Security authentication method, service consumption module, service providing module and product

Abstract

The invention provides a security authentication method, a service consumption module, a service providing module, a vehicle and a computer program product. The security authentication method comprises the following steps: acquiring an authorization plaintext, an authorization ciphertext and a first public key of an expected consumption service; an authorization plaintext and an authorization ciphertext are sent to the service providing module, the authorization plaintext and the authorization ciphertext are used for the service providing module to judge whether the service consumption module has the service consumption authority based on the second public key, and the first public key is different from the second public key; an identity authentication plaintext and an identity authentication ciphertext sent by the service providing module are received, and the identity authentication plaintext and the identity authentication ciphertext are generated under the condition that the service providing module determines that the service consumption module has the service consumption authority; according to the identity authentication plaintext, the identity authentication ciphertext and the first public key, judging whether the service providing module has a service providing permission or not; and under the condition of determining that the service providing module has the service providing permission, determining that the security authentication is passed.

Description

Technical Field

[0001] The present disclosure relates to technical fields such as vehicle communications, and in particular to a security authentication method, a service consumption module, a service provision module, a vehicle, and a computer program product. Background Art

[0002] The core idea of ​​SOA (Service-Oriented Architecture) is to split and encapsulate complex software systems into multiple services with high cohesion and low coupling. Each service performs a specific function, and multiple services are connected and interacted through interfaces.

[0003] When SOA is used as the architectural concept of vehicle software, the underlying system capabilities of the vehicle are usually abstracted and encapsulated into multiple basic services, and then the application software obtains the vehicle's underlying system information or controls the underlying system actuators through the basic service interface.

[0004] However, in the related art, the focus is mainly on the realization of SOA functions, while the development of SOA communication security is neglected, resulting in poor security when applied to vehicles. Summary of the invention

[0005] The present disclosure provides a security authentication method, a service consumption module, a service provision module, a vehicle and a computer program product.

[0006] According to a first aspect of the present disclosure, a security authentication method is provided, which is applied to a service consumption module, and the security authentication method includes: obtaining an authorization plaintext, an authorization ciphertext and a first public key of a desired consumption service; sending the authorization plaintext and the authorization ciphertext to a service provision module, wherein the authorization plaintext and the authorization ciphertext are used by the service provision module to determine whether the service consumption module has service consumption authority based on a second public key, and the first public key is different from the second public key; receiving an identity authentication plaintext and an identity authentication ciphertext sent by the service provision module, wherein the identity authentication plaintext and the identity authentication ciphertext are generated by the service provision module when it is determined that the service consumption module has the service consumption authority; determining whether the service provision module has service provision authority based on the identity authentication plaintext, the identity authentication ciphertext and the first public key; and determining that the security authentication is passed when it is determined that the service provision module has the service provision authority.

[0007] In the above scheme, a two-way security authentication method is adopted. The security authentication is passed only when the service providing module determines that the service consuming module has the service consuming authority and the service consuming module determines that the service providing module has the service providing authority, thereby improving security.

[0008] According to at least one embodiment of the present disclosure, the authorization ciphertext is obtained by encrypting the authorization plaintext based on a second private key, and the identity authentication ciphertext is obtained by encrypting the identity authentication plaintext based on a first private key, and the first private key and the second private key are different.

[0009] According to at least one embodiment of the present disclosure, obtaining authorization plaintext and authorization ciphertext of a desired consumption service includes: sending service consumption module identity information and a service consumption authority application to a server; and receiving authorization plaintext and authorization ciphertext of the desired consumption service sent by the server, wherein the authorization plaintext is obtained through the service consumption authority application, and the authorization ciphertext is obtained by encrypting the authorization plaintext based on a second private key when the server determines that the service consumption module has the authority to apply for service consumption authority based on the service consumption module identity information.

[0010] According to at least one embodiment of the present disclosure, whether the service provision module has the service provision authority is determined based on the identity authentication plaintext, the identity authentication ciphertext and the first public key, including: decrypting the identity authentication ciphertext based on the first public key to obtain first decryption information; and when the first decryption information is the same as the identity authentication plaintext, determining that the service provision module has the service provision authority.

[0011] According to at least one embodiment of the present disclosure, after determining that the security authentication is passed, the method also includes: generating identity authentication information based on the type of the identity authentication plaintext and the service consumption request; sending the identity authentication information and the service consumption request to the service provision module, wherein the identity authentication information is used by the service provision module to respond to the service consumption request; and receiving the service consumption response sent by the service provision module.

[0012] According to at least one embodiment of the present disclosure, identity authentication information is generated according to the type of the identity authentication plaintext and the service consumption request, including: when the type of the service consumption request is a first type, using the identity authentication plaintext as the identity authentication information; and when the type of the service consumption request is a second type, encrypting the identity authentication plaintext based on a pre-acquired third private key to obtain encrypted information, and using the encrypted information and the identity authentication plaintext as the identity authentication information.

[0013] According to at least one embodiment of the present disclosure, the authorization plain text includes an identifier of the desired consumption service and / or an identifier of an interface of the desired consumption service.

[0014] According to at least one embodiment of the present disclosure, the identity authentication plaintext includes a token.

[0015] According to a second aspect of the present disclosure, a security authentication method is provided, which is applied to a service providing module, and the security authentication method includes: obtaining a second public key; receiving an authorization plaintext and an authorization ciphertext of an expected consumption service sent by a service consuming module; judging whether the service consuming module has service consumption authority based on the authorization plaintext, the authorization ciphertext and the second public key; generating an identity authentication plaintext and an identity authentication ciphertext when it is determined that the service consuming module has the service consumption authority; and sending the identity authentication plaintext and the identity authentication ciphertext to the service consuming module, wherein the identity authentication plaintext and the identity authentication ciphertext are used by the service consuming module to judge whether the service providing module has service providing authority based on a first public key, and the first public key is different from the second public key.

[0016] In the above scheme, a two-way security authentication method is adopted, the service providing module can determine whether the service consuming module has the service consuming authority, and the service consuming module can determine whether the service providing module has the service providing authority, thereby improving security.

[0017] According to at least one embodiment of the present disclosure, judging whether the service consumption module has the service consumption authority is based on the authorization plaintext, the authorization ciphertext and the second public key, including: decrypting the authorization ciphertext based on the second public key to obtain second decryption information; and determining that the service consumption module has the service consumption authority when the second decryption information is the same as the authorization plaintext.

[0018] According to at least one embodiment of the present disclosure, generating identity authentication plaintext and identity authentication ciphertext includes: obtaining a first private key; generating a token through a token generation algorithm, and using the token as the identity authentication plaintext; and encrypting the identity authentication plaintext based on the first private key to obtain the identity authentication ciphertext.

[0019] According to at least one embodiment of the present disclosure, when it is determined that the service consumption module has the service consumption authority, the method also includes: establishing a mapping relationship between the identity authentication plaintext and the authorization plaintext, wherein the authorization plaintext includes the identifier of the desired consumption service and / or the identifier of the interface of the desired consumption service.

[0020] According to at least one embodiment of the present disclosure, after establishing a mapping relationship between the identity authentication plaintext and the authorization plaintext, the method also includes: receiving the identity authentication information and the service consumption request sent by the service consumption module; determining the target identity authentication plaintext according to the type of the service consumption request and the identity authentication information; based on the mapping relationship, determining the target service and / or the interface of the target service corresponding to the target identity authentication plaintext; and responding to the service consumption request through the target service and / or the target service interface.

[0021] According to at least one embodiment of the present disclosure, a target identity authentication plaintext is determined according to the type of the service consumption request and the identity authentication information, including: when the type of the service consumption request is a first type, using the identity authentication information as the target identity authentication plaintext; and when the type of the service consumption request is a second type, decrypting the encrypted information in the identity authentication information based on a pre-acquired third public key to obtain third decrypted information, and when the third decrypted information is the same as the identity authentication plaintext in the identity authentication information, using the identity authentication plaintext in the identity authentication information as the target identity authentication plaintext.

[0022] According to a third aspect of the present disclosure, a service consumption module is provided, comprising: a processor, a memory and a transceiver, wherein the memory stores a computer program, the transceiver is used to send and receive data, and when the computer program is executed by the processor, a method as described in any one of the first aspects is implemented.

[0023] According to a fourth aspect of the present disclosure, a service providing module is provided, comprising: a processor, a memory and a transceiver, wherein the memory stores a computer program, the transceiver is used to send and receive data, and when the computer program is executed by the processor, a method as described in any one of the second aspects is implemented.

[0024] According to a fifth aspect of the present disclosure, a vehicle is provided, comprising the above-mentioned service providing module.

[0025] According to at least one embodiment of the present disclosure, the vehicle further includes the above-mentioned service consumption module.

[0026] According to a sixth aspect of the present disclosure, a computer program product is provided, the computer program product comprising a computer program, and when the computer program is executed by a processor, it is used to implement at least the method described in the first aspect or the second aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] The accompanying drawings illustrate exemplary embodiments of the present disclosure and together with the description serve to explain the principles of the present disclosure. These drawings are included to provide a further understanding of the present disclosure and are incorporated in and constitute a part of this specification.

[0028] Figure 1 is a schematic diagram of a security authentication system according to an embodiment of the present disclosure.

[0029] Figure 2 is a schematic diagram of a security authentication system according to another embodiment of the present disclosure.

[0030] Figure 3 It is an interactive schematic diagram of a security authentication system according to an embodiment of the present disclosure.

[0031] Figure 4 It is a flowchart of a security authentication method according to an embodiment of the present disclosure.

[0032] Figure 5 It is a schematic diagram of the process of obtaining authorization plaintext and authorization ciphertext according to an embodiment of the present disclosure.

[0033] Figure 6 It is a schematic diagram of the process of providing authority for an audit service according to an embodiment of the present disclosure.

[0034] Figure 7 It is a flowchart of a security authentication method according to another embodiment of the present disclosure.

[0035] Figure 8 It is a flowchart of a security authentication method according to another embodiment of the present disclosure.

[0036] Fig. 9 It is a schematic diagram of the process of reviewing service consumption rights according to an embodiment of the present disclosure.

[0037] Fig.10 It is a schematic diagram of a process of generating identity authentication plaintext and identity authentication ciphertext according to an embodiment of the present disclosure.

[0038] Fig.11 It is a schematic block diagram of the structure of a service consumption module using a hardware implementation method of a processor according to an embodiment of the present disclosure.

[0039] Fig.12 It is a schematic block diagram of the structure of a service providing module using a hardware implementation method of a processor according to an embodiment of the present disclosure. DETAILED DESCRIPTION

[0040] The present disclosure is further described in detail below in conjunction with the accompanying drawings and examples. It is understood that the specific examples described herein are only used to explain the relevant content, rather than to limit the present disclosure. It should also be noted that, for ease of description, only the parts related to the present disclosure are shown in the accompanying drawings.

[0041] It should be noted that, in the absence of conflict, the embodiments and features of the embodiments in the present disclosure can be combined with each other. The technical solution of the present disclosure will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0042] With the development of vehicles, the complexity of vehicle software continues to increase. The SOA concept generated and widely used in the Internet industry has been widely accepted as the architectural concept of vehicle software. Although encapsulating the underlying system of the vehicle into services based on SOA can bring convenience to application software development, it also introduces communication security issues. For example, any device connected to the vehicle network can subscribe to the information provided by the service and can control the vehicle by calling the RPC (Remote Procedure Call) interface provided by the service. Since the application of SOA in the car is still in its infancy, the industry mainly focuses on the functional implementation of SOA, and has not systematically considered the communication security issues in the SOA application process. As vehicle SOA gradually matures and develops, its application will soon expand to outside the car. For example, the software architecture of many application scenarios of V2X (vehicle to everything, vehicle-to-external information exchange) may also be SOA-based. Therefore, it is crucial to improve the safety of vehicles during SOA applications. To this end, the following technical solutions are proposed in this disclosure.

[0043] In the present disclosure, electronic devices include but are not limited to servers, mobile phones, tablet computers, laptops, personal computers, wearable devices, ATMs, diagnostic instruments, etc. Vehicles are vehicles to which SOA is applied. Vehicles include but are not limited to pure electric vehicles, hybrid electric vehicles, extended-range electric vehicles, fuel vehicles, etc. The vehicle may be provided with multiple domain controllers and vehicle controllers connected by a bus, or a vehicle controller may not be provided, and one domain controller may be selected from multiple domain controllers as the main controller. The server may be a server in a physical form or a cloud server, and the present disclosure does not limit the type of server. The service consumption module, the service provision module, and the server each include at least one processor, at least one memory, and at least one transceiver. The transceiver includes but is not limited to a wireless transceiver, an I / O port, etc.

[0044] Figure 1A schematic diagram of a security authentication system according to an embodiment of the present disclosure is shown. In the security authentication system, an electronic device 100, a vehicle 200 and a server 300 may be provided. The server 300 can communicate with the electronic device 100 and the vehicle 200 respectively, and the electronic device 100 can communicate with the vehicle 200 to transmit and receive data. Figure 1 In the example, the controller in the electronic device 100 can be used as a service consumption module, and the domain controller or vehicle controller in the vehicle 200 can be used as a service provision module. Then, the electronic device 100 can perform security authentication with the domain controller or vehicle controller providing the service before consuming the services provided by the domain controller or vehicle controller. The server 300 can provide the data required for security authentication (such as keys) to the electronic device 100 and the vehicle 200 respectively, thereby improving the security of the interaction between the vehicle 200 and the external electronic device 100.

[0045] Figure 2 FIG. 2 is a schematic diagram of a safety authentication system according to another embodiment of the present disclosure. In the safety authentication system, a vehicle 200 and a server 300 may be provided, and the server 300 can communicate with the vehicle 200 to transmit and receive data. Figure 2 In the example, a domain controller or vehicle controller of vehicle 200 can be used as a service consumption module, and other domain controllers or vehicle controllers in vehicle 200 can be used as service provision modules. Then, one controller can perform security authentication with the controller providing the service before consuming the service provided by another controller. Server 300 can provide the data required for security authentication (such as keys) to each controller respectively, thereby improving the security of the internal interaction process of vehicle 200.

[0046] For the convenience of description and to make the technical solutions of the specific implementation methods of the present disclosure easier to understand, before describing the security authentication method implemented by the present disclosure, the technical terms involved in the specific implementation methods of the present disclosure are explained as follows: SOA (Service-Oriented Architecture) is a methodology for designing and building application software. It emphasizes splitting and encapsulating different functional units of application software into services, and connecting services through well-defined interfaces and protocols. A service can be regarded as a functional unit of application software.

[0047] RPC (Remote Procedure Call) is a technology that allows a program to call a subroutine or function in another address space. This technology supports calling remote services like calling local functions without having to worry too much about the underlying network communication details.

[0048] The domain controller is the centralization of vehicle-level software functions within a specific functional domain. The domain controller may include a domain master processor, operating system, application software and algorithms, etc.

[0049] ECU (Electronic Control Unit) is the basic component of the vehicle's electronic system. It can process the received signals according to the preset algorithm, thereby controlling the actuator to complete specific actions and realize the corresponding functions.

[0050] Plain text refers to information that is not encrypted.

[0051] Ciphertext refers to the information obtained after the text is encrypted.

[0052] Encryption is the process of converting data information (i.e. plain text) into an unrecognizable form (i.e. ciphertext).

[0053] Decryption is the process of converting ciphertext into plaintext.

[0054] An asymmetric key pair is a key pair consisting of a pair of different public keys and private keys.

[0055] A public key refers to a key that can be made public and can be used to decrypt ciphertext or encrypted information generated by the private key in the same key pair.

[0056] A private key is a key that needs to be kept secret and can be used to encrypt information or decrypt ciphertext generated by the public key in the same key pair.

[0057] A token is information used for identity authentication and can be a string of random numbers or a character string.

[0058] Figure 3 An interactive schematic diagram of a security authentication system according to an embodiment of the present disclosure is shown. Figure 3 The detailed description is for a clearer understanding of the technical solution of the present disclosure and should not be considered as a limitation of the protection scope of the present disclosure. In the process of implementing the technical idea of ​​the present disclosure, one or some steps may be omitted, or other alternatives may be adopted.

[0059] In step S301, the server generates a first key pair and a second key pair. The first key pair may be an asymmetric key pair, that is, the first key pair may include a first public key and a first private key, and the first public key is different from the first private key. If one of the first public key and the first private key is used for encryption, it can only be decrypted by the other of the first public key and the first private key. The second key pair may also be an asymmetric key pair, that is, the second key pair may include a second public key and a second private key, and the second public key is different from the second private key. If one of the second public key and the second private key is used for encryption, it can only be decrypted by the other of the second public key and the second private key. The first key pair is different from the second key pair, that is, the first private key and the second private key are different, and the first public key is different from the second public key, thereby providing a basis for two-way security authentication between the service consumption module and the service provision module. In the present disclosure, the first key pair is used by the service consumption module to verify whether the service provision module has the service provision authority, and the second key pair is used by the service provision module to verify whether the service consumption module has the service consumption authority. In the present disclosure, the service consumption module may be an electronic device, a domain controller of a vehicle, or a vehicle controller, etc., and the service provision module may be another electronic device, another domain controller of a vehicle, or another vehicle controller, etc.

[0060] In step S302, the server sends the first public key to the service consumption module, so that the service consumption module can obtain the first public key, which provides a basis for the subsequent service consumption module to verify whether the service providing module has the service providing authority. The first public key can be stored locally in the service consumption module.

[0061] In step S303, the server sends the first private key and the second public key to the service provision module, so that the service provision module can obtain the first private key to provide a basis for the subsequent service consumption module to verify whether the service provision module has the service provision authority, and the service provision module can obtain the second public key to provide a basis for the subsequent service provision module to verify whether the service consumption module has the service consumption authority. The first private key and the second public key can be stored locally in the service provision module. Officially authorized and legal service provision modules can receive the first private key sent by the server, and unauthorized and illegal service provision modules cannot obtain the first private key sent by the server. Figure 3 In the implementation manner, step S303 is performed after step S302; in other implementation manners, step S303 may also be performed before step S302, or step S302 and step S303 may be performed simultaneously, which is not limited here. Figure 3 In the implementation mode, after generating the first key pair and the second key pair, the server actively sends the first public key, the first private key and the second public key to the corresponding module; in other implementation modes, the server may also feedback the key corresponding to the key acquisition request to the module when receiving the key acquisition request from the module, which is not limited here.

[0062] In step S304, the service consumption module sends the service consumption module identity information and the service consumption permission application to the server, so as to facilitate the acquisition of the authorization plain text and the authorization ciphertext of the desired consumption service. The service consumption permission application is used to apply for the consumption permission of the desired consumption service. Exemplarily, the service consumption module may be installed with application software, and the application software may consume services on other modules during operation (for example, subscribing to messages of services on other modules or calling RPC interfaces of services on other modules, etc.), and then the service consumption module identity information may include one or more of the service consumption module ID, the service consumption module name, the application software version number, the application software name, and the application software ID. The service consumption permission application may carry the identifier of the desired consumption service and / or the identifier of the interface of the desired consumption service, so that the server can understand the application requirements of the service consumption module. The identifier includes but is not limited to the ID, name, etc. It is worth noting that the timing when the service consumption module sends the service consumption module identity information and the service consumption permission application to the server may be the first time the service is consumed, each time the service is consumed, or when the service consumption module installs the application software, which is not limited here. In addition, in other implementations, the service consumption module may not send the service consumption module identity information and service consumption permission application to the server, but the application software directly carries the authorization plaintext and authorization ciphertext of the expected consumption when it is released. In this way, after the service consumption module installs the application software, it can directly obtain the authorization plaintext and authorization ciphertext of the expected consumption.

[0063] In step S305, after receiving the service consumption module identity information and service consumption permission application sent by the service consumption module, the server determines whether the service consumption module has the right to apply for service consumption permission based on the service consumption module identity information. If so, step S306 is executed to facilitate the service consumption module to obtain service consumption permission; if not, the process ends to prevent the service consumption module from obtaining service consumption permission. In this way, illegal and unauthorized service consumption modules are prevented from obtaining service consumption permissions, thereby improving security. Specifically, the server may pre-store the service consumption module identity information that is allowed to apply for service consumption permissions, and then the server may compare the received service consumption module identity information with the service consumption module identity information that is allowed to apply for service consumption permissions. If the same service consumption module identity information exists, it is determined that the service consumption module has the right to apply for service consumption permissions.

[0064] In step S306, when the server determines that the service consumption module has the authority to apply for service consumption authority based on the identity information of the service consumption module, the server encrypts the authorization plaintext of the expected consumption service based on the second private key to obtain the authorization ciphertext. Among them, the authorization plaintext is obtained through the service consumption authority application, for example, the identifier of the expected consumption service and / or the identifier of the interface of the expected consumption service carried in the service consumption authority application is directly used as the authorization plaintext. It can be understood that a service provision module can provide multiple services, and a service usually has multiple interfaces. Compared with the scheme of using only the identifier of the service provision module as the authorization plaintext, the present disclosure uses the identifier of the expected consumption service and / or the identifier of the expected consumption service interface as the authorization plaintext, which can be refined to the authorization of the service, and even to the authorization of the service interface, thereby improving the degree of refinement of authorization management.

[0065] In step S307, the server sends the authorization plaintext and authorization ciphertext of the desired consumption service to the service consumption module, thereby providing a basis for the service consumption module to perform security authentication. After receiving the authorization plaintext and authorization ciphertext of the desired consumption service, the service consumption module can store the authorization plaintext and authorization ciphertext locally in the service consumption module, so as to facilitate subsequent multiple uses.

[0066] exist Figure 3 In the implementation manner, step S301, step S302, step S303, step S305, step S306 and step S307 are executed by the same server; in other implementation manners, there are a first server and a second server, the first server and the second server are different servers, wherein the first server can execute steps S301, step S302 and step S303, step S304 can be replaced by the service consumption module sending the service consumption module identity information and the service consumption authority application to the second server, the second server can execute step S305, and if the review is passed, send the service consumption authority application to the first server The first server executes step S306 and step S307; in other implementations, an application software management system and an enterprise information security system may be deployed on one server, wherein the enterprise information security system can execute steps S301, S302, and S303, and step S304 can be replaced by the service consumption module sending the service consumption module identity information and service consumption authority application to the application software management system, and the application software management system can execute step S305, and if the review is passed, send the service consumption authority application to the enterprise information security system, and the enterprise information security system executes steps S306 and step S307.

[0067] In step S308, the service consumption module sends the authorization plaintext and the authorization ciphertext to the service provision module, so that the service provision module can perform security authentication on the service consumption rights of the service consumption module. In addition, compared with the solution that the service provision module manages the authorization plaintext alone, that is, the service consumption module only sends the authorization ciphertext to the service provision module, the present disclosure sends the authorization plaintext and the authorization ciphertext together, so the service provision module does not need to manage the authorization plaintext additionally, and even if the formulation rules or content of the authorization plaintext are changed, the service provision module does not need to care, so the security authentication method of the present disclosure is more flexible and adaptable.

[0068] In step S309, after receiving the authorization plaintext and authorization ciphertext sent by the service consumption module, the service providing module determines whether the service consumption module has the service consumption authority according to the authorization plaintext, the authorization ciphertext and the second public key. If so, it enters step S310, so as to facilitate the execution of the subsequent security authentication process; if not, it ends, so as to avoid the service on the service providing module from being consumed by the illegal service consumption module that has not been officially authorized, thereby improving security. Specifically, judging whether the service consumption module has the service consumption authority according to the authorization plaintext, the authorization ciphertext and the second public key may include: decrypting the authorization ciphertext based on the second public key to obtain the second decryption information; when the second decryption information is the same as the authorization plaintext, determining that the service consumption module has the service consumption authority; when the second decryption information is different from the authorization plaintext, determining that the service consumption module does not have the service consumption authority. If the second decryption information is different from the authorization plaintext, it means that the encryption key used by the authorization ciphertext sent by the current service consumption module is not the second private key corresponding to the second public key held by the current service providing module, that is, the current service consumption module is an illegal module that has not been officially authorized, and at this time it is determined that the current service consumption module does not have the service consumption authority. If the encryption key used in the authorization ciphertext sent by the current service consumption module is the second private key corresponding to the second public key held by the current service provision module, then the second decryption information will be the same as the authorization plaintext.

[0069] In step S310, when the service providing module determines that the service consuming module has the service consuming authority, the service providing module generates a token through a token generation algorithm and uses the token as the identity authentication plaintext. Thus, the identity authentication plaintext includes the token. The present disclosure does not limit the token generation algorithm.

[0070] In step S311, the service providing module encrypts the identity authentication plaintext based on the first private key to obtain the identity authentication ciphertext.

[0071] In step S312, when it is determined that the service consumption module has the service consumption authority, the service provision module also establishes a mapping relationship between the identity authentication plaintext and the authorization plaintext, and stores the mapping relationship locally in the service provision module, wherein the authorization plaintext includes the identifier of the desired consumption service and / or the identifier of the interface of the desired consumption service. In this way, the service provision module is filed locally, which facilitates the subsequent rapid determination of the desired consumption service and / or the interface of the desired consumption service (i.e., the authorization plaintext) based on the token (i.e., the identity authentication plaintext), thereby improving communication efficiency.

[0072] In step S313, the service providing module sends the identity authentication plaintext and the identity authentication ciphertext to the service consuming module, so as to facilitate the service consuming module to perform security verification on the service providing authority of the service providing module. In addition, compared with the solution that the service consuming module manages the identity authentication plaintext alone, that is, the service providing module only sends the identity authentication ciphertext to the service consuming module, the present disclosure sends the identity authentication plaintext and the identity authentication ciphertext together, therefore, the service consuming module does not need to manage the identity authentication plaintext additionally, even if the formulation rules or content of the identity authentication plaintext are changed, the service consuming module does not need to care, so that the security authentication method disclosed in the present disclosure is more flexible and adaptable.

[0073] In step S314, after receiving the authentication plaintext and authentication ciphertext sent by the service provider module, the service consumption module determines whether the service provider module has the service provision authority based on the authentication plaintext, authentication ciphertext and the first public key. If so, it proceeds to step S314, so as to facilitate the execution of the subsequent security authentication process. If not, it ends, so as to avoid the service consumption module from consuming services from an illegal service provider module that is not officially authorized, thereby improving security. Specifically, judging whether the service provider module has the service provision authority based on the authentication plaintext, authentication ciphertext and the first public key includes: decrypting the authentication ciphertext based on the first public key to obtain the first decryption information; when the first decryption information is the same as the authentication plaintext, determining that the service provider module has the service provision authority; when the first decryption information is different from the authentication plaintext, determining that the service provider module does not have the service provision authority. If the first decrypted information is different from the authentication plaintext, it means that the encryption key used in the authentication ciphertext sent by the current service provider module is not the first private key corresponding to the first public key held by the current service consumer module, that is, the current service provider module is an illegal module that has not been officially authenticated, and it is determined that the current service provider module does not have the service provision authority. If the encryption key used in the authentication ciphertext sent by the current service provider module is the first private key corresponding to the first public key held by the current service consumer module, then the first decrypted information will be the same as the authentication plaintext.

[0074] In step S315, when it is determined that the service providing module has the service providing authority, it is determined that the security authentication has passed. The security authentication method of the disclosed embodiment adopts a two-way security authentication method. When the service providing module determines that the service consuming module has the service consuming authority, and the service consuming module determines that the service providing module has the service providing authority, it is determined that the security authentication has passed, thereby improving security. After determining that the security authentication has passed, the service consuming module can consume the expected consumption service on the service providing module. In the two-way security authentication process, if the security authentication of either party fails, it can be determined that the security authentication has failed.

[0075] In step S316, after determining that the security authentication has passed, the service consumption module generates identity authentication information according to the identity authentication plaintext and the type of the service consumption request, so as to safely consume the service on the service providing module based on the identity authentication information. Exemplarily, generating identity authentication information according to the identity authentication plaintext and the type of the service consumption request may include: when the type of the service consumption request is the first type, using the identity authentication plaintext as the identity authentication information; and when the type of the service consumption request is the second type, encrypting the identity authentication plaintext based on the pre-acquired third private key to obtain encrypted information, and using the encrypted information and the identity authentication plaintext as the identity authentication information. In this way, the identity authentication information can be flexibly generated according to the type of the service consumption request, which is conducive to improving communication efficiency. The first type may be a type with a security requirement lower than the set security standard, and the second type may be a type with a security requirement higher than the set security standard. In this way, when the security requirement is low, the identity authentication plaintext can be directly used as the identity authentication information, and when the security requirement is high, the identity authentication plaintext based on the third private key and the encrypted identity authentication plaintext are used as the identity authentication information, thereby further improving security. The service consumption request can be automatically generated by the service consumption module, so the service consumption module can automatically determine the type of the service consumption request. The third private key can be obtained through the server. For example, the server can pre-generate a third key pair. The third key pair can be an asymmetric key pair. The third key pair can include a third private key and a third public key. The server sends the third private key to the service consumption module and sends the third public key to the service provision module, so as to facilitate the service consumption module and the service provision module to further communicate securely after the security authentication is passed. The officially authorized and legal service consumption module can receive the third private key sent by the server, and the unauthorized and illegal service consumption module cannot obtain the third private key sent by the server.

[0076] In step S317, the service consumption module sends identity authentication information and a service consumption request to the service provision module, wherein the identity authentication information is used by the service provision module to respond to the service consumption request.

[0077] In step S318, after receiving the identity authentication information and the service consumption request sent by the service consumption module, the service providing module determines the target identity authentication plaintext according to the type of the service consumption request and the identity authentication information. Exemplarily, the target identity authentication plaintext is determined according to the type of the service consumption request and the identity authentication information, including: when the type of the service consumption request is the first type, the identity authentication information is used as the target identity authentication plaintext; and when the type of the service consumption request is the second type, the encrypted information in the identity authentication information is decrypted based on the third public key obtained in advance to obtain the third decrypted information, and when the third decrypted information is the same as the identity authentication plaintext in the identity authentication information, the identity authentication plaintext in the identity authentication information is used as the target identity authentication plaintext. The service providing module can determine the type of the service consumption request through the content of the type field in the service consumption request, and then adopt different processing methods for different types of service consumption requests, thereby ensuring communication efficiency while improving security. The third public key can be obtained through the server. When the third decryption information is different from the plaintext of the identity authentication in the identity authentication information, it means that the encryption key used in the encrypted information sent by the current service consumption module is not the third private key held by the service consumption module that has passed the security authentication. It can be considered that the current service consumption module is not a service consumption module that has passed the security authentication. In this case, the service provider module will not respond to the service consumption request of the service consumption module. That is to say, after the security authentication is passed, the service provider module can further verify the identity of the service consumption module that comes to consume the service, thereby further improving the security of the communication process.

[0078] In step S319, the service providing module determines the target service and / or target service interface corresponding to the target authentication plaintext based on the mapping relationship. If the service providing module pre-stores an authentication plaintext identical to the target authentication plaintext, the service providing module directly uses the identifier of the desired consumption service and / or the identifier of the interface of the desired consumption service corresponding to the same authentication plaintext as the target service and / or target service interface. If the service providing module pre-stores an authentication plaintext identical to the target authentication plaintext in the mapping relationship, the service providing module will not respond to the service consumption request of the service consumption module.

[0079] In step S320, the service providing module responds to the service consumption request through the target service and / or the target service interface, and sends the service consumption response to the service consumption module. In this way, after the security authentication is passed, the service consumption module can successfully subscribe to the message on the desired consumption service and / or call the RPC interface of the desired consumption service.

[0080] According to a further embodiment of the present disclosure, a security authentication method is also provided, which can be implemented in the service consumption module provided by the present disclosure. Figure 4 FIG. 1 is a flow chart showing a security authentication method according to the present disclosure. Figure 4 As shown, the security authentication method M600 may include step S610, step S620, step S630, step S640 and step S650.

[0081] S610: Obtain the authorization plaintext, authorization ciphertext and first public key of the desired consumption service.

[0082] S620: Send authorization plaintext and authorization ciphertext to the service providing module, wherein the authorization plaintext and authorization ciphertext are used by the service providing module to determine whether the service consuming module has service consumption authority based on the second public key, and the first public key is different from the second public key.

[0083] S630: Receive the identity authentication plaintext and identity authentication ciphertext sent by the service providing module, wherein the identity authentication plaintext and identity authentication ciphertext are generated by the service providing module when it is determined that the service consuming module has the service consumption authority.

[0084] S640: Determine whether the service providing module has the service providing authority according to the identity authentication plaintext, the identity authentication ciphertext and the first public key.

[0085] S650: When it is determined that the service providing module has the service providing authority, it is determined that the security authentication is passed.

[0086] As a possible implementation, the authorization ciphertext is obtained by encrypting the authorization plaintext based on the second private key, and the authentication ciphertext is obtained by encrypting the authentication plaintext based on the first private key, and the first private key and the second private key are different. The authorization plaintext may include an identifier of the desired consumption service and / or an identifier of the interface of the desired consumption service. The authentication plaintext may include a token.

[0087] See also Figure 5 , obtaining the authorization plaintext and authorization ciphertext of the desired consumption service in step S610 may include: S611, sending the service consumption module identity information and the service consumption authority application to the server; and S612, receiving the authorization plaintext and authorization ciphertext of the desired consumption service sent by the server, wherein the authorization plaintext is obtained through the service consumption authority application, and the authorization ciphertext is obtained by encrypting the authorization plaintext based on the second private key when the server determines that the service consumption module has the service consumption authority application authority based on the service consumption module identity information.

[0088] See also Figure 6 , step S640 may include: S641, decrypting the identity authentication ciphertext based on the first public key to obtain first decrypted information; and S642, when the first decrypted information is the same as the identity authentication plaintext, determining that the service providing module has the service providing authority.

[0089] See also Figure 7 According to at least one embodiment of the present disclosure, after step S650, the method may further include: S660, generating identity authentication information according to the identity authentication plaintext and the type of the service consumption request; S670, sending the identity authentication information and the service consumption request to the service providing module, wherein the identity authentication information is used by the service providing module to respond to the service consumption request; and S680, receiving the service consumption response sent by the service providing module. Further, step S660 may include: when the type of the service consumption request is the first type, using the identity authentication plaintext as the identity authentication information; and when the type of the service consumption request is the second type, encrypting the identity authentication plaintext based on the pre-acquired third private key to obtain encrypted information, and using the encrypted information and the identity authentication plaintext as the identity authentication information.

[0090] For the contents related to the security authentication method M600, please refer to the above description, which will not be repeated here for the sake of brevity.

[0091] According to a further embodiment of the present disclosure, a security authentication method is also provided, which can be implemented in the service providing module provided by the present disclosure. Figure 8 FIG. 1 is a flow chart showing a security authentication method according to the present disclosure. Figure 8 As shown, the security authentication method M900 may include step S910, step S920, step S930, step S940 and step S950.

[0092] S910: Obtain a second public key.

[0093] S920: Receive the authorization plaintext and authorization ciphertext of the desired consumption service sent by the service consumption module.

[0094] S930: Determine whether the service consumption module has service consumption authority according to the authorization plaintext, the authorization ciphertext and the second public key.

[0095] S940: When it is determined that the service consumption module has the service consumption authority, generate an identity authentication plain text and an identity authentication cipher text.

[0096] S950: Sending identity authentication plaintext and identity authentication ciphertext to the service consumption module, wherein the identity authentication plaintext and identity authentication ciphertext are used by the service consumption module to determine whether the service provision module has service provision authority based on the first public key, and the first public key is different from the second public key.

[0097] Please combine Fig. 9, step S930 may include: S931, decrypting the authorization ciphertext based on the second public key to obtain second decrypted information; and S932, when the second decrypted information is the same as the authorization plaintext, determining that the service consumption module has the service consumption authority.

[0098] Please combine Fig.10 , step S940 may include: S941, obtaining a first private key; S942, generating a token through a token generation algorithm, and using the token as an authentication plaintext; and S943, encrypting the authentication plaintext based on the first private key to obtain an authentication ciphertext.

[0099] In the case of determining that the service consumption module has the service consumption authority, the method may further include: S960, establishing a mapping relationship between the identity authentication plaintext and the authorization plaintext, wherein the authorization plaintext includes the identifier of the desired consumption service and / or the identifier of the interface of the desired consumption service. After step S960, the method may further include: receiving the identity authentication information and the service consumption request sent by the service consumption module; determining the target identity authentication plaintext according to the type of the service consumption request and the identity authentication information; determining the target service and / or the interface of the target service corresponding to the target identity authentication plaintext based on the mapping relationship; and responding to the service consumption request through the target service and / or the target service interface. Further, determining the target identity authentication plaintext according to the type of the service consumption request and the identity authentication information may include: in the case that the type of the service consumption request is the first type, using the identity authentication information as the target identity authentication plaintext; and in the case that the type of the service consumption request is the second type, decrypting the encrypted information in the identity authentication information based on the pre-acquired third public key to obtain the third decrypted information, and in the case that the third decrypted information is the same as the identity authentication plaintext in the identity authentication information, using the identity authentication plaintext in the identity authentication information as the target identity authentication plaintext.

[0100] For the contents related to the security authentication method M900, please refer to the above description, which will not be repeated here for the sake of brevity.

[0101] According to a further embodiment of the present disclosure, a service consumption module is also provided, which may be a controller in an electronic device or a domain controller or a vehicle controller of a vehicle.

[0102] Fig.11The structural schematic block diagram of the service consumption module using the hardware implementation of the processor in one embodiment of the present disclosure is shown. The hardware structure of the service consumption module 1000 of the present disclosure can be implemented using a bus architecture. The bus architecture may include any number of interconnected buses and bridges, depending on the specific application and overall design constraints of the hardware. The bus 1100 connects various circuits including one or more processors 1200, a memory 1300, a transceiver 1400 and / or hardware modules together. The bus 1100 may also connect various other circuits 1500 such as peripherals, voltage regulators, power management circuits, external antennas, etc. The bus 1100 may be an Industry Standard Architecture (ISA) bus, a Peripheral Component (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. The bus 1100 may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, only one connecting line is used in the figure, but it does not mean that there is only one bus or one type of bus. The memory 1300 stores a computer program, and the transceiver 1400 is used to send and receive data. When the processor 1200 executes the computer program, the above-mentioned security authentication method M600 for the service consumption module can be implemented.

[0103] For example, when the processor 1200 executes a computer program, the following method is implemented: obtaining authorization plaintext, authorization ciphertext and a first public key of the desired consumption service; sending the authorization plaintext and the authorization ciphertext to the service provision module, wherein the authorization plaintext and the authorization ciphertext are used by the service provision module to determine whether the service consumption module has service consumption authority based on the second public key, and the first public key is different from the second public key; receiving the identity authentication plaintext and the identity authentication ciphertext sent by the service provision module, wherein the identity authentication plaintext and the identity authentication ciphertext are generated by the service provision module when it is determined that the service consumption module has service consumption authority; determining whether the service provision module has service provision authority based on the identity authentication plaintext, the identity authentication ciphertext and the first public key; and determining that the security authentication is passed when it is determined that the service provision module has service provision authority.

[0104] For the contents related to the service consumption module, please refer to the above description, which will not be repeated here for the sake of brevity.

[0105] According to a further embodiment of the present disclosure, a service providing module is also provided, which may be another domain controller or a vehicle controller of the vehicle.

[0106] Fig.12The structural schematic block diagram of the service providing module using the hardware implementation of a processor in one embodiment of the present disclosure is shown. The hardware structure of the service providing module 2000 of the present disclosure can be implemented using a bus architecture. The bus architecture may include any number of interconnected buses and bridges, depending on the specific application and overall design constraints of the hardware. The bus 2100 connects various circuits including one or more processors 2200, a memory 2300, a transceiver 2400 and / or hardware modules together. The bus 2100 may also connect various other circuits 2500 such as peripherals, voltage regulators, power management circuits, external antennas, etc. The bus 2100 may be an Industry Standard Architecture (ISA) bus, a Peripheral Component (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. The bus 2100 may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, only one connecting line is used in the figure, but it does not mean that there is only one bus or one type of bus. The memory 2300 stores a computer program, and the transceiver 2400 is used to send and receive data. When the processor 2200 executes the computer program, the above-mentioned security authentication method M900 for the service providing module can be implemented.

[0107] For example, when the processor 2200 executes a computer program, the following method is implemented: obtaining a second public key; receiving an authorization plaintext and an authorization ciphertext of the desired consumption service sent by a service consumption module; judging whether the service consumption module has service consumption authority based on the authorization plaintext, the authorization ciphertext and the second public key; generating an identity authentication plaintext and an identity authentication ciphertext when it is determined that the service consumption module has service consumption authority; and sending an identity authentication plaintext and an identity authentication ciphertext to the service consumption module, wherein the identity authentication plaintext and the identity authentication ciphertext are used by the service consumption module to judge whether the service provision module has service provision authority based on the first public key, and the first public key is different from the second public key.

[0108] The contents related to the service providing module 2000 can refer to the above description, and will not be repeated here for the sake of brevity.

[0109] The present disclosure also provides a vehicle, the vehicle comprising the above-mentioned service providing module. Further, the vehicle may also comprise the above-mentioned service consuming module.

[0110] The present disclosure also provides a computer program product. The method of the present disclosure can be implemented in whole or in part by software, hardware, firmware, or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer programs or instructions. When the computer program or instruction is loaded and executed, the process or function of the present disclosure is executed in whole or in part.

[0111] A computer program or instruction may be stored in a readable storage medium or transmitted from one readable storage medium to another readable storage medium, for example, a computer program or instruction may be transmitted from one website, computer, server or data center to another website, computer, server or data center by wired or wireless means. The readable storage medium may be any available medium that can be accessed or a data storage device such as a server, data center, etc. that integrates one or more available media. The available medium may be a magnetic medium, such as a floppy disk, a hard disk, or a magnetic tape; it may also be an optical medium, such as a digital video disk; it may also be a semiconductor medium, such as a solid state drive. The computer readable storage medium may be a volatile or non-volatile storage medium, or may include both volatile and non-volatile types of storage media.

[0112] Those skilled in the art will appreciate that the embodiments of the present disclosure may be provided as methods, systems, or computer program products. Therefore, the present disclosure may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present disclosure may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0113] The present disclosure is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to the present disclosure. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0114] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0115] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0116] In the description of this specification, the description with reference to the terms "one embodiment / method", "some embodiments / methods", "example", "specific example", or "some examples" etc. means that the specific features, structures, or characteristics described in conjunction with the embodiment / method or example are included in at least one embodiment / method or example of the present disclosure. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment / method or example. Moreover, the specific features, structures, or characteristics described may be combined in any one or more embodiments / methods or examples in a suitable manner. In addition, those skilled in the art may combine and combine different embodiments / methods or examples described in this specification and features of different embodiments / methods or examples, unless they are contradictory.

[0117] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of the features. In the description of the present disclosure, "plurality" means at least two, such as two, three, etc., unless otherwise clearly and specifically defined.

[0118] Those skilled in the art should understand that the above embodiments are only for the purpose of clearly illustrating the present disclosure, and are not intended to limit the scope of the present disclosure. For those skilled in the art, other changes or modifications may be made based on the above disclosure, and these changes or modifications are still within the scope of the present disclosure.

Claims

1. A security authentication method, characterized in that: The security authentication method is applied to the service consumption module, and the security authentication method includes: Obtain the authorization plaintext, authorization ciphertext and first public key of the desired consumption service; Sending the authorization plaintext and the authorization ciphertext to the service providing module, wherein the authorization plaintext and the authorization ciphertext are used by the service providing module to determine whether the service consuming module has service consumption authority based on the second public key, and the first public key is different from the second public key; Receiving an identity authentication plaintext and an identity authentication ciphertext sent by the service providing module, wherein the identity authentication plaintext and the identity authentication ciphertext are generated by the service providing module when determining that the service consuming module has the service consumption authority; Determining whether the service providing module has service providing authority according to the identity authentication plaintext, the identity authentication ciphertext and the first public key; and In the case where it is determined that the service providing module has the service providing authority, it is determined that the security authentication is passed.

2. The security authentication method according to claim 1, characterized in that: The authorization ciphertext is obtained by encrypting the authorization plaintext based on a second private key, and the identity authentication ciphertext is obtained by encrypting the identity authentication plaintext based on a first private key, and the first private key and the second private key are different.

3. The security authentication method according to claim 1, characterized in that: Obtain the authorization plaintext and ciphertext of the desired consumption service, including: Sending the service consumption module identity information and service consumption permission application to the server; and Receive the authorization plaintext and authorization ciphertext of the desired consumption service sent by the server, wherein the authorization plaintext is obtained through the service consumption authority application, and the authorization ciphertext is obtained by encrypting the authorization plaintext based on the second private key when the server determines that the service consumption module has the authority to apply for service consumption authority based on the identity information of the service consumption module.

4. The security authentication method according to claim 1, characterized in that: Judging whether the service providing module has service providing authority according to the identity authentication plaintext, the identity authentication ciphertext and the first public key includes: Decrypting the identity authentication ciphertext based on the first public key to obtain first decrypted information; and When the first decrypted information is identical to the identity authentication plaintext, it is determined that the service providing module has the service providing authority.

5. The security authentication method according to claim 1, characterized in that: After determining that the security authentication is passed, the method further includes: Generate identity authentication information according to the type of the identity authentication plaintext and service consumption request; Sending the identity authentication information and the service consumption request to the service providing module, wherein the identity authentication information is used by the service providing module to respond to the service consumption request; and Receive a service consumption response sent by the service providing module.

6. The security authentication method according to claim 5, characterized in that: Generate identity authentication information according to the identity authentication plaintext and the type of service consumption request, including: In a case where the type of the service consumption request is the first type, using the identity authentication plaintext as the identity authentication information; and In the case that the type of the service consumption request is the second type, the identity authentication plaintext is encrypted based on a pre-acquired third private key to obtain encrypted information, and the encrypted information and the identity authentication plaintext are used as the identity authentication information.

7. The security authentication method according to any one of claims 1 to 6, characterized in that: The authorization plain text includes the identifier of the desired consumption service and / or the identifier of the interface of the desired consumption service.

8. The security authentication method according to any one of claims 1 to 6, characterized in that: The identity authentication plaintext includes a token.

9. A security authentication method, characterized in that: The security authentication method is applied to the service providing module, and the security authentication method includes: Obtain the second public key; Receive the authorization plaintext and authorization ciphertext of the expected consumption service sent by the service consumption module; Determining whether the service consumption module has service consumption authority according to the authorization plaintext, the authorization ciphertext and the second public key; In the case where it is determined that the service consumption module has the service consumption authority, generating an identity authentication plaintext and an identity authentication ciphertext; and The identity authentication plaintext and the identity authentication ciphertext are sent to the service consumption module, wherein the identity authentication plaintext and the identity authentication ciphertext are used by the service consumption module to determine whether the service providing module has service providing authority based on a first public key, and the first public key is different from the second public key.

10. The security authentication method according to claim 9, characterized in that: Judging whether the service consumption module has service consumption authority according to the authorization plaintext, the authorization ciphertext and the second public key includes: Decrypting the authorization ciphertext based on the second public key to obtain second decrypted information; and When the second decrypted information is identical to the authorization plain text, it is determined that the service consumption module has the service consumption authority.

11. The security authentication method according to claim 9, characterized in that: Generate authentication plaintext and authentication ciphertext, including: Get the first private key; Generate a token by using a token generation algorithm, and use the token as the identity authentication plaintext; and The identity authentication plaintext is encrypted based on the first private key to obtain the identity authentication ciphertext.

12. The security authentication method according to claim 9, characterized in that: In the case where it is determined that the service consumption module has the service consumption authority, the method further includes: A mapping relationship between the identity authentication plaintext and the authorization plaintext is established, wherein the authorization plaintext includes an identifier of the desired consumption service and / or an identifier of an interface of the desired consumption service.

13. The security authentication method according to claim 12, characterized in that: After establishing the mapping relationship between the identity authentication plaintext and the authorization plaintext, the method further includes: Receiving identity authentication information and service consumption request sent by the service consumption module; Determine a target identity authentication plaintext according to the type of the service consumption request and the identity authentication information; Based on the mapping relationship, determining the target service corresponding to the target identity authentication plaintext and / or the interface of the target service; and The service consumption request is responded to through the target service and / or the target service interface.

14. The security authentication method according to claim 13, characterized in that: Determining a target identity authentication plaintext according to the type of the service consumption request and the identity authentication information includes: In a case where the type of the service consumption request is the first type, using the identity authentication information as the target identity authentication plaintext; and In the case where the type of the service consumption request is the second type, the encrypted information in the identity authentication information is decrypted based on a third public key obtained in advance to obtain third decrypted information, and in the case where the third decrypted information is the same as the identity authentication plaintext in the identity authentication information, the identity authentication plaintext in the identity authentication information is used as the target identity authentication plaintext.

15. A service consumption module, characterized in that: include: A processor, a memory and a transceiver, wherein the memory stores a computer program, and the transceiver is used to send and receive data. When the computer program is executed by the processor, the method according to any one of claims 1 to 8 is implemented.

16. A service providing module, characterized in that: include: A processor, a memory and a transceiver, wherein the memory stores a computer program, and the transceiver is used to send and receive data. When the computer program is executed by the processor, the method according to any one of claims 9 to 14 is implemented.

17. A vehicle, characterized in that: The vehicle comprises the service providing module of claim 16.

18. The vehicle according to claim 17, characterized in that It also includes the service consumption module as described in claim 15.

19. A computer program product, characterized in that The computer program product comprises a computer program, which is used to implement at least the method according to any one of claims 1 to 8 or the method according to any one of claims 9 to 14 when being executed by a processor.

Images