Data processing method and device based on digital certificate, equipment and readable storage medium

Abstract

The invention relates to a data processing method and device based on a digital certificate, computer equipment, a computer readable storage medium and a computer program product. The method comprises the following steps: in response to an application operation for a formal certificate, obtaining a certificate abstract from a hardware security module of a vehicle end, and reading a preset certificate from a target flash memory of the vehicle end; the target flash memory has a read-only attribute; the preset certificate is verified through the certificate abstract; generating certificate request information under the condition that the verification is passed, and sending the certificate request information to a cloud based on the preset certificate; receiving a formal certificate fed back by the cloud according to the certificate request information; storing the formal certificate; the formal certificate is used for data communication between the vehicle end and the cloud end. By adopting the method, the communication security between the vehicle end and the cloud end can be effectively ensured.

Description

Technical Field

[0001] The present application relates to the field of vehicle networking technology, and in particular to a data processing method, apparatus, computer equipment, computer-readable storage medium, and computer program product based on digital certificates. Background Art

[0002] With the development of vehicle networking and intelligence, vehicles have gradually changed from a closed environment to an open environment. There is a risk that network threats will gradually penetrate into vehicles through the vehicle-to-cloud data transmission path, which may easily lead to illegal control of vehicles and cause damage to the life and property of drivers and OEMs. Therefore, vehicle-to-cloud network security has become increasingly important in recent years.

[0003] To ensure the security of the vehicle-cloud network, a secure transmission link between the vehicle and the cloud is usually established through digital certificates. During the production process of vehicles, certificates are often pre-installed to facilitate a secure transmission link between the vehicle and the cloud.

[0004] In traditional technology, the pre-installed certificate on the vehicle side is directly canned into the EMMC (embedded multimedia card) inside the device terminal. However, storing the pre-installed certificate in the EMMC inside the terminal is at risk of being tampered with by external abnormal access, which poses a security risk. Summary of the invention

[0005] Based on this, it is necessary to provide a data processing method, device, computer equipment, computer-readable storage medium and computer program product based on digital certificates that can ensure the security of vehicle-to-cloud data communications in response to the above technical problems.

[0006] In a first aspect, the present application provides a data processing method based on a digital certificate, comprising:

[0007] In response to an application operation for a formal certificate, a certificate summary is obtained from a hardware security module on the vehicle side, and a preset certificate is read from a target flash memory on the vehicle side; the target flash memory has a read-only attribute;

[0008] Verifying the pre-set certificate through the certificate digest;

[0009] Generate certificate request information if the verification is passed, and send the certificate request information to the cloud based on the preset certificate;

[0010] Receiving a formal certificate fed back by the cloud according to the certificate request information;

[0011] The official certificate is stored; the official certificate is used for data communication between the vehicle and the cloud.

[0012] In one embodiment, the method further comprises:

[0013] During the vehicle production process, the pre-installed certificate is canned and burned into a target flash memory of an onboard communication module of the vehicle, and the target flash memory is set to have a read-only attribute;

[0014] A certificate digest of the prefabricated certificate is calculated, and the certificate digest is canned into a hardware security module of the vehicle-mounted communication module.

[0015] In one embodiment, generating certificate request information when the verification passes includes:

[0016] If the verification is passed, obtain the local public key in the local key pair generated by the vehicle communication module;

[0017] The local public key is transmitted to the cryptographic security component, and after the key security component signs the local public key, a certificate request message is generated.

[0018] In one embodiment, sending the certificate request information to the cloud based on the pre-set certificate includes:

[0019] Establishing a two-way encrypted connection channel with the cloud through the pre-set certificate;

[0020] A message is generated according to the certificate request information and the user identification code of the vehicle, and the message is sent to the cloud through the two-way encrypted connection channel; the message is used to instruct the cloud to verify the user identification code of the vehicle, and obtain a formal certificate according to the certificate request information if the verification passes.

[0021] In one embodiment, establishing a two-way encrypted connection channel with the cloud through the pre-set certificate includes:

[0022] Perform two-way authentication with the cloud based on the preset certificate, and send the algorithm suite information to be selected to the cloud after the two-way authentication passes;

[0023] Receive the target algorithm set information fed back by the cloud; the target algorithm set information is the algorithm set information in the algorithm set information to be selected;

[0024] Generate a pre-master key, and encrypt the pre-master key and transmit it to the cloud using the cloud public key, so as to instruct the cloud to obtain the pre-master key after decryption using the cloud private key;

[0025] Generate a master key based on the pre-master key to establish a two-way encrypted connection channel with the cloud; the master key is used to encrypt and transmit data in the two-way encrypted connection channel;

[0026] In one embodiment, the two-way authentication with the cloud based on the pre-set certificate includes:

[0027] Sending protocol version information to the cloud, and receiving the protocol version information, cloud certificate and cloud public key fed back by the cloud;

[0028] The cloud certificate is verified, and if the verification passes, the pre-set certificate and the vehicle-side public key are sent to the cloud to instruct the cloud to verify the pre-set certificate, and the vehicle-side public key is saved after the verification passes.

[0029] In a second aspect, the present application further provides a data processing device based on a digital certificate, comprising:

[0030] A reading module, used for obtaining a certificate summary from a hardware security module on the vehicle side in response to an application operation for a formal certificate, and reading a preset certificate from a target flash memory on the vehicle side; the target flash memory has a read-only attribute;

[0031] A verification module, used to verify the pre-set certificate through the certificate summary;

[0032] The sending module is further used to generate certificate request information when the verification is passed, and send the certificate request information to the cloud based on the preset certificate;

[0033] A receiving module, used for receiving the official certificate fed back by the cloud according to the certificate request information;

[0034] The storage module is also used to store the official certificate; the official certificate is used for data communication between the vehicle and the cloud.

[0035] In a third aspect, the present application further provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the following steps are implemented:

[0036] In response to an application operation for a formal certificate, a certificate summary is obtained from a hardware security module on the vehicle side, and a preset certificate is read from a target flash memory on the vehicle side; the target flash memory has a read-only attribute;

[0037] Verifying the pre-set certificate through the certificate digest;

[0038] Generate certificate request information if the verification is passed, and send the certificate request information to the cloud based on the preset certificate;

[0039] Receiving a formal certificate fed back by the cloud according to the certificate request information;

[0040] The official certificate is stored; the official certificate is used for data communication between the vehicle and the cloud.

[0041] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the following steps are implemented:

[0042] In response to an application operation for a formal certificate, a certificate summary is obtained from a hardware security module on the vehicle side, and a preset certificate is read from a target flash memory on the vehicle side; the target flash memory has a read-only attribute;

[0043] Verifying the pre-set certificate through the certificate digest;

[0044] Generate certificate request information if the verification is passed, and send the certificate request information to the cloud based on the preset certificate;

[0045] Receiving a formal certificate fed back by the cloud according to the certificate request information;

[0046] The official certificate is stored; the official certificate is used for data communication between the vehicle and the cloud.

[0047] In a fifth aspect, the present application further provides a computer program product, including a computer program, which implements the following steps when executed by a processor:

[0048] In response to an application operation for a formal certificate, a certificate summary is obtained from a hardware security module on the vehicle side, and a preset certificate is read from a target flash memory on the vehicle side; the target flash memory has a read-only attribute;

[0049] Verifying the pre-set certificate through the certificate digest;

[0050] Generate certificate request information if the verification is passed, and send the certificate request information to the cloud based on the preset certificate;

[0051] Receiving a formal certificate fed back by the cloud according to the certificate request information;

[0052] The official certificate is stored; the official certificate is used for data communication between the vehicle and the cloud.

[0053] The above-mentioned data processing method, device, computer equipment, computer-readable storage medium and computer program product based on digital certificates respond to the application request of the formal certificate, obtain the certificate summary from the hardware security module of the vehicle side, and read the pre-set certificate from the target flash memory of the vehicle side. By setting the permission of the target flash memory to read-only, the pre-set certificate is effectively prevented from being tampered with. By storing the certificate summary of the pre-set certificate on the hardware security module, the internal space of the hardware security module is effectively released. By verifying the pre-set certificate through the certificate summary, it can be checked whether the pre-set certificate has been tampered with, thereby ensuring the security of communication. If the verification passes, a certificate request information is generated, and the certificate request information is sent to the cloud based on the pre-set certificate. The cloud issues a formal certificate to the vehicle side according to the certificate request information, so that secure data communication can be carried out with the cloud through the pre-set certificate in exchange for the formal certificate, and the candidate can establish a secure channel for data communication through the formal certificate. In this way, the pre-set certificate is stored in the target flash memory of the vehicle side in advance, and it is verified before the certificate request is sent, which ensures the security of using the pre-set certificate to exchange for the formal certificate in the actual process, and can ensure the security of the vehicle-cloud communication. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the drawings required for use in the embodiments of the present application or related technical descriptions will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0055] FIG1 is an application environment diagram of a data processing method based on a digital certificate in one embodiment;

[0056] FIG2 is a schematic diagram of a flow chart of a data processing method based on a digital certificate in one embodiment;

[0057] FIG3 is a structural block diagram of a data processing device based on a digital certificate in one embodiment;

[0058] FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0059] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0060] The data processing method based on digital certificates provided in the embodiment of the present application can be applied in the application environment shown in FIG1 . Among them, the vehicle end 102 communicates with the cloud 104 through the network. The data storage system can store the data that the cloud 104 needs to process. The data storage system can be integrated on the cloud 104 or placed on other network servers. The cloud 104 can be an independent physical server, a server cluster or a distributed system composed of multiple physical servers, or a cloud server that provides cloud computing services.

[0061] In an exemplary embodiment, as shown in FIG2 , a data processing method based on a digital certificate is provided, which is described by taking the method applied to the vehicle end in FIG1 as an example, and includes the following steps 202 to 210. Among them:

[0062] Step 202, in response to the application operation for the formal certificate, obtain the certificate summary from the hardware security module of the vehicle end, and read the preset certificate from the target flash memory of the vehicle end; the target flash memory has a read-only attribute.

[0063] Among them, the formal certificate may not be a national secret certificate, but may be other relevant certificates, which is not limited in the embodiments of this application. The vehicle-side hardware security module (HSM) is a hardware device in the vehicle-mounted communication module that can be used for secure management / storage of keys and can provide cryptographic computing operations. The target flash memory refers to the Nand flash (non-volatile memory) located in the vehicle-side TBOX (vehicle-mounted communication module).

[0064] In an exemplary embodiment, the vehicle side will respond to the application operation for the formal certificate, obtain the summary of the preset certificate from the hardware security module of the vehicle side, and obtain the preset certificate of the vehicle side from the target flash memory of the vehicle side, namely Nand flash.

[0065] Step 204: Verify the preset certificate through the certificate digest.

[0066] The certificate summary is a certificate summary of a preset certificate calculated in advance by a preset algorithm. The preset algorithm may be a hash algorithm or other algorithms that can calculate a certificate summary, which is not limited in the present embodiment of the application.

[0067] In some embodiments, the vehicle side verifies the pre-set certificate in the target flash memory of the vehicle side through the certificate summary stored in the hardware security module of the vehicle side, reads the pre-set certificate in the target flash memory, calculates the summary of the pre-set certificate through the hash algorithm, and compares it with the certificate summary in the hardware security module. If they are the same, the verification is passed; if they are different, it indicates that the verification fails. It is determined whether a formal certificate request needs to be generated based on the verification result.

[0068] Step 206: Generate certificate request information if the verification is passed, and send the certificate request information to the cloud based on the preset certificate.

[0069] The certificate request information is a request or operation code (such as P10) related to the vehicle. The cloud can be an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides cloud computing services.

[0070] In some embodiments, after the certificate summary in the hardware security module of the vehicle side verifies the preset certificate in the target flash memory of the vehicle side, the vehicle side obtains the public key in the local key pair from the vehicle-mounted communication module and submits the public key to the cryptographic security component in the vehicle side. The cryptographic security component signs the public key, generates certificate request information based on the signature, and sends the certificate request information to the cloud.

[0071] Step 208: Receive the official certificate fed back by the cloud according to the certificate request information.

[0072] In some embodiments, a two-way encrypted connection channel is established between the vehicle and the cloud, and interaction and verification are performed through the two-way encrypted connection channel. After both parties have passed the verification, the cloud will feedback the official certificate to the vehicle based on the certificate request information.

[0073] Step 210, store the official certificate; the official certificate is used for data communication between the vehicle and the cloud.

[0074] In some embodiments, the vehicle side receives the official certificate sent by the cloud side, and stores the official certificate in the EMMC (embedded multimedia card), and re-establishes a two-way encrypted connection channel between the vehicle side and the cloud side based on the official certificate obtained by the vehicle side, and re-negotiates the algorithm suite and master key to perform encrypted data communication.

[0075] In the above-mentioned data processing method based on digital certificates, the vehicle side will respond to the application request for the formal certificate, obtain the certificate summary from the hardware security module of the vehicle side, and read the pre-set certificate from the target flash memory of the vehicle side. By setting the permission of the target flash memory to read-only, the pre-set certificate is effectively prevented from being tampered with. By storing the certificate summary of the pre-set certificate on the hardware security module, the internal space of the hardware security module is effectively released. By verifying the pre-set certificate through the certificate summary, it can be checked whether the pre-set certificate has been tampered with, thereby ensuring the security of communication. If the verification passes, the certificate request information is generated, and the certificate request information is sent to the cloud based on the pre-set certificate. The cloud issues a formal certificate to the vehicle side according to the certificate request information, so that secure data communication can be carried out with the cloud through the pre-set certificate in exchange for the formal certificate, and the candidate can establish a secure channel for data communication through the formal certificate. In this way, the pre-set certificate is stored in the target flash memory of the vehicle side in advance, and it is verified before the certificate request is sent, which ensures the security of using the pre-set certificate to exchange for the formal certificate in the actual process, and can ensure the security of the vehicle-cloud communication.

[0076] In some embodiments, the data processing method based on digital certificates also includes: during the vehicle production process, canning and burning the preset certificate into the target flash memory of the vehicle's on-board communication module, and setting the target flash memory to have a read-only attribute; calculating the certificate summary of the preset certificate, and canning the certificate summary into the hardware security module of the on-board communication module.

[0077] In actual implementation, the vehicle side will can the pre-set certificate into the target flash memory of the vehicle's on-board communication module during the vehicle production process, and set the permission of the target flash memory area to read-only through the vehicle's system layer. The vehicle side will calculate the certificate summary of the pre-set certificate through the hash algorithm and can the certificate summary into the hardware security module of the on-board communication module.

[0078] In the above embodiment, by calculating the summary of the pre-set certificate on the vehicle side and storing the certificate summary in the hardware security module of the vehicle-mounted communication module, the internal space of the hardware security module is effectively released, so that the hardware security module can support more other security content storage.

[0079] In some embodiments, certificate request information is generated when the verification passes, including: when the verification passes, obtaining the local public key in the local key pair generated by the on-board communication module; transmitting the local public key to the cryptographic security component, and generating certificate request information after the local public key is signed by the key security component.

[0080] In actual implementation, after verifying that the certificate digest in the hardware security module is the same as the digest of the pre-set certificate in the target flash memory of the vehicle communication module, the vehicle end will obtain the local public key in the local key pair generated by the vehicle communication module. Then the local public key is transmitted to the cryptographic security component, which signs the local public key and generates the certificate request information based on the signature and public key.

[0081] In the above embodiment, the certificate request information generated by the signature of the public key of the local key pair can only be decrypted by the private key corresponding to the local key pair, thereby ensuring the security of the information transmission process.

[0082] In some embodiments, certificate request information is sent to the cloud based on a preset certificate, including: establishing a two-way encrypted connection channel with the cloud through the preset certificate; generating a message based on the certificate request information and the user identification code of the vehicle, and sending the message to the cloud through the two-way encrypted connection channel; the message is used to instruct the cloud to verify the user identification code of the vehicle, and obtain the official certificate according to the certificate request information if the verification passes.

[0083] In actual implementation, before the vehicle sends the certificate request information to the cloud, a two-way encrypted connection channel will be established between the vehicle and the cloud based on the preset certificate. The vehicle will generate a message based on the certificate request information and the vehicle's user identification code, and send the message to the cloud through a two-way encrypted channel. The cloud receives the message sent by the vehicle, verifies the user identification code in the message, verifies whether the vehicle's user identification code is normal, and sends the official certificate to the vehicle based on the certificate request information after the verification is passed.

[0084] Specifically, after establishing a two-way encrypted connection channel between the vehicle and the cloud, both the vehicle and the cloud have confirmed the algorithm set and master key used to encrypt the transmitted data. Therefore, in actual data transmission, the vehicle will transmit the data encrypted with the master key to the cloud, and the cloud will use the master key to decrypt and obtain the data. Similarly, the cloud will also send the data encrypted with the master key to the vehicle, and the vehicle will use the master key to decrypt it.

[0085] In the above embodiment, the cloud verifies the user identification code of the vehicle before proceeding to the next step, which can effectively identify each car and avoid security issues caused by the theft of the vehicle user identification code, thereby improving the security of the communication process.

[0086] In some embodiments, a two-way encrypted channel is established with the cloud through a pre-set certificate, including: performing two-way authentication with the cloud based on the pre-set certificate, and sending the algorithm suite information to be selected to the cloud after the two-way authentication is passed; receiving target algorithm suite information fed back by the cloud; the target algorithm suite information is the algorithm suite information in the algorithm suite information to be selected; generating a pre-master key, and encrypting the pre-master key and transmitting it to the cloud through the cloud public key to instruct the cloud to obtain the pre-master key after decrypting it according to the cloud private key; generating a master key based on the pre-master key to establish a two-way encrypted connection channel with the cloud; the master key is used to encrypt and transmit data in the two-way encrypted connection channel.

[0087] In some embodiments, two-way authentication is performed with the cloud based on a preset certificate, including: sending protocol version information to the cloud, and receiving protocol version information, cloud certificate and cloud public key fed back by the cloud; verifying the cloud certificate, and if the verification passes, sending the preset certificate and the vehicle-side public key to the cloud to instruct the cloud to verify the preset certificate, and saving the vehicle-side public key after the verification passes.

[0088] In actual implementation, the vehicle sends the protocol version information and the first random number it supports to the cloud. The cloud determines that the protocol version supported by the vehicle is consistent with itself, and sends the cloud certificate, cloud public key, and the second random number to the vehicle. The vehicle first checks the validity period of the cloud certificate to ensure that the cloud certificate has not expired, and then verifies whether the CA (issuing authority) of the cloud certificate is credible, thereby completing the verification of the legitimacy of the cloud certificate. After the verification is passed, the preset certificate and the vehicle public key are sent to the cloud. After the cloud verifies the preset certificate of the vehicle, it saves the public key of the vehicle.

[0089] In the above embodiment, the security of establishing a two-way encrypted connection channel is ensured by verifying the certificates of both parties on the vehicle side and the cloud side.

[0090] In some embodiments, two-way authentication is performed between the vehicle and the cloud. After both parties pass the authentication, the vehicle sends the supported algorithm suite information to the cloud. After receiving the algorithm suite information from the vehicle, the cloud selects the most suitable algorithm suite as the target algorithm suite, and encrypts the target algorithm suite information using the public key of the cloud, and then sends it to the vehicle. After receiving the target algorithm suite information sent by the cloud, the vehicle uses its own private key to decrypt and obtain the confirmed target algorithm suite. The vehicle generates a pre-master key based on the random code generated during the decryption process, encrypts the pre-master key using the public key of the cloud, and sends it to the cloud. After receiving the information, the cloud uses the corresponding private key to decrypt and obtain the pre-master key. The vehicle and the cloud use the pre-master key and the first random number and the second random number to generate the master key. The vehicle and the cloud use the negotiated algorithm suite and master key to encrypt and transmit data in a two-way encrypted connection channel.

[0091] In the above embodiment, by establishing a two-way encrypted connection channel between the vehicle and the cloud, and using a negotiated algorithm set and a master key for data communication, the security of the communication process is guaranteed.

[0092] In a specific embodiment, the data processing method based on the digital certificate includes the following steps:

[0093] During the vehicle production process, the preset certificate is canned and burned into the target flash memory of the vehicle's on-board communication module, and the target flash memory is set to have a read-only attribute; the certificate digest of the preset certificate is calculated, and the certificate digest is canned into the hardware security module of the on-board communication module.

[0094] In response to the application operation for the formal certificate, the certificate summary is obtained from the hardware security module on the vehicle side, and the pre-set certificate is read from the target flash memory on the vehicle side. The pre-set certificate is verified by the certificate summary; if the verification passes, the local public key in the local key pair generated by the vehicle communication module is obtained; the local public key is transmitted to the cryptographic security component, and after the key security component signs the local public key, the certificate request information is generated.

[0095] Send the protocol version information to the cloud, and receive the protocol version information, cloud certificate and cloud public key fed back by the cloud; verify the cloud certificate, and if the verification passes, send the preset certificate and vehicle-side public key to the cloud to instruct the cloud to verify the preset certificate, and save the vehicle-side public key after the verification passes.

[0096] After the two-way authentication is passed, the algorithm set information to be selected is sent to the cloud; the target algorithm set information fed back by the cloud is received; the target algorithm set information is the algorithm set information in the algorithm set information to be selected;

[0097] Generate a pre-master key, and encrypt the pre-master key and transmit it to the cloud through the cloud public key, so as to instruct the cloud to obtain the pre-master key after decryption according to the cloud private key; generate a master key according to the pre-master key to establish a two-way encrypted connection channel with the cloud; the master key is used to encrypt and transmit data in the two-way encrypted connection channel;

[0098] A message is generated based on the certificate request information and the user identification code of the vehicle, and the message is sent to the cloud through a two-way encrypted connection channel; the message is used to instruct the cloud to verify the user identification code of the vehicle, and obtain the formal certificate according to the certificate request information if the verification passes. After obtaining the formal certificate, the formal certificate is stored in the vehicle-side EMMC (embedded multimedia card), and a two-way encrypted connection channel is established again between the vehicle-side and the cloud based on the formal certificate obtained, and the algorithm suite and master key are negotiated again to perform encrypted data communication.

[0099] To explain in detail the data processing method based on digital certificates in the present application, an embodiment is used for illustration below. By way of example, the present application is described with a data processing method based on digital certificates in which a specific vehicle applies for a national secret certificate from the cloud.

[0100] During the vehicle production process, the vehicle side will can the pre-installed certificate into the target flash memory of the vehicle's on-board communication module, and set the permission of the target flash memory area to read-only through the vehicle's system layer. The vehicle side will calculate the certificate summary of the pre-installed certificate through the hash algorithm and can the certificate summary into the hardware security module of the on-board communication module.

[0101] In the actual implementation process, the vehicle side will use the certificate summary to verify the summary of the pre-set certificate. After verifying that the certificate summary in the hardware security module is the same as the summary of the pre-set certificate in the target flash memory of the vehicle communication module, the vehicle side will obtain the local public key in the local key pair generated by the vehicle communication module. The local public key is then transmitted to the cryptographic security component, which signs the local public key and generates certificate request information based on the signature and public key.

[0102] The vehicle sends the protocol version information it supports and the first random number to the cloud. The cloud determines that the protocol version supported by the vehicle is consistent with itself, and sends the cloud certificate, cloud public key, and second random number to the vehicle. The vehicle first checks the validity period of the cloud certificate to ensure that the cloud certificate has not expired, and then verifies whether the CA (issuing authority) of the cloud certificate is credible, thereby completing the verification of the legitimacy of the cloud certificate. After the verification is passed, the preset certificate and the vehicle public key are sent to the cloud. After the cloud verifies the preset certificate of the vehicle, it saves the public key of the vehicle.

[0103] After both parties have passed the authentication, the vehicle sends the supported algorithm suite information to the cloud. After receiving the algorithm suite information from the vehicle, the cloud selects the most suitable algorithm suite as the target algorithm suite, and encrypts the target algorithm suite information using the public key of the cloud before sending it to the vehicle. After receiving the target algorithm suite information sent by the cloud, the vehicle uses its own private key to decrypt and obtain the confirmed target algorithm suite. The vehicle generates a pre-master key based on the random code generated during the decryption process, encrypts the pre-master key using the public key of the cloud, and sends it to the cloud. After receiving the information, the cloud uses the corresponding private key to decrypt and obtain the pre-master key. The vehicle and the cloud use the pre-master key and the first and second random numbers to generate the master key. The vehicle and the cloud use the negotiated algorithm suite and master key to encrypt and transmit data in a two-way encrypted connection channel.

[0104] The vehicle side will generate a message based on the certificate request information and the vehicle's user identification code, and send the message to the cloud through a two-way encrypted channel. The cloud receives the message sent by the vehicle side, verifies the user identification code in the message, verifies whether the vehicle's user identification code is normal, and sends the national encryption certificate to the vehicle side according to the certificate request information after the verification is passed.

[0105] The vehicle receives the national encryption certificate sent by the cloud, and stores it in the EMMC (embedded multimedia card). Based on the national encryption certificate obtained by the vehicle, a two-way encrypted connection channel is established between the vehicle and the cloud, and the algorithm suite and master key are negotiated again to conduct encrypted data communication.

[0106] This application can verify the pre-set certificate through the certificate summary before applying for the certificate, and set the target flash memory area to a read-only area, avoiding external abnormal access to tamper with the pre-set certificate content. This application avoids information leakage during the communication process by performing two-way authentication between the vehicle and the cloud, and using the negotiated algorithm suite and master key for encrypted communication.

[0107] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0108] Based on the same inventive concept, the embodiment of the present application also provides a digital certificate-based data processing device for implementing the digital certificate-based data processing method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in the one or more digital certificate-based data processing device embodiments provided below can refer to the above limitations on the digital certificate-based data processing method, which will not be repeated here.

[0109] In an exemplary embodiment, as shown in FIG3 , a data processing device based on a digital certificate is provided, comprising: a reading module 301, a verification module 302, a sending module 303, a receiving module 304 and a storage module 305, wherein:

[0110] The reading module is used to obtain the certificate summary from the hardware security module of the vehicle side in response to the application operation for the formal certificate, and read the preset certificate from the target flash memory of the vehicle side; the target flash memory has a read-only attribute.

[0111] A verification module is used to verify the preset certificate through the certificate summary.

[0112] The sending module is further used to generate certificate request information when the verification is passed, and send the certificate request information to the cloud based on the preset certificate.

[0113] The receiving module is used to receive the official certificate fed back by the cloud according to the certificate request information.

[0114] The storage module is also used to store the official certificate; the official certificate is used for data communication between the vehicle and the cloud.

[0115] In some embodiments, the device also includes a canning module, which is used to can and burn the pre-set certificate into the target flash memory of the vehicle's on-board communication module during the vehicle production process, and set the target flash memory to have a read-only attribute; calculate the certificate summary of the pre-set certificate, and can the certificate summary into the hardware security module of the on-board communication module.

[0116] In some embodiments, the above-mentioned verification module is also used to obtain the local public key in the local key pair generated by the vehicle-mounted communication module when the verification passes; transmit the local public key to the cryptographic security component, and generate certificate request information after the key security component signs the local public key.

[0117] In some embodiments, the above-mentioned verification module is also used to establish a two-way encrypted connection channel with the cloud through the preset certificate; generate a message based on the certificate request information and the user identification code of the vehicle, and send the message to the cloud through the two-way encrypted connection channel; the message is used to instruct the cloud to verify the user identification code of the vehicle, and obtain a formal certificate according to the certificate request information if the verification passes.

[0118] In some embodiments, the device also includes an establishment module for performing two-way authentication with the cloud based on the pre-set certificate, and sending the algorithm suite information to be selected to the cloud after the two-way authentication is passed; receiving the target algorithm suite information fed back by the cloud; the target algorithm suite information is the algorithm suite information in the algorithm suite information to be selected; generating a pre-master key, and encrypting the pre-master key and transmitting it to the cloud through the cloud public key to instruct the cloud to obtain the pre-master key after decrypting it according to the cloud private key; generating a master key based on the pre-master key to establish a two-way encrypted connection channel with the cloud; the master key is used to encrypt and transmit data in the two-way encrypted connection channel.

[0119] In some embodiments, the device also includes an authentication module, which is used to send protocol version information to the cloud, and receive the protocol version information, cloud certificate and cloud public key fed back by the cloud; verify the cloud certificate, and if the verification passes, send the preset certificate and vehicle-side public key to the cloud to instruct the cloud to verify the preset certificate, and save the vehicle-side public key after the verification passes.

[0120] Each module in the above-mentioned digital certificate-based data processing device can be implemented in whole or in part by software, hardware, or a combination thereof. Each of the above-mentioned modules can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute operations corresponding to each of the above modules.

[0121] In an exemplary embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be shown in FIG4. The computer device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. The processor, the memory and the input / output interface are connected via a system bus, and the communication interface is connected to the system bus via the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store formal certificate data. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal via a network connection. When the computer program is executed by the processor, a data processing method based on a digital certificate is implemented.

[0122] In an exemplary embodiment, a computer device is provided, which may be a terminal, and its internal structure diagram may be shown in FIG4. The computer device includes a processor, a memory, an input / output interface, a communication interface, a display unit, and an input device. The processor, the memory, and the input / output interface are connected via a system bus, and the communication interface, the display unit, and the input device are connected to the system bus via the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner may be implemented through WIFI, a mobile cellular network, near field communication (NFC) or other technologies. When the computer program is executed by the processor, a data processing method based on a digital certificate is implemented. The display unit of the computer device is used to form a visually visible picture, which may be a display screen, a projection device, or a virtual reality imaging device. The display screen can be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device can be a touch layer covering the display screen, or a button, trackball or touchpad set on the computer device shell, or an external keyboard, touchpad or mouse.

[0123] Those skilled in the art will understand that the structure shown in FIG. 4 is merely a block diagram of a partial structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have a different arrangement of components.

[0124] In an exemplary embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and when the processor executes the computer program, the following steps are implemented:

[0125] In response to an application operation for a formal certificate, a certificate summary is obtained from a hardware security module on the vehicle side, and a preset certificate is read from a target flash memory on the vehicle side; the target flash memory has a read-only attribute;

[0126] Verifying the pre-set certificate through the certificate digest;

[0127] Generate certificate request information if the verification is passed, and send the certificate request information to the cloud based on the preset certificate;

[0128] Receiving a formal certificate fed back by the cloud according to the certificate request information;

[0129] The official certificate is stored; the official certificate is used for data communication between the vehicle and the cloud.

[0130] In one embodiment, a computer readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, the following steps are implemented:

[0131] In response to an application operation for a formal certificate, a certificate summary is obtained from a hardware security module on the vehicle side, and a preset certificate is read from a target flash memory on the vehicle side; the target flash memory has a read-only attribute;

[0132] Verifying the pre-set certificate through the certificate digest;

[0133] Generate certificate request information if the verification is passed, and send the certificate request information to the cloud based on the preset certificate;

[0134] Receiving a formal certificate fed back by the cloud according to the certificate request information;

[0135] The official certificate is stored; the official certificate is used for data communication between the vehicle and the cloud.

[0136] In one embodiment, a computer program product is provided, comprising a computer program, which, when executed by a processor, implements the following steps:

[0137] In response to an application operation for a formal certificate, a certificate summary is obtained from a hardware security module on the vehicle side, and a preset certificate is read from a target flash memory on the vehicle side; the target flash memory has a read-only attribute;

[0138] Verifying the pre-set certificate through the certificate digest;

[0139] Generate certificate request information if the verification is passed, and send the certificate request information to the cloud based on the preset certificate;

[0140] Receiving a formal certificate fed back by the cloud according to the certificate request information;

[0141] The official certificate is stored; the official certificate is used for data communication between the vehicle and the cloud.

[0142] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0143] A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, an artificial intelligence (AI) processor, etc., but are not limited to this.

[0144] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0145] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be construed as limiting the scope of the present application. It should be noted that, for a person of ordinary skill in the art, several modifications and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A data processing method based on digital certificates, characterized in that: The method comprises: In response to an application operation for a formal certificate, a certificate summary is obtained from a hardware security module on the vehicle side, and a preset certificate is read from a target flash memory on the vehicle side; the target flash memory has a read-only attribute; Verifying the pre-set certificate through the certificate digest; Generate certificate request information if the verification is passed, and send the certificate request information to the cloud based on the preset certificate; Receiving a formal certificate fed back by the cloud according to the certificate request information; The official certificate is stored; the official certificate is used for data communication between the vehicle and the cloud.

2. The method according to claim 1, characterized in that The method further comprises: During the vehicle production process, the pre-installed certificate is canned and burned into a target flash memory of an onboard communication module of the vehicle, and the target flash memory is set to have a read-only attribute; A certificate digest of the pre-set certificate is calculated, and the certificate digest is canned into a hardware security module of the vehicle-mounted communication module.

3. The method according to claim 1, characterized in that The generating of certificate request information when the verification passes includes: If the verification is passed, obtain the local public key in the local key pair generated by the vehicle communication module; The local public key is transmitted to the cryptographic security component, and after the key security component signs the local public key, a certificate request message is generated.

4. The method according to claim 1, characterized in that: The sending the certificate request information to the cloud based on the pre-set certificate includes: Establishing a two-way encrypted connection channel with the cloud through the pre-set certificate; A message is generated according to the certificate request information and the user identification code of the vehicle, and the message is sent to the cloud through the two-way encrypted connection channel; the message is used to instruct the cloud to verify the user identification code of the vehicle, and obtain a formal certificate according to the certificate request information if the verification passes.

5. The method according to claim 4, characterized in that The step of establishing a two-way encrypted connection channel with the cloud through the pre-set certificate includes: Perform two-way authentication with the cloud based on the preset certificate, and send the algorithm suite information to be selected to the cloud after the two-way authentication passes; Receive the target algorithm set information fed back by the cloud; the target algorithm set information is the algorithm set information in the algorithm set information to be selected; Generate a pre-master key, and encrypt the pre-master key and transmit it to the cloud using the cloud public key, so as to instruct the cloud to obtain the pre-master key after decryption using the cloud private key; A master key is generated based on the pre-master key to establish a two-way encrypted connection channel with the cloud; the master key is used to encrypt and transmit data in the two-way encrypted connection channel.

6. The method according to claim 5, characterized in that The two-way authentication with the cloud based on the pre-set certificate includes: Sending protocol version information to the cloud, and receiving the protocol version information, cloud certificate and cloud public key fed back by the cloud; The cloud certificate is verified, and if the verification passes, the pre-set certificate and the vehicle-side public key are sent to the cloud to instruct the cloud to verify the pre-set certificate, and the vehicle-side public key is saved after the verification passes.

7. A data processing method based on digital certificates, characterized in that: The device comprises: A reading module, used for obtaining a certificate summary from a hardware security module on the vehicle side in response to an application operation for a formal certificate, and reading a preset certificate from a target flash memory on the vehicle side; the target flash memory has a read-only attribute; A verification module, used to verify the pre-set certificate through the certificate summary; The sending module is further used to generate certificate request information when the verification is passed, and send the certificate request information to the cloud based on the preset certificate; A receiving module, used for receiving the official certificate fed back by the cloud according to the certificate request information; The storage module is also used to store the official certificate; the official certificate is used for data communication between the vehicle and the cloud.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images