Communication method and system, electronic equipment and storage medium

Abstract

The invention relates to the technical field of communication, in particular to a communication method and system, electronic equipment and a storage medium. The communication method comprises the steps that a first communication end sends a connection request to a second communication end; the second communication end verifies the first identity certificate based on the root certificate, verifies the first signature information based on the first public key when the verification is passed, and generates a second temporary public key and a second temporary private key when the verification is passed; the second communication end generates a public session key based on the first temporary public key and the second temporary private key, and sends a request response to the first communication end; and the first communication terminal verifies the second identity certificate based on the root certificate, verifies the second signature information based on the second public key when the verification is passed, and generates a public session key based on the first temporary private key and the second temporary public key when the verification is passed. Through the process, the security of establishing the secure data transmission channel can be improved.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a communication method, system, electronic device and storage medium. Background Art

[0002] With the rapid development of IoT technology, more and more devices are connected to each other through the Internet. In IoT technology, the security of data transmission is crucial. At present, in order to ensure that data can be transmitted safely in the network, security protocols such as Transport Layer Security (TLS) are usually used to establish a secure connection to ensure the security of data transmission.

[0003] However, the process of establishing a secure connection based on existing security protocols usually requires multiple data exchanges, and there are problems such as slow connection establishment and vulnerability of the connection establishment process to attacks. Summary of the invention

[0004] In order to solve the above technical problems, the embodiments of the present application provide a communication method, system, electronic device and storage medium.

[0005] In a first aspect, an embodiment of the present application provides a communication method, which is applied to a first communication terminal, and the method includes:

[0006] Generate a first temporary public key and a first temporary private key; the first temporary public key is used to enable the second communication end to generate a public session key;

[0007] Send a connection request to the second communication terminal; the connection request carries the first identity certificate, first signature information and first public key corresponding to the first communication terminal; the first identity certificate is issued using the root certificate; the first identity certificate corresponds to the first public key and the first private key; the first signature information is obtained by signing the first temporary public key using the first private key;

[0008] Receive a request response sent by the second communication terminal; the request response is sent when the second communication terminal generates a second temporary public key, and the second temporary public key is generated when the second communication terminal verifies the connection request; the second communication terminal verifies the connection request including: the second communication terminal verifies the first identity certificate based on the root certificate, and verifies the first signature information based on the first public key when the first identity certificate verifies the first identity certificate; the request response carries the second identity certificate, the second signature information and the second public key corresponding to the second communication terminal; the second identity certificate is issued using the root certificate; the second identity certificate corresponds to the second public key and the second private key; the second signature information is obtained by signing the second temporary public key using the second private key;

[0009] Verify the second identity certificate based on the root certificate, and if the second identity certificate passes the verification, verify the second signature information based on the second public key;

[0010] When the second signature information is verified to be successful, a public session key is generated based on the first temporary private key and the second temporary public key.

[0011] In some optional embodiments, the method further comprises:

[0012] Encapsulate the data to be transmitted according to a preset format to obtain a session message;

[0013] Encrypting the session message based on the public session key to obtain an encrypted session message;

[0014] The encrypted session message is sent to the second communication end through the first network channel.

[0015] In some optional embodiments, the method further comprises:

[0016] A heartbeat test message is sent to the second communication end so that the second communication end maintains a session connection with the first communication end.

[0017] In a second aspect, an embodiment of the present application provides a communication method, which is applied to a second communication terminal, and the method includes:

[0018] Receive a connection request sent by the first communication terminal; the connection request carries a first identity certificate, first signature information and a first public key corresponding to the first communication terminal; the first identity certificate is obtained by issuing a root certificate; the first identity certificate corresponds to a first public key and a first private key; the first signature information is obtained by signing the first temporary public key using the first private key;

[0019] Verify the first identity certificate based on the root certificate, and if the first identity certificate passes the verification, verify the first signature information based on the first public key;

[0020] When the first signature information is verified, a second temporary public key and a second temporary private key are generated;

[0021] Send a request response to the first communication terminal; the request response carries the second identity certificate, second signature information and second public key corresponding to the second communication terminal; the second identity certificate is issued using the root certificate; the second identity certificate corresponds to the second public key and the second private key; the second signature information is obtained by signing the second temporary public key using the second private key; the second temporary public key is used to enable the first communication terminal to generate a public session key if the request response verification passes; the first communication terminal verifies the request response including: the first communication terminal verifies the second identity certificate based on the root certificate, and verifies the second signature information based on the second public key if the second identity certificate verification passes;

[0022] Based on the first temporary public key and the second temporary private key, a public session key is generated.

[0023] In some optional embodiments, the connection request also carries a request timestamp and an identifier of the first communication end; verifying the first identity certificate based on the root certificate, and verifying the first signature information based on the first public key if the first identity certificate passes the verification, including:

[0024] Determining the validity of a connection request based on a request timestamp;

[0025] If the connection request is valid, determining compliance of the first communication end based on the identifier of the first communication end;

[0026] When the first communication terminal is compliant, the first identity certificate is verified based on the root certificate, and when the first identity certificate passes the verification, the first signature information is verified based on the first public key.

[0027] In some optional embodiments, a message agent is provided in the second communication terminal; the first identity certificate carries the identity information of the first communication terminal; and the method further includes:

[0028] Parsing the first identity certificate to obtain identity information of the first communication terminal;

[0029] authenticating the first communication terminal based on the identity information of the first communication terminal;

[0030] When the identity authentication is passed, the first communication terminal is used as a client of the message proxy.

[0031] In some optional embodiments, the method further comprises:

[0032] Acquire security status data of the first communication terminal through the second network channel;

[0033] Identify the security status data based on preset rules to obtain the security status of the first communication terminal;

[0034] When the security status of the first communication terminal does not meet the preset condition, the session connection with the first communication terminal is disconnected.

[0035] In a third aspect, an embodiment of the present application provides a communication system, including: a first communication device and a second communication device; wherein the first communication device is used to execute the communication method described in the first aspect, and the second communication device is used to execute the communication method described in the second aspect.

[0036] In a fourth aspect, an embodiment of the present application provides an electronic device, comprising: one or more processors; one or more memories; one or more memories storing one or more programs, and when one or more programs are executed by one or more processors, the electronic device executes the communication method as described above.

[0037] In a fifth aspect, an embodiment of the present application provides a readable storage medium, on which instructions are stored. When the instructions are executed on a communication device, the communication device executes the communication method as described above.

[0038] The technical solution provided by the embodiment of the present application has the following technical effects:

[0039] In the communication method described in the embodiment of the present application, the first communication terminal sends a connection request to the second communication terminal, so that the second connection terminal verifies the first identity certificate based on the root certificate, and verifies the first signature information based on the first public key when the first identity certificate is verified, and sends a request response to the first communication terminal when the verification is passed, so that the first communication terminal can verify the second identity certificate based on the root certificate, and verify the second signature information based on the second public key when the second identity certificate is verified, and generate a public session key based on the first temporary private key and the second temporary public key when the second signature information is verified. Through the above process, it can be ensured that the process of establishing a secure data transmission channel between the first communication terminal and the second communication terminal is not vulnerable to attack, thereby improving the security of establishing a secure data transmission channel. At the same time, in the process of establishing a secure data transmission channel, the first communication terminal and the second communication terminal only interact once, thereby improving the speed and efficiency of establishing a secure data transmission channel. In addition, based on the generated public session key, the security of data transmission between the first communication terminal and the second communication terminal can be ensured. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] Figure 1 is a schematic diagram of an exemplary application scenario provided by an embodiment of the present application;

[0041] Figure 2 It is a flow chart of a communication method provided in an embodiment of the present application;

[0042] Figure 3This is a schematic diagram of the architecture of a first communication terminal and a second communication terminal provided in an embodiment of the present application;

[0043] Figure 4 This is a schematic diagram of information carried in a connection request provided by an embodiment of the present application;

[0044] Figure 5 It is a schematic diagram of a flow chart of a second communication terminal verifying a connection request provided in an embodiment of the present application;

[0045] Figure 6 This is a schematic diagram of a request response carrying information provided by an embodiment of the present application;

[0046] Figure 7 It is a schematic diagram of a process of verifying a request response by a first communication terminal provided in an embodiment of the present application;

[0047] Figure 8 This is a schematic diagram of a network architecture of a first communication terminal and a second communication terminal provided in an embodiment of the present application;

[0048] Fig. 9 It is a hardware structure block diagram of a server according to a method provided by an exemplary embodiment. DETAILED DESCRIPTION

[0049] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application.

[0050] It should be noted that the terms "first", "second", etc. in the specification and claims of the embodiments of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. Thus, the features defined as "first" and "second" may expressly or implicitly include one or more of the features. In addition, unless otherwise specified, the meaning of "multiple" is two or more. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or server comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0051] In order to make the purpose, technical solution and advantages disclosed in the embodiments of the present application more clearly understood, the embodiments of the present application are further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the embodiments of the present application and are not used to limit the embodiments of the present application.

[0052] In IoT application scenarios, IoT devices can exchange data with cloud platforms through the Internet. The following uses a vehicle and a cloud platform as an example to illustrate the data transmission process between IoT devices and cloud platforms through the Internet.

[0053] refer to Figure 1 As shown, the vehicle 10 and the cloud platform 20 can be connected via a network (such as optical fiber, 5G network). When the vehicle 10 needs to exchange data with the cloud platform 20, data transmission can be performed through a message transmission protocol (such as a message queuing telemetry transport (MQTT) protocol).

[0054] Since the network between the vehicle 10 and the cloud platform 20 is a public network channel, this increases the risk of data being intercepted and tampered with. In order to ensure the security of data transmission between the vehicle 10 and the cloud platform 20, the relevant technology usually establishes an encrypted data transmission channel between the vehicle 10 and the cloud platform 20 based on a security protocol (such as TLS). However, traditional security protocols have problems such as slow connection establishment and susceptibility to man-in-the-middle attacks. In addition, when establishing an encrypted data transmission channel, problems such as high computing resource consumption and long latency are often faced. Especially in the Internet of Vehicles environment, higher requirements are placed on the real-time and security of communication. These problems limit the application effect of encrypted data transmission channels in high concurrency and low latency scenarios.

[0055] In view of this, the embodiment of the present application provides a communication method that can efficiently, securely and easily ensure the communication between the vehicle and the cloud platform, so as to cope with the challenges of the current communication between the vehicle and the cloud platform, and solve the problems of slow connection establishment and vulnerability to security threats in the Internet of Vehicles environment of the prior art. It aims to achieve a fast and secure connection between the vehicle and the cloud platform, and ensure the confidentiality, integrity and authentication of subsequent communications, so as to ensure the overall security and reliability of the Internet of Vehicles communication system and promote the healthy development of the intelligent connected vehicle industry.

[0056] The communication method provided by the embodiment of the present application is described in detail below. In the following description, the first communication terminal can be an Internet of Things device, including but not limited to vehicles, mobile phones, tablet computers, wearable devices, augmented reality (AR) / virtual reality (VR) devices, laptops, ultra-mobile personal computers (UMPC), netbooks, personal digital assistants (PDA), smart speakers, intelligent voice interaction devices, smart home appliances, smart watches, vehicle terminals, aircraft, etc. The second communication terminal can be a server. Optionally, the server 02 can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content delivery networks (CDN), and big data and artificial intelligence platforms and other basic cloud computing services. The first communication terminal can be connected to the second communication terminal through a network. Figure 2 is a flow chart of a communication method provided in an embodiment of the present application, refer to Figure 2 As shown, the method may include:

[0057] S201: The first communication terminal generates a first temporary public key and a first temporary private key.

[0058] In the embodiment of the present application, in order to improve the security of data transmission between the first communication terminal and the second communication terminal, a secure session connection can be established between the first communication terminal and the second communication terminal, and the first communication terminal and the second communication terminal can perform data transmission based on the secure session connection, thereby ensuring the security of data transmission between the two. When establishing a secure session connection between the first communication terminal and the second communication terminal, it can be achieved by adding security control of the security protocol in the message transmission protocol.

[0059] Specifically, an encrypted data transmission channel can be constructed between the first communication terminal and the second communication terminal based on the security protocol, and a session connection between the first communication terminal and the second communication terminal can be constructed based on the message transmission protocol. The security protocol focuses on protecting the confidentiality, integrity and authentication of data during transmission. The security protocol can ensure that the identities of both parties in communication are verified and that the data is not eavesdropped or tampered with by unauthorized third parties. Optionally, the security protocol can be one of the protocols such as the Transport Layer Security Protocol, the Secure Socket Layer (SSL), the Internet Protocol Security (IPsec), the Secure Shell Protocol (SSH), or one of the variants of the above protocols. The message transmission protocol focuses on the transmission and routing of data, ensuring that the message can be reliably transmitted from the sender to the receiver. The message transmission protocol defines the format of the message, the transmission method and the interaction rules between the two parties in communication. Optionally, the message transmission protocol may be one of the protocols such as Hyper Text Transfer Protocol (HTTP), Message Queuing Telemetry Transport (MQTT), Simple Mail Transfer Protocol (SMTP), Advanced Message Queuing Protocol (AMQP), or one of the variants of the above protocols.

[0060] When an encrypted data transmission channel is constructed between the first communication end and the second communication end based on a security protocol, the first communication end and the second communication end need to authenticate each other and negotiate a public session key. The public session key is used to encrypt / decrypt data transmitted through the secure session connection, thereby ensuring the security of the data. Before the first communication end and the second communication end authenticate each other, the certificates required for authentication need to be pre-set in the first communication end and the second communication end.

[0061] Specifically, the first communication terminal is pre-embedded with a root certificate and a first identity certificate, and the second communication terminal is pre-embedded with a root certificate and a second identity certificate. The root certificate can be a custom certificate designed according to a preset standard (such as the PBOC standard). When designing a custom certificate according to the preset standard, it can be optimized and adjusted according to the needs of the application scenario. As an example, the first communication terminal is a vehicle, and the second communication terminal is a cloud platform corresponding to the vehicle. When designing a custom certificate according to the PBOC standard, the standard PBOC certificate (such as an X509 certificate) can be customized in terms of certificate length, hierarchy, algorithm, etc., so that the designed certificate is more in line with the requirements of intelligent connected vehicles in terms of performance and scalability. By adopting a custom certificate, the size of the certificate can be reduced (for example, 80% less than the size of the standard X509 certificate) while ensuring the degree of security (such as meeting the PBOC3.0 security specification of the financial industry), which is more convenient for the communication terminal device to store.

[0062] The root certificate, the first identity certificate and the second identity certificate can all be issued by a trusted certificate authority (CA). Among them, the trusted certificate authority can be a self-test CA. The root certificate is the anchor point of authentication. The first identity certificate and the second identity certificate are secondary certificates corresponding to the root certificate. The first identity certificate is used to authenticate the first communication terminal, which corresponds to the first communication terminal, and different first communication terminals have different first identity certificates. As an example, when the first communication terminal is a vehicle, the first identity certificate can be the identity certificate of each vehicle. The second identity certificate is used to authenticate the second communication terminal, which corresponds to the second communication terminal, and different second communication terminals have different second identity certificates. As an example, when the second communication terminal is a cloud platform, the second identity certificate can be the site certificate of each server.

[0063] The first identity certificate and the second identity certificate can be issued by the root certificate. In practical applications, the root certificate can be used to issue a first identity certificate for each first communication terminal, and a second identity certificate for each second communication terminal. As an example, when the first communication terminal is a vehicle and the second communication terminal is a cloud platform, the first identity certificate (such as the vehicle's identity certificate) can be issued separately to each vehicle in the production line, and the second identity certificate (such as the site certificate) is generated by the background and deployed on the reverse proxy server. The root certificate will be integrated on both the vehicle and the cloud platform.

[0064] Figure 3 This is a schematic diagram of the architecture of a first communication terminal and a second communication terminal provided in an embodiment of the present application, with reference to Figure 3As shown, the root certificate and the first identity certificate are pre-embedded in the first communication terminal, and the root certificate and the second identity certificate are pre-embedded in the second communication terminal. The relevant certificates of the first communication terminal and the second communication terminal are issued by the self-built CA according to the customized certificate format. The certificate chain length is two sections, where the trust anchor is the root certificate, and the site certificate and the vehicle identity certificate are both secondary certificates, which are integrated together with the root certificate on the first communication terminal and the second communication terminal respectively for subsequent signature authentication. The root certificate and the first identity certificate in the first communication terminal can be pre-embedded in the security chip in the first communication terminal, and the root certificate and the second identity certificate in the second communication terminal can be pre-embedded in the hardware security module (HSM) in the first communication terminal, so as to ensure the security of the certificates. Pre-embedding the root certificate and the first identity certificate in the first communication terminal and pre-embedding the root certificate and the second identity certificate in the second communication terminal can be completed in the production line link, which is the basic preparation for the first communication terminal and the second communication terminal to establish a secure data transmission channel.

[0065] refer to Figure 3 As shown, a security chip is provided in the first communication terminal, and a hardware security module is provided in the second communication terminal. Among them, the security chip is an encryption chip in the first communication terminal, which integrates a hardware cryptographic algorithm unit that meets security standards and has a hardware trust root anti-tampering detection function. The hardware security module is an embedded hardware cryptographic machine that meets preset specifications (such as the PBOC3.0 specification) and supports capabilities such as key divergence and security algorithms. The main functions of the security chip and the hardware security module are to ensure the secure storage of the private keys of their respective communication terminals, and to increase the speed of key derivation and signing through the hardware acceleration card.

[0066] In an embodiment of the present application, when the first communication terminal and the second communication terminal authenticate each other, the first communication terminal may first generate a temporary public-private key pair of the first communication terminal, i.e., a first temporary public key and a first temporary private key, through a security chip. As an example, when the first communication terminal is a vehicle and the second communication terminal is a cloud platform, after the vehicle is powered on, it can start preparing to establish a secure session connection with the cloud platform, and the vehicle terminal may first generate a temporary public-private key pair of the first communication terminal through a security chip. When the second communication terminal authenticates the first communication terminal and generates a second public-private key pair, the second communication terminal may use the first temporary public key and the second temporary private key to generate a public session key. The first temporary private key is used to generate a public session key based on the second temporary public key and the first temporary private key when the first communication terminal obtains the second temporary public key generated by the second communication terminal. The public session key is used to encrypt data transmitted between the first communication terminal and the second communication terminal.

[0067] S202: The first communication end sends a connection request to the second communication end; the connection request carries the first identity certificate, first signature information and first public key corresponding to the first communication end; the first identity certificate is issued using a root certificate; the first identity certificate corresponds to a first public key and a first private key; the first signature information is obtained by signing the first temporary public key using the first private key.

[0068] In the embodiment of the present application, after generating the first temporary public-private key pair, the first communication end may send a connection request to the second communication end. Figure 3 As shown, the first communication terminal and the second communication terminal can be connected through a first network channel. The first communication terminal can send a connection request to the second communication terminal through the first network channel. The first network channel can be a private network channel. A private network channel refers to an isolated network designed specifically for communication between a first communication terminal (such as a vehicle) and a second communication terminal (such as a cloud platform). The network uses encryption technology to ensure the security and privacy of communication data and prevent unauthorized access and data leakage. In the private network channel, the first communication terminal can use a private Internet Protocol Address (IP) for internal communication without being exposed to the public Internet. By using this network architecture, the first communication terminal can interact efficiently and reliably with the second communication terminal or other trusted services in an independent network, while avoiding the security risks that may be caused by routing and addressing directly on the public Internet.

[0069] The security chip stores a public-private key pair corresponding to the first identity certificate, namely, a first public key and a first private key. The first private key is used to generate a first signature information, and the first public key is used to enable the second communication terminal to verify the first signature information. When encapsulating a connection request, the first communication terminal can sign the first temporary public key with the first private key to generate the first signature information. Then, the first communication terminal encapsulates the first identity certificate, the first signature information and the first public key into a connection request. The first temporary public key is signed with the first private key to generate the first signature information, and the asymmetric key technology is used to prevent eavesdropping and tampering by the middleman. In some embodiments, the first public key may also be stored in the first identity certificate. In other embodiments, the first identity certificate may also include information such as the algorithm identifier of the key negotiation algorithm, the identity information of the first communication terminal (such as the frame number), and the like.

[0070] Figure 4 This is a schematic diagram of a connection request carrying information provided by an embodiment of the present application, refer to Figure 4As shown, the connection request may also carry information such as the first communication terminal network identifier, request timestamp, connection identifier, key validity period, etc. Among them, the first communication terminal network identifier is used to identify the first communication terminal. Optionally, the first communication terminal network identifier may be the IP of the first communication terminal, etc. The request timestamp is used to indicate the sending time of the connection request. The connection identifier is used to identify the secure session connection to be established between the first connection terminal and the second connection terminal. Optionally, the connection identifier may be a randomly combined character of a certain length, such as a 64-bit random character. The key validity period refers to how long the final negotiated public session key is valid. The first communication terminal may assemble this information into a connection request and send it to the second communication terminal through the first network channel.

[0071] S203: The second communication end verifies the first identity certificate based on the root certificate, and if the first identity certificate passes the verification, verifies the first signature information based on the first public key.

[0072] In the embodiment of the present application, after receiving the connection request sent by the first communication terminal, the second communication terminal may verify the connection request, that is, verify the first signature information, the first identity certificate and other information carried in the connection request.

[0073] Specifically, when the second communication terminal verifies the connection request, the validity of the connection request can be determined based on the request timestamp. If the connection request is valid, the compliance of the first communication terminal is determined based on the identifier of the first communication terminal. If the first communication terminal is compliant, the first identity certificate is verified based on the root certificate, and if the first identity certificate passes the verification, the first signature information is verified based on the first public key.

[0074] Figure 5 This is a flow chart of a second communication terminal verifying a connection request provided by an embodiment of the present application, with reference to Figure 5 As shown, the second communication terminal first determines whether the connection request is a timeout information by requesting a timestamp. If it is a timeout information, the verification fails and the first communication terminal fails to authenticate. If it is not a timeout information, the verification passes, and the network identification of the first communication terminal can be queried to see if it is compliant (for example, whether it is in the blacklist). If it is not compliant with the rules, the verification fails and the first communication terminal fails to authenticate. If the compliance verification passes, the compliance of the first identity certificate can be verified using the root certificate preset in the second communication terminal. If it is not compliant with the rules, the authentication of the first communication terminal fails. If the compliance verification passes, the compliance of the first signature information can then be verified using the first public key. If it is not compliant with the rules, the verification fails and the first communication terminal fails. If the compliance verification passes.

[0075] The above-mentioned verification of the connection request is a series of verification processes performed by the second communication terminal after receiving the handshake request initiated by the first communication terminal to ensure the credibility and integrity of the received data. By verifying the validity of the request timestamp to determine whether it is a timed-out request, anti-replay attacks can be intercepted. The first communication terminal network identification verification determines whether it is a blacklist risk device, so that rapid failure can reduce the pressure on the second communication terminal. The compliance of the first identity certificate is verified using the public key in the preset root certificate, and the compliance of the first signature information is verified using the first public key in the first identity certificate to ensure the credibility of the connection request. The above steps are linked together to reasonably avoid the impact of various network attacks on the second communication terminal.

[0076] In an embodiment of the present application, when a session connection between a first communication terminal and a second communication terminal is constructed based on a message transmission protocol, the second communication terminal (which may be a server, such as an MQTT server) may authenticate the accessed second communication terminal (which may be a client, such as an MQTT client). After successful authentication, data transmission can be performed between the first communication terminal and the second communication terminal (such as an MQTT client publishing or subscribing to messages through an MQTT server). Therefore, when a session connection between a first communication terminal and a second communication terminal is constructed based on a message transmission protocol, it is not only necessary to mutually authenticate the first communication terminal and the second communication terminal based on a security protocol, but also necessary to authenticate the access of the first communication terminal by the second communication terminal. Taking the security protocol as the TLS protocol and the message transmission protocol as the MQTT protocol as an example, in the related art, MQTT authentication is usually performed after TLS two-way authentication. This method takes a long time to authenticate and the efficiency of establishing a session connection is low. Therefore, in an embodiment of the present application, authentication based on a message transmission protocol is performed while authentication based on a security protocol is performed.

[0077] Specifically, when the first signature information verification passes, the second communication terminal can perform identity information verification to establish a session connection between the first communication terminal and the second communication terminal. Specifically, a message agent is set in the second communication terminal; the first identity certificate carries the identity information of the first communication terminal. Optionally, the identity information of the first communication terminal can be the identifier of the first communication terminal (such as a unique device identification code), account name and password, etc. The second communication terminal parses the first identity certificate to obtain the identity information of the first communication terminal, and then authenticates the first communication terminal based on the identity information of the first communication terminal. When the identity authentication passes, the first communication terminal is used as the client of the message agent.

[0078] refer to Figure 5As shown, the identity information verification is a login authentication between the first communication terminal and the second communication terminal. The second communication terminal obtains the identity information (such as the vehicle frame number) of the first communication terminal by parsing the first identity certificate, and then verifies whether the connection request is a compliant login request. When the connection request is a compliant login request, a session connection is established between the first communication terminal and the second communication terminal. As an example, when the message transmission protocol is the MQTT protocol, when the connection request is a compliant login request, the first communication terminal can act as an MQTT client to publish or subscribe to messages with the second communication terminal (MQTT server) to achieve data transmission.

[0079] Through the above method, the process of establishing a secure session connection between the first communication terminal and the second communication terminal can be simplified, and the authentication steps based on the security protocol and the authentication steps based on the message transmission protocol can be merged by using a custom certificate, which effectively improves the speed of establishing a secure session connection between the first communication terminal and the second communication terminal.

[0080] S204: When the first signature information is verified to be successful, the second communication terminal generates a second temporary public key and a second temporary private key.

[0081] In the embodiment of the present application, after the second communication terminal verifies the connection request, it can generate a temporary public-private key pair of the second communication terminal, namely a second temporary public key and a second temporary private key. Optionally, the second temporary public key and the second temporary private key can be generated by a hardware security module.

[0082] S205: The second communication end generates a public session key based on the first temporary public key and the second temporary private key.

[0083] In an embodiment of the present application, after generating the second temporary public key and the second temporary private key, the second communication end can obtain the algorithm identifier of the key negotiation algorithm in the first identity certificate, and use the first temporary public key and the second temporary private key to generate a public session key according to the key negotiation algorithm indicated by the algorithm identifier.

[0084] The public session key is a symmetric key generated by the second communication end and used in subsequent communications between the first communication end and the second communication end. When generating the public session key, Diffie-Hellman key negotiation can be performed based on an elliptic curve with a one-way characteristic, and the public session key can be calculated using the second temporary private key and the first temporary public key, that is, aB=a(bP) and bA=b(aP). Optionally, after generating the public session key, the second communication end can bind the generated public session key to the connection identifier in the connection request for encryption and decryption of subsequent session messages.

[0085] S206: The second communication end sends a request response to the first communication end; the request response carries the second identity certificate, second signature information and second public key corresponding to the second communication end; the second identity certificate is issued using the root certificate; the second identity certificate corresponds to the second public key and the second private key; the second signature information is obtained by signing the second temporary public key using the second private key.

[0086] In the embodiment of the present application, after the second communication end passes the verification of the first communication end, the second communication end may send a request response to the first communication end, so that the first communication end authenticates the second communication end.

[0087] Specifically, a public-private key pair corresponding to the second identity certificate, i.e., a second public key and a second private key, is stored in the hardware security module in the second communication terminal. The second private key is used to generate the second signature information, and the second public key is used to enable the first communication terminal to verify the second signature information. When encapsulating the request response, the second communication terminal can sign the second temporary public key with the second private key to generate the second signature information. Then, the second communication terminal encapsulates the second identity certificate, the second signature information and the second public key into a request response. In some embodiments, the second identity certificate may include information such as the second public key of the certificate, the server domain name (Domain Name Server, DNS), and the validity period of the public session key.

[0088] Figure 6 This is a schematic diagram of a request response carrying information provided by an embodiment of the present application, refer to Figure 6 As shown, the request may also carry information such as a response timestamp and identity information verification results. The response timestamp is used to indicate the time when the request response is sent. The identity information verification result is used to indicate whether the identity information verification of the first communication terminal has passed. After the second communication terminal completes the identity information verification of the first communication terminal, it may assemble the identity information verification result with the second communication terminal response timestamp, the second temporary public key, the second signature information, the second identity certificate and other information into a request response, and then reply the request response to the first communication terminal through the first network channel.

[0089] S207: The first communication end verifies the second identity certificate based on the root certificate, and if the second identity certificate passes the verification, verifies the second signature information based on the second public key.

[0090] In an embodiment of the present application, after the first communication terminal receives the request response replied by the second communication terminal, the second communication terminal can be authenticated. Specifically, first determine whether it is a timeout message through the response timestamp carried in the request response. If it is a timeout message, the authentication of the second communication terminal fails. If it is not a timeout message, the compliance of the second identity certificate can be verified based on the root certificate preset in the first communication terminal. If it does not comply with the rules, the authentication of the second communication terminal fails. If it is compliant, the compliance of the second signature information can be verified using the second public key carried in the request response (or the second public key parsed from the second identity certificate). If it does not comply with the rules, the authentication of the second communication terminal fails. If it complies with the rules, the authentication of the second communication terminal is passed.

[0091] Figure 7 This is a flow chart of a first communication terminal verifying a request response provided by an embodiment of the present application, with reference to Figure 7 As shown, the first communication terminal verifies the request response, which is a series of verification processes performed by the first communication terminal after receiving the request response replied by the second communication terminal. The first communication terminal determines whether it is a timed-out request by the response timestamp, and can intercept anti-replay attacks. By using the public key in the preset root certificate to verify the compliance of the second identity certificate, and by using the second public key to verify the compliance of the second signature information, the credibility of the request response can be ensured.

[0092] After the second signature information is verified, the first communication end can perform identity information verification according to the identity information verification result in the request response. Specifically, when the identity information verification result indicates that the identity information of the first communication end is verified, a session connection action (such as an action of connecting to MQTT) is performed to transmit session messages.

[0093] S208: When the second signature information is verified to be successful, the first communication terminal generates a public session key based on the first temporary private key and the second temporary public key.

[0094] In the embodiment of the present application, after the first communication terminal passes the request response verification, the first temporary private key and the second temporary public key can be used to calculate the public session key through an algorithm and properly store it. Specifically, the first communication terminal uses the first temporary private key generated above and the second temporary public key in the request response, and uses an elliptic curve with an agreed curvature to calculate the public session key for subsequent communication message encryption and decryption. Thus, a secure session connection is established between the first communication terminal and the second communication terminal.

[0095] After a secure session connection is established between the first communication terminal and the second communication terminal, the service initiating side will assemble the service message into a session message according to the message transmission protocol specification, and then encrypt it with a public session key and transmit it to the first network channel. After receiving the message, the service receiving side will decrypt it with its own public session key and perform corresponding service processing, and vice versa. As an example, the first communication terminal encapsulates the data to be transmitted according to a preset format to obtain a session message, and the first communication terminal encrypts the session message based on the public session key to obtain an encrypted session message, and then the first communication terminal sends the encrypted session message to the second communication terminal through the first network channel.

[0096] It should be noted that after the public session key expires, the first communication end may restart the process of initiating a secure session connection.

[0097] In the embodiment of the present application, after a secure session connection is established between a first communication terminal and a second communication terminal, the first communication terminal will periodically send a heartbeat test message to the second communication terminal to enable the second communication terminal to maintain a session connection with the first communication terminal. Specifically, the first communication terminal will periodically send a heartbeat test message to the second communication terminal to prove its own survivability. If the second communication terminal does not receive the heartbeat test message sent by the first communication terminal within a preset time (such as 1.2 times the heartbeat period), it will actively disconnect the secure session connection with the first communication terminal.

[0098] In the embodiment of the present application, the first communication end and the second communication end may be connected through a second network channel in addition to being connected through the first network channel. The second network channel may be a public network channel.

[0099] As an example, Figure 8 is a schematic diagram of a network architecture of a first communication terminal and a second communication terminal provided in an embodiment of the present application, with reference to Figure 8 As shown, when the first communication terminal is a vehicle and the second communication terminal is a cloud platform, a business system and a risk control decision system are provided in the second communication terminal. Among them, the first communication terminal is connected to the business system through a connection gateway. The first network channel is used to establish a secure session connection between the first communication terminal and the second communication terminal to transmit data with higher security requirements (such as business data) to ensure the security of the data. In addition, after the secure session connection is established between the first communication terminal and the second communication terminal, a heartbeat test message of a preset length (such as 2 bytes) is sent regularly according to the agreed heartbeat cycle, and the second communication terminal replies with a heartbeat reply message of a preset length (such as 2 bytes) after receiving it. If the second communication terminal does not receive any data packet from the first communication terminal within a preset time (such as 1.2 times the heartbeat cycle), it is considered that there is a problem with the connection and it is actively disconnected. In the above manner, the stability of the connection can be ensured.

[0100] refer to Figure 8 As shown, the first communication terminal and the second communication terminal also have many businesses running in the second network channel. In order to ensure the stability of the private network connection, the second communication terminal will build a risk control decision system. The risk control decision system can obtain a series of security status data such as the buried data of the first communication terminal and the data reported by the intrusion detection and defense system, and judge whether the first communication terminal is in an abnormal state according to the rules, so as to timely update the connection status of the first communication terminal and the gateway blacklist information, and more effectively improve the overall reliability of vehicle-to-cloud communication through the combination of multiple security measures.

[0101] Specifically, refer to Figure 8 As shown, the second network channel is used to transmit security status data for determining the security status of the first communication terminal. Specifically, the second communication terminal obtains the security status data of the first communication terminal through the second network channel, and then the second communication terminal identifies the security status data based on a preset rule to obtain the security status of the first communication terminal. If the security status of the first communication terminal does not meet the preset conditions, the second communication terminal disconnects the session connection with the first communication terminal.

[0102] refer to Figure 8 As shown, the risk control decision system can obtain a series of information such as the tracking data of the first communication terminal and the risk events reported by the intrusion detection and prevention system from the second network channel, and determine whether the first communication terminal is in an unsafe state according to the attack model rules. If the security state of the first communication terminal is determined to be unsafe, the security session connection with the first communication terminal will be disconnected or it will be added to the connection blacklist depending on the degree of risk.

[0103] By establishing a composite security mechanism, collecting information from multiple channels, and continuously iterating the attack analysis model, the online connection status of the first communication terminal can be more accurately determined, thereby ensuring the overall security of the first communication terminal and the second communication terminal.

[0104] The communication method described in the embodiment of the present application is to design a certificate in a custom format based on a preset standard (such as the PBOC standard). Compared with other certificates (such as X509 certificates), custom certificates have been customized and optimized in terms of certificate length, hierarchy, algorithm, etc., and are more in line with the requirements of different application scenarios (such as smart connected vehicles) in terms of performance and scalability. At the same time, by designing a custom authentication scheme based on a security protocol and a message transmission protocol, combined with the authentication information of the custom certificate and the message transmission protocol, the authentication process based on the security protocol and the message transmission protocol is completed within one round-trip time (RTT) cycle, reducing the authentication time and improving the system security, while meeting the requirements of security and efficiency. In addition, by combining heartbeat monitoring, collecting point data and security situation awareness data through public network channels, black and white lists and other means, the information status of the first communication terminal registered on the secure session connection channel is monitored in real time. Compared with the traditional single security mechanism, building a comprehensive set of multiple security protection mechanisms can more effectively improve the overall security of the communication system.

[0105] An embodiment of the present application also provides a communication system, including: a first communication device and a second communication device; wherein the first communication device is used to execute the communication method described in the first aspect, and the second communication device is used to execute the communication method described in the second aspect.

[0106] An embodiment of the present application also provides an electronic device, comprising: one or more processors; one or more memories; one or more memories storing one or more programs, and when the one or more programs are executed by the one or more processors, the electronic device executes the communication method as described above.

[0107] The method provided in the embodiment of the present application can be applied to any electronic device, including but not limited to a mobile station (MS), a mobile terminal (MT), etc. For example, the electronic device can be a mobile phone, a smart TV, a wearable device, a tablet computer (Pad), a desktop computer, a laptop computer, a virtual reality (VR) device, an augmented reality (AR) device, a terminal in industrial control, a terminal in self-driving, a terminal in remote medical surgery, a terminal in a smart grid, a terminal in transportation safety, a terminal in a smart city, a terminal in a smart home, etc. The embodiment of the present application does not limit the specific form of the electronic device.

[0108] An embodiment of the present application also provides a readable storage medium, on which instructions are stored. When the instructions are executed on a communication device, the communication device executes the communication method as described above.

[0109] Optionally, in the embodiment of this specification, the storage medium may be located in at least one of the multiple network servers of the computer network. Optionally, in this embodiment, the above storage medium may include but is not limited to: a USB flash drive, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk or an optical disk, and other media that can store program codes.

[0110] The memory of the embodiment of this specification can be used to store software programs and modules, and the processor executes various functional applications and data processing by running the software programs and modules stored in the memory. The memory may mainly include a program storage area and a data storage area, wherein the program storage area may store an operating system, applications required for functions, etc.; the data storage area may store data created according to the use of the device, etc. In addition, the memory may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other volatile solid-state storage device. Accordingly, the memory may also include a memory controller to provide the processor with access to the memory.

[0111] The embodiment of the present application also provides a computer program product or a computer program, which includes a computer instruction stored in a computer-readable storage medium. The processor of the computer device reads the computer instruction from the computer-readable storage medium, and the processor executes the computer instruction, so that the computer device executes the method provided in the above method embodiment.

[0112] The method embodiments provided in the embodiments of the present application can be executed in a terminal, a computer terminal, a server or a similar computing device. Taking running on a server as an example, Fig. 9 FIG. 1 is a hardware structure diagram of a server according to a method provided by an exemplary embodiment. Fig. 9 As shown, the server 300 may have relatively large differences due to different configurations or performances, and may include one or more central processing units (CPU) 310 (the central processing unit 310 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA), a memory 330 for storing data, and one or more storage media 320 (such as one or more mass storage devices) for storing application programs 323 or data 322. Among them, the memory 330 and the storage medium 320 can be short-term storage or permanent storage. The program stored in the storage medium 320 may include one or more modules, each of which may include a series of instruction operations on the server. Furthermore, the central processing unit 310 can be configured to communicate with the storage medium 320 and execute a series of instruction operations in the storage medium 320 on the server 300. The server 300 may also include one or more power supplies 360, one or more wired or wireless network interfaces 350, one or more input and output interfaces 340, and / or one or more operating systems 321, such as Windows ServerTM, Mac OS XTM, UnixTM, LinuxTM, FreeBSDTM, etc.

[0113] The input / output interface 340 may be used to receive or send data via a network. The specific example of the network may include a wireless network provided by a communication provider of the server 300. In one example, the input / output interface 340 includes a network adapter (Network Interface Controller, NIC), which may be connected to other network devices via a base station so as to communicate with the Internet. In one example, the input / output interface 340 may be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0114] It can be understood by those skilled in the art that Fig. 9 The structure shown is only for illustration and does not limit the structure of the above electronic device. Fig. 9 More or fewer components as shown, or with Fig. 9 Different configurations are shown.

[0115] It should be noted that the above-mentioned sequence of the embodiments of the present application is for description only and does not represent the advantages and disadvantages of the embodiments. The above-mentioned specific embodiments of this specification are described. Other embodiments are within the scope of the attached claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0116] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the device and server embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiments.

[0117] A person skilled in the art will understand that all or part of the steps to implement the above embodiments may be accomplished by hardware, or by a program to instruct the relevant hardware, and the program may be stored in a computer-readable storage medium, and the above-mentioned storage medium may be a read-only memory, a disk or an optical disk, etc.

[0118] The above are only preferred embodiments of the present application and are not intended to limit the present application. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application should be included in the protection scope of the present application.

Claims

1. A communication method, characterized in that: Applied to the first communication terminal, the method includes: Generate a first temporary public key and a first temporary private key; the first temporary public key is used to enable the second communication end to generate a public session key; Sending a connection request to the second communication end; the connection request carries a first identity certificate, first signature information, and first public key corresponding to the first communication end; the first identity certificate is obtained by issuing a root certificate; the first identity certificate corresponds to the first public key and a first private key; the first signature information is obtained by signing the first temporary public key using the first private key; Receive a request response sent by the second communication end; the request response is sent when the second communication end generates a second temporary public key, and the second temporary public key is generated when the second communication end verifies the connection request; the second communication end verifies the connection request including: the second communication end verifies the first identity certificate based on the root certificate, and verifies the first signature information based on the first public key when the first identity certificate verifies the first identity certificate; the request response carries the second identity certificate, second signature information and second public key corresponding to the second communication end; the second identity certificate is issued using the root certificate; the second identity certificate corresponds to the second public key and the second private key; the second signature information is obtained by signing the second temporary public key using the second private key; Verifying the second identity certificate based on the root certificate, and if the second identity certificate passes the verification, verifying the second signature information based on the second public key; When the second signature information passes verification, the public session key is generated based on the first temporary private key and the second temporary public key.

2. The method according to claim 1, characterized in that The method further comprises: Encapsulate the data to be transmitted according to a preset format to obtain a session message; Encrypting the session message based on the public session key to obtain an encrypted session message; The encrypted session message is sent to the second communication end through the first network channel.

3. The method according to claim 1 or 2, characterized in that: The method further comprises: A heartbeat test message is sent to the second communication end so that the second communication end maintains a session connection with the first communication end.

4. A communication method, characterized in that: Applied to the second communication terminal, the method includes: Receive a connection request sent by a first communication terminal; the connection request carries a first identity certificate, first signature information and a first public key corresponding to the first communication terminal; the first identity certificate is issued using a root certificate; the first identity certificate corresponds to the first public key and a first private key; the first signature information is obtained by signing a first temporary public key using the first private key; Verifying the first identity certificate based on the root certificate, and if the first identity certificate passes the verification, verifying the first signature information based on the first public key; If the first signature information passes verification, generating a second temporary public key and a second temporary private key; Sending a request response to the first communication end; the request response carries the second identity certificate, second signature information and second public key corresponding to the second communication end; the second identity certificate is issued using the root certificate; the second identity certificate corresponds to the second public key and the second private key; the second signature information is obtained by signing the second temporary public key using the second private key; the second temporary public key is used to enable the first communication end to generate a public session key if the request response is verified; the first communication end verifies the request response including: the first communication end verifies the second identity certificate based on the root certificate, and verifies the second signature information based on the second public key if the second identity certificate is verified; The public session key is generated based on the first temporary public key and the second temporary private key.

5. The method according to claim 4, characterized in that The connection request also carries a request timestamp and an identifier of the first communication end; the verifying the first identity certificate based on the root certificate, and verifying the first signature information based on the first public key if the first identity certificate passes the verification, includes: determining validity of the connection request based on the request timestamp; If the connection request is valid, determining compliance of the first communication end based on the identifier of the first communication end; When the first communication terminal is compliant, the first identity certificate is verified based on the root certificate, and when the first identity certificate passes the verification, the first signature information is verified based on the first public key.

6. The method according to claim 4 or 5, characterized in that: The second communication terminal is provided with a message agent; the first identity certificate carries the identity information of the first communication terminal; the method further includes: Parsing the first identity certificate to obtain identity information of the first communication end; authenticating the first communication end based on the identity information of the first communication end; When the identity authentication is passed, the first communication terminal is used as the client of the message proxy.

7. The method according to claim 4, characterized in that The method further comprises: Acquire the security status data of the first communication terminal through the second network channel; Identify the security status data based on a preset rule to obtain the security status of the first communication terminal; When the security status of the first communication terminal does not meet a preset condition, the session connection with the first communication terminal is disconnected.

8. A communication system, characterized in that: include: A first communication device and a second communication device; wherein the first communication device is used to execute the communication method described in any one of claims 1 to 3, and the second communication device is used to execute the communication method described in any one of claims 4 to 7.

9. An electronic device, characterized in that: include: one or more processors; One or more memories; the one or more memories store one or more programs, and when the one or more programs are executed by the one or more processors, the electronic device executes the communication method as described in any one of claims 1 to 7.

10. A readable storage medium, characterized in that: The readable storage medium stores instructions, which, when executed on a communication device, enable the communication device to execute the communication method according to any one of claims 1 to 7.

Images