Cloud certificate management system for dynamically replacing certificates for remote OBU equipment

Abstract

The invention provides a cloud certificate management system for dynamically replacing a certificate for remote OBU equipment. The cloud certificate management system comprises an authentication registration module, a certificate management module, a communication module, a storage module and a log and monitoring module, the authentication registration module is responsible for registering and authorizing vehicle OBU equipment and an authentication authorization center, and generating certificate application information for the OBU equipment; the certificate management module is used for generating, storing, distributing and managing certificates of vehicle OBU equipment; the certificate comprises a national cryptographic algorithm certificate and an RSA algorithm certificate; the communication module is used for supporting secure communication of a national cryptographic algorithm certificate and an RSA algorithm certificate; the storage module is used for storing the certificate generated by the certificate management module, and the log and monitoring module is used for recording and monitoring the updating and using process of the certificate; the vehicle OBU equipment initiates a certificate application request after registering and obtaining authorization of the authentication and authorization center.

Description

Technical Field

[0001] The present invention belongs to the field of cloud certificate management, and in particular relates to a cloud certificate management system for dynamically replacing certificates for remote OBU devices. Background Art

[0002] At present, in the context of the development of intelligent transportation and vehicle-to-everything (V2X) technology, on-board devices such as OBU (On-Board Unit) play a key role in data communication between vehicles and infrastructure. In order to ensure the security and reliability of these communications, OBU devices need to regularly update and replace their certificates to prevent data tampering and identity forgery. With the continuous evolution of network environments and attack methods, traditional certificate management methods have gradually revealed their limitations, and there is an urgent need for a dynamic, cloud-based certificate management system to replace certificates for remote OBU devices. However, current certificate management technology still has significant defects in many aspects, which limits its effectiveness and security in practical applications.

[0003] Existing certificate management systems usually rely on manual operations and regular updates, which are particularly unsuitable in a rapidly changing network environment. Manual updates are not only inefficient, but also easily lead to certificate expiration or failure to update in a timely manner, increasing security risks. In addition, traditional methods cannot achieve effective batch management when facing large-scale OBU devices, resulting in high management costs and difficulty in meeting the requirements of modern intelligent transportation systems for flexibility and efficiency. Secondly, current certificate management technology is insufficient in terms of security. Many systems fail to adopt sufficiently strong encryption measures during the storage and transmission of certificates, which may cause certificates to be stolen or tampered with by malicious attackers. This security risk is particularly prominent in the Internet of Vehicles environment. Once an attacker successfully obtains or forges a certificate, it will pose a serious threat to the security and stability of the entire transportation system.

[0004] The existing certificate management system is also insufficient in terms of dynamics and real-time performance. In modern transportation systems, OBU equipment may be in different network environments at any time. How to identify the status of the equipment in real time and dynamically update the certificate has become a major challenge. Traditional systems often lack effective real-time monitoring and response mechanisms, resulting in the inability to quickly update certificates when equipment abnormalities occur, affecting the overall security and reliability of the system. At the same time, many existing systems need to be improved in terms of user-friendliness. Complex certificate management processes often require professional technicians to operate, and ordinary users or operators may face difficulties during use, affecting the popularization and application of the system. In addition, the current certificate management system is relatively weak in data analysis and feedback functions, lacks real-time monitoring and analysis of certificate usage, and cannot provide managers with effective data support, resulting in a lack of basis for certificate updates and management decisions.

[0005] Existing certificate management technologies also have deficiencies in scalability. With the rapid development of Internet of Vehicles technology, the number of OBU devices continues to increase. Existing systems often find it difficult to maintain efficient management capabilities when faced with massive devices, limiting their effectiveness in large-scale applications. Therefore, in response to these shortcomings, there is an urgent need for a new type of dynamic cloud-based certificate management system that can achieve efficient and secure certificate updates and management, with real-time monitoring, data analysis, and a user-friendly operation interface to improve the security and reliability of OBU devices in intelligent transportation systems.

[0006] Therefore, there is an urgent need for a cloud-based certificate management system that can dynamically replace certificates for remote OBU devices. Summary of the invention

[0007] The present invention proposes a cloud-based certificate management system for dynamically replacing certificates for remote OBU devices, which solves the security and efficiency problems of dynamically replacing certificates for remote OBU devices, and ensures the rapid generation, storage and distribution of OBU device certificates through centralized management and secure communication.

[0008] The technical solution of the present invention is implemented as follows: a cloud-based certificate management system for dynamically replacing certificates for remote OBU devices, comprising an authentication registration module, a certificate management module, a communication module, a storage module and a log and monitoring module; the authentication registration module is responsible for registering and authorizing vehicle OBU devices and an authentication authorization center, and generating certificate application information for the OBU devices; the certificate management module is used to generate, store, distribute and manage certificates of vehicle OBU devices; the certificates include national secret algorithm certificates and RSA algorithm certificates; the communication module is used to support secure communication of national secret algorithm certificates and RSA algorithm certificates; the storage module is used to store certificates generated by the certificate management module, and the log and monitoring module is used to record and monitor the process of certificate update and use; after the vehicle OBU device is registered and authorized by the authentication authorization center, the certificate application request is initiated; after receiving the certificate application request, the cloud-based certificate management system of the vehicle OBU device generates a national secret algorithm certificate and an RSA algorithm certificate, and stores the certificates in the national secret SM authentication center database and the RSA authentication center database in the cloud respectively, the vehicle OBU device obtains the certificate through the authentication center database, and uses the certificate in the national secret SM authentication center database or the RSA authentication center database through the communication module for secure communication.

[0009] Compared with the existing technology, this cloud-based certificate management system has significant advantages in the flexibility of dynamic certificate management. Traditional certificate management systems are often static and difficult to support dynamic certificate updates and management of remote devices. For vehicle OBU devices, with the changes in application scenarios and the increase in security requirements, dynamic replacement of certificates has become an inevitable requirement. This system realizes the real-time application, generation and update of OBU device certificates through the combination of authentication registration module, certificate management module and communication module, and can quickly respond to security requirements in different scenarios, which is relatively rare in the existing technology.

[0010] The system supports the generation and management of multiple algorithm certificates, including national encryption algorithm certificates and RSA algorithm certificates. This diverse certificate support enables the system to adapt to different security standards and requirements. Traditional systems are often limited to a single encryption algorithm and cannot meet the diverse needs of different regions and industries for certificates. By supporting both national encryption and RSA algorithms, this system can provide wider compatibility and flexibility worldwide, enhancing the applicability of the system.

[0011] The centralized management and monitoring functions of the system improve security and controllability. Through the log and monitoring module, the system can record and monitor the update and use of certificates in real time. This transparent management method allows users to review the validity and use of certificates at any time, reducing the security risks caused by certificate expiration or tampering. Traditional certificate management systems usually lack effective monitoring mechanisms, making it difficult to track and manage security risks, while this system provides a more complete monitoring solution.

[0012] The system supports secure certificate communication through the communication module to ensure data security when the OBU device interacts with the cloud for certificates. Traditional methods may have the risk of data leakage and tampering during certificate transmission, while this system ensures the integrity and confidentiality of certificates during transmission through a secure communication protocol. This security mechanism greatly improves the security of certificate management and ensures the safe operation of OBU devices in a dynamic environment.

[0013] The automation and centralized design of the system improves management efficiency. By automatically generating and distributing certificates, manual intervention and operational errors are reduced, improving overall work efficiency. The traditional certificate management process is usually cumbersome, involving multiple links and manual operations, which can easily cause time delays and errors. This system ensures the efficiency and accuracy of certificate management through automated processes, allowing OBU devices to quickly obtain the required certificates and adapt to dynamically changing environments.

[0014] As a preferred implementation, the authentication registration module is responsible for the registration and authorization of the vehicle OBU device and the authentication authorization center, as well as the generation and review of certificate application information; during the registration and authorization process, the vehicle OBU device and the authentication authorization center are registered with a unique ID, the authentication authorization center is registered and activated, and the vehicle OBU device is registered and activated.

[0015] As a preferred implementation, the communication module supports two different encryption algorithms, SM2 and RSA, and simultaneously provides automatic certificate switching function and dual database storage support, supporting multi-type protocol transmission; the automatic certificate switching function is operated through an adaptive switching module, which automatically manages the SM2 and RSA certificate libraries, automatically manages the usage status of the certificates, automatically checks the validity of the certificates, automatically updates the registration information, automatically re-requests to update the certificates, and automatically handles certificate verification failures.

[0016] As a preferred implementation, the log recording unit is responsible for recording all the processes of updating the vehicle OBU equipment certificate and the authentication authorization center authorization process, and the monitoring alarm unit verifies the validity of the updated certificate, confirms its legitimacy and issues an alarm if it is not legal.

[0017] As a preferred implementation, the communication module uses a two-way authentication method for communication, including using the SSL / TLS protocol for encrypted communication, certificate signature verification, and message encryption and decryption.

[0018] As a preferred implementation, the log and monitoring module records detailed operation logs for each certificate generation, distribution, update, and revocation, including operation time, device ID, and certificate type; the abnormal monitoring and alarm module can monitor various abnormal situations during the certificate update process, such as certificate distribution failure, device refusal to update, and trigger an alarm to notify the administrator of the abnormality.

[0019] As a preferred implementation, the log and monitoring module is built with a background server, and the background server obtains the remaining validity period and update time of the current certificate from the vehicle OBU device; the background server determines whether the current certificate needs to be updated based on the remaining validity period; if the current certificate needs to be updated, the new certificate is searched through the cloud storage and distributed to the device, and the update result is returned; if the current certificate does not need to be updated, the background server enters a dormant state and waits for the next update notification; if the current certificate needs to be updated and there is no new certificate in the cloud storage, the background server notifies the administrator to update the certificate to the cloud storage; after the vehicle OBU device receives the new certificate, it verifies and applies it; when the vehicle OBU device successfully applies it, the result of the successful update is fed back to the background server, and the background server sends a message of successful update; when the update fails in the cloud storage, the administrator notifies all devices to update the certificate; when the administrator uploads the new certificate to the cloud storage, the background server and the vehicle OBU device are notified to update.

[0020] After adopting the above technical solution, the beneficial effect of the present invention is that through dynamic certificate management and secure communication mechanism, the system can ensure that each OBU device always maintains a valid and secure certificate during use. This security guarantee is crucial for the safe operation of vehicle networking and intelligent transportation systems, and can effectively prevent security risks caused by certificate expiration or tampering.

[0021] The flexibility and adaptability of the system enable users in different regions and industries to choose the appropriate certificate type according to their needs. Supporting the diversity of national encryption algorithms and RSA algorithms, the system can be widely used in various application scenarios at home and abroad, improving market competitiveness. This adaptability not only enhances user trust, but also lays a good foundation for the promotion and application of the system. Through centralized management and monitoring, the system can track and record the use of certificates in real time, improving the transparency of management. This transparent management method enables users to understand the validity and usage status of certificates in a timely manner, reducing management risks. This monitoring function not only enhances users' sense of security, but also provides strong data support for subsequent security audits.

[0022] The automated design of the system reduces manual intervention and operational risks. By automatically generating and distributing certificates, the system can quickly respond to user needs and ensure that OBU devices obtain the required certificates in the shortest possible time. This efficient processing capability can quickly restore services in response to emergencies, improving the stability and reliability of the overall system. The implementation of the system will promote the development of intelligent transportation and the Internet of Vehicles. By providing a secure and reliable certificate management solution, the system can provide support for secure communications between vehicles and between vehicles and infrastructure. This secure communication guarantee will contribute to the efficient operation of intelligent transportation systems, improve traffic safety and efficiency, and ultimately promote the construction of smart cities.

[0023] This cloud-based certificate management system for dynamic certificate replacement of remote OBU devices provides an intelligent and reliable solution for the security of vehicle communications through innovative design and efficient management processes, significantly improves the system's adaptability and market competitiveness, and provides a solid foundation for the development of future intelligent transportation. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0025] Figure 1 It is a flow chart of the system of the present invention. DETAILED DESCRIPTION

[0026] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0027] Example like Figure 1 As shown in the figure, a cloud-based certificate management system that dynamically replaces certificates for remote OBU devices is designed to provide automated, periodic certificate update services for remote OBU devices through centralized management. The system supports two types of certificates: national encryption (SM series) and RSA, ensuring that the equipment has a secure communication environment under national encryption standards or international general standards. The system goal is to achieve safe, reliable, and efficient certificate management and reduce security risks caused by certificate expiration, leakage, or loss.

[0028] Certificate management module with dual algorithm support; this module is one of the core components, responsible for managing the national secret and RSA certificates in the system, including certificate generation, storage, distribution, update, revocation and other functions. Specifically includes the following functions: Certificate generation: supports the generation of certificates of SM2 and RSA algorithms, and the certificate type can be selected according to the security requirements of the OBU equipment. SM2 certificate: uses the SM2 algorithm to generate public and private key pairs and digital certificates that meet the national secret standards, mainly used in the domestic market and specific industry applications. RSA certificate: generates internationally accepted RSA public and private key pairs and digital certificates to meet the needs of global applications. Certificate pool management: The system provides centralized certificate pool management functions to store and manage all generated certificates. Through grouping and marking mechanisms, certificates of different algorithm types are distinguished, and efficient search and call are supported. Certificate validity monitoring: periodically checks the validity of each certificate, automatically triggers the update operation according to the validity period, and supports a regular rotation mechanism to ensure the communication security of the device when it is online for a long time.

[0029] Certificate distribution and communication module compatible with multiple algorithms; To ensure the communication security of different types of equipment, the system is designed to support the distribution and communication modules of national encryption and RSA certificates, and realize the remote distribution of certificates and secure communication of OBU equipment: Automatic distribution strategy: The system can automatically select and distribute certificates of the corresponding algorithm type according to the geographical location or national requirements of the OBU equipment. Encrypted transmission channel: Certificates are distributed and transmitted through the SSL / TLS protocol or other encrypted channels, supporting two-way authentication of SM2 and RSA certificates. During the transmission process, the system will automatically select the encryption algorithm to ensure that the certificate is not tampered with or intercepted. Certificate update notification: When the certificate is about to expire or needs to be replaced, the system will send an update notification to the OBU device and use the encrypted channel to complete the push of the new certificate. After the device accepts the new certificate, it will be applied to the subsequent communication process.

[0030] Automatic certificate update and switching module for OBU devices; this module supports automatic switching and application of OBU devices during the certificate update process, ensuring business continuity during the certificate update process; Certificate expiration detection: The OBU device periodically sends certificate status requests to the cloud, and the system automatically determines whether an update is required based on the validity period of the device's current certificate.

[0031] Seamless switching mechanism: The system ensures seamless switching between old and new certificates during the update process to avoid communication interruption. After the new certificate is distributed, the device completes verification and application, and feeds back to the cloud for confirmation.

[0032] Security assurance and log monitoring module: In order to improve the security and traceability of the system, a log monitoring module is designed to achieve real-time monitoring and recording of certificate operations: Operation log recording: The system records detailed operation logs for each certificate generation, distribution, update, and revocation, including operation time, device ID, certificate type, etc., to facilitate future audits and problem tracing. Abnormal monitoring and alarm: Monitor abnormal situations during the certificate update process, such as certificate distribution failure, device refusal to update, etc. The system will automatically trigger an alarm and notify the administrator to ensure that the problem is handled in a timely manner.

[0033] This technical solution involves a cloud-based certificate management system that dynamically replaces certificates for remote OBU (On-Board Unit) devices. Its design goal is to provide automated and periodic certificate update services through centralized management. The system supports two types of certificates: national encryption (SM series) and RSA, to ensure that the equipment has a secure communication environment under both national encryption standards and international general standards. The core of the system is to achieve safe, reliable and efficient certificate management, thereby reducing the security risks caused by certificate expiration, leakage or loss.

[0034] In the specific workflow, first of all, the system's dual-algorithm supported certificate management module is the core component responsible for managing the national secret and RSA certificates within the system. This module can perform functions such as certificate generation, storage, distribution, update and revocation. In the certificate generation stage, the system chooses to generate certificates with SM2 or RSA algorithms according to the security requirements of the OBU equipment. For the domestic market and specific industry applications, the system uses the SM2 algorithm to generate public and private key pairs and digital certificates that meet national secret standards; for international applications, it generates RSA public and private key pairs and digital certificates that meet international standards. All generated certificates will be centrally stored in the certificate pool. The system manages certificates of different algorithm types through grouping and tagging mechanisms, and supports efficient search and call.

[0035] In terms of certificate validity monitoring, the system will regularly check the validity of each certificate, automatically trigger the update operation according to the validity period, and support a regular rotation mechanism to ensure the communication security of the device when it is online for a long time. This process can effectively avoid communication interruptions and security risks caused by expired certificates.

[0036] The certificate distribution and multi-algorithm compatible communication module is an important part of the system. This module is designed to ensure the communication security of different types of equipment, and can realize remote certificate distribution and secure communication for OBU equipment. The system automatically selects and distributes certificates of the corresponding algorithm type according to the geographical location or national requirements of the OBU equipment. During the transmission of the certificate, the system encrypts the transmission through the SSL / TLS protocol or other encrypted channels, supports two-way authentication of SM2 and RSA certificates, and ensures that the certificate is not tampered with or intercepted during the transmission process.

[0037] When a certificate is about to expire or needs to be replaced, the system will automatically send an update notification to the OBU device and use an encrypted channel to push the new certificate. After receiving the new certificate, the OBU device will apply it to subsequent communication processes. The automatic certificate update and switching module of the OBU device supports automatic switching and application during the certificate update process to ensure business continuity during the certificate update process. The OBU device will periodically send certificate status requests to the cloud, and the system will automatically determine whether an update is required based on the validity period of the device's current certificate. During the update process, the system ensures seamless switching between the old and new certificates to avoid communication interruptions.

[0038] Finally, to improve the security and traceability of the system, the system has designed a log monitoring module to achieve real-time monitoring and recording of certificate operations. Detailed operation logs for each certificate generation, distribution, update, and revocation will be recorded, including operation time, device ID, and certificate type, etc., to facilitate subsequent audits and problem tracing. At the same time, the system will also monitor abnormal situations during the certificate update process, such as certificate distribution failure, device refusal to update, etc., automatically trigger an alarm and notify the administrator to ensure that the problem is handled in a timely manner.

[0039] In an actual work scenario, assume that the OBU devices in a city's public transportation system need to update their certificates regularly to maintain secure communications. First, the system detects that the certificates of some OBU devices are about to expire through the automated certificate management module, and sends certificate update notifications to these devices. After receiving the notification, the OBU device requests the status of the current certificate from the cloud and confirms that an update is required. The system selects the appropriate certificate type based on the device's geographic location and current security requirements, generates a new SM2 or RSA certificate, and sends the new certificate to the OBU device through an encrypted channel.

[0040] After the OBU device receives the new certificate, the system will ensure seamless switching between the old and new certificates to avoid communication interruptions during the update process. The device will verify the validity of the new certificate and apply it to subsequent communications after confirmation. During this process, all operations will be recorded in the log monitoring module to ensure traceability. At the same time, the system will continue to monitor the validity of the certificate and the status of the device, and make timely adjustments and maintenance to ensure the security and efficiency of the entire certificate management process.

[0041] Through this centralized cloud-based certificate management system, OBU devices in the public transportation system can achieve automatic and periodic certificate updates, ensuring secure communication of devices under national and international standards, greatly improving the security and reliability of the system.

[0042] The authentication registration module is responsible for the registration and authorization of the vehicle OBU equipment and the authentication and authorization center, as well as the generation and review of certificate application information; during the registration and authorization process, the vehicle OBU equipment and the authentication and authorization center are registered with a unique ID, the authentication and authorization center is registered and activated, and the vehicle OBU equipment is registered and activated.

[0043] The authentication registration module is responsible for the registration and authorization of the vehicle OBU (On-Board Unit) equipment and the authentication authorization center, as well as the generation and review of the certificate application information. The design of this module has significant differences and advantages compared with the prior art. First, in the prior art, the registration and authorization of the vehicle OBU equipment and the authentication authorization center are often independent processes, lacking a unified management and monitoring mechanism, which easily leads to redundancy and inconsistency of registration information. However, this solution uses a centralized management method to register the unique ID of the vehicle OBU equipment and the authentication authorization center, ensuring that each device and center has a unique identifier, avoiding the problem of information duplication and conflict. In addition, the registration and activation process of the authentication authorization center is also included in the unified management in this solution, which is in sharp contrast to the decentralized management of the prior art, effectively improving the security and reliability of the system. Through this centralized registration and authorization mechanism, the whole process becomes more efficient, can quickly respond to the needs of the vehicle OBU equipment and the authentication center, and ensure flexibility and adaptability in a dynamic environment.

[0044] The communication module supports two different encryption algorithms, SM2 and RSA, and provides automatic certificate switching function and dual database storage support, supporting multi-type protocol transmission; the automatic certificate switching function is operated by an adaptive switching module, which automatically manages the SM2 and RSA certificate libraries, automatically manages the usage status of certificates, automatically checks the validity of certificates, automatically updates registration information, automatically re-requests to update certificates, and automatically handles certificate verification failures. In the design of the communication module, this solution supports two different encryption algorithms, SM2 and RSA, and provides automatic certificate switching function and dual database storage support, which is not common in the prior art. In the prior art, usually only a single encryption algorithm is supported, lacking adaptability to different security requirements. The dual algorithm support of this solution enables the system to flexibly select the appropriate encryption method according to actual needs to ensure the security of communication. The automatic certificate switching function is operated by an adaptive switching module, which can automatically manage the SM2 and RSA certificate libraries, check the validity of certificates in real time and update registration information. This automated management design is in sharp contrast to the common manual management mode in the prior art, which is often prone to certificate expiration or invalidation due to human factors. Through automated certificate management, this solution improves the security and stability of the system and ensures reliability in a variety of communication environments.

[0045] The log recording unit is responsible for recording all the processes of updating the vehicle OBU equipment certificate and the process of authorization by the certification authority center, and the monitoring and alarm unit verifies the validity of the updated certificate, confirms its legitimacy and alarms when it is illegal. In the design of the log recording unit, this solution is responsible for recording all the processes of updating the vehicle OBU equipment certificate and the process of authorization by the certification authority center. Compared with the prior art, the introduction of this function enhances the traceability and transparency of the system. In the prior art, the operation records of the certificate are often not detailed enough, and it is difficult to trace the root cause of the problem. However, this solution records the operation logs of each certificate generation, distribution, update and revocation in detail, including information such as operation time, device ID, certificate type, etc., which is convenient for future audits and problem tracing. In addition, the monitoring and alarm unit can verify the validity of the updated certificate in real time, ensure its legitimacy, and automatically trigger an alarm when it is found to be illegal. This mechanism significantly improves the security of the system, so that abnormal situations can be discovered and handled in time, avoiding potential safety hazards.

[0046] The communication module uses a two-way authentication method to communicate, including encrypted communication using the SSL / TLS protocol, certificate signature verification, and message encryption and decryption. In this application document, the communication module communicates through a two-way authentication method and uses the SSL / TLS protocol to achieve encrypted communication, thereby ensuring the security and integrity of data transmission. In a specific implementation scenario, assume that we are deploying an intelligent transportation system, which involves communication between the OBU (On-Board Unit) devices of multiple vehicles and a central server. First, when the vehicle OBU device starts and tries to establish a connection with the central server, it will first authenticate its identity. Through two-way authentication, the OBU device and the server mutually verify each other's identity to ensure that only authenticated devices can communicate. This process uses the SSL / TLS protocol for data encryption to protect the communication content from man-in-the-middle attacks and data eavesdropping.

[0047] The log and monitoring module records the detailed operation log of each certificate generation, distribution, update, and revocation, including the operation time, device ID, and certificate type; the abnormal monitoring and alarm module can monitor various abnormal situations in the certificate update process, such as certificate distribution failure, device refusal to update, and trigger an alarm to notify the administrator of the abnormality. After establishing a secure channel, the OBU device will send a request to the server to obtain the status and validity information of its current certificate. After receiving the request, the server first checks the identity information of the device and confirms its validity, and then returns the remaining validity period and update time of the certificate in an encrypted manner. If it is found that the certificate is about to expire, the OBU device will request the server to update the certificate. The server determines whether the current certificate needs to be updated based on internal policies, and retrieves a new certificate from cloud storage when necessary.

[0048] At the same time, the system's log and monitoring module plays an important role. Whenever a certificate is generated, distributed, updated, or revoked, the module records detailed operation logs, including operation time, device ID, and certificate type. This logging not only helps with subsequent audits and compliance checks, but also provides basic data for abnormal monitoring. The abnormal monitoring and alarm module monitors the entire certificate update process, automatically identifies abnormal situations such as certificate distribution failure or device refusal to update, and immediately triggers an alarm when an abnormality occurs, notifying the system administrator in a timely manner.

[0049] The log and monitoring module is built with a background server, and the background server obtains the remaining validity period and update time of the current certificate from the vehicle OBU device; the background server determines whether the current certificate needs to be updated according to the remaining validity period; if the current certificate needs to be updated, the new certificate is searched through the cloud storage and distributed to the device, and the update result is returned; if the current certificate does not need to be updated, the background server enters a dormant state and waits for the next update notification; if the current certificate needs to be updated and there is no new certificate in the cloud storage, the background server notifies the administrator to update the certificate to the cloud storage; after the vehicle OBU device receives the new certificate, it verifies and applies it; when the vehicle OBU device successfully applies it, the result of the successful update is fed back to the background server, and the background server sends a message of successful update; when the update fails in the cloud storage, the administrator notifies all devices to update the certificate; when the administrator uploads the new certificate to the cloud storage, the background server and the vehicle OBU device are notified to update.

[0050] When the backend server finds that the current certificate needs to be updated, it queries the cloud storage to obtain the latest certificate. If there is a new certificate in the cloud storage, the server distributes it to the OBU device and returns the update result. After receiving the new certificate, the OBU device will verify it to ensure the validity and integrity of the certificate, and then apply the new certificate. If the certificate is applied successfully, the OBU device will feedback the result of the successful update to the backend server, and the server will record the log of the successful update and send a confirmation message.

[0051] However, if there is no new certificate in the cloud storage, the backend server will notify the administrator to update the certificate to the cloud storage. The administrator can upload the new certificate through the secure management interface to ensure that the certificates in the cloud storage are always kept up to date. After the upload is completed, the administrator will notify the backend server and all OBU devices to update.

[0052] Throughout the entire process, the backend server of the log and monitoring module is always in monitoring status. When the certificate update fails, the administrator will receive an alarm and take timely measures to notify all devices to manually update to ensure the security and stability of the system. Through such a workflow, the certificate management and communication process between the OBU devices and the central server of the entire intelligent transportation system is effectively guaranteed, ensuring the secure transmission of information and the normal operation of the equipment. The system's automated monitoring and management functions greatly reduce the need for manual intervention, improve operation and maintenance efficiency, and ensure the security and reliability of the intelligent transportation system.

[0053] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A cloud certificate management system for dynamically changing certificates for remote OBU devices, characterized in that: It includes an authentication registration module, a certificate management module, a communication module, a storage module and a log and monitoring module; the authentication registration module is responsible for registering and authorizing the vehicle OBU equipment and the authentication authorization center, and generating certificate application information for the OBU equipment; the certificate management module is used to generate, store, distribute and manage certificates of vehicle OBU equipment; the certificates include national secret algorithm certificates and RSA algorithm certificates; the communication module is used to support the secure communication of national secret algorithm certificates and RSA algorithm certificates; The storage module is used to store the certificates generated by the certificate management module, and the log and monitoring module is used to record and monitor the process of certificate update and use; After the vehicle OBU device is registered and authorized by the certification authority, it initiates a certificate application request; After receiving the certificate application request, the cloud-based certificate management system of the vehicle OBU device generates a national secret algorithm certificate and an RSA algorithm certificate, and stores the certificates in the national secret SM authentication center database and the RSA authentication center database in the cloud respectively. The vehicle OBU device obtains the certificate through the authentication center database, and uses the certificate in the national secret SM authentication center database or the RSA authentication center database for secure communication through the communication module.

2. A cloud-based certificate management system for dynamically changing certificates for remote OBU devices as claimed in claim 1, characterized in that: The authentication registration module is responsible for the registration and authorization of the vehicle OBU equipment and the authentication and authorization center, as well as the generation and review of certificate application information; during the registration and authorization process, the vehicle OBU equipment and the authentication and authorization center are registered with a unique ID, the authentication and authorization center is registered and activated, and the vehicle OBU equipment is registered and activated.

3. A cloud-based certificate management system for dynamically changing certificates for remote OBU devices as claimed in claim 1, characterized in that: The communication module supports two different encryption algorithms, SM2 and RSA, and provides automatic certificate switching function and dual database storage support, supporting multi-type protocol transmission; the automatic certificate switching function is operated through an adaptive switching module, which automatically manages the SM2 and RSA certificate libraries, automatically manages the usage status of certificates, automatically checks the validity of certificates, automatically updates registration information, automatically re-requests certificate updates, and automatically handles certificate verification failures.

4. A cloud-based certificate management system for dynamically changing certificates for remote OBU devices as claimed in claim 1, characterized in that: The log recording unit is responsible for recording all the processes of updating the vehicle OBU equipment certificate and the process of authorization by the certification authority center. The monitoring and alarm unit verifies the validity of the updated certificate, confirms its legitimacy and issues an alarm if it is not legal.

5. A cloud-based certificate management system for dynamically changing certificates for remote OBU devices as claimed in claim 1, characterized in that: The communication module uses a two-way authentication method to communicate, including using the SSL / TLS protocol for encrypted communication, certificate signature verification, and message encryption and decryption.

6. A cloud-based certificate management system for dynamically changing certificates for remote OBU devices as claimed in claim 1, characterized in that: The log and monitoring module records the detailed operation log of each certificate generation, distribution, update, and revocation, including the operation time, device ID, and certificate type; the abnormal monitoring and alarm module can monitor various abnormal situations in the certificate update process, such as certificate distribution failure, device refusal to update, and trigger an alarm to notify the administrator of the abnormality.

7. A cloud-based certificate management system for dynamically changing certificates for remote OBU devices as claimed in claim 1, characterized in that: The log and monitoring module is built with a backend server, which obtains the remaining validity period and update time of the current certificate from the vehicle OBU device; the backend server determines whether the current certificate needs to be updated according to the remaining validity period; if the current certificate needs to be updated, the new certificate is searched through the cloud storage and distributed to the device, and the update result is returned; if the current certificate does not need to be updated, the backend server enters a dormant state and waits for the next update notification; if the current certificate needs to be updated and there is no new certificate in the cloud storage, the backend server notifies the administrator to update the certificate to the cloud storage; After receiving the new certificate, the vehicle OBU device verifies and applies it; When the vehicle OBU device is successfully applied, the result of the successful update is fed back to the backend server, and the backend server sends a message of successful update; when the update fails in the cloud storage, the administrator notifies all devices to update the certificate; After the administrator uploads the new certificate to the cloud storage, the backend server and vehicle OBU devices are notified to update.

Images