Vehicle terminal access method, device and system

Abstract

The present invention relates to the field of intelligent vehicle technology, and provides a vehicle terminal access method, device and system, the method comprising: receiving an access request corresponding to a target client, allocating a corresponding dynamic port for the current access request; sending the dynamic port to the target client, and instructing the target client to establish a first data channel between the target client and a reverse proxy server; sending the dynamic port to a target vehicle terminal through a target control channel, and instructing the target vehicle terminal to establish a second data channel between the reverse proxy server and the target vehicle terminal; based on the first data channel, receiving an external network request sent by the target client; based on the second data channel, sending the external network request to a target service associated with the external network request in the target vehicle terminal. The present invention can improve the security of communication and ensure the stability of system operation.

Description

Technical Field

[0001] The present invention relates to the field of intelligent vehicle technology, and in particular to a vehicle-mounted terminal access method, device and system. Background Art

[0002] In the network architecture of the unmanned driving system in mining areas based on intelligent networking, the TBOX (TelematicBOX, intelligent vehicle terminal) in the vehicle is connected to the network through 5G. However, during the operation process, the operation and maintenance personnel cannot directly access different services inside the vehicle from the external network using the private IP address (Internet Protocol Address).

[0003] In the prior art, operation and maintenance personnel generally use remote access to access various types of on-board equipment inside the vehicle to obtain the vehicle's operating status and facilitate troubleshooting. However, if the external network access rights of the system network architecture are opened, it is easy to be attacked illegally and cause the system equipment to fail to work properly. Therefore, there is a serious security risk. Therefore, how to securely remotely access the internal services of the vehicle is a technical problem that needs to be solved urgently. Summary of the invention

[0004] The present invention provides a vehicle-mounted terminal access method, device and system, which are used to solve the defect of opening external network access rights for remote access in the prior art, which has serious security risks.

[0005] The present invention provides a vehicle-mounted terminal access method, which is applied to any reverse proxy server, and the method comprises: When receiving an access request corresponding to the target client, allocate a corresponding dynamic port for the current access request; Sending the dynamic port to the target client and instructing the target client to establish a first data channel between the target client and the reverse proxy server; Sending the dynamic port to the target vehicle terminal through the target control channel, and instructing the target vehicle terminal to establish a second data channel between the reverse proxy server and the target vehicle terminal; the target control channel is established after the target vehicle terminal successfully registers with the reverse proxy server based on the identity information of the target vehicle terminal; Based on the first data channel, receiving an external network request sent by the target client; Based on the second data channel, the external network request is sent to a target service associated with the external network request in the target vehicle-mounted terminal.

[0006] According to the vehicle terminal access method provided by the present invention, the target control channel is established based on the following steps: Receiving identity information of the target vehicle terminal based on an encrypted channel between the reverse proxy server and the target vehicle terminal; After the identity information is authenticated, the encrypted channel is determined as the target control channel.

[0007] According to the vehicle terminal access method provided by the present invention, the identity information includes VIN and ICCID, the VIN is the vehicle number corresponding to the target vehicle terminal, and the ICCID is the SIM card number in the TBOX module in the target vehicle terminal.

[0008] According to the vehicle terminal access method provided by the present invention, the sending of the external network request to the target service associated with the external network request in the target vehicle terminal based on the second data channel includes: Determine a target service in the target vehicle-mounted terminal corresponding to the external network request; Encrypting the external network request based on the key exchange algorithm in the SSL mode; Based on the second data channel, the encrypted external network request is sent to the target service in the target vehicle terminal.

[0009] According to the vehicle terminal access method provided by the present invention, the method further includes: In the case where the reverse proxy server is indirectly connected to the target client via a load balancer, a target request corresponding to the target client forwarded by the load balancer is received.

[0010] According to the vehicle terminal access method provided by the present invention, the target request includes an access request and an external network request; The receiving the target request corresponding to the target client forwarded by the load balancer includes: Upon receiving an access request corresponding to a target client forwarded by the load balancer, sending a dynamic port allocated for the target client to the load balancer, and establishing a third data channel between the reverse proxy server and the load balancer based on the dynamic port; Based on the third data channel, an external network request sent by the target client and forwarded by the load balancer is received.

[0011] The present invention also provides a vehicle-mounted terminal access device, which is applied to any reverse proxy server, and the device includes: The port allocation module is used to receive the access request corresponding to the target client and allocate the corresponding dynamic port for the current access request; A first sending module, used for sending the dynamic port to the target client and instructing the target client to establish a first data channel between the target client and the reverse proxy server; A second sending module is used to send the dynamic port to the target vehicle terminal through the target control channel, and instruct the target vehicle terminal to establish a second data channel between the reverse proxy server and the target vehicle terminal; the target control channel is established after the target vehicle terminal successfully registers with the reverse proxy server based on the identity information of the target vehicle terminal; A receiving module, configured to receive, based on the first data channel, an external network request sent by the target client; The third sending module is used to send the external network request to the target service associated with the external network request in the target vehicle terminal based on the second data channel.

[0012] The present invention also provides a vehicle-mounted terminal access system, comprising: at least one reverse proxy server, the at least one reverse proxy server is communicatively connected to at least one client, and a first data channel is established between each of the reverse proxy servers and the corresponding client; the at least one reverse proxy server is also communicatively connected to the corresponding vehicle-mounted terminal, and a control channel and a second data channel are respectively established between each of the reverse proxy servers and the corresponding vehicle-mounted terminal; each of the reverse proxy servers is used to execute the vehicle-mounted terminal access method as described in any of the above items.

[0013] The vehicle terminal access system provided by the present invention further includes a load balancer, and the at least one reverse proxy server and the at least one client are both connected to the load balancer; The load balancer is used to determine a target reverse proxy server from the at least one reverse proxy server when receiving an access request from a target client, and forward the access request to the target reverse proxy server; Receiving a dynamic port allocated by the target reverse proxy server, and establishing a third data channel between the load balancer and the target reverse proxy server based on the dynamic port; Based on the third data channel, the external network request sent by the target client is forwarded to the target reverse proxy server.

[0014] The vehicle terminal access method, device and system provided by the present invention, when the reverse proxy server receives the access request corresponding to the target client, allocates the dynamic port corresponding to the current access request, sends the dynamic port to the target client, and sends the dynamic port to the target vehicle terminal through the target control channel between the reverse proxy server and the target vehicle terminal, instructs the target client to establish a first data channel between the target client and the reverse proxy server through the dynamic port, and instructs the target vehicle terminal to establish a second data channel between the reverse proxy server and the target vehicle terminal, and then receives the external network request sent by the target client through the first data channel, and sends the external network request to the target service associated with the external network request in the target vehicle terminal through the second data channel. The present invention dynamically allocates the corresponding dynamic port for the current access request, realizes the allocation of a dynamic port once for each connection, ensures the randomness of the first data channel and the second data channel, reduces the risk of the dynamic port being scanned and cracked, and at the same time, the first data channel and the second data channel are separated from the target control port, further improves the security of communication, and ensures the stability of system operation. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0016] Figure 1 It is a flowchart of a vehicle terminal access method provided by an embodiment of the present invention.

[0017] Figure 2 It is a schematic diagram of a first data channel and a second data channel provided by an embodiment of the present invention.

[0018] Figure 3 It is a schematic diagram of the structure of the vehicle-mounted terminal access device provided by an embodiment of the present invention.

[0019] Figure 4 It is a schematic diagram of the structure of a reverse proxy server provided by an embodiment of the present invention.

[0020] Figure 5 It is a structural diagram of a vehicle terminal access system provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0021] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0022] During operation, maintenance personnel cannot directly access different services inside the vehicle from the external network using private IP addresses (Internet Protocol Address). Therefore, local debugging and remote debugging are generally used to achieve remote access to various types of on-board devices inside the vehicle. Among them: (1) Near-end debugging includes on-site debugging and WiFi (Wireless Fidelity) debugging. On-site debugging means that the operation and maintenance personnel get on the vehicle and connect the debugging cable. Although WiFi debugging does not require the connection of debugging cables, the connection distance is very limited. Based on the mobility of the vehicle, WiFi debugging cannot meet the needs. During near-end debugging, accurate remote debugging can be achieved under the same intranet, but due to the limited size of the intranet, the network architecture of the mine unmanned driving system based on intelligent networking only supports debugging within the factory area, requiring operation and maintenance personnel to travel to the deployed mine area. However, there are great safety risks for operation and maintenance personnel to enter and exit the mine area, and it seriously affects the operating efficiency. Even if the operation and maintenance personnel are in the mine area, there are still great communication costs when communicating with technical personnel.

[0023] (2) Remote debugging is to open up external network access rights, allowing operation and maintenance personnel to remotely access various types of on-board equipment inside the vehicle. However, there are greater security risks such as being vulnerable to illegal attacks and causing the system equipment to fail to work properly.

[0024] In view of the above problems in the prior art, an embodiment of the present invention provides a vehicle terminal access method, which is applied to any reverse proxy server. Figure 1 is a flow chart of a vehicle terminal access method provided by an embodiment of the present invention, such as Figure 1 As shown, the method includes the following steps 110 to 150.

[0025] Step 110: Receive an access request corresponding to the target client, and allocate a corresponding dynamic port for the current access request.

[0026] It should be noted that in the embodiment of the present invention, the reverse proxy server is set in the intranet. The intranet refers to a private network composed of different vehicle-mounted terminals and the reverse proxy server. The IP address of the intranet is not open to the public, which makes it difficult to directly access the internal services of the corresponding vehicle-mounted terminal in the intranet. The external network refers to the Internet, which is a public, global network. The reverse proxy server adopts the intranet penetration reverse proxy technology to realize the interaction between the target client of the external network and the internal services of different vehicle-mounted terminals in the intranet, meeting the needs of operation and maintenance personnel to remotely access different types of services of the target vehicle terminal.

[0027] Specifically, after configuring the reverse proxy server in the intranet, the reverse proxy server can monitor the needs of each client. When the reverse proxy server receives an access request sent by the target client, the reverse proxy server can determine whether the target client is legal based on the access request. If it is legal, a dynamic port is allocated for the current access request. If it is not legal, the target client's access is denied.

[0028] It should be noted that the access request may include identity authentication information corresponding to the target client, and the identity authentication information may include an account and password for logging into the reverse proxy server, etc., which is not limited in the embodiments of the present invention. For example, if the account and password in the access request match the preset account and preset password corresponding to the operation and maintenance personnel in the preset database, it indicates that the user corresponding to the target client is an authorized operation and maintenance personnel. At this time, it indicates that the target client is legal. If the account and password in the access request do not match the preset account and preset password corresponding to the operation and maintenance personnel in the preset database, it indicates that the user corresponding to the target client may be an unauthorized illegal user. At this time, it indicates that the target client is illegal.

[0029] It should be noted that the assigned dynamic port is only valid within the connection period corresponding to the current access request. After the target client is disconnected from the reverse proxy server, the dynamic port becomes invalid. When the target client accesses the reverse proxy server again, the reverse proxy server will reallocate a new dynamic port after verifying that the target client is legitimate. The dynamic port at this time may be the same as or different from the dynamic port assigned during the last connection. Preferably, the dynamic port assigned during the current connection can be different from the dynamic port assigned during the previous connection to reduce the risk of the same dynamic port being scanned and cracked.

[0030] Step 120: Send the dynamic port to the target client, and instruct the target client to establish a first data channel between the target client and the reverse proxy server.

[0031] Specifically, after allocating the dynamic port, the allocated dynamic port can be fed back to the target client, notifying the target client that it can establish a connection with the reverse proxy server through the allocated dynamic port, that is, building a first data channel between the target client and the reverse proxy server to achieve data interaction between the target client and the reverse proxy server.

[0032] Step 130: Send the dynamic port to the target vehicle terminal through the target control channel, and instruct the target vehicle terminal to establish a second data channel between the reverse proxy server and the target vehicle terminal; the target control channel is established after the target vehicle terminal successfully registers with the reverse proxy server based on its identity information.

[0033] Specifically, after the dynamic port is allocated, the allocated dynamic port can be sent to the target vehicle terminal through the target control terminal established after the target vehicle terminal successfully registers with the reverse proxy server, notifying the target vehicle terminal that it can establish a connection with the reverse proxy server through the dynamic port number, that is, establishing a second data channel between the target vehicle terminal and the reverse proxy server. Figure 2 is a schematic diagram of a first data channel and a second data channel provided by an embodiment of the present invention, such as Figure 2 As shown, the second data channel and the first data channel constitute a target data channel between the target client and the target vehicle terminal. At the same time, the target data channel and the target control channel operate independently without affecting each other, thereby improving network security and stability of system operation.

[0034] Further, the target control channel is established based on the following steps; Receiving identity information between the target vehicle terminal based on an encrypted channel between the reverse proxy server and the target vehicle terminal; After the identity information is authenticated, the encrypted channel is determined as the target control channel.

[0035] Specifically, preferably, the encrypted channel is constructed based on the SSL method, that is, before sending an external network request to the target vehicle terminal, the SSL method must be used to construct an encrypted channel between the reverse proxy server and the target vehicle terminal. The construction process of the encrypted channel specifically includes: (1) Certificate preparation stage: The target vehicle terminal and reverse proxy server generate their own private keys, and use the private keys to create a certificate signing request (CSR) respectively. The CSR may include a public key and verification information. The verification information may include the organization name and geographic location, etc. After that, the target vehicle terminal and reverse proxy server send their corresponding CSRs to the Certificate Authority (CA). After the CA verifies the identity of the entity that the target vehicle terminal and reverse proxy server send their corresponding CSRs to, if the verification is successful, the CA signs the CSR and issues a certificate. After that, the target vehicle terminal and reverse proxy server can each install the corresponding certificate, which includes the public key certificate and the CA's root certificate.

[0036] (2) SSL configuration phase: Parameter configuration is performed during the handshake process between the target vehicle terminal and the reverse proxy server. The configured parameters may include: SSL protocol, encryption suite, key exchange algorithm, identity authentication, session parameters, and SSL parameters. Among them, the target vehicle terminal and the reverse proxy server have the same SSL protocol version, the same encryption suite, and the same key exchange algorithm to ensure the security of communication. After the parameter configuration, an encrypted channel can be established between the target vehicle terminal and the reverse proxy server.

[0037] After establishing an encrypted channel between the target vehicle terminal and the reverse proxy server, the reverse proxy server can receive the identity information corresponding to the target vehicle terminal through the encrypted channel, authenticate the identity information, and verify whether the target vehicle terminal corresponding to the identity information is legal. If it is legal, the target vehicle terminal is registered in the reverse proxy server, that is, the identity information corresponding to the target vehicle terminal is added in the reverse proxy server to facilitate subsequent matching according to external network requests. At the same time, the encrypted channel is determined as the target control channel between the reverse proxy server and the target vehicle terminal. If it is illegal, it indicates that the current registration is a malicious registration of an illegal vehicle terminal, and the connection with the illegal vehicle terminal can be disconnected.

[0038] Optionally, the encryption exchange algorithm between the reverse proxy server and the target vehicle-mounted terminal may include a Diffie-Hellen key exchange method or an IKE (Internet Key Exchange) protocol, etc., which is not limited in the embodiment of the present invention.

[0039] It should be noted that the identity information includes VIN (Vehicle Identification Number) and ICCID (Integrate circuit card identity). VIN is the vehicle number corresponding to the target vehicle terminal, and is the unique number of each vehicle when it leaves the factory. The VIN consists of 17 characters. The VIN may include information such as the manufacturer, production date, and production location of the vehicle. The ICCID is the SIM card number in the TBOX (Telematic BOX) module in the target vehicle terminal. The ICCID consists of 20 characters.

[0040] It should be noted that when authenticating the target vehicle-mounted terminal based on the identity information, VIN and ICCID can be used as authentication passwords for authentication.

[0041] Step 140: Based on the first data channel, receive an external network request sent by the target client.

[0042] Specifically, after the target client establishes a first data channel with the reverse proxy server, the reverse proxy server can receive an external network request sent by the target client through the first data channel. The external network request may include a remote login initiated by the target client in response to a user operation or a connection request to a target service inside the target vehicle terminal.

[0043] Step 150: Based on the second data channel, the external network request is sent to the target service associated with the external network request in the target vehicle terminal.

[0044] Specifically, after receiving the external network request sent by the target client, the reverse proxy server can determine the target vehicle terminal from multiple vehicle terminals deployed in the intranet according to the external network request, and send the external network request to the target service associated with the external network request in the target vehicle terminal through the second data channel between the target vehicle terminal. The target service can be the Web (World Wide Web, Global Wide Area Network) service and SSH (Secure Shell, Secure Shell Protocol) remote login service of the corresponding vehicle parts provided in response to the external network request in the target vehicle terminal, so as to realize the remote access and management of the vehicle parts in the intranet by the operation and maintenance personnel.

[0045] Further, based on the second data channel, the external network request is sent to a target service associated with the external network request in the target vehicle terminal, including: Determine the target service in the target vehicle terminal corresponding to the external network request; Based on the key exchange algorithm in SSL mode, external network requests are encrypted; Based on the second data channel, the encrypted external network request is sent to the target service in the target vehicle terminal.

[0046] Specifically, after receiving the external network request sent by the target client, the external network request can be parsed to determine the user needs corresponding to the target client, and then determine the target service of the target vehicle terminal that meets the user needs. For example, the user performs an input operation on the vehicle component A in the target vehicle terminal in the target client, and the input operation can be a read, query data, or add or delete parameter operation, etc. The target client generates an external network request to the target vehicle terminal according to the user's input operation, and the external network request includes the VIN corresponding to the target vehicle terminal and the identifier corresponding to the vehicle component A. By parsing the external network request, the corresponding target vehicle terminal can be determined from multiple vehicle terminals in the intranet according to the VIN, and the target service corresponding to the vehicle component A that the user needs to access can be determined from multiple vehicle components in the target vehicle terminal according to the identifier corresponding to the vehicle component A.

[0047] After parsing the target vehicle terminal and the target service corresponding to the target vehicle terminal, the key exchange algorithm configured in the SSL method can be used to encrypt the external network request, and according to the target control channel between the target vehicle terminal and the reverse proxy server, the encrypted external network request is sent to the target service in the target vehicle terminal to achieve remote access to the target service. Moreover, due to the separation of the second data channel and the target control channel during the access process, the security of the access process can be improved.

[0048] Furthermore, the method further comprises: When the reverse proxy server is indirectly connected to the target client via a load balancer, the target request corresponding to the target client forwarded by the load balancer is received.

[0049] Specifically, if the reverse proxy server and the target client are indirectly connected, that is, when the target client is indirectly connected to the reverse proxy server through a load balancer, the reverse proxy server needs to monitor the user needs of each client through the load balancer. That is, when the target client sends a target request to the reverse proxy server, it must first send the target request to the load balancer, and then the load balancer forwards it to the corresponding reverse proxy server. It should be noted that the target request includes an access request and an external network request.

[0050] Further, receiving a target request corresponding to a target client forwarded by the load balancer includes: When receiving an access request corresponding to a target client forwarded by the load balancer, sending a dynamic port allocated for the target client to the load balancer, and establishing a third data channel between the reverse proxy server and the load balancer based on the dynamic port; Based on the third data channel, an external network request sent by the target client and forwarded by the load balancer is received.

[0051] Specifically, when there is a load balancer between the reverse proxy server and the target client, the interaction process between the reverse proxy server, the load balancer and the target client is as follows: (1) The target client sends an access request to the load balancer, and the load balancer forwards the access request to the reverse proxy server.

[0052] (2) The reverse proxy server verifies the legitimacy of the target client based on the access request. If the target client is verified to be legitimate, it allocates the dynamic port corresponding to the current access request to the target client and sends the dynamic port to the load balancer.

[0053] (3) The load balancer forwards the assigned dynamic port to the target client. When the load balancer receives the external network request sent by the target client, the load balancer establishes a third data channel between the load balancer and the reverse proxy server through the dynamic port to achieve a secure connection between the load balancer and the reverse proxy server. After that, the load balancer sends the external network request to the reverse proxy server through the third data channel.

[0054] The vehicle terminal access method provided by the embodiment of the present invention, when the reverse proxy server receives the access request corresponding to the target client, allocates the dynamic port corresponding to the current access request, sends the dynamic port to the target client, and sends the dynamic port to the target vehicle terminal through the target control channel between the reverse proxy server and the target vehicle terminal, instructs the target client to establish a first data channel between the target client and the reverse proxy server through the dynamic port, and instructs the target vehicle terminal to establish a second data channel between the reverse proxy server and the target vehicle terminal, and then receives the external network request sent by the target client through the first data channel, and sends the external network request to the target service associated with the external network request in the target vehicle terminal through the second data channel. The present invention dynamically allocates the corresponding dynamic port for the current access request, realizes the allocation of a dynamic port once for each connection, ensures the randomness of the first data channel and the second data channel, reduces the risk of the dynamic port being scanned and cracked, and at the same time, the first data channel and the second data channel are separated from the target control port, further improves the security of communication, and ensures the stability of system operation.

[0055] The vehicle-mounted terminal access device provided by the present invention is described below. The vehicle-mounted terminal access device described below and the vehicle-mounted terminal access method described above can be referenced to each other.

[0056] The embodiment of the present invention also provides a vehicle-mounted terminal access device, which is applied to any reverse proxy server. Figure 3 is a schematic diagram of the structure of the vehicle terminal access device provided by an embodiment of the present invention, such as Figure 3 As shown, the vehicle-mounted terminal access device 300 includes: a port allocation module 310 , a first sending module 320 , a second sending module 330 , a receiving module 340 and a third sending module 350 .

[0057] The port allocation module 310 is used to receive an access request corresponding to a target client and allocate a corresponding dynamic port to the current access request; A first sending module 320, configured to send the dynamic port to the target client and instruct the target client to establish a first data channel between the target client and the reverse proxy server; The second sending module 330 is used to send the dynamic port to the target vehicle terminal through the target control channel, and instruct the target vehicle terminal to establish a second data channel between the reverse proxy server and the target vehicle terminal; the target control channel is established after the target vehicle terminal successfully registers with the reverse proxy server based on the identity information of the target vehicle terminal; The receiving module 340 is used to receive an external network request sent by a target client based on the first data channel; The third sending module 350 is used to send the external network request to the target service associated with the external network request in the target vehicle terminal based on the second data channel.

[0058] The vehicle terminal access device provided by the embodiment of the present invention, when the reverse proxy server receives the access request corresponding to the target client, allocates the dynamic port corresponding to the current access request, sends the dynamic port to the target client, and sends the dynamic port to the target vehicle terminal through the target control channel between the reverse proxy server and the target vehicle terminal, instructs the target client to establish a first data channel between the target client and the reverse proxy server through the dynamic port, and instructs the target vehicle terminal to establish a second data channel between the reverse proxy server and the target vehicle terminal, and then receives the external network request sent by the target client through the first data channel, and sends the external network request to the target service associated with the external network request in the target vehicle terminal through the second data channel. The present invention dynamically allocates the corresponding dynamic port for the current access request, realizes the allocation of a dynamic port for each connection, ensures the randomness of the first data channel and the second data channel, reduces the risk of the dynamic port being scanned and cracked, and at the same time, the first data channel and the second data channel are separated from the target control port, further improves the security of communication, and ensures the stability of system operation.

[0059] Optionally, the third sending module 350 is specifically configured to: Determine the target service in the target vehicle terminal corresponding to the external network request; Based on the key exchange algorithm in SSL mode, external network requests are encrypted; Based on the second data channel, the encrypted external network request is sent to the target service in the target vehicle terminal.

[0060] Optionally, the vehicle-mounted terminal access device 300 further includes an establishment module, the establishment module being specifically used for: Receiving identity information between the target vehicle terminal based on an encrypted channel between the reverse proxy server and the target vehicle terminal; After the identity information is authenticated, the encrypted channel is determined as the target control channel.

[0061] Optionally, the identity information includes VIN and ICCID, VIN is the vehicle number corresponding to the target vehicle terminal, and ICCID is the SIM card number in the TBOX module in the target vehicle terminal.

[0062] Optionally, the vehicle-mounted terminal access device 300 further includes a forwarding module, which is specifically used to: When the reverse proxy server is indirectly connected to the target client via a load balancer, the target request corresponding to the target client forwarded by the load balancer is received.

[0063] Optionally, the target request includes an access request and an external network request.

[0064] Optionally, the forwarding module is specifically used to: When receiving an access request corresponding to a target client forwarded by the load balancer, sending a dynamic port allocated for the target client to the load balancer, and establishing a third data channel between the reverse proxy server and the load balancer based on the dynamic port; Based on the third data channel, an external network request sent by the target client and forwarded by the load balancer is received.

[0065] Figure 4 Schematic diagram of the structure of the reverse proxy server provided by the embodiment of the present invention. Figure 4 As shown, the reverse proxy server may include: a processor 410, a communications interface 420, a memory 430 and a communication bus 440, wherein the processor 410, the communications interface 420 and the memory 430 communicate with each other through the communication bus 440. The processor 410 may call the logic instructions in the memory 430 to execute the vehicle terminal access method, which includes: Receive the access request corresponding to the target client and allocate the corresponding dynamic port for the current access request; Sending the dynamic port to the target client and instructing the target client to establish a first data channel between the target client and the reverse proxy server; Sending the dynamic port to the target vehicle terminal through the target control channel, and instructing the target vehicle terminal to establish a second data channel between the reverse proxy server and the target vehicle terminal; the target control channel is established after the target vehicle terminal successfully registers with the reverse proxy server based on the identity information of the target vehicle terminal; Based on the first data channel, receiving an external network request sent by a target client; Based on the second data channel, the external network request is sent to the target service associated with the external network request in the target vehicle terminal.

[0066] In addition, the logic instructions in the above-mentioned memory 430 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods of various embodiments of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0067] On the other hand, the present invention further provides a computer program product, the computer program product includes a computer program, the computer program can be stored in a non-transitory computer-readable storage medium, when the computer program is executed by a processor, the computer can execute the vehicle terminal access method provided by the above methods, the method includes: Receive the access request corresponding to the target client and allocate the corresponding dynamic port for the current access request; Sending the dynamic port to the target client and instructing the target client to establish a first data channel between the target client and the reverse proxy server; Sending the dynamic port to the target vehicle terminal through the target control channel, and instructing the target vehicle terminal to establish a second data channel between the reverse proxy server and the target vehicle terminal; the target control channel is established after the target vehicle terminal successfully registers with the reverse proxy server based on the identity information of the target vehicle terminal; Based on the first data channel, receiving an external network request sent by a target client; Based on the second data channel, the external network request is sent to the target service associated with the external network request in the target vehicle terminal.

[0068] In another aspect, the present invention further provides a non-transitory computer-readable storage medium having a computer program stored thereon, which is implemented when the computer program is executed by a processor to execute the vehicle terminal access method provided by the above methods, the method comprising: Receive the access request corresponding to the target client and allocate the corresponding dynamic port for the current access request; Sending the dynamic port to the target client and instructing the target client to establish a first data channel between the target client and the reverse proxy server; Sending the dynamic port to the target vehicle terminal through the target control channel, and instructing the target vehicle terminal to establish a second data channel between the reverse proxy server and the target vehicle terminal; the target control channel is established after the target vehicle terminal successfully registers with the reverse proxy server based on the identity information of the target vehicle terminal; Based on the first data channel, receiving an external network request sent by a target client; Based on the second data channel, the external network request is sent to the target service associated with the external network request in the target vehicle terminal.

[0069] In addition, an embodiment of the present invention also provides a vehicle terminal access system. Figure 5 is a schematic diagram of the structure of the vehicle terminal access system provided by an embodiment of the present invention, such as Figure 5 As shown, the vehicle-mounted terminal access system includes at least one reverse proxy server, which is communicatively connected to at least one client, and a first data channel is established between each of the reverse proxy servers and the corresponding client; the at least one reverse proxy server is also communicatively connected to the corresponding vehicle-mounted terminal, and a control channel and a second data channel are respectively established between each of the reverse proxy servers and the corresponding vehicle-mounted terminal; each of the reverse proxy servers is used to execute the vehicle-mounted terminal access method as described in any of the above items.

[0070] It should be noted that as the number of vehicle terminals increases, the number of internal services of vehicle terminals that need to be proxied also increases. The computing power and network resources of a single reverse proxy server are insufficient to support it. Therefore, the number of reverse proxy servers in the vehicle terminal access system can be expanded according to the number of vehicle terminals. Each reverse proxy server is responsible for monitoring the user needs of some clients. All reverse proxy servers monitor the user needs of all clients.

[0071] In addition, the vehicle-mounted terminal access system also includes a load balancer, and at least one reverse proxy server and at least one client are both connected to the load balancer; The load balancer is used to determine a target reverse proxy server from at least one reverse proxy server when receiving an access request from a target client, and forward the access request to the target reverse proxy server; Receiving a dynamic port assigned by the target reverse proxy server, and establishing a third data channel between the load balancer and the target reverse proxy server based on the dynamic port; Based on the third data channel, the external network request sent by the target client is forwarded to the target reverse proxy server.

[0072] Specifically, when the number of reverse proxy servers needs to be expanded in the vehicle terminal access system, a load balancer can be set between each client and the existing reverse proxy server. The load balancer monitors the user needs of each client and forwards access needs, dynamic ports and external network needs between the target client and the reverse proxy server.

[0073] In addition, after expanding the new reverse proxy server, the load balancer can automatically detect the newly added reverse proxy server, and after receiving the client's access request, it can detect the load of each reverse proxy server and allocate tasks according to the load balancing mechanism, that is, forward the received client's access request to the idle reverse proxy server. During the expansion of the reverse proxy server, there is no need to reconstruct the entire system on a large scale, which facilitates expansion and meets the needs of business growth. Through load balancing control, the load of a single reverse proxy server can be avoided from being too high, and the network resources and computing power of each reverse proxy server can be fully utilized. When any reverse proxy server fails, the request can be automatically transferred, enhancing the reliability and system performance of the vehicle terminal access system.

[0074] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, i.e., they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Those of ordinary skill in the art may understand and implement it without creative effort.

[0075] Through the description of the above implementation modes, those skilled in the art can clearly understand that each implementation mode can be implemented by means of software plus a necessary general hardware platform, or of course by hardware. Based on such an understanding, the above technical solution can essentially or in other words be embodied in the form of a software product that contributes to the prior art. The computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a magnetic disk, an optical disk, etc., and includes a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods of each embodiment or some parts of the embodiment.

[0076] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A vehicle terminal access method, characterized in that: Applied to a reverse proxy server, the method comprises: Receive the access request corresponding to the target client and allocate the corresponding dynamic port for the current access request; Sending the dynamic port to the target client and instructing the target client to establish a first data channel between the target client and the reverse proxy server; Sending the dynamic port to the target vehicle terminal through the target control channel, and instructing the target vehicle terminal to establish a second data channel between the reverse proxy server and the target vehicle terminal; the target control channel is established after the target vehicle terminal successfully registers with the reverse proxy server based on the identity information of the target vehicle terminal; Based on the first data channel, receiving an external network request sent by the target client; Based on the second data channel, the external network request is sent to a target service associated with the external network request in the target vehicle-mounted terminal.

2. The vehicle terminal access method according to claim 1, characterized in that: The target control channel is established based on the following steps: Receiving identity information of the target vehicle terminal based on an encrypted channel between the reverse proxy server and the target vehicle terminal; After the identity information is authenticated, the encrypted channel is determined as the target control channel.

3. The vehicle terminal access method according to claim 2, characterized in that: The identity information includes VIN and ICCID, the VIN is the vehicle number corresponding to the target vehicle terminal, and the ICCID is the SIM card number in the TBOX module in the target vehicle terminal.

4. The vehicle terminal access method according to claim 2, characterized in that: The sending, based on the second data channel, the external network request to a target service associated with the external network request in the target vehicle terminal includes: Determine a target service in the target vehicle-mounted terminal corresponding to the external network request; Encrypting the external network request based on the key exchange algorithm in the SSL mode; Based on the second data channel, the encrypted external network request is sent to the target service in the target vehicle terminal.

5. The vehicle-mounted terminal access method according to any one of claims 1 to 4, characterized in that: The method further comprises: In the case where the reverse proxy server is indirectly connected to the target client via a load balancer, a target request corresponding to the target client forwarded by the load balancer is received.

6. The vehicle terminal access method according to claim 5, characterized in that: The target request includes an access request and an external network request; The receiving a target request corresponding to the target client forwarded by the load balancer includes: Upon receiving an access request corresponding to a target client forwarded by the load balancer, sending a dynamic port allocated for the target client to the load balancer, and establishing a third data channel between the reverse proxy server and the load balancer based on the dynamic port; Based on the third data channel, an external network request sent by the target client and forwarded by the load balancer is received.

7. A vehicle-mounted terminal access device, characterized in that: Applied to any reverse proxy server, the device comprises: The port allocation module is used to receive the access request corresponding to the target client and allocate the corresponding dynamic port for the current access request; A first sending module, used for sending the dynamic port to the target client, and instructing the target client to establish a first data channel between the target client and the reverse proxy server; A second sending module is used to send the dynamic port to the target vehicle terminal through the target control channel, and instruct the target vehicle terminal to establish a second data channel between the reverse proxy server and the target vehicle terminal; the target control channel is established after the target vehicle terminal successfully registers with the reverse proxy server based on the identity information of the target vehicle terminal; A receiving module, configured to receive, based on the first data channel, an external network request sent by the target client; The third sending module is used to send the external network request to the target service associated with the external network request in the target vehicle terminal based on the second data channel.

8. A vehicle-mounted terminal access system, characterized in that: It includes at least one reverse proxy server, which is communicatively connected to at least one client, and a first data channel is established between each reverse proxy server and the corresponding client; the at least one reverse proxy server is also communicatively connected to the corresponding vehicle-mounted terminal, and a control channel and a second data channel are respectively established between each reverse proxy server and the corresponding vehicle-mounted terminal; each reverse proxy server is used to execute the vehicle-mounted terminal access method as described in any one of claims 1-6.

9. The vehicle-mounted terminal access system according to claim 8, characterized in that: Also comprising a load balancer, the at least one reverse proxy server and the at least one client are both connected to the load balancer; The load balancer is used to determine a target reverse proxy server from the at least one reverse proxy server when receiving an access request from a target client, and forward the access request to the target reverse proxy server; Receiving a dynamic port allocated by the target reverse proxy server, and establishing a third data channel between the load balancer and the target reverse proxy server based on the dynamic port; Based on the third data channel, the external network request sent by the target client is forwarded to the target reverse proxy server.

Images