Data processing method, communication module, equipment and readable storage medium

Abstract

The invention discloses a data processing method, a communication module, equipment and a readable storage medium in the technical field of vehicle-mounted communication, and the method comprises the steps: providing a sending interface for a V2X protocol stack in the communication module, so as to enable the V2X protocol stack to write a data processing request into a receiving queue; reading a data processing request to be processed from the receiving queue; determining a target hardware security module from the plurality of hardware security modules according to the allocation strategy; sending the data processing request to a target hardware security module, so that the target hardware security module processes the data processing request; writing a return result processed by the target hardware security module into a return queue; and providing a query interface for the V2X protocol stack, so that the V2X protocol stack obtains a return result from the return queue. According to the method and the device, the multiple hardware security modules are effectively fused based on the resource pool, so that the multiple hardware security modules perform data processing in parallel, and the data processing efficiency in the V2X equipment is improved.

Description

Technical Field

[0001] The present application relates to the field of vehicle-mounted communication technology, and in particular to a data processing method, a communication module, a device and a readable storage medium. Background Art

[0002] With the development of V2X (Vehicle to X, communication between vehicles and other devices) technology, more and more traffic equipment is involved in the vehicle communication system of the intelligent transportation system. For example, vehicles, pedestrians, road infrastructure, network infrastructure, service networks, commercial satellites, etc. The main participants involve on-board units (OBU), roadside units (RSU), personal wearable devices and other forms of equipment. Many forms of equipment exchange data through cellular networks and short-range communication technologies, collect road information in real time, and provide real-time traffic status information, including road conditions, congestion, construction, etc., by communicating with other vehicles and infrastructure. This allows drivers to make decisions in advance and avoid accidents.

[0003] V2X communication involves a large amount of sensitive information, such as the vehicle's speed and location information, so it is necessary to ensure the security and privacy protection of the communication process. This involves encryption technology, digital signatures, access control and other technologies to prevent information from being stolen or tampered with.

[0004] The current NAD (network access device, such as a 5G communication module) platform itself, TEE, V2X module eHSM and other existing modules cannot meet the message verification performance requirements. Although the use of high-performance HSM hardware chips can meet the message verification performance requirements, the cost of high-performance HSM chips is relatively high.

[0005] In summary, the data processing efficiency issue in V2X devices is a technical problem that technical personnel in this field urgently need to solve. Summary of the invention

[0006] The purpose of this application is to provide a data processing method, a communication module, a device and a readable storage medium. By integrating multiple hardware security modules through a resource pool and performing data processing in parallel based on multiple hardware security modules, the data processing efficiency in the V2X device can be effectively improved, thereby meeting the security and privacy protection in the V2X communication process.

[0007] In order to solve the above technical problems, this application provides the following technical solutions:

[0008] A data processing method is applied to a resource pool, the resource pool is located in a communication module of a V2X device, the resource pool is communicatively connected to a plurality of hardware security modules capable of processing data processing requests in parallel, the resource pool comprises a sending interface, a query interface, a receiving queue and a return queue, the method comprising:

[0009] Providing the sending interface to the V2X protocol stack in the communication module so that the V2X protocol stack writes a data processing request to the receiving queue;

[0010] Reading a pending data processing request from the receiving queue;

[0011] determining a target hardware security module from among a plurality of hardware security modules;

[0012] Sending the data processing request to the target hardware security module so that the target hardware security module processes the data processing request;

[0013] Writing the returned result after processing by the target hardware security module into a return queue;

[0014] The query interface is provided to the V2X protocol stack so that the V2X protocol stack obtains a return result from the return queue.

[0015] Preferably, determining a target hardware security module from a plurality of hardware security modules comprises:

[0016] Obtaining resource consumption indicators of the communication module;

[0017] When the resource consumption index is greater than or equal to a preset threshold, selecting a target hardware security module located outside the communication module from a plurality of hardware security modules;

[0018] When the resource consumption indicator is less than the preset threshold, a target hardware security module located in the communication module is selected from a plurality of hardware security modules.

[0019] Preferably, determining a target hardware security module from a plurality of hardware security modules comprises:

[0020] Obtain computing power resource information of the hardware security module;

[0021] The computing power resource information is used to determine a target hardware security module with the most abundant computing power resources from multiple hardware security modules.

[0022] Preferably, determining a target hardware security module from a plurality of hardware security modules comprises:

[0023] determining a request type of the data processing request;

[0024] If the request type is a request signature, a target hardware security module is determined from multiple hardware security modules according to a signature allocation policy;

[0025] If the request type is a request for signature verification, the target hardware security module is determined from multiple hardware security modules according to the signature verification allocation policy.

[0026] Preferably, reading the to-be-processed data processing request from the receiving queue comprises:

[0027] Reading the data processing request to be processed and the packet sequence number of the data processing request from the receiving queue;

[0028] Accordingly, writing the returned result after being processed by the target hardware security module into the return queue includes:

[0029] Writing the returned result processed by the target hardware security module and the packet sequence number corresponding to the returned result into the return queue;

[0030] The V2X protocol stack matches requests and results in the receiving queue and the query queue by packet sequence numbers.

[0031] Preferably, before providing the sending interface to the V2X protocol stack in the communication module, the method further includes:

[0032] Get the configuration file;

[0033] Loading the configuration file to determine the allocation strategy;

[0034] Accordingly, a target hardware security module is determined from a plurality of hardware security modules, including:

[0035] According to the allocation policy, a target hardware security module is determined from multiple hardware security modules.

[0036] Preferably, it also includes:

[0037] Record key execution steps during request processing in the log.

[0038] A communication module, applied to a V2X device, comprising:

[0039] A resource pool, the resource pool is located in the communication module, the resource pool is in communication connection with a plurality of hardware security modules capable of processing data processing requests in parallel, the resource pool comprises a sending interface, a query interface, a receiving queue, a return queue and a processing module;

[0040] The processing module comprises:

[0041] A queue management module, configured to provide the sending interface to the V2X protocol stack in the communication module so that the V2X protocol stack writes a data processing request to the receiving queue;

[0042] A task dispatching strategy module is used to read the pending data processing request from the receiving queue; determine a target hardware security module from a plurality of hardware security modules; and send the data processing request to the target hardware security module so that the target hardware security module processes the data processing request;

[0043] The queue management module is used to write the return result processed by the target hardware security module into a return queue; and provide the query interface to the V2X protocol stack so that the V2X protocol stack obtains the return result from the return queue.

[0044] A V2X device, comprising:

[0045] A V2X module, a plurality of hardware security modules and a communication module as described above, wherein the communication module includes a resource pool,

[0046] The V2X module is connected to the V2X protocol stack in the communication module, and the eHSM in the V2X module is connected to the resource pool.

[0047] The resource pool implements the steps of the above-mentioned data processing method.

[0048] A readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the above data processing method are implemented.

[0049] The method provided in the embodiment of the present application is applied to a resource pool, where the resource pool is located in a communication module of a V2X device. The resource pool is communicated with multiple hardware security modules that can process data processing requests in parallel. The resource pool includes a sending interface, a query interface, a receiving queue, and a return queue, including: providing a sending interface to the V2X protocol stack in the communication module so that the V2X protocol stack writes a data processing request to the receiving queue; reading the data processing request to be processed from the receiving queue; determining a target hardware security module from multiple hardware security modules according to an allocation strategy; sending the data processing request to the target hardware security module so that the target hardware security module processes the data processing request; writing the return result processed by the target hardware security module into the return queue; providing a query interface to the V2X protocol stack so that the V2X protocol stack obtains the return result from the return queue.

[0050] In the present application, a resource pool is provided in the communication module of the V2X device, and the resource pool is connected to multiple hardware security modules that can issue data requests in parallel, and the resource pool has a sending interface, a query interface, a receiving queue and a return queue. The resource pool provides a sending interface and a query interface to the V2X protocol stack in the communication module, so that the V2X protocol stack can write a data processing request to the receiving queue and obtain a return result from the return queue. After the resource pool reads the data processing request of the receiving queue, it can determine the target hardware security module from multiple hardware security modules according to the allocation strategy, and then send the data processing request to the target hardware security module for processing, so as to obtain the processed return result, and the return result is written to the return queue. In this way, based on the resource pool, it is possible to effectively integrate multiple hardware security modules, so that multiple hardware security modules can perform data processing in parallel, thereby improving the data processing efficiency in the V2X device, thereby meeting the security and privacy protection in the V2X communication process.

[0051] Correspondingly, the embodiments of the present application also provide a communication module, a V2X device and a readable storage medium corresponding to the above-mentioned data processing method, which have the above-mentioned technical effects and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the related technologies, the drawings required for use in the embodiments or the related technical descriptions are briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0053] FIG1 is a flowchart of an implementation method of a data processing method in an embodiment of the present application;

[0054] FIG. 2 is a schematic diagram of the structure of a V2X device in an embodiment of the present application.

[0055] FIG3 is a schematic diagram of a request scheduling in an embodiment of the present application;

[0056] FIG4 is a schematic diagram of a scenario of a data processing method in an embodiment of the present application;

[0057] FIG5 is a schematic diagram of the structure of a data processing device in an embodiment of the present application;

[0058] FIG6 is a schematic diagram of a specific structure of a V2X device in an embodiment of the present application. DETAILED DESCRIPTION

[0059] In order to enable those skilled in the art to better understand the present application, the present application is further described in detail below in conjunction with the accompanying drawings and specific implementation methods. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in the field without making creative work are within the scope of protection of the present application.

[0060] For ease of understanding, the technical terms in this article are explained below:

[0061] V2X (Vehicle to X) is a key technology for future intelligent transportation systems, which enables communication between vehicles, vehicles and base stations, and base stations and base stations.

[0062] OBU (On board Unit) vehicle-mounted unit.

[0063] RSU (Road Side Unit) road side unit.

[0064] HSM (Hardware Security Module) hardware security module.

[0065] NAD (Network Access Device) network access device.

[0066] TEE (Trusted Execution Environment) Trusted Execution Environment.

[0067] REE (Rich Execution Environment) is a common environment for all mobile devices, running common OS, such as Android, LINUX and other systems.

[0068] SMC (Secure Monitor Call) security monitor call.

[0069] GP (Global Platform) is a cross-industry international standards organization.

[0070] CA (Client Application) client application, TEE refers to the application in REE.

[0071] TA (Trusted Application) is an application in a trusted execution environment.

[0072] OPTEE (Open Portable Trusted Execution Environment) Open Portable Trusted Execution Environment.

[0073] SPI (Serial Peripheral Interface) is a serial peripheral interface.

[0074] I2C (Inter-Integrated Circuit) is a serial communication bus.

[0075] 7816 is a widely used smart card communication and data exchange protocol.

[0076] Please refer to FIG. 1 , which is a flow chart of a data processing method in an embodiment of the present application, which is applied to a resource pool (HSM resource pool), the resource pool is located in the communication module of the V2X device as shown in FIG. 2 , and the resource pool is communicated with multiple hardware security modules that can process data processing requests in parallel. The resource pool includes a sending interface, a query interface, a receiving queue and a return queue, including:

[0077] S101. Provide a sending interface for the V2X protocol stack in the communication module so that the V2X protocol stack writes a data processing request to a receiving queue.

[0078] In the present application, the resource pool in the communication module of the V2X device can provide a sending interface to the V2X protocol stack in the communication module, so that the V2X protocol stack can write a data processing request to the receiving queue of the resource pool.

[0079] The V2X protocol stack writes data processing requests to the receiving queue, which can be done in a sequential insertion manner or according to different priorities.

[0080] It should be noted that the V2X device can be an on-board device located inside the vehicle, or it can be other equipment located outside the vehicle, such as a roadside device.

[0081] The specific types of the data processing request include: requesting to sign data, requesting to verify the signature of data. In this embodiment, the specific type of the data processing request is not specifically limited, that is, the data processing request can be a request for signing, or a request for verifying the signature.

[0082] For example, the last data processing request read is a request for signature, and the next data processing request read is a request for signature or a request for signature verification.

[0083] S102: Read the pending data processing request from the receiving queue.

[0084] The resource pool can read the pending data processing requests from the receiving queue in sequence. The processed data processing requests can be deleted from the receiving queue. The length of the receiving queue can be based on the total computing power resources that the resource pool can integrate as the upper limit, and of course, it can also be the length corresponding to the best performance of the actual application test.

[0085] S103: Determine a target hardware security module from multiple hardware security modules.

[0086] In this embodiment, as shown in Figure 3, the hardware security module may include TEE in the communication module, eHSM in the V2X module, national encryption HSM connected to the resource pool via SPI or USB, and other HSMs connected to the resource pool via 7816 or I2C.

[0087] Specifically, the communication interface between the resource pool and other HSM resource modules can be determined by the actual NAD environment. For example, NAD and V2X eHSM modules communicate via the SPI interface. The built-in TEE of the NAD platform is OPTEE, which provides cryptographic services to the outside world via the GP standard interface. Cryptographic calculations are completed through the logical calls of the CA module interface, driver, SMC, TA module, OPTEE OS, and HSM. NAD can have an external national secret HSM or other HSM, generally using standard protocol interfaces such as SPI, I2C, and 7816.

[0088] A data processing request only needs one hardware security module to process it. Therefore, when each data processing request is read from the receiving queue, a target hardware security module can be determined for the request. In this embodiment, since multiple hardware security modules can be executed in parallel, a target hardware security module can be determined from multiple hardware security modules to process the request.

[0089] In actual applications, you can set a variety of specific allocation strategies according to your needs, and select a specific strategy according to your actual needs. For example, the allocation strategies may include: Allocation strategy 1, in actual applications, considering that V2X eHSM will consume V2X module computing power and TEE will consume NAD computing power, you can give priority to using national secret HSM chips and other forms of HSM modules; Allocation strategy 2, overall polling and calling in sequence, you can call different modules in proportion to process computing requests according to the processing capacity of the configured module; Allocation strategy 3, you can use the specified module for calculation according to the module identifier in the request data service protocol.

[0090] In a specific implementation of the present application, determining a target hardware security module from a plurality of hardware security modules includes:

[0091] Get the resource consumption index of the communication module;

[0092] When the resource consumption index is greater than or equal to a preset threshold, selecting a target hardware security module located outside the communication module from the multiple hardware security modules;

[0093] When the resource consumption indicator is less than a preset threshold, a target hardware security module located in the communication module is selected from multiple hardware security modules.

[0094] For ease of description, the above steps are combined for explanation below.

[0095] In this embodiment, how to select a target hardware security module can be determined based on the resource consumption index of the communication module.

[0096] Since there are hardware security modules inside and outside the communication module, and the hardware security modules can process data processing requests, it is possible to determine how to select a hardware security module based on the resource consumption of the current communication module. The resource consumption indicator can be the 100% storage resource consumption or the 100% computing resource consumption of the communication module.

[0097] A preset threshold may be set in advance, and the size of the preset threshold may be set based on experience or based on actual experiments to find out a maximum resource consumption indicator for the communication module to maintain normal operation.

[0098] When it is found that the resource consumption index of the communication module is greater than or equal to the preset threshold, it means that the current communication module can no longer undertake more data processing tasks. At this time, the data processing request can be assigned to a hardware security module located outside the communication module. Therefore, the target hardware security module located outside the communication module can be selected from multiple hardware security modules.

[0099] When it is found that the resource consumption index of the communication module is less than the preset threshold, it means that the current communication module can undertake more data processing tasks. At this time, the data processing request can be assigned to the hardware security module located in the communication module. Therefore, the target hardware security module located in the communication module can be selected from multiple hardware security modules.

[0100] Of course, when it is found that the resource consumption index of the communication module is less than a preset threshold, a hardware security module may be randomly selected from multiple hardware security modules as the target hardware security module.

[0101] In a specific implementation of the present application, determining a target hardware security module from a plurality of hardware security modules includes:

[0102] Obtain computing power resource information of the hardware security module;

[0103] By using the computing power resource information, a target hardware security module with the most abundant computing power resources is determined from multiple hardware security modules.

[0104] For ease of description, the above steps are combined for explanation below.

[0105] In this embodiment, the hardware security module can be different types of encryption and decryption modules. Different types of hardware security modules have different processing performances. If the polling order allocation method is directly adopted, it may cause the hardware security module with high performance to be in a relatively idle state for a long time, while the hardware security module with low performance is in a busy or even overloaded state for a long time.

[0106] In order to effectively improve data processing efficiency, in this embodiment, the computing power resource information of the hardware security module can be obtained, and then when selecting the target hardware security module, based on the computing power resource information, the one with the most abundant computing power resources is selected from multiple hardware security modules as the target hardware security module. In this way, matching task allocation can be performed based on the computing power resources of each hardware security module, thereby accelerating data processing efficiency.

[0107] Among them, since NAD is a network access module with an operating system, some Linux system commands (such as the top command) can be used to monitor system resource consumption. Therefore, the strategy for calling NAD platform TEE calculation can be adjusted according to CPU or memory usage.

[0108] In a specific implementation of the present application, determining a target hardware security module from a plurality of hardware security modules includes:

[0109] Determine the request type for the data processing request;

[0110] If the request type is a request signature, a target hardware security module is determined from multiple hardware security modules according to a signature allocation policy;

[0111] If the request type is a request for signature verification, the target hardware security module is determined from multiple hardware security modules according to the signature verification allocation policy.

[0112] For ease of description, the above steps are combined for explanation below.

[0113] Considering that there are different requirements for signing and verifying data, in general, the processing efficiency requirement for data signing is lower than that for data verification. For example, some evaluation schemes specify that 2000+ message verifications should be processed per second, but no clear indicator is set for the efficiency of signing.

[0114] Therefore, when allocating data processing requests, signature verification requests may be preferentially allocated to hardware security modules with higher processing efficiency, while signature requests may be allocated to hardware security modules with lower processing efficiency.

[0115] Specifically, in actual applications, different allocation strategies can be set for different request types. After reading the data processing request, the request type of the data processing request can be determined. Specifically, whether to request a signature or request a signature verification can be determined based on the protocol parameters carried in the data processing request.

[0116] After the request type of the data processing request is clear, the corresponding allocation strategy can be used to select the target hardware security module from multiple hardware security modules. For example, if the allocation strategy for request signature is to specify a hardware security module to specifically handle signatures, then after it is clear that the request type of the currently read data processing request is request signature, the specified hardware security module can be directly determined as the target hardware security module.

[0117] S104: Send the data processing request to the target hardware security module so that the target hardware security module processes the data processing request.

[0118] Specifically, based on the communication protocol of the specific communication connection between the resource pool and the target hardware security module, the data processing request may be sent to the target hardware security module based on the communication protocol.

[0119] After receiving the data processing request, the target hardware security module can use the specified algorithm to sign or verify the data, and after completing the data processing, return the processed results to the resource pool.

[0120] S105: Write the returned result processed by the target hardware security module into a return queue.

[0121] After the return result is obtained, the return result can be written into the return queue.

[0122] S106. Provide a query interface for the V2X protocol stack so that the V2X protocol stack can obtain a return result from the return queue.

[0123] In order to facilitate the V2X protocol stack to obtain the data processing results, in this embodiment, the resource pool provides a query interface for V2X. The V2X protocol stack can obtain the return result from the return queue through the query interface.

[0124] As shown in Figure 4, the V2X device can process the data processing requests sent by N vehicles in parallel and provide feedback. That is, data signing and signature verification are performed through the improvement of the common integration solution of NAD's own TEE computing power, V2X module eHSM computing power, national secret HSM chip, and other forms of HSM. Specifically, the parallel computing of multiple HSMs increases the V2X cryptographic computing performance. It can be compatible with the original V2X implementation solution and quickly integrate applications. It can save costs without adding expensive high-performance HSM chips. It can meet the current hardware HSM signature regulations. Other HSM resources can be flexibly expanded. The resource pool can be implemented in software, so that the scheduling strategy can be adjusted according to the characteristics of different HSMs.

[0125] The method provided in the embodiment of the present application is applied to a resource pool, where the resource pool is located in a communication module of a V2X device. The resource pool has a communication connection with multiple hardware security modules that can process data processing requests in parallel. The resource pool includes a sending interface, a query interface, a receiving queue, and a return queue, including: providing a sending interface to the V2X protocol stack in the communication module so that the V2X protocol stack writes a data processing request to the receiving queue; reading the data processing request to be processed from the receiving queue; determining a target hardware security module from multiple hardware security modules according to an allocation strategy; sending the data processing request to the target hardware security module so that the target hardware security module processes the data processing request; writing the return result processed by the target hardware security module into the return queue; providing a query interface to the V2X protocol stack so that the V2X protocol stack obtains the return result from the return queue.

[0126] In the present application, a resource pool is provided in the communication module of the V2X device, and the resource pool is connected to multiple hardware security modules that can issue data requests in parallel, and the resource pool has a sending interface, a query interface, a receiving queue and a return queue. The resource pool provides a sending interface and a query interface to the V2X protocol stack in the communication module, so that the V2X protocol stack can write a data processing request to the receiving queue and obtain a return result from the return queue. After the resource pool reads the data processing request of the receiving queue, it can determine the target hardware security module from multiple hardware security modules according to the allocation strategy, and then send the data processing request to the target hardware security module for processing, so as to obtain the processed return result, and the return result is written to the return queue. In this way, based on the resource pool, it is possible to effectively integrate multiple hardware security modules, so that multiple hardware security modules can perform data processing in parallel, thereby improving the data processing efficiency in the V2X device, thereby meeting the security and privacy protection in the V2X communication process.

[0127] It should be noted that, based on the above embodiments, the embodiments of the present application also provide corresponding improved solutions. In the preferred / improved embodiments, the same steps or corresponding steps as those in the above embodiments can be referenced to each other, and the corresponding beneficial effects can also be referenced to each other, which will not be described one by one in the preferred / improved embodiments of this article.

[0128] In a specific implementation of the present application, reading a pending data processing request from a receiving queue includes:

[0129] Reading the pending data processing request and the packet sequence number of the data processing request from the receiving queue;

[0130] Accordingly, the return result processed by the target hardware security module is written into the return queue, including:

[0131] Write the return result processed by the target hardware security module and the packet sequence number corresponding to the return result into the return queue;

[0132] Among them, the V2X protocol stack matches requests and results in the receiving queue and query queue through packet sequence numbers.

[0133] For ease of description, the above steps are combined for explanation below.

[0134] That is to say, when writing a data processing request to the receiving queue, its corresponding packet sequence number needs to be written into the receiving queue. The subsequent resource pool can read the packet sequence number when reading the data processing request from the receiving queue. When writing the return result processed by the target hardware security module into the return queue, the corresponding packet sequence number will also be written into the return queue. In this way, the V2X protocol stack can match requests and results in the street queue and query queue by the packet sequence number.

[0135] In a specific implementation of the present application, before providing a sending interface to the V2X protocol stack in the communication module, it also includes:

[0136] Get the configuration file;

[0137] Load the configuration file to determine the allocation strategy;

[0138] Accordingly, a target hardware security module is determined from a plurality of hardware security modules, including:

[0139] According to the allocation policy, a target hardware security module is determined from multiple hardware security modules.

[0140] That is to say, in this embodiment, the allocation strategy can be determined based on the configuration file. Thus, when selecting a target hardware security module, the target hardware security module can be determined from multiple hardware security modules based on the allocation strategy.

[0141] The configuration file can record the available HSM resources. When the resource pool is initialized, the configuration file can be loaded to specify resources, configure queue parameters, and task scheduling timeout parameters.

[0142] In a specific implementation of the present application, key execution steps in the request processing process may also be recorded in a log, that is, key execution steps in the task execution process may be recorded, and error logs may be mainly recorded.

[0143] Corresponding to the above method embodiment, the embodiment of the present application further provides a communication module. The communication module described below and the data processing method described above can refer to each other.

[0144] As shown in FIG5 , the communication module 500 is applied to a V2X device, including:

[0145] A resource pool 510, which is located in the communication module. The resource pool has a communication connection with multiple hardware security modules that can process data processing requests in parallel. The resource pool includes a sending interface 511, a query interface 512, a receiving queue 513, a return queue 514 and a processing module 515;

[0146] Processing module, including:

[0147] The queue management module 515a is used to provide a sending interface to the V2X protocol stack in the communication module so that the V2X protocol stack writes a data processing request to the receiving queue;

[0148] The task dispatching strategy module 515b is used to read the data processing request to be processed from the receiving queue; determine the target hardware security module from multiple hardware security modules; send the data processing request to the target hardware security module so that the target hardware security module processes the data processing request;

[0149] The queue management module 515a is used to write the return result processed by the target hardware security module into the return queue; and provide a query interface for the V2X protocol stack so that the V2X protocol stack can obtain the return result from the return queue.

[0150] Using the communication module provided in the embodiment of the present application, a resource pool is located in the communication module of the V2X device, and the resource pool is communicated with multiple hardware security modules that can process data processing requests in parallel. The resource pool includes a sending interface, a query interface, a receiving queue and a return queue, including: providing a sending interface to the V2X protocol stack in the communication module so that the V2X protocol stack writes a data processing request to the receiving queue; reading the data processing request to be processed from the receiving queue; determining a target hardware security module from multiple hardware security modules according to an allocation strategy; sending the data processing request to the target hardware security module so that the target hardware security module processes the data processing request; writing the return result processed by the target hardware security module into the return queue; providing a query interface to the V2X protocol stack so that the V2X protocol stack obtains the return result from the return queue.

[0151] In the present application, a resource pool is provided in the communication module of the V2X device, and the resource pool is connected to multiple hardware security modules that can issue data requests in parallel, and the resource pool has a sending interface, a query interface, a receiving queue and a return queue. The resource pool provides a sending interface and a query interface to the V2X protocol stack in the communication module, so that the V2X protocol stack can write a data processing request to the receiving queue and obtain a return result from the return queue. After the resource pool reads the data processing request of the receiving queue, it can determine the target hardware security module from multiple hardware security modules according to the allocation strategy, and then send the data processing request to the target hardware security module for processing, so as to obtain the processed return result, and the return result is written to the return queue. In this way, based on the resource pool, it is possible to effectively integrate multiple hardware security modules, so that multiple hardware security modules can perform data processing in parallel, thereby improving the data processing efficiency in the V2X device, thereby meeting the security and privacy protection in the V2X communication process.

[0152] In a specific embodiment of the present application, the task dispatching strategy module is specifically used to obtain the resource consumption index of the communication module; when the resource consumption index is greater than or equal to a preset threshold, a target hardware security module located outside the communication module is selected from multiple hardware security modules; when the resource consumption index is less than the preset threshold, a target hardware security module located within the communication module is selected from multiple hardware security modules.

[0153] In a specific implementation of the present application, the task dispatching strategy module is specifically used to obtain computing power resource information of the hardware security module; using the computing power resource information, determine the target hardware security module with the most abundant computing power resources from multiple hardware security modules.

[0154] In a specific implementation of the present application, the task dispatching policy module is specifically used to determine the request type of the data processing request; if the request type is a request signature, the target hardware security module is determined from multiple hardware security modules according to the signature allocation strategy; if the request type is a request signature verification, the target hardware security module is determined from multiple hardware security modules according to the signature verification allocation strategy.

[0155] In a specific embodiment of the present application, the queue management module 515a is specifically used to read the data processing request to be processed and the packet serial number of the data processing request from the receiving queue; accordingly, the return result processed by the target hardware security module is written into the return queue, including: writing the return result processed by the target hardware security module and the packet serial number corresponding to the return result into the return queue; wherein, the V2X protocol stack matches the request and the result in the receiving queue and the query queue through the packet serial number.

[0156] In a specific implementation of the present application, the processing module further includes:

[0157] The resource configuration management module is used to obtain the configuration file before providing the sending interface to the V2X protocol stack in the communication module; load the configuration file to determine the allocation strategy;

[0158] Correspondingly, the task allocation strategy module is specifically used to determine a target hardware security module from multiple hardware security modules according to the allocation strategy.

[0159] In a specific implementation of the present application, the processing module further includes:

[0160] The log management module is used to record the key execution steps in the request processing process in the log.

[0161] Corresponding to the above method embodiment, an embodiment of the present application further provides a V2X device. The V2X device described below and the data processing method described above can refer to each other.

[0162] As shown in FIG6 , the V2X device 600 includes:

[0163] V2X module 601, multiple hardware security modules 602 and the communication module 500 as described above, the communication module includes a resource pool 510,

[0164] The V2X module is connected to the V2X protocol stack 603 in the communication module, and the eHSM in the V2X module is connected to the resource pool.

[0165] The resource pool implements the steps of the above-mentioned data processing method.

[0166] Corresponding to the above method embodiment, the embodiment of the present application further provides a readable storage medium. The readable storage medium described below and the data processing method described above can refer to each other.

[0167] A readable storage medium stores a computer program, which implements the steps of the data processing method of the above method embodiment when the computer program is executed by a processor.

[0168] The readable storage medium may specifically be a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, or other readable storage medium that can store program codes.

[0169] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0170] Those skilled in the art may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented with electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in terms of function in the above description. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0171] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0172] Finally, it should be noted that, in this article, relationships such as first and second, etc. are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms include, include or any other variations are intended to cover non-exclusive inclusion, so that a process, method, article or device that includes a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device.

[0173] Specific examples are used herein to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method and core idea of ​​the present application. At the same time, for those skilled in the art, according to the idea of ​​the present application, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A data processing method, characterized in that: Applied to a resource pool, the resource pool is located in a communication module of a V2X device, the resource pool is communicatively connected to a plurality of hardware security modules capable of processing data processing requests in parallel, the resource pool includes a sending interface, a query interface, a receiving queue and a return queue, the method includes: Providing the sending interface to the V2X protocol stack in the communication module so that the V2X protocol stack writes a data processing request to the receiving queue; Reading a pending data processing request from the receiving queue; determining a target hardware security module from among a plurality of hardware security modules; Sending the data processing request to the target hardware security module so that the target hardware security module processes the data processing request; Writing the returned result after processing by the target hardware security module into a return queue; The query interface is provided to the V2X protocol stack so that the V2X protocol stack obtains a return result from the return queue.

2. The method according to claim 1, characterized in that Identify the target hardware security module from multiple hardware security modules, including: Obtaining resource consumption indicators of the communication module; When the resource consumption index is greater than or equal to a preset threshold, selecting a target hardware security module located outside the communication module from a plurality of hardware security modules; When the resource consumption indicator is less than the preset threshold, a target hardware security module located in the communication module is selected from a plurality of hardware security modules.

3. The method according to claim 1, characterized in that Identify the target hardware security module from multiple hardware security modules, including: Obtain computing power resource information of the hardware security module; The computing power resource information is used to determine a target hardware security module with the most abundant computing power resources from multiple hardware security modules.

4. The method according to claim 1, characterized in that: Identify the target hardware security module from multiple hardware security modules, including: determining a request type of the data processing request; If the request type is a request signature, a target hardware security module is determined from multiple hardware security modules according to a signature allocation policy; If the request type is a request for signature verification, the target hardware security module is determined from multiple hardware security modules according to the signature verification allocation policy.

5. The method according to claim 1, characterized in that Reading a pending data processing request from the receiving queue includes: Reading the data processing request to be processed and the packet sequence number of the data processing request from the receiving queue; Accordingly, writing the returned result after processing by the target hardware security module into the return queue includes: Writing the returned result processed by the target hardware security module and the packet sequence number corresponding to the returned result into the return queue; The V2X protocol stack matches requests and results in the receiving queue and the query queue by packet sequence numbers.

6. The method according to claim 1, characterized in that Before providing the sending interface to the V2X protocol stack in the communication module, the method further includes: Get the configuration file; Loading the configuration file to determine the allocation strategy; Accordingly, a target hardware security module is determined from a plurality of hardware security modules, including: According to the allocation policy, a target hardware security module is determined from multiple hardware security modules.

7. The method according to any one of claims 1 to 6, characterized in that: Also includes: Record key execution steps during request processing in the log.

8. A communication module, characterized in that: Applied to V2X equipment, including: A resource pool, the resource pool is located in the communication module, the resource pool is communicatively connected with a plurality of hardware security modules capable of processing data processing requests in parallel, the resource pool comprises a sending interface, a query interface, a receiving queue, a return queue and a processing module; The processing module comprises: A queue management module, configured to provide the sending interface to the V2X protocol stack in the communication module so that the V2X protocol stack writes a data processing request to the receiving queue; A task dispatching strategy module is used to read the pending data processing request from the receiving queue; determine a target hardware security module from a plurality of hardware security modules; and send the data processing request to the target hardware security module so that the target hardware security module processes the data processing request; The queue management module is used to write the return result processed by the target hardware security module into a return queue; and provide the query interface to the V2X protocol stack so that the V2X protocol stack obtains the return result from the return queue.

9. A V2X device, characterized in that: include: A V2X module, a plurality of hardware security modules and a communication module as claimed in claim 8, wherein the communication module includes a resource pool, The V2X module is connected to the V2X protocol stack in the communication module, and the eHSM in the V2X module is connected to the resource pool. The resource pool implements the steps of the data processing method according to any one of claims 1 to 7.

10. A readable storage medium, characterized in that: The readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the data processing method according to any one of claims 1 to 7 are implemented.

Images