense function module, the network intrusion detection function module or the network intrusion defense function module is started, a thread and a timer are created to poll and check whether the configuration information has changed; the function is turned on or off according to the status.

[0010] Furthermore, the device-side security function configuration update process includes: S21, a security function configuration file submodule, which reads the configuration file in the security function configuration information cache submodule when the program starts, and records the configuration file version information; S22, security function configuration polling update submodule, create threads and timers, S23, the security function configuration polling update submodule obtains the configuration file version information of the security function configuration information cache submodule, S24, the safety function configuration polling update submodule polls the cloud configuration information status of the safety function vehicle-cloud interaction submodule; if an update is required, the integrity and format information of the configuration information are verified, and if the verification is successful, the device safety function configuration information is updated to the safety function configuration file submodule, otherwise the verification failure is returned; S25. The security function configuration polling update submodule updates the device security function cache to the security function configuration information cache submodule.

[0011] Further, the cloud device security function configuration information management component includes a device security function configuration request processing module, a device security function configuration signature verification module, a device security function configuration information reading and writing module, a device security function configuration information database module and a device security function configuration issuing module; The steps to configure the cloud security function include: S31, the device-side function vehicle-cloud interaction submodule sends a configuration information check update request to the device safety function configuration request processing module; S32, the device security function configuration request processing module caches the request data, verifies the function configuration request format and content through the device security function configuration signature verification module, and reads the configuration information and the configuration information version number after the verification passes; S33, the device safety function configuration information reading and writing module reads the configuration information version number in the device safety function configuration information database module, compares the configuration information version number in the database with the configuration file version number, and if the configuration information version number in the database is greater than the configuration file version number, reads the configuration information version in the database; S34, the device security function configuration issuing module generates configuration information change data according to the configuration information version in the database, and requests the device security function configuration signature verification module to sign the configuration information update data. S35. After the device security function configuration signature verification module signs the configuration information update data, it sends the configuration information to the device-side functional vehicle-cloud interaction sub-module.

[0012] Furthermore, the defense detection function module or the intrusion detection function module includes a host intrusion detection function module, a host intrusion defense function module, a network intrusion detection function module, and a network intrusion defense function module.

[0013] The beneficial effects of the present invention are as follows: 1) The device-side safety function configuration management module and the cloud-side device safety function configuration management module were introduced; the request and response data formats for vehicle-cloud interactive device safety function configuration management were defined; the communication efficiency of the vehicle-cloud collaborative vehicle safety monitoring system was improved, with the advantages of low cost, high flexibility and low maintenance cost.

[0014] 2) Implemented a cloud-based system solution for managing vehicle safety functions. By issuing strategies from the cloud and coordinating with the safety monitoring components inside the vehicle, the functional status is changed in real time, thereby enabling, disabling and managing the corresponding safety function modules.

[0015] The above description is only an overview of the technical solution of the present invention. In order to more clearly understand the technical means of the present invention, it can be implemented in accordance with the contents of the specification. In order to make the above description and other purposes, features and advantages of the present invention more obvious and easy to understand, the preferred embodiments are specifically cited and described in detail as follows. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Various other advantages and benefits will become apparent to those of ordinary skill in the art by reading the detailed description of the preferred embodiments below. The accompanying drawings are only for the purpose of illustrating the preferred embodiments and are not to be considered as limiting the present invention. Moreover, the same reference symbols are used throughout the accompanying drawings to represent the same components. In the accompanying drawings: Figure 1 A framework diagram of a system for managing vehicle safety monitoring functions based on the cloud; Figure 2 This is a business sequence diagram for the cloud-based management of vehicle safety function systems; Figure 3Configure the management framework diagram for device-side security functions; Figure 4 Configure read flow chart for device-side security functions; Figure 5 Configure update flow chart for device-side security functions; Figure 6 Configure information management framework diagram for cloud security functions; Figure 7 Configure information flow diagram for cloud security features. DETAILED DESCRIPTION

[0017] The exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments described herein. On the contrary, these embodiments are provided in order to enable a more thorough understanding of the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art.

[0018] In the description of the present invention, unless otherwise clearly specified and limited, the terms "installed", "connected", "connected", "fixed" and the like should be understood in a broad sense, for example, it can be connected, detachably connected, or integrated; it can be mechanically connected or electrically connected; it can be directly connected or indirectly connected through an intermediate medium, it can be the internal connection of two elements or the interaction relationship between two elements. For ordinary technicians in this field, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0019] Example 1 The present invention provides a system for managing vehicle safety monitoring functions based on the cloud, the system comprising: Figure 1 The modules in the architecture diagram shown are: security function components on the device side and device security function configuration management components on the cloud side: The security function components on the device side include a defense detection function module or an intrusion detection function module and a security function configuration management module; The device security function configuration management component in the cloud includes a device security function configuration request processing module, a device security function configuration management module, a device security function configuration signature module and a device security function configuration delivery module.

[0020] Furthermore, if Figure 2 As shown, Figure 2 This is a business sequence diagram for the cloud-based management of vehicle safety function systems. Specifically, the process of the safety function components on the device side and the device safety function configuration management components on the cloud side includes: S1, the defense detection function module or the intrusion detection function module checks whether the security function is enabled, and if not, executes step S2; S2. The security function configuration management module sends a function status change request to the device security function configuration request processing module, and the device security function configuration request processing module checks whether the function configuration has been changed; S3. The device security function configuration management module checks whether the function status needs to be changed. If not, it directly returns the result to the security function configuration management module; otherwise, it sends the configuration file signature to the device security function configuration signature module. After the device security function configuration signature module verifies the signature, the device security function configuration delivery module delivers the configuration module to the security function configuration management module; S4. The security function configuration management module returns the function status.

[0021] S5. The defense detection function module or the intrusion detection function module is turned on or off according to the status.

[0022] Furthermore, the safety function configuration information request data format includes: json data format and a first field description, and the field description includes: main vehicle manufacturer ID, vehicle ID, ecu-ID, component type, session challenge value, and configuration information version number.

[0023] For example, the security function configuration information request data format definition JSON data format and corresponding field description: { "vehicle_oem": "BAIC MOTOR", "vehicle_id":"LFV5A24GXH0012345", "sn":"a4f7818dc6f34c37a3d4388aa877b6a9", "ecu_type":"IVI", "nonce":"99a3eafe1a86e1bfcd8f2b86104735bf", "version": "1.2" } Furthermore, the safety function configuration information response data format includes a json data format and a second field description, and the second field description includes: function list, vehicle ID, component type, session challenge value, configuration information version number, and signature information.

[0024] For example, the safety function configuration information response data format definition JSON data format and corresponding field description: { "featurelist": { "nids": 1, "nips": 0, "hids": 1, "hips": 0, }, "vehicle_id":"LFV5A24GXH0012345", "sn":"a4f7818dc6f34c37a3d4388aa877b6a9", "ecu_type":"IVI", "nonce":"99a3eafe1a86e1bfcd8f2b86104735bf", "version": "1.2", "signature": "iwyLbRqvx0hgAG06DDjDhVbdlbQd4TPU7hhiqdCWiDjxgUnYgzqjTIgPPZSDjjsM\nkzVp / 0nJMGlVHP / yENbSaTi+mXBHhBoH DliC / t6BycSEpOR7 / D+D3pIGr826Yp1W\nLSSVmV2y7SB / ZL5TSRRfI6saxmLTAgMBAAGjUzBRMB0GA1UdDgQWBBRtaDR4EdGX" } Furthermore, if Figure 3 As shown, the safety function configuration management module includes a safety function configuration information cache submodule, a safety function configuration polling reading submodule, a safety function configuration file submodule, a safety function configuration polling update submodule, a safety function configuration signature verification submodule, and a safety function vehicle-cloud interaction submodule; Furthermore, if Figure 4 As shown in the figure, the process of reading the device-side security function configuration includes the following steps: S11, the security function configuration information cache submodule reads the configuration file in the security function configuration file submodule when the program is started, and records the version information of the configuration file; S12, the safety function configuration polling reading submodule creates a thread and a timer, polls and reads the configuration file in the safety function configuration file submodule; and reads the current configuration file version information of the safety function configuration information cache submodule, checks the configuration file version number, and executes the update of the configuration file information of the safety function configuration information cache submodule if it is greater than the existing version number; the version information includes the version number; S13. When the machine intrusion detection function module, the host intrusion defense function module, the network intrusion detection function module or the network intrusion defense function module is started, a thread and a timer are created to poll and check whether the configuration information has changed; the function is turned on or off according to the status.

[0025] For example, various detection or defense function modules, security function configuration information cache, security function configuration polling reading and security function configuration files. Among them, various detection or defense function modules can be one or more function combinations of host intrusion detection function module, host intrusion defense function module, network intrusion detection function module and network intrusion defense function module.

[0026] Furthermore, if Figure 5 As shown in the figure, the device-side security function configuration update process includes: S21, a security function configuration file submodule, which reads the configuration file in the security function configuration information cache submodule when the program starts, and records the configuration file version information; S22, security function configuration polling update submodule, create threads and timers, S23, the security function configuration polling update submodule obtains the configuration file version information of the security function configuration information cache submodule, S24, the safety function configuration polling update submodule polls the cloud configuration information status of the safety function vehicle-cloud interaction submodule; if an update is required, the integrity and format information of the configuration information are verified, and if the verification is successful, the device safety function configuration information is updated to the safety function configuration file submodule, otherwise the verification failure is returned; S25. The security function configuration polling update submodule updates the device security function cache to the security function configuration information cache submodule.

[0027] For example, the device-side safety function configuration update process involves safety function configuration polling updates, safety function vehicle-cloud interaction, safety function configuration signature verification, and safety function configuration files.

[0028] Furthermore, if Figure 6 As shown, the cloud device security function configuration information management component includes a device security function configuration request processing module, a device security function configuration signature verification module, a device security function configuration information reading and writing module, a device security function configuration information database module and a device security function configuration issuing module; Furthermore, if Figure 7 As shown, the steps of configuring information for cloud security functions include: S31, the device-side function vehicle-cloud interaction submodule sends a configuration information check update request to the device safety function configuration request processing module; S32, the device security function configuration request processing module caches the request data, verifies the function configuration request format and content through the device security function configuration signature verification module, and reads the configuration information and the configuration information version number after the verification passes; S33, the device safety function configuration information reading and writing module reads the configuration information version number in the device safety function configuration information database module, compares the configuration information version number in the database with the configuration file version number, and if the configuration information version number in the database is greater than the configuration file version number, reads the configuration information version in the database; S34, the device security function configuration issuing module generates configuration information change data according to the configuration information version in the database, and requests the device security function configuration signature verification module to sign the configuration information update data. S35. After the device security function configuration signature verification module signs the configuration information update data, it sends the configuration information to the device-side functional vehicle-cloud interaction sub-module.

[0029] Furthermore, the defense detection function module or the intrusion detection function module includes a host intrusion detection function module, a host intrusion defense function module, a network intrusion detection function module, and a network intrusion defense function module.

[0030] Example 2 The present invention provides a signature verification method, which is applied to a device security function configuration signature verification module, comprising: In the security function car-cloud interaction, the vehicle ID uses the private key S ID Generate a signed message for the request to be sent to the cloud: S41. Select a random number: r, and calculate ; S42, the vehicle selects a random sequence number , and calculate the signature information ; S43, vehicle ID sends signature information ; In verification according to Verify the signature information; Among them, H1(.), H2(.), h1(.) are hash security functions, and P is a non-singular elliptic curve The elements generated by a, b on the q-order additive cyclic group G Z p ,,p,q are prime numbers, and r is a random number.

[0031] The beneficial effects of the present invention are as follows: 1) The device-side safety function configuration management module and the cloud-side device safety function configuration management module were introduced; the request and response data formats for vehicle-cloud interactive device safety function configuration management were defined; the communication efficiency of the vehicle-cloud collaborative vehicle safety monitoring system was improved, with the advantages of low cost, high flexibility and low maintenance cost.

[0032] 2) Implemented a cloud-based system solution for managing vehicle safety functions. By issuing strategies from the cloud and coordinating with the safety monitoring components inside the vehicle, the functional status is changed in real time, thereby enabling, disabling and managing the corresponding safety function modules.

[0033] 3) Use elliptic curve cryptography algorithm to generate elliptic curve verification interaction protocol to improve the security of information transmission.

[0034] The above is only a preferred specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed by the present invention should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be based on the protection scope of the claims.

Claims

1. A cloud-based system for managing vehicle safety monitoring functions, characterized in that: The system includes the following modules: security function components on the device side and device security function configuration management components on the cloud side: The security function components on the device side include a defense detection function module or an intrusion detection function module and a security function configuration management module; The device security function configuration management component in the cloud includes a device security function configuration request processing module, a device security function configuration management module, a device security function configuration signature module and a device security function configuration delivery module.

2. The system for managing vehicle safety monitoring functions based on the cloud according to claim 1, characterized in that: The process of the device-side security function component and the cloud-side device security function configuration management component includes: S1, the defense detection function module or the intrusion detection function module checks whether the security function is enabled, and if not enabled, executes step S2 S2. The security function configuration management module sends a function status change request to the device security function configuration request processing module, and the device security function configuration request processing module checks whether the function configuration has been changed; S3. The device security function configuration management module checks whether the function status needs to be changed. If not, it directly returns the result to the security function configuration management module; otherwise, it sends the configuration file signature to the device security function configuration signature module. After the device security function configuration signature module verifies the signature, the device security function configuration delivery module delivers the configuration module to the security function configuration management module; S4, the security function configuration management module returns the function status, S5. The defense detection function module or the intrusion detection function module is turned on or off according to the status.

3. The system for managing vehicle safety monitoring functions based on the cloud according to claim 1, characterized in that: The safety function configuration information request data format includes: json data format and the first field description, and the field description includes: main vehicle manufacturer ID, vehicle ID, ecu-ID, component type, session challenge value, and configuration information version number.

4. The system for managing vehicle safety monitoring functions based on the cloud according to claim 1, characterized in that: The safety function configuration information response data format includes a json data format and a second field description, wherein the second field description includes: function list, vehicle ID, component type, session challenge value, configuration information version number, and signature information.

5. The system for managing vehicle safety monitoring functions based on the cloud according to claim 1, characterized in that: The safety function configuration management module includes a safety function configuration information cache submodule, a safety function configuration polling reading submodule, a safety function configuration file submodule, a safety function configuration polling update submodule, a safety function configuration signature verification submodule, and a safety function vehicle-cloud interaction submodule; The process of reading the device-side security function configuration includes the following steps: S11, the security function configuration information cache submodule reads the configuration file in the security function configuration file submodule when the program is started, and records the version information of the configuration file; S12, the safety function configuration polling reading submodule creates a thread and a timer, and polls and reads the configuration file in the safety function configuration file submodule; and reading the current configuration file version information of the security function configuration information cache submodule, checking the configuration file version number, and if it is greater than the existing version number, executing the security function configuration information cache submodule configuration file information update; the version information includes the version number; S13. When the machine intrusion detection function module, the host intrusion defense function module, the network intrusion detection function module or the network intrusion defense function module is started, a thread and a timer are created to poll and check whether the configuration information has changed; the function is turned on or off according to the status.

6. The system for managing vehicle safety monitoring functions based on the cloud according to claim 4, characterized in that: The device-side security function configuration update process includes: S21, a security function configuration file submodule, which reads the configuration file in the security function configuration information cache submodule when the program starts, and records the configuration file version information; S22, security function configuration polling update submodule, create threads and timers, S23, the security function configuration polling update submodule obtains the configuration file version information of the security function configuration information cache submodule, S24, the safety function configuration polling update submodule polls the cloud configuration information status of the safety function vehicle-cloud interaction submodule; if an update is required, the integrity and format information of the configuration information are verified, and if the verification is successful, the device safety function configuration information is updated to the safety function configuration file submodule, otherwise the verification failure is returned; S25. The security function configuration polling update submodule updates the device security function cache to the security function configuration information cache submodule.

7. The system for managing vehicle safety monitoring functions based on the cloud according to claim 1, characterized in that: The cloud device security function configuration information management component includes a device security function configuration request processing module, a device security function configuration signature verification module, a device security function configuration information reading and writing module, a device security function configuration information database module and a device security function configuration issuing module; The steps to configure the cloud security function include: S31, the device-side function vehicle-cloud interaction submodule sends a configuration information check update request to the device safety function configuration request processing module; S32, the device security function configuration request processing module caches the request data, verifies the function configuration request format and content through the device security function configuration signature verification module, and reads the configuration information and the configuration information version number after the verification passes; S33, the device safety function configuration information reading and writing module reads the configuration information version number in the device safety function configuration information database module, compares the configuration information version number in the database with the configuration file version number, and if the configuration information version number in the database is greater than the configuration file version number, reads the configuration information version in the database; S34, the device security function configuration issuing module generates configuration information change data according to the configuration information version in the database, and requests the device security function configuration signature verification module to sign the configuration information update data. S35. After the device security function configuration signature verification module signs the configuration information update data, it sends the configuration information to the device-side functional vehicle-cloud interaction sub-module.

8. The system for managing vehicle safety monitoring functions based on the cloud according to claim 1, characterized in that: The defense detection function module or intrusion detection function module includes a host intrusion detection function module, a host intrusion defense function module, a network intrusion detection function module, and a network intrusion defense function module.

Images