Road terminal access method of road traffic network and related equipment

Abstract

The invention provides a road terminal access method of a road traffic network and related equipment. The method comprises the following steps: acquiring an access request from a road terminal, wherein the access request comprises attribute information of the road terminal; performing first identity authentication on the road terminal based on the access request; in response to the passing of the first identity authentication, sending a random challenge value and a second identity authentication request to the road terminal; receiving a ciphertext and a signature returned by the road terminal for the second identity authentication request; wherein the ciphertext is obtained based on the random challenge value, and the signature is obtained based on the ciphertext; performing second identity authentication based on the ciphertext and the signature; in response to the passing of the second identity authentication, evaluating the operating environment of the road terminal to obtain an evaluation result; and allowing the road terminal to access the road traffic network in response to the fact that the evaluation result meets a preset requirement.

Description

Technical Field

[0001] The present disclosure relates to the field of road communications, and in particular to a road terminal access method for a road traffic network and related equipment. Background Art

[0002] When a terminal device needs to access the road traffic network system, the terminal device and the access server need to perform identity authentication. When the access server verifies the identity authentication information of the terminal device, it allows the terminal device to access the system, thereby ensuring the legitimacy of the identity of the terminal device accessing the road traffic network. Since a large number of road traffic terminals are distributed outdoors and are easily stolen and invaded, the traditional authentication method only requires one authentication to be passed for permanent access, which reduces the security of terminal access to the road traffic network and cannot effectively prevent the risk of malicious attacks and illegal access. Summary of the invention

[0003] The present disclosure proposes a road terminal access method and related equipment for a road traffic network to solve the above-mentioned technical problems to a certain extent.

[0004] In a first aspect of the present disclosure, a road terminal access method for a road traffic network is provided, comprising: Acquire an access request from a road terminal, wherein the access request includes attribute information of the road terminal; Performing a first identity authentication on the road terminal based on the access request; In response to the first identity authentication being passed, sending a random challenge value and a second identity authentication request to the road terminal; Receiving the ciphertext and signature data returned from the road terminal in response to the second identity authentication request; wherein the ciphertext is obtained based on the random challenge value, and the signature data is obtained based on the ciphertext; Performing a second identity authentication based on the ciphertext and the signature data; In response to the second identity authentication being passed, evaluating the operating environment of the road terminal to obtain an evaluation result; In response to the evaluation result meeting the preset requirement, the road terminal is allowed to access the road traffic network.

[0005] In a second aspect of the present disclosure, a road terminal access device for a road traffic network is provided, comprising: An identification authentication module is used to: obtain an access request from a road terminal, the access request including attribute information of the road terminal; perform a first identity authentication on the road terminal based on the access request; in response to the first identity authentication being passed, send a random challenge value and a second identity authentication request to the road terminal; receive a ciphertext and a signature returned from the road terminal in response to the second identity authentication request; wherein the ciphertext is obtained based on the random challenge value, and the signature is obtained based on the ciphertext; and perform a second identity authentication based on the ciphertext and the signature; An operating environment security assessment module is used to: in response to the second identity authentication being passed, assess the operating environment of the road terminal to obtain an assessment result; and in response to the assessment result meeting a preset requirement, allow the road terminal to access the road traffic network.

[0006] In a third aspect of the present disclosure, an electronic device is provided, comprising one or more processors, a memory; and one or more programs, wherein the one or more programs are stored in the memory and executed by the one or more processors, and the programs include instructions for executing the method described in the first aspect.

[0007] According to a fourth aspect of the present disclosure, a non-volatile computer-readable storage medium containing a computer program is provided. When the computer program is executed by one or more processors, the processors execute the method described in the first aspect.

[0008] In a fifth aspect of the present disclosure, a computer program product is provided, comprising computer program instructions, which, when executed on a computer, enable the computer to execute the method described in the first aspect.

[0009] From the above description, it can be seen that the present disclosure provides a road terminal access method and related equipment for a road traffic network, a static authentication mechanism combining identity authentication and basic operating environment security assessment, and a method using a dynamic measurement mechanism of operating behavior during terminal operation, and provides a related system structure. Based on the identity authentication mechanism and the evaluation strategy of the terminal's basic operating environment, combined with the dynamic measurement mechanism of operating behavior, continuous trust evaluation is provided for the terminal, cryptographic technology is combined with anomaly detection, and the method of first authentication, then connection and dynamic evaluation is adopted to achieve safe and reliable access to road traffic terminals. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] In order to more clearly illustrate the technical solutions in the present disclosure or related technologies, the drawings required for use in the embodiments or related technical descriptions are briefly introduced below. Obviously, the drawings described below are only embodiments of the present disclosure. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0011] Figure 1 A schematic diagram of a road terminal access architecture of a road traffic network according to an embodiment of the present disclosure.

[0012] Figure 2 The figure is a schematic diagram of the hardware structure of an exemplary electronic device according to an embodiment of the present disclosure.

[0013] Figure 3 A schematic flow chart of a road terminal access method for a road traffic network according to an embodiment of the present disclosure.

[0014] Figure 4 A schematic diagram of a road terminal access device for a road traffic network according to an embodiment of the present disclosure. DETAILED DESCRIPTION

[0015] In order to make the objectives, technical solutions and advantages of the present disclosure more clearly understood, the present disclosure is further described in detail below in combination with specific embodiments and with reference to the accompanying drawings.

[0016] It should be noted that, unless otherwise defined, the technical terms or scientific terms used in the embodiments of the present disclosure should be understood by people with ordinary skills in the field to which the present disclosure belongs. The "first", "second" and similar words used in the embodiments of the present disclosure do not indicate any order, quantity or importance, but are only used to distinguish different components. "Including" or "comprising" and similar words mean that the elements or objects appearing before the word cover the elements or objects listed after the word and their equivalents, without excluding other elements or objects. "Connect" or "connected" and similar words are not limited to physical or mechanical connections, but can include electrical connections, whether direct or indirect. "Up", "down", "left", "right" and the like are only used to indicate relative positional relationships. When the absolute position of the described object changes, the relative positional relationship may also change accordingly.

[0017] It is understandable that before using the technical solutions disclosed in the embodiments of the present disclosure, the types, scope of use, usage scenarios, etc. of the personal information involved in the present disclosure should be informed to the user and the user's authorization should be obtained in an appropriate manner in accordance with relevant laws and regulations.

[0018] For example, in response to receiving an active request from a user, a prompt message is sent to the user to clearly prompt the user that the operation requested to be performed will require obtaining and using the user's personal information. Thus, the user can autonomously choose whether to provide personal information to software or hardware such as an electronic device, application, server, or storage medium that performs the operation of the technical solution of the present disclosure according to the prompt message.

[0019] It is understandable that the above notification and the process of obtaining user authorization are merely illustrative and do not constitute a limitation on the implementation of the present disclosure. Other methods that meet the relevant laws and regulations may also be applied to the implementation of the present disclosure.

[0020] Figure 1 A schematic diagram showing a road terminal access architecture of a road traffic network according to an embodiment of the present disclosure is shown. Figure 1 , the road terminal access architecture 100 of the road traffic network may include a server 110, a terminal 120, and a network 130 providing a communication link. The server 110 and the terminal 120 may be connected via a wired or wireless network 130. The server 110 may be an independent physical server, or a server cluster or distributed system consisting of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, security services, and CDN.

[0021] The terminal 120 may be implemented in hardware or software. For example, when the terminal 120 is implemented in hardware, it may be various electronic devices having a display screen and supporting page display, including but not limited to smart phones, tablet computers, e-book readers, laptop portable computers, and desktop computers, etc. When the terminal 120 device is implemented in software, it may be installed in the electronic devices listed above; it may be implemented as multiple software or software modules (such as software or software modules used to provide distributed services), or it may be implemented as a single software or software module, which is not specifically limited here.

[0022] It should be noted that the road terminal access method for the road traffic network provided in the embodiment of the present application can be executed by the terminal 120 or by the server 110. It should be understood that Figure 1 The number of terminals, networks and servers in the embodiment is only for illustration and is not intended to limit the number of terminals, networks and servers. Any number of terminals, networks and servers may be provided as required.

[0023] Figure 2 FIG. 2 shows a schematic diagram of the hardware structure of an exemplary electronic device 200 provided in an embodiment of the present disclosure. Figure 2As shown, the electronic device 200 may include: a processor 202, a memory 204, a network module 206, a peripheral interface 208 and a bus 210. The processor 202, the memory 204, the network module 206 and the peripheral interface 208 are connected to each other in communication within the electronic device 200 through the bus 210.

[0024] Processor 202 may be a central processing unit (CPU), a neural network processor (NPU), a microcontroller (MCU), a programmable logic device, a digital signal processor (DSP), an application specific integrated circuit (ASIC), or one or more integrated circuits. Processor 202 may be used to perform functions related to the technology described in this disclosure. In some embodiments, processor 202 may also include multiple processors integrated into a single logical component. For example, Figure 2 As shown, processor 202 may include a plurality of processors 202a, 202b, and 202c.

[0025] The memory 204 may be configured to store data (eg, instructions, computer code, etc.). Figure 2 As shown, the data stored in the memory 204 may include program instructions (for example, program instructions for implementing the road terminal access method of the road traffic network of the embodiment of the present disclosure) and data to be processed (for example, the memory may store configuration files of other modules, etc.). The processor 202 may also access the program instructions and data stored in the memory 204, and execute the program instructions to operate on the data to be processed. The memory 204 may include a volatile storage device or a non-volatile storage device. In some embodiments, the memory 204 may include a random access memory (RAM), a read-only memory (ROM), an optical disk, a magnetic disk, a hard disk, a solid-state drive (SSD), a flash memory, a memory stick, etc.

[0026] The network module 206 can be configured to provide the electronic device 200 with communication with other external devices via a network. The network can be any wired or wireless network capable of transmitting and receiving data. For example, the network can be a wired network, a local wireless network (e.g., Bluetooth, WiFi, near field communication (NFC), etc.), a cellular network, the Internet, or a combination thereof. It is understood that the type of network is not limited to the above specific examples. In some embodiments, the network module 206 can include any number of network interface controllers (NICs), radio frequency modules, transceivers, modems, routers, gateways, adapters, cellular network chips, etc., in any combination.

[0027] The peripheral interface 208 can be configured to connect the electronic device 200 to one or more peripheral devices to achieve information input and output. For example, the peripheral devices can include input devices such as a keyboard, a mouse, a touch pad, a touch screen, a microphone, and various sensors, and output devices such as a display, a speaker, a vibrator, and an indicator light.

[0028] The bus 210 may be configured to transmit information between various components of the electronic device 200 (e.g., the processor 202, the memory 204, the network module 206, and the peripheral interface 208), such as an internal bus (e.g., a processor-memory bus), an external bus (USB port, PCI-E bus), etc.

[0029] It should be noted that, although the architecture of the electronic device 200 only shows the processor 202, the memory 204, the network module 206, the peripheral interface 208 and the bus 210, in the specific implementation process, the architecture of the electronic device 200 may also include other components necessary for normal execution. In addition, it can be understood by those skilled in the art that the architecture of the electronic device 200 may also only include the components necessary for implementing the embodiments of the present disclosure, and does not necessarily include all the components shown in the figure.

[0030] With the rapid development of intelligent transportation systems, more and more terminal devices (such as roadside units, electric police checkpoints, etc.) need to be connected to the road traffic network. In addition, the terminal nodes are widely dispersed, the business scenarios are complex, and each terminal node may be scheduled for use. Large-scale ubiquitous heterogeneous terminals have become a security shortcoming. The access security and reliability of these terminal devices have become urgent problems to be solved. When a terminal device needs to access the road traffic network system, the terminal device and the access server need to perform identity authentication. When the access server verifies that the identity authentication information of the terminal device has passed, the terminal device is allowed to access the system, thereby ensuring the legitimacy of the identity of the terminal device accessing the road traffic network. Since a large number of road traffic terminals are distributed outdoors and are easily stolen and invaded, the traditional one-time authentication and permanent access method can no longer meet the requirements of the new Internet. In addition, the lack of static security assessment of the basic operating environment of the terminal and dynamic monitoring of behavior during operation cannot effectively prevent the risk of malicious attacks and illegal access. Therefore, how to improve the security and credibility of road traffic terminal access has become a technical problem that needs to be solved urgently.

[0031] In view of this, the embodiments of the present disclosure provide a road terminal access method and related equipment for a road traffic network, a static authentication mechanism combining identity authentication and basic operating environment security assessment, and a method using a dynamic measurement mechanism of operating behavior during terminal operation, and provide related system structures. Based on the identity authentication mechanism and the evaluation strategy of the terminal's basic operating environment, combined with the dynamic measurement mechanism of operating behavior, continuous trust evaluation is provided for the terminal, cryptographic technology is combined with anomaly detection, and the method of first authentication, then connection, and dynamic assessment is adopted to achieve secure and trusted access to road traffic terminals.

[0032] See also Figure 3 , Figure 3 A schematic flow chart of a road terminal access method for a road traffic network according to an embodiment of the present disclosure is shown. The road terminal access method for a road traffic network according to an embodiment of the present disclosure can be deployed on a terminal or a server. Figure 3 In the method 300 for accessing a road terminal to a road traffic network, the method 300 may further include the following steps.

[0033] In step S310, an access request from a road terminal is obtained, where the access request includes attribute information of the road terminal.

[0034] The terminal device sends an access request to the trusted access gateway, and the attribute information of the road terminal may include device identification, IP address, etc. The access request of the road terminal and its attribute information may be transmitted via the network through a specific communication protocol or data interface.

[0035] In some embodiments, method 300 may further include: Generate session keys, public parameters, signature master public key, and signature master private key.

[0036] In some embodiments, method 300 may further include: A corresponding terminal signature private key is generated based on the signature master private key and the device identification of the road terminal.

[0037] Specifically, the key generation center can use the national secret algorithm SM4 to generate the session key SessionKey and securely send it to the terminal device and the trusted access gateway. KGC uses the SM9 algorithm to generate the system public parameters and the signature master key pair (ks, Ppub-s), and secretly saves the signature master private key ks, and discloses the system public parameters and the signature master public key Ppub-s. KGC combines the master private key ks and the terminal identification ID to generate the terminal signature private key ds, and secretly sends it to the terminal device.

[0038] In step S320, a first identity authentication is performed on the road terminal based on the access request.

[0039] Among them, the first identity authentication can be to confirm whether the road terminal is registered and whether the network address is credible.

[0040] In some embodiments, performing a first identity authentication on the road terminal based on the access request includes: Verifying whether the device identification is registered and whether the network address is in a trusted network segment based on a comparison database; In response to the device identification having been registered and the network address being in a trusted network segment, it is determined that the first identity authentication has passed.

[0041] Specifically, after receiving the access request from the terminal device, the trusted access gateway verifies whether the terminal device is legitimate, whether the terminal device's ID is registered in the system, and whether the terminal device's IP address is in the network segment assigned by the trusted access gateway by comparing it with the database. If the terminal device's device ID exists in the database and the terminal device's IP address is also a legitimate network segment, an identity authentication request and a random challenge value are sent to the road terminal for further identity authentication; otherwise, the terminal device is illegitimate and access is denied.

[0042] In step S330, in response to the first identity authentication being successful, a random challenge value and a second identity authentication request are sent to the road terminal.

[0043] Among them, the road terminal first attempts to access the road traffic network and sends a first authentication request containing its basic identity information (such as device ID, serial number, etc.). After receiving the request, it can be compared with the pre-stored information to verify the validity of these identity information. Once the first authentication is passed, a random challenge value, such as a random number or a string of encrypted data, can be used to increase uncertainty in subsequent authentication steps to prevent replay attacks or other forms of fraud. This random challenge value is sent to the road terminal as part of the second authentication request. In addition to the random challenge value, the second authentication request may also contain other instructions or requirements, such as instructing the road terminal to use a specific encryption algorithm or hash function to process the challenge value.

[0044] In step S340, the ciphertext and signature data returned from the road terminal in response to the second identity authentication request are received; wherein the ciphertext is obtained based on the random challenge value, and the signature data is obtained based on the ciphertext.

[0045] Among them, after receiving the challenge value and the second authentication request, the road terminal processes it as required and returns the processed response. After receiving this response, the same algorithm or key (if it is symmetric encryption) can be used to verify the correctness of the response. If it is asymmetric encryption, the system may use the public key of the road terminal to verify the validity of the signature. If the second authentication response is successfully verified, the identity of the road terminal can be considered legitimate and allowed to access the system or perform subsequent operations. If the verification fails, the access request can be rejected and the relevant events can be recorded for subsequent analysis. Random challenge values ​​can ensure that the challenge value is truly random to prevent attackers from predicting or reusing previous challenge values. Use strong encryption algorithms and sufficiently long key lengths to increase the difficulty of cracking. Include a timestamp in the challenge value or response to prevent replay attacks. Through the two-authentication process, the identity of the road terminal can be more effectively verified and the overall security can be enhanced.

[0046] In some embodiments, the ciphertext is obtained based on the random challenge value, including: The road terminal generates a data packet based on the random challenge value, the device identification, the basic operating environment, the timestamp and the data packet size; The data packet is encrypted based on the session key to obtain the ciphertext.

[0047] Specifically, the terminal device generates a data packet M based on the random challenge value, device identification, basic operating environment (including IP address, protocol version, operating system, etc.), timestamp, data packet size, etc. The terminal device encrypts the data packet M using the key SessionKey sent by KCG to generate a ciphertext C, C=E(M,SessionKey), where E can be the encryption algorithm of SM4.

[0048] In some embodiments, the signature data is obtained based on the ciphertext, including: The road terminal signs the ciphertext based on the public parameters, the signature master public key, the ciphertext and the terminal signature private key to obtain the signature data.

[0049] Specifically, the terminal device uses the system parameter params, the signature master public key Ppub-s, the data C and the signature key ds to sign the data packet and generate a signature (h, S), (h, S) = Sign (C, params, Ppub-s, ds), where Sign is the SM9 signature algorithm. After the calculation is completed, the road terminal sends the ciphertext C and the signature (h, S) to the trusted access gateway.

[0050] In step S350, a second identity authentication is performed based on the ciphertext and the signature data.

[0051] In some embodiments, performing a second identity authentication based on the ciphertext and the signature data includes: Verify the signature data based on the public parameters, the signature master public key, the identifier, the device identification, and the ciphertext to obtain a verification result; In response to the verification result indicating successful verification, decrypting the ciphertext based on the session key to obtain a restored data packet; Extracting the random challenge recovery value and the device recovery identifier in the recovery data packet; comparing the random challenge recovery value with the random challenge value and whether the device recovery identifier is legal; In response to the random challenge recovery value being consistent with the random challenge value and the device recovery identifier being legal, the second identity authentication is passed.

[0052] Specifically, after the trusted access gateway receives the ciphertext C' and signature (h', S') of the terminal device, the trusted access gateway verifies the correctness of the signature using the system parameter params, the signature master public key Ppub-s, the identifier hid (the identifier can be selected and disclosed by the key generation center), the device identification ID, the message C' and its digital signature (h', S'): , where Verify is the signature verification algorithm of SM9. If the verification is successful (output is 1), the signature information of the terminal device is confirmed to be legal. The trusted access gateway uses SessionKey to decrypt the ciphertext C, restore the original data packet M', extract the random challenge value and device identification, and verify whether the random challenge value is consistent with the one sent before, to ensure that the terminal device responds to the current authentication request and prevent replay attacks. Confirm again that the device identification is legal and valid in the system to ensure that even if other steps are passed, the device that is finally connected is still a legally registered device. If the identity authentication is successful, a static security assessment is performed, otherwise the terminal device access is denied.

[0053] In step S360, in response to the second identity authentication being passed, the operating environment of the road terminal is evaluated to obtain an evaluation result.

[0054] In some embodiments, evaluating the operating environment of the road terminal to obtain an evaluation result includes: Determining an evaluation membership matrix based on the network address, protocol version and operating system information of the road terminal; wherein the protocol version includes protocol supportability and protocol security, and the operating system information includes version compliance and system security; The evaluation result is obtained based on the membership matrix and the weight matrix.

[0055] Specifically, the trusted access gateway parses the data packet M' and extracts the IP address, protocol version, operating system information and other data. The fuzzy comprehensive evaluation method (FCE) is used to evaluate the basic environment score. First, a comprehensive evaluation factor set is constructed. The factor set is a general set composed of various factors that affect the evaluation object. In this scheme, the factor set is a factor with a certain degree of fuzziness for evaluating the road terminal operating environment, denoted as U={IP address u1, protocol version u2 (protocol support u21, protocol security u22), operating system information u3 (version compliance u31, system security u32)}, and the weight parameters of each level of indicators are given. The first-level weight is denoted as W=[w1,w2,w3], the second-level weight is W2=[w21,w22], W3=[w31,w32], and the evaluation level set V={poor, poor, medium, good, good} is set to describe the evaluation results of each indicator. According to the extracted IP address, protocol version, and operating system information, the evaluation membership of each indicator R1, R2, and R3 is obtained, where R1 is the single factor evaluation vector corresponding to the IP address, and R2 and R3 are the secondary single factor evaluation matrices corresponding to the protocol version and operating system information. The membership matrix R=[R1, (W2*R2)T, (W3*R3)T] is calculated. The first-level indicator evaluation set B=W*R ​​is calculated, and the evaluation level with the largest value in B is taken as the comprehensive evaluation result. If the evaluation result is "good" or above, the safety assessment is passed and the road terminal equipment is allowed to access.

[0056] In step S370, in response to the evaluation result meeting the preset requirement, the road terminal is allowed to access the road traffic network.

[0057] In some embodiments, method 300 may further include: receiving a registration request from the road terminal, the registration request including a device identification of the road terminal; In response to the registration request, a registration result is returned to the road terminal.

[0058] Among them, the registration request is usually sent to the central system through a network (such as the Internet, a private network, etc.). The registration request may include the device identification of the road terminal, which may include a unique identifier of the device (such as a MAC address, a serial number, etc.), a device type, manufacturer information, an installation location, etc. After receiving the registration request, the key generation center (KGC) will first verify the identity information in the request. The verification process may include checking whether the device identifier is unique, whether the device type is within the permitted range, whether the manufacturer is trustworthy, etc. If the identity information does not meet the requirements, the key generation center (KGC) may reject the registration request. If the identity information is verified, the system will continue to process the registration request. For example, a new device record is created in the database, a unique device ID is assigned, and basic parameters of the device are configured (such as communication protocol, data format, etc.). After processing the registration request, the key generation center (KGC) may return the registration result to the road terminal. The registration result can be a simple status code or message indicating whether the registration is successful. If the registration is successful, the result may also include necessary information such as the device ID, key, and configuration parameters. If the registration fails, the result should include the reason for the failure or an error code so that the road terminal can troubleshoot or retry the registration.

[0059] Specifically, the method for a road terminal device to access a road traffic network may include steps such as registration, key generation, access request, basic verification, challenge authentication, data packet information generation, identity authentication, and security assessment. For example, a road terminal device may be registered. The road terminal device sends the identity information as registration information to the key generation center (KGC). KGC receives and processes the registration information, generates a session key SessionKey, and securely sends it to the terminal device and the trusted access gateway. At the same time, KGC generates a system public parameter and a signature master key pair, and secretly stores the signature master private key, and discloses the system public parameters and the signature master public key.

[0060] KGC can generate and distribute keys without explicit message transmission. Processing logic: KGC combines the master private key and the terminal identity to generate the terminal signature private key and sends it secretly to the terminal device.

[0061] The terminal device sends an access request to the trusted access gateway, which contains information such as device identification, IP address, etc. The trusted access gateway receives and processes the access request.

[0062] The trusted access gateway performs basic authentication (i.e., the first identity authentication) and initiates challenge authentication (i.e., the second identity authentication). The trusted access gateway verifies the legitimacy of the terminal device, the registration of the identification ID, and the allocation of the IP address. If the verification is successful, an identity authentication request and a random challenge value are initiated to the terminal device. No explicit message transmission (based on database verification) can be used.

[0063] The terminal device generates data packet M information, including random challenge value, device identification, basic operating environment (including IP address, protocol version, operating system, etc.), timestamp, data packet size, etc., and uses SessionKey to encrypt data M to generate ciphertext C and signature (h, S). The terminal device sends ciphertext C and signature (h, S) to the trusted access gateway.

[0064] The trusted access gateway receives the ciphertext C' and signature (h', S'), verifies the correctness of the signature, and uses the SessionKey to decrypt the ciphertext C to obtain the data packet M', and verifies the random challenge value and device identification.

[0065] Use the security assessment algorithm to conduct a security assessment on the basic operating environment. If the terminal device successfully passes the identity authentication and security assessment, it will be connected to the road traffic network system; otherwise, access will be denied.

[0066] Among them, the national secret algorithms SM4 and SM9 can be used for encryption and signing to ensure the security of communication and the integrity of data. It can be seen that the above-mentioned trusted access gateway passes a strict verification and evaluation process to ensure that the accessed terminal devices meet the security requirements.

[0067] In some embodiments, method 300 may further include: Acquire the first type of network traffic data and the second type of network traffic data of the road terminal within a target time period; Predicting the first type of traffic data of the target time period based on the trained first type of prediction model to obtain a first prediction sequence set; and predicting the second type of traffic data of the target time period based on the trained second type of prediction model to obtain a second prediction sequence set; wherein the first type of prediction model and the second type of prediction model are trained based on the historical first type of network traffic data and the historical second type of network traffic data, respectively; Obtain a first error based on the first prediction sequence set and the first type of network traffic data, and obtain a second error based on the second prediction sequence set and the second type of network traffic data; In response to the first error being greater than or equal to a first confidence threshold and / or the second error being greater than or equal to a second confidence threshold, determining that a traffic anomaly exists at the road terminal; wherein the first confidence threshold and the second confidence threshold are obtained based on the training of the first type of prediction model and the second type of prediction model, respectively; In response to traffic anomalies at the road terminal, denying the road terminal access to the road traffic network; and / or performing secondary authentication on the road terminal.

[0068] Specifically, the historical normal network traffic data of the terminal can be obtained, which is a feature vector of a specific dimension based on the statistics of the terminal traffic activity in the time slot. Before training with a neural network, the above data needs to be normalized. By normalizing the data, numerical problems can be avoided and the network can converge quickly. The statistical limit value method is a commonly used normalization method. The specific implementation is to find the maximum value Max and the minimum value Min in the sample data set to perform normalization, and scale the values ​​of each feature in the feature vector to the closed interval of [0,1]. The formula is: . The time dimension of the terminal is divided into two time dimensions: terminal request activity and daily activity. The first traffic data sequence under the time dimension of the terminal request activity is extracted, and the VAE-LSTM model is used for time series modeling to obtain the request prediction model and calculate the reconstruction error to obtain the first confidence threshold. The second traffic data sequence under the time dimension of the terminal daily activity is extracted, and the VAE-LSTM model is used for time series modeling to obtain the daily prediction model and calculate the reconstruction error to obtain the second confidence threshold. The VAE-LSTM model encodes the data sequence in the input time window using the VAE encoder to obtain a low-dimensional embedded sequence, and then inputs the embedded sequence into the LSTM model to obtain a predicted embedded sequence, which is then decoded by the VAE decoder to obtain a reconstructed window sequence.

[0069] Obtain the terminal network traffic data within the time period to be detected, and divide the terminal's time dimension into two time dimensions: terminal request activity and terminal daily activity. Tq={tq1,…,tqn} represents the time slot set of the terminal request activity, and Tr={tr1,…,trm} represents the time slot set of the terminal daily activity. The traffic data within the time dimension of the terminal request activity is predicted by the request-time prediction model to obtain the first prediction sequence set, and the traffic data within the time dimension of the terminal daily activity is predicted by the daily-time prediction model to obtain the second prediction sequence set. The prediction error is calculated using the prediction sequence and the actual traffic data using the Euclidean distance. The formula is: , the mean of the prediction error set of the first prediction sequence set is compared with the first confidence threshold, and the mean of the prediction error set of the second prediction sequence set is compared with the second confidence threshold. If it is greater than the confidence threshold, it indicates that there is a traffic anomaly.

[0070] According to the anomaly detection results, if there is traffic anomaly, the terminal is prohibited from accessing the road traffic network business system, and the terminal is required to initiate secondary authentication.

[0071] It can be seen that according to the method of the embodiment of the present disclosure, the static authentication mechanism combining identity authentication and basic operating environment security assessment, and the method of using a dynamic measurement mechanism of operating behavior during terminal operation can meet the security requirements of road traffic networks for road terminals. When the terminal accesses, a static security authentication module including identity authentication and basic operating environment security assessment is adopted to achieve secure access to the road traffic network terminal. Identity authentication based on identity can effectively ensure the legitimacy of massive ubiquitous heterogeneous terminal devices in the road traffic network and prevent illegal access to the equipment. Combined with the enhanced identity authentication based on the national secret algorithm challenge authentication and the basic operating environment assessment, it is ensured that only legal and environmentally stable terminal devices can access the system. At the same time, the evaluation strategy for the basic operating environment of the terminal can identify potential risks and confirm whether the software and hardware configuration of the terminal device is stable enough to support the expected applications and services.

[0072] After the terminal is connected, the dynamic measurement module of operation behavior is used to track the communication behavior and other operation behaviors of the terminal, collect terminal network traffic data, and combine with the deep learning model to detect whether there are abnormal activity patterns. Dynamic access control is implemented according to the abnormal detection results to prevent security problems caused by abnormal terminal operation. The abnormal detection method based on time series prediction is adopted to divide terminal activities into two time dimensions: request activities and daily activities. Prediction models are established to adapt to traffic changes in different scenarios, and dynamic access control is adopted. The authentication basis is based on the identity authentication mechanism and the evaluation strategy of the terminal's basic operating environment. The dynamic measurement mechanism of operation behavior is combined to provide continuous trust evaluation for the terminal. Cryptography technology is combined with abnormal detection. The method of authentication first, connection and dynamic evaluation is adopted to achieve safe and reliable access to road traffic terminals.

[0073] It should be noted that the method of the embodiment of the present disclosure can be performed by a single device, such as a computer or a server. The method of the present embodiment can also be applied in a distributed scenario and completed by multiple devices cooperating with each other. In the case of such a distributed scenario, one of the multiple devices can only perform one or more steps in the method of the embodiment of the present disclosure, and the multiple devices will interact with each other to complete the described method.

[0074] It should be noted that the above describes some embodiments of the present disclosure. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the above embodiments and still achieve the desired results. In addition, the processes depicted in the accompanying drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0075] Based on the same technical concept, corresponding to any of the above-mentioned embodiments and methods, the present disclosure also provides a road terminal access device for a road traffic network, see Figure 4 , a road terminal access device of the road traffic network, the device comprising: An identification authentication module is used to: obtain an access request from a road terminal, the access request including attribute information of the road terminal; perform a first identity authentication on the road terminal based on the access request; in response to the first identity authentication being passed, send a random challenge value and a second identity authentication request to the road terminal; receive a ciphertext and a signature returned from the road terminal in response to the second identity authentication request; wherein the ciphertext is obtained based on the random challenge value, and the signature is obtained based on the ciphertext; and perform a second identity authentication based on the ciphertext and the signature; An operating environment security assessment module is used to: in response to the second identity authentication being passed, assess the operating environment of the road terminal to obtain an assessment result; and in response to the assessment result meeting a preset requirement, allow the road terminal to access the road traffic network.

[0076] In some embodiments, the apparatus further comprises: The key generation center is used to generate session keys, public parameters, signature master public keys and signature master private keys; and to generate corresponding terminal signature private keys based on the signature master private key and the device identification of the road terminal.

[0077] In some embodiments, the apparatus further comprises: An abnormal behavior detection module is used to: obtain the first type of network traffic data and the second type of network traffic data of the road terminal within a target time period; Predicting the first type of traffic data of the target time period based on the trained first type of prediction model to obtain a first prediction sequence set; and predicting the second type of traffic data of the target time period based on the trained second type of prediction model to obtain a second prediction sequence set; wherein the first type of prediction model and the second type of prediction model are trained based on the historical first type of network traffic data and the historical second type of network traffic data, respectively; Obtain a first error based on the first prediction sequence set and the first type of network traffic data, and obtain a second error based on the second prediction sequence set and the second type of network traffic data; In response to the first error being greater than or equal to a first confidence threshold and / or the second error being greater than or equal to a second confidence threshold, it is determined that there is a traffic anomaly at the road terminal; wherein the first confidence threshold and the second confidence threshold are respectively obtained based on the training of the first type of prediction model and the second type of prediction model.

[0078] In some embodiments, the apparatus further comprises: The dynamic access control module is used to deny the road terminal access to the road traffic network in response to traffic anomalies at the road terminal; and / or to perform secondary authentication on the road terminal.

[0079] For the convenience of description, the above device is described by dividing it into various modules according to its functions. Of course, when implementing the present disclosure, the functions of each module can be implemented in the same or multiple software and / or hardware.

[0080] The device of the above embodiment is used to implement the road terminal access method of the corresponding road traffic network in any of the above embodiments, and has the beneficial effects of the corresponding method embodiment, which will not be repeated here.

[0081] Based on the same technical concept, corresponding to any of the above-mentioned embodiment methods, the present disclosure also provides a non-transitory computer-readable storage medium, wherein the non-transitory computer-readable storage medium stores computer instructions, and the computer instructions are used to enable the computer to execute the road terminal access method of the road traffic network as described in any of the above embodiments.

[0082] The computer-readable medium of this embodiment includes permanent and non-permanent, removable and non-removable media, and information storage can be implemented by any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, read-only compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, tape disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device.

[0083] The computer instructions stored in the storage medium of the above embodiment are used to enable the computer to execute the road terminal access method of the road traffic network as described in any of the above embodiments, and have the beneficial effects of the corresponding method embodiments, which will not be repeated here.

[0084] Those skilled in the art should understand that the discussion of any of the above embodiments is merely illustrative and is not intended to imply that the scope of the present disclosure (including the claims) is limited to these examples. Based on the concept of the present disclosure, the technical features in the above embodiments or different embodiments may be combined, the steps may be implemented in any order, and there are many other variations of the different aspects of the embodiments of the present disclosure as described above, which are not provided in detail for the sake of simplicity.

[0085] In addition, to simplify the description and discussion, and in order not to obscure the embodiments of the present disclosure, known power / ground connections to integrated circuit (IC) chips and other components may or may not be shown in the provided figures. In addition, devices may be shown in the form of block diagrams to avoid obscuring the embodiments of the present disclosure, and this also takes into account the fact that the details of the implementation of these block diagram devices are highly dependent on the platform on which the embodiments of the present disclosure are to be implemented (i.e., these details should be fully within the scope of understanding of those skilled in the art). Where specific details (e.g., circuits) are set forth to describe exemplary embodiments of the present disclosure, it is apparent to those skilled in the art that the embodiments of the present disclosure may be implemented without these specific details or with variations in these specific details. Therefore, these descriptions should be considered illustrative rather than restrictive.

[0086] Although the present disclosure has been described in conjunction with specific embodiments of the present disclosure, many alternatives, modifications and variations of these embodiments will be apparent to those skilled in the art from the foregoing description. For example, other memory architectures (e.g., dynamic RAM (DRAM)) may use the discussed embodiments.

[0087] The embodiments of the present disclosure are intended to cover all such substitutions, modifications and variations that fall within the broad scope of the appended claims. Therefore, any omissions, modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the embodiments of the present disclosure should be included in the scope of protection of the present disclosure.

Claims

1. A road terminal access method for a road traffic network, characterized in that: include: Acquire an access request from a road terminal, wherein the access request includes attribute information of the road terminal; Performing a first identity authentication on the road terminal based on the access request; In response to the first identity authentication being passed, sending a random challenge value and a second identity authentication request to the road terminal; Receiving the ciphertext and signature data returned from the road terminal in response to the second identity authentication request; wherein the ciphertext is obtained based on the random challenge value, and the signature data is obtained based on the ciphertext; Performing a second identity authentication based on the ciphertext and the signature data; In response to the second identity authentication being passed, evaluating the operating environment of the road terminal to obtain an evaluation result; In response to the evaluation result meeting the preset requirement, the road terminal is allowed to access the road traffic network.

2. The method according to claim 1, characterized in that The attribute information includes a device identifier and a network address; Then, based on the access request, the first identity authentication is performed on the road terminal, including: Verifying whether the device identification is registered and whether the network address is in a trusted network segment based on a comparison database; In response to the device identification having been registered and the network address being in a trusted network segment, it is determined that the first identity authentication has passed.

3. The method according to claim 2, characterized in that The ciphertext is obtained based on the random challenge value, including: The road terminal generates a data packet based on the random challenge value, the device identification, the basic operating environment, the timestamp and the data packet size; Encrypting the data packet based on the session key to obtain the ciphertext; The signature data is obtained based on the ciphertext, including: The road terminal signs the ciphertext based on the public parameters, the signature master public key, the ciphertext and the terminal signature private key to obtain the signature data.

4. The method according to claim 2, characterized in that: Performing a second identity authentication based on the ciphertext and the signature data includes: Verify the signature data based on the public parameters, the signature master public key, the identifier, the device identification, and the ciphertext to obtain a verification result; In response to the verification result indicating successful verification, decrypting the ciphertext based on the session key to obtain a restored data packet; Extracting the random challenge recovery value and the device recovery identifier in the recovery data packet; comparing the random challenge recovery value with the random challenge value and whether the device recovery identifier is legal; In response to the random challenge recovery value being consistent with the random challenge value and the device recovery identifier being legal, it is determined that the second identity authentication is passed.

5. The method according to claim 1, characterized in that The operating environment of the road terminal is evaluated to obtain an evaluation result, including: Determining an evaluation membership matrix based on the network address, protocol version and operating system information of the road terminal; wherein the protocol version includes protocol supportability and protocol security, and the operating system information includes version compliance and system security; The evaluation result is obtained based on the membership matrix and the weight matrix.

6. The method according to claim 1, characterized in that The method further comprises: Acquire the first type of network traffic data and the second type of network traffic data of the road terminal within a target time period; Predicting the first type of traffic data of the target time period based on the trained first type of prediction model to obtain a first prediction sequence set; and predicting the second type of traffic data of the target time period based on the trained second type of prediction model to obtain a second prediction sequence set; wherein the first type of prediction model and the second type of prediction model are trained based on the historical first type of network traffic data and the historical second type of network traffic data, respectively; Obtain a first error based on the first prediction sequence set and the first type of network traffic data, and obtain a second error based on the second prediction sequence set and the second type of network traffic data; In response to the first error being greater than or equal to a first confidence threshold and / or the second error being greater than or equal to a second confidence threshold, determining that a traffic anomaly exists at the road terminal; wherein the first confidence threshold and the second confidence threshold are obtained based on the training of the first type of prediction model and the second type of prediction model, respectively; In response to traffic anomalies at the road terminal, denying the road terminal access to the road traffic network; and / or performing secondary authentication on the road terminal.

7. The method according to claim 1, characterized in that The method further comprises: Generate session keys, public parameters, signature master public key and signature master private key; A corresponding terminal signature private key is generated based on the signature master private key and the device identification of the road terminal.

8. A road terminal access device for a road traffic network, characterized in that: include: The identification authentication module is used to: obtain an access request from a road terminal, wherein the access request includes attribute information of the road terminal; Performing a first identity authentication on the road terminal based on the access request; in response to the first identity authentication being successful, sending a random challenge value and a second identity authentication request to the road terminal; receiving a ciphertext and a signature returned from the road terminal in response to the second identity authentication request; wherein the ciphertext is obtained based on the random challenge value, and the signature is obtained based on the ciphertext; and performing a second identity authentication based on the ciphertext and the signature; An operating environment security assessment module is used to: in response to the second identity authentication being passed, assess the operating environment of the road terminal to obtain an assessment result; and in response to the assessment result meeting a preset requirement, allow the road terminal to access the road traffic network.

9. An electronic device, characterized in that: The method comprises a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the method according to any one of claims 1 to 7 is implemented.

10. A non-transitory computer-readable storage medium, characterized in that: The non-transitory computer-readable storage medium stores computer instructions, and the computer instructions are used to cause a computer to execute the method according to any one of claims 1 to 7.

Images