Vehicle data security hosting method, system and device and storage medium

Abstract

The invention discloses a vehicle data security hosting method, system and device and a storage medium, and relates to the technical field of vehicle data management. According to the method, network global state information is collected, the network global state information comprises virtual machine state information and network link information, risk analysis is conducted on virtual machine links according to the network global state information, the link state of each virtual machine is obtained, and then available virtual machines are screened out according to the link states of the virtual machines. And obtaining a to-be-scheduled vehicle data file set, determining a virtual machine scheduling scheme of the vehicle data file set by taking minimization of a virtual machine use space difference between available virtual machines as a target, and allocating files in the vehicle data file set to the corresponding available virtual machines according to the virtual machine scheduling scheme. According to the invention, the vehicle data security and processing efficiency in the data processing process based on the virtual machine can be improved.

Description

Technical Field

[0001] The present invention relates to the technical field of vehicle data management, and in particular to a vehicle data security trusteeship method, system, device and storage medium. Background Art

[0002] With the development of intelligent and connected vehicles, the security and privacy protection of vehicle data have become particularly important. Vehicle data security hosting services refer to the establishment of a secure hosting service platform by a professional service provider through advanced technical means and management measures. The platform collects, stores, processes, analyzes and protects various types of data generated by vehicles, thereby achieving secure hosting of vehicle data. In the secure hosting service platform, data processing may need to be implemented in different virtual machines, but there are problems with vehicle data security and processing efficiency in the data processing process based on virtual machines. Summary of the invention

[0003] The main purpose of the embodiments of the present application is to propose a vehicle data security hosting method, system, device and storage medium, aiming to improve vehicle data security and processing efficiency in the data processing process based on a virtual machine.

[0004] To achieve the above-mentioned purpose, one aspect of an embodiment of the present application proposes a vehicle data security hosting method, which is applied to a security hosting service platform. The security hosting service platform is used to receive vehicle data from a vehicle terminal and manage the vehicle data. The vehicle data security hosting method includes the following steps:

[0005] Collecting network global status information, wherein the network global status information includes virtual machine status information and network link information;

[0006] Performing risk analysis on virtual machine links according to the network global status information to obtain link status of each virtual machine;

[0007] Filter out available virtual machines according to the link status of the virtual machines;

[0008] Obtain a set of vehicle data files to be dispatched;

[0009] With the goal of minimizing the difference in virtual machine usage space between the available virtual machines, a virtual machine scheduling scheme for the vehicle data file set is determined, and files in the vehicle data file set are allocated to corresponding available virtual machines according to the virtual machine scheduling scheme.

[0010] In some embodiments, the step of determining the virtual machine scheduling scheme for the vehicle data file set with the goal of minimizing the difference in virtual machine usage space between the available virtual machines comprises the following steps:

[0011] Sorting the files in the vehicle data file set respectively using a plurality of preset sorting methods to obtain a plurality of corresponding variant file sets;

[0012] Dividing each of the variant file sets to obtain a first file set and a second file set;

[0013] Using a plurality of preset scheduling methods to respectively schedule the first file set and the second file set of the variant file set, and obtaining virtual machine usage space differences of corresponding scheduling methods;

[0014] The preset sorting method and scheduling method corresponding to the smallest virtual machine usage space difference are selected to determine the virtual machine scheduling scheme for the vehicle data file set.

[0015] In some embodiments, the plurality of preset sorting methods include random file sorting, descending file sorting, and ascending file sorting, and the plurality of preset scheduling methods include a method of scheduling the first file set first and then the second file set, and a method of scheduling the second file set first and then the first file set.

[0016] In some embodiments, the vehicle data security hosting method further includes the following steps:

[0017] Receiving a first identity authentication request from a vehicle terminal;

[0018] authenticating the vehicle terminal according to the first authentication request, and when the vehicle terminal passes the authentication, allocating a vehicle identifier and a communication encryption key to the vehicle terminal, and storing the vehicle identifier and the communication encryption key in association;

[0019] A first request response of successful authentication is sent to the vehicle terminal, wherein the first request response includes the vehicle identifier and the communication encryption key, so that the vehicle terminal uses the vehicle identifier and the communication encryption key to interact with vehicle data.

[0020] In some embodiments, the vehicle data security hosting method further includes the following steps:

[0021] Determining sensitive data in the vehicle data according to key fields;

[0022] Splitting the sensitive data into two segments to obtain two first data blocks;

[0023] Using a triple data encryption algorithm to encrypt the two first data blocks respectively to obtain two first encrypted data;

[0024] Splitting each of the two first encrypted data into two segments to obtain four second data blocks;

[0025] Using an encryption algorithm based on the Advanced Encryption Standard to encrypt the four second data blocks respectively to obtain four second encrypted data;

[0026] The same data identifier is allocated to the four second encrypted data, and the second encrypted data is stored according to the data identifier.

[0027] In some embodiments, the vehicle data security hosting method further includes the following steps:

[0028] Receiving a second identity authentication request from a user terminal, wherein the second identity authentication request includes a user identity identifier;

[0029] Authenticating the user terminal according to the user identity identifier in the second identity authentication request, and when the user terminal passes the identity authentication, setting a remote access permission for the user terminal, and storing the user identity identifier and the remote access permission in association, wherein the remote access permission includes a vehicle remote control permission and a vehicle data access scope;

[0030] An access request from a user terminal is received, and a corresponding remote access permission is determined according to a user identity in the access request, and access control is performed on the access request according to the remote access permission.

[0031] In some embodiments, the vehicle data security hosting method further includes the following steps:

[0032] Regularly perform security assessment and vulnerability scanning on the vehicle system of the vehicle terminal to monitor whether the vehicle system has security vulnerabilities;

[0033] When it is determined that the vehicle system has a security vulnerability, a system update notification is sent to the system developer platform according to the security vulnerability to obtain a system upgrade package;

[0034] The system upgrade package is sent to the vehicle terminal to repair the security loopholes of the vehicle system.

[0035] To achieve the above-mentioned purpose, another aspect of the embodiment of the present application proposes a vehicle data security hosting system, which is applied to a security hosting service platform. The security hosting service platform is used to receive vehicle data from a vehicle terminal and manage the vehicle data. The vehicle data security hosting system includes:

[0036] A performance data collection module, used to collect network global status information, wherein the network global status information includes virtual machine status information and network link information;

[0037] A performance data analysis module, used to perform risk analysis on virtual machine links according to the network global status information to obtain the link status of each virtual machine; and filter out available virtual machines according to the link status of the virtual machine;

[0038] A data scheduling module is used to obtain a set of vehicle data files to be scheduled; determine a virtual machine scheduling scheme for the vehicle data file set with the goal of minimizing the difference in virtual machine usage space between the available virtual machines, and allocate files in the vehicle data file set to corresponding available virtual machines according to the virtual machine scheduling scheme.

[0039] To achieve the above-mentioned purpose, another aspect of an embodiment of the present application proposes an electronic device, which includes a memory, a processor, a program stored on the memory and executable on the processor, and a data bus for realizing connection and communication between the processor and the memory. When the program is executed by the processor, the vehicle data security hosting method described in the above-mentioned embodiment is realized.

[0040] To achieve the above-mentioned purpose, another aspect of an embodiment of the present application proposes a storage medium, which is a computer-readable storage medium used for computer-readable storage, and the storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the vehicle data security hosting method described in the above embodiment.

[0041] The vehicle data security hosting method, system, device and storage medium proposed in the present application collect network global status information, which includes virtual machine status information and network link information, and then perform risk analysis on virtual machine links based on the network global status information to obtain the link status of each virtual machine, and then filter out available virtual machines based on the link status of the virtual machine. Obtain a set of vehicle data files to be scheduled, determine a virtual machine scheduling scheme for the vehicle data file set with the goal of minimizing the difference in virtual machine usage space between available virtual machines, and allocate files in the vehicle data file set to corresponding available virtual machines according to the virtual machine scheduling scheme. The present application can improve the security of the data scheduling process by performing risk analysis on virtual machine links and screening available virtual machines, and improve data processing efficiency by determining a scheduling scheme and performing virtual machine resource allocation with the goal of minimizing the difference in virtual machine usage space between available virtual machines. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] Figure 1 is a flow chart of a vehicle data security hosting method provided in an embodiment of the present application;

[0043] Figure 2 yes Figure 1 Flow chart of step S105 in FIG.

[0044] Figure 3 is a flow chart of a vehicle data security hosting method provided by another embodiment of the present application;

[0045] Figure 4 is a flow chart of a vehicle data security hosting method provided by another embodiment of the present application;

[0046] Figure 5 is a flow chart of a vehicle data security hosting method provided by another embodiment of the present application;

[0047] Figure 6 is a flow chart of a vehicle data security hosting method provided by another embodiment of the present application;

[0048] Figure 7 is a schematic diagram of a vehicle data security hosting system provided in an embodiment of the present application;

[0049] Figure 8 It is a schematic diagram of the interaction scenario of the secure hosting service platform provided in the embodiment of the present application;

[0050] Fig. 9 is a schematic diagram of the hardware structure of an electronic device provided in an embodiment of the present application;

[0051] Fig.10 It is a functional schematic diagram of the security hosting service platform provided in the embodiment of the present application;

[0052] Fig.11 It is a schematic diagram of the privacy protection function provided by an embodiment of the present application;

[0053] Fig.12 It is a schematic diagram of the security vulnerability processing function provided by the embodiment of the present application;

[0054] Fig.13 It is a schematic diagram of the security upgrade and patching functions provided in an embodiment of the present application. DETAILED DESCRIPTION

[0055] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0056] It should be noted that, although the functional modules are divided in the system schematic diagram and the logical order is shown in the flowchart, in some cases, the steps shown or described may be performed in a different order than the module division in the system or the order in the flowchart. The terms "first", "second", etc. in the specification, claims and the above drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

[0057] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art to which this application belongs. The terms used herein are only for the purpose of describing the embodiments of this application and are not intended to limit this application.

[0058] The embodiments of the present application propose a vehicle data security hosting method, system, device and storage medium, aiming to improve vehicle data security and processing efficiency in a virtual machine-based data processing process.

[0059] The vehicle data security hosting method, system, device and storage medium provided in the embodiments of the present application are specifically illustrated through the following embodiments. First, the vehicle data security hosting method in the embodiments of the present application is described.

[0060] The vehicle data security hosting method provided in the embodiment of the present application relates to the field of vehicle data management technology. The vehicle data security hosting method provided in the embodiment of the present application can be applied to the terminal or to the server. In other words, a security hosting service platform that can implement the vehicle data security hosting method of the embodiment of the present application can be built on the terminal or the server. In some embodiments, the terminal can be a smart phone, a tablet computer, a laptop computer, a desktop computer, etc.; the server side can be configured as an independent physical server, or as a server cluster or distributed system composed of multiple physical servers, or as a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms.

[0061] The present application can be used in many general or special computer system environments or configurations. For example: personal computers, server computers, handheld or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics, network PCs, minicomputers, mainframe computers, distributed computing environments including any of the above systems or devices, etc. The present application can be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. The present application can also be practiced in distributed computing environments, in which tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules can be located in local and remote computer storage media including storage devices.

[0062] The vehicle data security hosting method of the embodiment of the present application is applied to the security hosting service platform, please refer to Figure 8 , the security hosting service platform 100 can interact with the user terminal 300 and the vehicle terminal 200 respectively, and the security hosting service platform can provide data management (such as data storage and data protection) and data processing (such as vehicle fault analysis) and other functions for the vehicle terminal. The security hosting service platform can provide the user terminal with vehicle data query, vehicle remote control and other functions. Furthermore, the security hosting service platform can also interact with the system developer platform 400, so that the system developer platform can provide the security hosting service platform with the software upgrade package of the vehicle system, so as to issue the vehicle upgrade instruction to the vehicle terminal through the security hosting service platform. The function of the security hosting service platform is implemented based on the vehicle data security hosting method of the embodiment of the present application, and the vehicle data security hosting method of the embodiment of the present application is introduced below.

[0063] Please refer to Figure 1 The vehicle data security hosting method of the embodiment of the present application may include but is not limited to steps S101 to S105:

[0064] Step S101, collecting network global status information, wherein the network global status information includes virtual machine status information and network link information;

[0065] Step S102, performing risk analysis on virtual machine links according to the global network status information to obtain the link status of each virtual machine;

[0066] Step S103, filtering out available virtual machines according to the link status of the virtual machines;

[0067] Step S104, obtaining a set of vehicle data files to be scheduled;

[0068] Step S105 , with the goal of minimizing the difference in virtual machine usage space between available virtual machines, determine a virtual machine scheduling scheme for the vehicle data file set, and allocate files in the vehicle data file set to corresponding available virtual machines according to the virtual machine scheduling scheme.

[0069] In this embodiment, in the secure hosting service platform, data processing may be performed in different cloud virtual machines. Based on this, the embodiment of the present application proposes a vehicle data security hosting method of steps S101 to S105, which can realize data scheduling in a cloud environment.

[0070] First, all possible information about the global status of the network can be collected through the performance data collection module (i.e., collector). The collector agent scans all available resources and collects virtual machine status information and network link information. The virtual machine status information represents the current resource usage and operation status of the virtual machine. The network link information includes the virtual machine communication link status and can also include the communication link status of the interactive terminal, etc.

[0071] Secondly, the performance data analysis module (i.e., monitor) can be used to perform risk analysis on the collected information and further determine the security level and type of each network link, such as whether the network link is a downlink, a low-risk link, a fair link, or a high-risk link.

[0072] Then, available virtual machines that can process data are selected from the virtual machine cluster according to the link status of the virtual machine. Specifically, virtual machines with higher security levels are selected as available virtual machines according to the security level of the link status of the virtual machine.

[0073] Finally, the vehicle data file set to be scheduled is obtained through the data scheduling module, and the virtual machine scheduling scheme for the vehicle data file set is determined with the goal of minimizing the difference in virtual machine usage space between available virtual machines. The files in the vehicle data file set are allocated to the corresponding available virtual machines according to the virtual machine scheduling scheme to achieve load balancing of the virtual machines, thereby improving data processing efficiency.

[0074] Among them, in the scheduling process of the data scheduling module, the goal of the scheduling scheme is to minimize the virtual machine usage space difference GpV. Therefore, this embodiment searches for the distance between all virtual machines in the used space (that is, the virtual machine usage space difference), and the distance is expressed by GpV, as follows:.

[0075]

[0076] Among them, N v Indicates the number of available virtual machines, V i Indicates the virtual machine number, Tv i Indicates the total space of the virtual machine, Tv min Indicates the minimum space used In addition, to facilitate the subsequent description, F is defined as the vehicle data file set, N f is the number of files in the vehicle data file set, V m A collection of virtual machines (including N v available virtual machines), f j is the file number, sf j For file f j The size of tf j Transfer files j The space used.

[0077] See also Figure 2 In some embodiments, the step of determining the virtual machine scheduling scheme for the vehicle data file set with the goal of minimizing the virtual machine usage space difference between the available virtual machines in step S105 may include, but is not limited to, steps S201 to S204:

[0078] Step S201, sorting the files in the vehicle data file sets using a plurality of preset sorting methods to obtain a plurality of corresponding variant file sets;

[0079] Step S202, dividing each variant file set to obtain a first file set and a second file set;

[0080] Step S203, using a plurality of preset scheduling methods to respectively schedule the first file set and the second file set of the variant file set, and obtaining virtual machine usage space differences of corresponding scheduling methods;

[0081] Step S204 , selecting a preset sorting method and scheduling method corresponding to the smallest virtual machine usage space difference, and determining a virtual machine scheduling scheme for the vehicle data file set.

[0082] In some embodiments, multiple preset sorting methods include random file sorting, descending file sorting, and ascending file sorting, and multiple preset scheduling methods include scheduling the first file set first and then the second file set, and scheduling the second file set first and then the first file set.

[0083] In some embodiments, for the splitting of the variant file set, two empty data sets may be defined first, and the number of files in the first data set G1 is defined as The number of files in the second data set G2 is n2 = Nf-n1. where F = {f1,…,f Nf}.

[0084] For example, the vehicle data file set is randomly sorted to obtain the first variant file set, which is divided into two file sets G1 and G2, and the two file sets are scheduled according to two preset scheduling methods. The first method is that after all files in G1 are scheduled, the files in G2 are scheduled. The second method is that after all files in G2 are scheduled, all files in G1 are scheduled. The GpV of each scheduling method is calculated.

[0085] After sorting the vehicle data file set in descending order, the second variant file set is obtained, which is divided into two file sets G1 and G2, and the two file sets are scheduled according to two preset scheduling methods. The first method is that after all files in G1 are scheduled, the files in G2 are scheduled. The second method is that after all files in G2 are scheduled, all files in G1 are scheduled. Calculate the GpV of each scheduling method.

[0086] After sorting the vehicle data file set in ascending order, the third variant file set is obtained, which is divided into two file sets G1 and G2, and the two file sets are scheduled according to the two preset scheduling methods. The first method is to schedule all files in G1 before scheduling files in G2. The second method is to schedule all files in G1 after scheduling all files in G2. Calculate the GpV of each scheduling method.

[0087] The descending operation can be implemented using the DCs(A) function, which takes a set of elements as input and sorts them in descending order of their values. The ascending operation can be implemented using ICs(A), which takes a set of elements as input and sorts them in ascending order of their values.

[0088] The scheduling of file elements can be implemented by Sh(A) function, which means scheduling the elements on the virtual machine one by one. i The minimum value is the characteristic element. Each variant file set is represented by HGCP and its scheduling process is as follows:

[0089] Step 0 constructs G1 and G2;

[0090] Step 1 calls Sh(G1);

[0091] Step 2 calls Sh(G2);

[0092] Step 3 Calculation

[0093] Step 4: Call Sh(G2);

[0094] Step 5: Call Sh(G1);

[0095] Step 6 Calculation

[0096] The above process returns the solution and Here, k represents the type of the preset sorting method, and in this embodiment, k={1, 2, 3}.

[0097] The calculation process to minimize GpV is as follows:

[0098] Step 0: Call HGCP(F) for each variant.

[0099] Step 1 Calculation

[0100] The minimum GpV is determined through the above process, so as to determine the corresponding preset sorting method (ie, the variant method of the vehicle data file set) and the scheduling method to form the final scheduling strategy.

[0101] It is understandable that the above-mentioned preset sorting method, the number of splits of the vehicle data file set and the scheduling method are only exemplary. In more embodiments, the vehicle data file set can be modified and split into a larger number of file sets (for example, three), and then different order scheduling methods are used for each file set to calculate the corresponding GpV.

[0102] See also Figure 3 In some embodiments, the vehicle data security hosting method of the embodiment of the present application further includes but is not limited to steps S301 to S303:

[0103] Step S301, receiving a first identity authentication request from a vehicle terminal;

[0104] Step S302, performing identity authentication on the vehicle terminal according to the first identity authentication request, and when the vehicle terminal passes the identity authentication, allocating a vehicle identifier and a communication encryption key to the vehicle terminal, and storing the vehicle identifier and the communication encryption key in association;

[0105] Step S303, sending a first request response of successful authentication to the vehicle terminal, wherein the first request response includes a vehicle identifier and a communication encryption key, so that the vehicle terminal uses the vehicle identifier and the communication encryption key to interact with vehicle data.

[0106] In this embodiment, please refer to Fig.10 The secure hosting service platform can also provide vehicle identity authentication functions, making the communication between the vehicle and the secure hosting service platform safe and reliable. The vehicle identity authentication functions specifically include:

[0107] Authentication protocol: The vehicle communicates with the secure hosting service platform through an encryption protocol. At the beginning of the communication, the vehicle uses its own number to send the first identity authentication request to the platform for identity authentication and registration on the platform. Specifically, when the vehicle communicates with the cloud for the first time, the platform needs to apply for a communication certificate to establish a long link with the platform. The controller that communicates between the vehicle and the platform obtains the vehicle's VIN and SN code to form the application communication certificate ID. The vehicle generates a public and private key pair through the HSM chip and establishes a secure link TLS1.2 with the platform. After verifying the vehicle information, the platform forwards the application for a communication certificate to the corresponding CA, and the CA issues a communication certificate and returns it to the vehicle terminal through the platform (the validity period of the communication certificate can be limited to 3 months). After the vehicle terminal verifies that the certificate is correct, the communication certificate (such as an X509 certificate) is securely stored. Each time the vehicle is powered on, the validity period of the communication certificate is first checked. If it is less than 1 month, the communication certificate can be re-applied. This process can use the original communication certificate for application; if the communication certificate is expired, the vehicle VIN and SN code must be used for re-application.

[0108] Unique identifier allocation: When the vehicle terminal passes the platform's identity authentication, the platform allocates a unique vehicle identifier to the vehicle terminal, such as a number or character sequence, which is used to identify and recognize the vehicle.

[0109] Key management: The vehicle terminal passes the platform's identity authentication, and the platform generates vehicle-related encryption keys. In the subsequent data interaction process, the platform uses the vehicle's identifier and the corresponding key to authenticate the vehicle and perform data interaction.

[0110] Encryption and authentication mechanisms: Communications between the platform and the vehicle use powerful encryption algorithms and authentication mechanisms, such as symmetric encryption and asymmetric encryption, to improve data confidentiality, integrity, and authenticity during communication.

[0111] See also Figure 4 In some embodiments, the vehicle data security hosting method of the embodiment of the present application further includes but is not limited to steps S401 to S406:

[0112] Step S401, determining sensitive data in vehicle data according to key fields;

[0113] Step S402, split the sensitive data into two segments to obtain two first data blocks;

[0114] Step S403, using a triple data encryption algorithm to encrypt the two first data blocks respectively to obtain two first encrypted data;

[0115] Step S404, splitting the two first encrypted data into two segments to obtain four second data blocks;

[0116] Step S405, using an encryption algorithm based on the Advanced Encryption Standard to encrypt the four second data blocks respectively to obtain four second encrypted data;

[0117] Step S406: assign the same data identifier to the four second encrypted data, and store the second encrypted data according to the data identifier.

[0118] In this embodiment, the secure hosting service platform can also provide a data security storage function to protect vehicle data and achieve privacy protection. The data security storage function specifically includes:

[0119] Data encryption and decryption: Sensitive vehicle data (such as driving records, vehicle information, and user privacy) is encrypted using a high-strength encryption algorithm before storage. Only authorized users can decrypt and access sensitive data.

[0120] Access control and permission management: The secure data storage system implements strict access control policies, allowing only authorized users or car owners to access specific data. The platform can assign different data access permissions based on user roles and authorization levels.

[0121] Data backup and disaster recovery: To ensure data security and reliability, the secure data storage system can perform regular data backup and take disaster recovery measures to deal with possible failures and data loss.

[0122] Security auditing and monitoring: The secure data storage system records and monitors data access and operation logs for security auditing and tracking, which helps detect potential data abuse and illegal access.

[0123] Through the combination of a secure hosting service platform and secure data storage, the vehicle's sensitive data is protected and only authorized users can access and decrypt the data. The platform's security measures enhance the confidentiality of vehicle data and prevent unauthorized data access and theft.

[0124] Please refer to Fig.11 ,For the privacy protection of vehicle sensitive data, the following measures are adopted:

[0125] Minimize data collection and storage: Collect and store only the necessary data required by the vehicle safety system and avoid collecting sensitive information. Classify and encrypt the collected data, restrict access rights, and establish strict data protection policies.

[0126] Anonymization and desensitization technology: Anonymize and desensitize vehicle data to protect the privacy of car owners and users. For example, use anonymous IDs instead of real identities and desensitize sensitive data to reduce the risk of privacy leaks.

[0127] Privacy policy and informed consent: Formulate a clear privacy policy and provide relevant informed consent mechanisms to car owners and users so that they understand how their data is used and protected, and enable users to correctly limit the platform's data collection permissions.

[0128] In some embodiments, a secure data obfuscation encryption method is provided. First, the data is split into data of equal length at both ends, and the split data is obfuscated and encrypted using triple DES (i.e., triple data encryption algorithm), and the obfuscated encrypted data blocks are split again, and the split data blocks are obfuscated and encrypted using 128_AES (128-bit key based on the Advanced Encryption Standard), and finally four obfuscated data blocks are obtained. Different and unique numbers are assigned for identification of different vehicle sensitive data, and the same number is used for identification of the same vehicle sensitive data. When a certain data needs to be called, the corresponding multiple data blocks can be obtained by number identification, and the corresponding sensitive data can be obtained by reverse decrypting the multiple data blocks. It can be understood that in the encryption process of sensitive data, the data can be split into a larger number of data blocks, and more encryption times can be used, and the embodiments of the present application are not specifically limited. This embodiment can increase its complexity and reliability through multiple obfuscation encryptions, so that the difficulty of obtaining data by reverse attacks is increased.

[0129] See also Figure 5 In some embodiments, the vehicle data security hosting method of the embodiment of the present application further includes but is not limited to steps S501 to S503:

[0130] Step S501, receiving a second identity authentication request from a user terminal, wherein the second identity authentication request includes a user identity identifier;

[0131] Step S502, authenticating the user terminal according to the user identity identifier in the second identity authentication request, and when the user terminal passes the identity authentication, setting a remote access permission for the user terminal, and storing the user identity identifier and the remote access permission in association, wherein the remote access permission includes a vehicle remote control permission and a vehicle data access scope;

[0132] Step S503: receiving an access request from a user terminal, determining a corresponding remote access permission according to the user identity in the access request, and performing access control on the access request according to the remote access permission.

[0133] In this embodiment, please refer to Fig.10 The secure hosting service platform can also provide remote access and control functions, allowing the owner or authorized user to remotely access and control the vehicle. The remote access and control functions include:

[0134] User identity authentication: The platform receives a second identity authentication request from the user end, and authenticates the user end according to the user identity identifier in the second identity authentication request. If the user end passes the identity authentication, it indicates that the user end is a trusted terminal of the vehicle. At this time, the remote access permission can be set according to the role defined by the owner for the user end, where the remote access permission includes the remote operations that can be performed and the scope of vehicle data that can be accessed. If the user end fails the identity authentication, the user is denied access to data and control of the vehicle.

[0135] Remote monitoring and control interface: The platform provides a user interface, such as a mobile app or web interface, for remote monitoring and control of the vehicle. Users can view the real-time status of the vehicle, start / stop the engine, lock / unlock the vehicle, etc. through the interface.

[0136] Secure communication protocol: A secure communication protocol is used during remote access and control to ensure the confidentiality, integrity and authenticity of data. This protocol can use encryption algorithms and digital signature technology to protect the secure transmission of data.

[0137] See also Figure 6 In some embodiments, the vehicle data security hosting method of the embodiment of the present application further includes but is not limited to steps S601 to S603:

[0138] Step S601, regularly performing security assessment and vulnerability scanning on the vehicle system of the vehicle terminal to monitor whether there are security vulnerabilities in the vehicle system;

[0139] Step S602, when it is determined that there is a security vulnerability in the vehicle system, a system update notification is sent to the system developer platform according to the security vulnerability to obtain a system upgrade package;

[0140] Step S603: Send a system upgrade package to the vehicle terminal to repair the security loopholes of the vehicle system.

[0141] In this embodiment, please refer to Fig.10 The security hosting service platform can also provide security upgrades and patching functions to regularly protect vehicle systems against new system security vulnerabilities and attacks. The security upgrade and patching functions specifically include:

[0142] Security assessment and vulnerability scanning: The platform can conduct regular security assessment and vulnerability scanning on itself or the vehicle system to discover new security vulnerabilities and potential attack surfaces, and take timely measures to repair existing security defects. For details, please refer to Fig.12 , the solutions to security vulnerabilities include:

[0143] Implement security testing and vulnerability assessment: The platform regularly conducts security testing and vulnerability assessments on vehicle safety systems to discover and fix potential security vulnerabilities, including comprehensive reviews and tests of communication protocols, identity authentication mechanisms, and software implementations.

[0144] Strengthen authentication and encryption mechanisms: Strengthen authentication and data encryption mechanisms between vehicles and secure hosting services. Use strong passwords and multi-factor authentication to ensure that only authorized users can access vehicle data and control functions.

[0145] Implementing the Security Development Lifecycle (SDLC): During the development of vehicle safety systems, the security development lifecycle approach should be adopted, including stages such as security requirements analysis, security design, security coding and security testing, which can help discover and resolve potential security issues at an early stage.

[0146] Regular security patches and upgrades: The security hosting service platform regularly provides security patches and upgrades to fix known security vulnerabilities and fill system security gaps.

[0147] Remote update mechanism: The vehicle's software and systems can be updated remotely through a secure hosting service platform. This allows car owners to obtain the latest security protection in a timely manner and reduce physical access to the vehicle.

[0148] Error reporting and feedback mechanism: Car owners and users can report any errors or security issues found to the security hosting service platform and provide feedback. This helps the platform understand and solve problems in a timely manner.

[0149] For details, please refer to Fig.13 , the platform's specific handling of security upgrades and patches is as follows:

[0150] Remote security upgrades: Design and implement remote security upgrade mechanisms to enable vehicle systems to regularly receive and install security patches and updates, thereby reducing the need for physical access to vehicles and promptly fixing known security vulnerabilities.

[0151] Security upgrade notification and push: Establish an effective notification and push mechanism to provide timely information on security upgrades and patches to car owners and users. Message notifications can be achieved through mobile phone applications, emails, or the information display system inside the vehicle, so that car owners and users can understand and take necessary security updates in a timely manner.

[0152] Partner management: Establish effective security partnerships with suppliers and partners, establish connections with the vehicle's system developer platform in the event of security vulnerabilities, and require system developers to provide support for security upgrades and patches. The platform can also conduct compliance assessments, security audits, and establish security protocols with hardware and software suppliers.

[0153] In some embodiments, please refer to Fig.10 The security hosting service platform can also provide anomaly detection and alarm functions to monitor the safety status of the vehicle in real time and detect any abnormal activities or potential attacks. The anomaly detection and alarm functions include:

[0154] Network traffic monitoring: The secure hosting service platform monitors the vehicle’s network traffic in real time, detecting data packets and flows related to vehicle communications.

[0155] System status monitoring: The platform monitors the vehicle's system status, such as engine status, vehicle location, sensor data, etc., to analyze any abnormal or abnormal behavior.

[0156] Anomaly detection algorithm: The platform uses anomaly detection algorithms to analyze the vehicle's network traffic and system status to detect potential attack behaviors or abnormal activities. The detection algorithm used can be based on rules, machine learning, or behavioral analysis algorithms.

[0157] Real-time alarm mechanism: When the platform detects abnormal activities, it can trigger an alarm mechanism. The alarm can notify the car owner or relevant security personnel through mobile phone applications, SMS, email or sound alarms.

[0158] See also Figure 7 The embodiment of the present application also provides a vehicle data security hosting system, which is applied to a security hosting service platform. The security hosting service platform is used to receive vehicle data from a vehicle terminal and manage the vehicle data. The vehicle data security hosting system includes:

[0159] A performance data collection module is used to collect network global status information, wherein the network global status information includes virtual machine status information and network link information;

[0160] The performance data analysis module is used to perform risk analysis on virtual machine links based on the global network status information to obtain the link status of each virtual machine; and to filter out available virtual machines based on the link status of the virtual machines;

[0161] The data scheduling module is used to obtain a set of vehicle data files to be scheduled; determine a virtual machine scheduling scheme for the vehicle data file set with the goal of minimizing the difference in virtual machine usage space between available virtual machines, and allocate files in the vehicle data file set to corresponding available virtual machines according to the virtual machine scheduling scheme.

[0162] It can be understood that the contents of the above method embodiments are all applicable to the present system embodiments, the functions specifically implemented by the present system embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0163] The embodiment of the present application also provides an electronic device, the electronic device comprising: a memory, a processor, a program stored in the memory and executable on the processor, and a data bus for realizing connection and communication between the processor and the memory, and the program is executed by the processor to realize the above-mentioned vehicle data security hosting method. The electronic device can be any intelligent terminal including a tablet computer, a vehicle-mounted computer, etc.

[0164] See also Fig. 9 , Fig. 9 The hardware structure of an electronic device of another embodiment is illustrated, and the electronic device includes:

[0165] The processor 901 may be implemented by a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (Application Specific Integrated Circuit, ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of the present application;

[0166] The memory 902 can be implemented in the form of a read-only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RAM). The memory 902 can store an operating system and other applications. When the technical solution provided in the embodiment of this specification is implemented by software or firmware, the relevant program code is stored in the memory 902, and the processor 901 calls and executes the vehicle data security trusteeship method of the embodiment of this application;

[0167] Input / output interface 903, used to implement information input and output;

[0168] Communication interface 904, used to realize communication interaction between the device and other devices, which can be realized by wired mode (such as USB, network cable, etc.) or wireless mode (such as mobile network, WIFI, Bluetooth, etc.);

[0169] A bus 905 that transmits information between various components of the device (e.g., the processor 901, the memory 902, the input / output interface 903, and the communication interface 904);

[0170] The processor 901 , the memory 902 , the input / output interface 903 and the communication interface 904 are connected to each other in communication within the device via a bus 905 .

[0171] An embodiment of the present application also provides a storage medium, which is a computer-readable storage medium used for computer-readable storage. The storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the above-mentioned vehicle data security hosting method.

[0172] The memory, as a non-transient computer-readable storage medium, can be used to store non-transient software programs and non-transient computer executable programs. In addition, the memory may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some embodiments, the memory may optionally include a memory remotely disposed relative to the processor, and these remote memories may be connected to the processor via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0173] The embodiments described in the embodiments of the present application are intended to more clearly illustrate the technical solutions of the embodiments of the present application and do not constitute a limitation on the technical solutions provided in the embodiments of the present application. Those skilled in the art will appreciate that with the evolution of technology and the emergence of new application scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

[0174] Those skilled in the art will appreciate that the technical solutions shown in the figures do not constitute a limitation on the embodiments of the present application, and may include more or fewer steps than shown in the figures, or a combination of certain steps, or different steps.

[0175] Those skilled in the art will appreciate that all or some of the steps in the methods disclosed above, and the functional modules / units in the systems and devices may be implemented as software, firmware, hardware, or a suitable combination thereof.

[0176] The terms "first", "second", "third", "fourth", etc. (if any) in the specification of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0177] In the several embodiments provided in the present application, it should be understood that the disclosed systems and methods can be implemented in other ways. For example, the system embodiments described above are only schematic. For example, the division of the above modules is only a logical function division. There may be other division methods in actual implementation, such as multiple modules or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, systems or units, which can be electrical, mechanical or other forms.

[0178] The units described above as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0179] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0180] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including multiple instructions to enable a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of various embodiments of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (Read-Only Memory, referred to as ROM), random access memory (Random Access Memory, referred to as RAM), disk or optical disk and other media that can store programs.

[0181] The preferred embodiments of the present invention are described above with reference to the accompanying drawings, but the scope of the rights of the present invention is not limited thereto. Any modification, equivalent substitution and improvement made by a person skilled in the art without departing from the scope and essence of the present invention should be within the scope of the rights of the present invention.

Claims

1. A vehicle data security trusteeship method, characterized in that: Applied to a secure hosting service platform, the secure hosting service platform is used to receive vehicle data from a vehicle terminal and manage the vehicle data. The vehicle data secure hosting method includes the following steps: Collecting network global status information, wherein the network global status information includes virtual machine status information and network link information; Performing risk analysis on virtual machine links according to the network global status information to obtain link status of each virtual machine; Filter out available virtual machines according to the link status of the virtual machines; Obtain a set of vehicle data files to be dispatched; With the goal of minimizing the difference in virtual machine usage space between the available virtual machines, a virtual machine scheduling scheme for the vehicle data file set is determined, and files in the vehicle data file set are allocated to corresponding available virtual machines according to the virtual machine scheduling scheme.

2. The vehicle data security hosting method according to claim 1, characterized in that: The step of determining the virtual machine scheduling scheme for the vehicle data file set with the goal of minimizing the difference in virtual machine usage space between the available virtual machines comprises the following steps: Sorting the files in the vehicle data file set respectively using a plurality of preset sorting methods to obtain a plurality of corresponding variant file sets; Dividing each of the variant file sets to obtain a first file set and a second file set; Using a plurality of preset scheduling methods to respectively schedule the first file set and the second file set of the variant file set, and obtaining virtual machine usage space differences of corresponding scheduling methods; The preset sorting method and scheduling method corresponding to the smallest virtual machine usage space difference are selected to determine the virtual machine scheduling scheme for the vehicle data file set.

3. The vehicle data security hosting method according to claim 2, characterized in that: The plurality of preset sorting methods include random file sorting, descending file sorting, and ascending file sorting. The plurality of preset scheduling methods include a method of scheduling the first file set first and then the second file set, and a method of scheduling the second file set first and then the first file set.

4. The vehicle data security hosting method according to claim 1, characterized in that: The vehicle data security hosting method further comprises the following steps: Receiving a first identity authentication request from a vehicle terminal; authenticating the vehicle terminal according to the first authentication request, and when the vehicle terminal passes the authentication, allocating a vehicle identifier and a communication encryption key to the vehicle terminal, and storing the vehicle identifier and the communication encryption key in association; A first request response of successful authentication is sent to the vehicle terminal, wherein the first request response includes the vehicle identifier and the communication encryption key, so that the vehicle terminal uses the vehicle identifier and the communication encryption key to interact with vehicle data.

5. The vehicle data security trusteeship method according to claim 1, characterized in that: The vehicle data security hosting method further comprises the following steps: Determining sensitive data in the vehicle data according to key fields; Splitting the sensitive data into two segments to obtain two first data blocks; Using a triple data encryption algorithm to encrypt the two first data blocks respectively to obtain two first encrypted data; Splitting each of the two first encrypted data into two segments to obtain four second data blocks; Using an encryption algorithm based on the Advanced Encryption Standard to encrypt the four second data blocks respectively to obtain four second encrypted data; The same data identifier is allocated to the four second encrypted data, and the second encrypted data is stored according to the data identifier.

6. The vehicle data security hosting method according to claim 1, characterized in that: The vehicle data security hosting method further comprises the following steps: Receiving a second identity authentication request from a user terminal, wherein the second identity authentication request includes a user identity identifier; Authenticating the user terminal according to the user identity identifier in the second identity authentication request, and when the user terminal passes the identity authentication, setting a remote access permission for the user terminal, and storing the user identity identifier and the remote access permission in association, wherein the remote access permission includes a vehicle remote control permission and a vehicle data access scope; An access request from a user terminal is received, and a corresponding remote access permission is determined according to a user identity in the access request, and access control is performed on the access request according to the remote access permission.

7. The vehicle data security trusteeship method according to claim 1, characterized in that: The vehicle data security hosting method further comprises the following steps: Regularly perform security assessment and vulnerability scanning on the vehicle system of the vehicle terminal to monitor whether the vehicle system has security vulnerabilities; When it is determined that the vehicle system has a security vulnerability, a system update notification is sent to the system developer platform according to the security vulnerability to obtain a system upgrade package; The system upgrade package is sent to the vehicle terminal to repair the security loopholes of the vehicle system.

8. A vehicle data security hosting system, characterized in that: Applied to a security hosting service platform, the security hosting service platform is used to receive vehicle data from a vehicle terminal and manage the vehicle data. The vehicle data security hosting system includes: A performance data collection module, used to collect network global status information, wherein the network global status information includes virtual machine status information and network link information; A performance data analysis module, used to perform risk analysis on virtual machine links according to the network global status information to obtain the link status of each virtual machine; and filter out available virtual machines according to the link status of the virtual machine; A data scheduling module is used to obtain a set of vehicle data files to be scheduled; determine a virtual machine scheduling scheme for the vehicle data file set with the goal of minimizing the difference in virtual machine usage space between the available virtual machines, and allocate files in the vehicle data file set to corresponding available virtual machines according to the virtual machine scheduling scheme.

9. An electronic device, characterized in that: The electronic device includes a memory, a processor, a program stored in the memory and executable on the processor, and a data bus for realizing connection and communication between the processor and the memory. When the program is executed by the processor, the steps of the vehicle data security hosting method as described in any one of claims 1 to 7 are implemented.

10. A computer storage medium, the storage medium being a computer-readable storage medium, used for computer-readable storage, characterized in that: The storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the steps of the vehicle data security hosting method described in any one of claims 1 to 7.

Images