Tamper-proof autonomous driving data recording method, system, medium and product

Abstract

The present invention discloses a tamper-proof autonomous driving data recording method, system, medium, and product, comprising: obtaining a time-stamped data set and image during the activation period of the autonomous driving system at a preset fixed frequency; dividing the obtained data set and image each time according to a preset time period to obtain data sets and images for multiple preset time periods; packaging the data sets and images for the multiple preset time periods into multiple record files; calculating a composite hash value, time, and file sequence number for each record file; combining each record file and the corresponding composite hash value, time, and file sequence number into a plaintext; encrypting each plaintext according to a preset access control policy and a system public key to obtain a ciphertext corresponding to each plaintext; and storing the ciphertext. The present invention allows users to obtain only the plaintext content within their authority without being aware of it, effectively preventing the record files from being tampered with or deleted.

Description

Technical Field

[0001] The present invention relates to the field of autonomous driving data processing technology, and in particular to a tamper-proof autonomous driving data recording method, system, medium and product. Background Art

[0002] Autonomous vehicles rely on artificial intelligence, visual computing, radar, monitoring devices, and global positioning systems to work together to complete driving operations without a human driver. During the autonomous driving process, an autonomous driving data recording system is required to monitor and record the data of the autonomous vehicle's operation.

[0003] Automated driving data recording systems are crucial to the safety of autonomous vehicles. They provide detailed accident data after an accident, helping investigators understand the cause, determine liability, and optimize the design and algorithms of the automated driving system. Therefore, access permissions for automated driving data recording systems must be controlled to prevent modification or deletion of recorded data.

[0004] Currently, autonomous driving data recording systems mainly control the reading permissions of external data readers through authentication certificates or digital signatures, which cannot meet the anti-tampering and integrity verification requirements brought about by directly modifying the hard disk contents after the file storage hard disk is disassembled. Summary of the Invention

[0005] In order to solve the technical problems existing in the background technology, the present invention proposes a tamper-proof autonomous driving data recording method, system, medium and product.

[0006] In a first aspect, the present invention provides a tamper-proof autonomous driving data recording method, comprising:

[0007] Obtaining time-stamped datasets and images during the activation of the autonomous driving system at a preset fixed frequency;

[0008] Divide the data sets and images obtained each time into preset time periods to obtain data sets and images of multiple preset time periods;

[0009] Packing data sets and images of multiple preset time periods into multiple record files;

[0010] Calculate the composite hash value, time and file sequence number of each record file respectively;

[0011] Combine each record file and its corresponding composite hash value, time, and file serial number into a plaintext;

[0012] Encrypt each plaintext according to the preset access control policy and the system public key to obtain the ciphertext corresponding to each plaintext;

[0013] Store the ciphertext.

[0014] Preferably, after storing the ciphertext, the method further includes:

[0015] Receiving an access request from a user; wherein the access request includes a set of attributes of the user;

[0016] According to the user's access request, determine whether the user's attribute set meets the preset attribute set;

[0017] If not, it will directly return decryption failure;

[0018] If so, the user's access rights are determined based on the user's attribute set and access control policy;

[0019] Extracting, from the ciphertext, ciphertext fragments or ciphertext that matches the user's access rights according to the user's access rights;

[0020] The user's private key is called according to the user's attribute set, and the ciphertext fragment or ciphertext is decrypted using the user's private key to obtain a partial plaintext or plaintext that matches the user's attribute set.

[0021] Preferably, before encrypting each plaintext according to the preset access control policy and the system public key to obtain the ciphertext corresponding to each plaintext, the method further includes:

[0022] Obtain the master key and system public key pre-generated by the manufacturer according to the key policy attribute-based encryption algorithm and store them;

[0023] Defining a preset attribute set; wherein each attribute in the preset attribute set is represented by a unique identifier;

[0024] Constructing a preset access control policy; wherein the access control policy includes the access policy for external data readers, manufacturers, and regulators; wherein the access policy indicates the corresponding user's access rights to the data;

[0025] Generate and store each user's private key based on each user's attribute set, access policy, and master key.

[0026] Preferably, in the access control policy, the manufacturer can access the time and file serial number, but cannot access the record file and the composite hash value; the regulatory agency can access the record file, the composite hash value, the time and file serial number; and the external data reader can access the record file.

[0027] Preferably, when the user is a regulatory agency, after obtaining the partial plaintext or plaintext that matches the attribute set of the user, the method further includes:

[0028] Perform data integrity verification on part of the plaintext or plaintext.

[0029] Preferably, data integrity verification is performed on part of the plaintext or plaintext, specifically including:

[0030] Perform two hash operations on part of the plaintext or the plaintext record file to obtain a decrypted composite hash value;

[0031] Based on the decrypted composite hash value and the composite hash value, determine whether part of the plaintext or the plaintext has been tampered with;

[0032] If the decrypted composite hash value and the composite hash value are inconsistent, it is determined that part of the plaintext or the plaintext has been tampered with; if the decrypted composite hash value and the composite hash value are consistent, it is determined that part of the plaintext or the plaintext has not been tampered with;

[0033] When it is determined that the part of the plaintext or the plaintext has not been tampered with, determining whether the part of the plaintext or the plaintext has been deleted;

[0034] When the file sequence numbers of part of the plaintext or the plaintext are discontinuous, it is determined that the part of the plaintext or the plaintext has been deleted; when the file sequence numbers of part of the plaintext or the plaintext are continuous, it is determined that the part of the plaintext or the plaintext has not been deleted;

[0035] If it is determined that part of the plaintext or plaintext has not been deleted, determine whether the part of the plaintext or plaintext has been forged in a time attack;

[0036] When part of the plaintext or the file sequence number in the plaintext is out of order with the time, it is determined that part of the plaintext or the plaintext has a forged time attack;

[0037] When the file sequence number and time in the partial plaintext or the plaintext are not out of order, it is determined that the partial plaintext or the plaintext does not have a forged time attack;

[0038] When it is determined that the partial plaintext or plaintext does not have a forged time attack, the data integrity verification of the partial plaintext or plaintext passes.

[0039] Preferably, the composite hash value is obtained by calculating the hash values ​​twice.

[0040] Preferably, the calculation process of the composite hash value includes:

[0041] Use the SHA-256 algorithm to calculate the record file and obtain a 256-bit hash value;

[0042] The 256-bit hash value is then calculated using the RIPMED-160 cryptographic hash function to obtain a 160-bit hash value.

[0043] In a second aspect, the present invention further proposes a tamper-proof autonomous driving data recording system, comprising:

[0044] A data acquisition module, used to acquire data sets and images with timestamps during the activation of the autonomous driving system at a preset fixed frequency;

[0045] The data processing module is used to divide the data sets and images obtained each time into preset time periods to obtain data sets and images of multiple preset time periods; and to package the data sets and images of multiple preset time periods into multiple record files;

[0046] The hardware security module is used to calculate the composite hash value, time and file serial number of each record file respectively; combine each record file and the corresponding composite hash value, time and file serial number into a plaintext; encrypt each plaintext according to the preset access control policy and the system public key, obtain the ciphertext corresponding to each plaintext, and store the ciphertext.

[0047] Preferably, the hardware security module is also used to receive a user's access request; wherein the access request includes a user's attribute set; based on the user's access request, determine whether the user's attribute set meets a preset attribute set; if not, directly return a decryption failure; if so, determine the user's access rights based on the user's attribute set and the access control policy; based on the user's access rights, extract a ciphertext fragment or ciphertext that matches the user's access rights from the ciphertext; call the user's private key based on the user's attribute set, and use the user's private key to decrypt the ciphertext fragment or ciphertext to obtain a partial plaintext or plaintext that matches the user's attribute set.

[0048] In a third aspect, the present invention further proposes a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the tamper-proof autonomous driving data recording method as described in any one of the first aspects.

[0049] In a fourth aspect, the present invention further proposes a computer program product, comprising a computer program, which, when executed by a processor, implements the steps of the tamper-proof autonomous driving data recording method as described in any one of the first aspects.

[0050] During specific implementation, a data set and an image with a timestamp during the activation period of the autonomous driving system are obtained at a preset fixed frequency; the data set and images obtained each time are divided according to a preset time period to obtain data sets and images of multiple preset time periods; the data set and images of each preset time period are packaged into a record file, so that the data sets and images of multiple preset time periods can obtain multiple record files; the composite hash value, time and file serial number of each record file are calculated respectively; each record file and the corresponding composite hash value, time and file serial number are combined into a plaintext; each plaintext is encrypted according to the preset access control policy and the system public key to obtain the ciphertext corresponding to each plaintext.

[0051] In the present invention, the proposed tamper-proof autonomous driving data recording method, system, medium and product encrypt the recorded files, composite hash values, time and file serial numbers through CP-ABE (Cipher Policy Attribute Based Encryption), which can meet the decryption strategies of various types of users in the process of extracting files, and can only obtain the plaintext content within the scope of their own authority without the user's knowledge, effectively preventing the recorded files from being tampered with or deleted. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] Figure 1 A schematic flow chart of a tamper-proof autonomous driving data recording method according to an embodiment of the present invention.

[0053] Figure 2 A schematic diagram of the data reading process in the tamper-proof autonomous driving data recording method in one embodiment of the present invention.

[0054] Figure 3 A schematic diagram of a process for verifying the data integrity of a portion of plaintext or plaintext in a tamper-proof autonomous driving data recording method in one embodiment of the present invention. DETAILED DESCRIPTION

[0055] It should be noted that, in the absence of conflict, the embodiments and features of the embodiments of the present invention can be combined with each other. The present invention will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0056] First, as Figure 1 As shown, the present invention proposes a tamper-proof autonomous driving data recording method, comprising:

[0057] Obtaining time-stamped datasets and images during the activation of the autonomous driving system at a preset fixed frequency;

[0058] Divide the data sets and images obtained each time into preset time periods to obtain data sets and images of multiple preset time periods;

[0059] The data sets and images of each preset time period are packaged into a record file, so that the data sets and images of multiple preset time periods can obtain multiple record files;

[0060] Calculate the composite hash value, time and file sequence number of each record file respectively;

[0061] Combine each record file and the corresponding composite hash value, time and file serial number into a plaintext M;

[0062] Encrypt each plaintext M according to the preset access control policy and the system public key PK to obtain the ciphertext CT;

[0063] The ciphertext CT is stored.

[0064] During specific implementation, a data set and an image with a timestamp during the activation period of the autonomous driving system are obtained at a preset fixed frequency; the data set and images obtained each time are divided according to a preset time period to obtain data sets and images of multiple preset time periods; the data set and images of each preset time period are packaged into a record file, so that the data sets and images of multiple preset time periods can obtain multiple record files; the composite hash value, time and file serial number of each record file are calculated respectively; each record file and the corresponding composite hash value, time and file serial number are combined into a plaintext M; each plaintext M is encrypted according to the preset access control policy and the system public key PK to obtain a ciphertext CT.

[0065] The present invention encrypts record files, composite hash values, time and file serial numbers through CP-ABE (Cipher Policy Attribute Based Encryption), which can meet the decryption strategies of various types of users in the process of extracting files. Without the user's knowledge, the user can only obtain the plaintext content within the scope of his or her own authority, effectively preventing the record files from being tampered with or deleted.

[0066] In one embodiment, the preset time period is seconds, that is, each acquired data set and image is divided into seconds. The time of each record file is the time corresponding to the record file.

[0067] It should be understood that the file serial number is a strictly incremented value. After each power-on, the latest stored file serial number will be retrieved once as the basis for subsequent newly added file serial numbers to prevent the time from being forged through the time calibration service to overwrite or confuse recorded data.

[0068] In order to ensure that each user can only obtain the plain text content within the scope of his or her own authority, such as Figure 2 As shown, in this embodiment, it also includes:

[0069] Receiving an access request from a user; wherein the access request includes a set of attributes of the user;

[0070] According to the user's access request, determine whether the user's attribute set meets the preset attribute set;

[0071] If not, it will directly return decryption failure;

[0072] If so, the user's access rights are determined based on the user's attribute set and access control policy;

[0073] According to the user's access rights, extract the ciphertext segment CT_attr that matches the user's access rights from the ciphertext CT;

[0074] The user's private key SK is called according to the user's attribute set, and the ciphertext segment CT_attr is decrypted using the user's private key SK to obtain the partial plaintext M_attr or plaintext M that matches the user's attributes.

[0075] To ensure that each user can only obtain the plaintext content within their own permission range, in this embodiment, before encrypting the plaintext M according to the preset access control policy and the system public key PK to obtain the ciphertext CT, the following steps are also included:

[0076] Obtain the master key MSK and system public key PK generated in advance by the manufacturer according to the Key Policy Attribute-Based Encryption (CP-ABE) algorithm, and store them;

[0077] Defining a preset attribute set; wherein each attribute in the preset attribute set is represented by a unique identifier;

[0078] Constructing a preset access control policy; wherein the access control policy includes the access policy for external data readers, manufacturers, and regulators; wherein the access policy indicates the corresponding user's access rights to the data;

[0079] Generate and store each user's private key based on each user's attribute set, access policy, and master key MSK.

[0080] This embodiment is configured so that when a user accesses the system, the user's private key can be automatically called according to the user's attribute set. The user does not directly access the private key itself, which greatly improves security.

[0081] It should be understood that the types of users in this embodiment are divided into manufacturers, regulatory agencies, and external data readers.

[0082] The process of generating a user's private key is represented as keygen(MSK, PK, S)->SK. The master key MSK, the system public key PK, and the user's attribute set S are input to generate the user's corresponding private key SK.

[0083] The process of encrypting plaintext is expressed as MSGEnc(M, T, PK)->CT. The input is plaintext M, access control policy (T) and system public key PK, and the output is ciphertext CT. The access control policy has a tree structure.

[0084] The process of decrypting ciphertext is expressed as MSGDec(CT, SK, S)->M or decryption fails, where CT is the ciphertext, SK is the private key of a certain type of user, S is the attribute set of the user, and M is the plaintext.

[0085] In one specific embodiment, in the access control policy, the manufacturer can access the time and file serial number to confirm whether the file has been deleted or forged in a time attack, but cannot access private information such as the file content; the regulatory agency can access the record file, composite hash value, time and file serial number to confirm whether the record file has been tampered with or deleted and directly obtain the record file; external data readers can access the record file to analyze the cause of the accident but do not understand how the anti-tampering technical details are implemented.

[0086] This embodiment, through such an access control policy, can meet the decryption policies of various types of users in the process of extracting files, and can effectively meet the verification requirements of manufacturers and regulatory agencies to confirm whether files have been tampered with or deleted.

[0087] Of course, in other embodiments, when the user type changes or the file category changes, the access control policy is adjusted as needed.

[0088] In order to confirm the integrity of the decrypted record file and thus determine whether the record file has been tampered with or deleted, in a further embodiment, when the user is a regulatory agency, after obtaining the plaintext M that matches the user's attributes, the following steps are further included:

[0089] Perform data integrity verification on part of the plaintext or plaintext.

[0090] Among them, Figure 3 As shown, data integrity verification is performed on part of the plaintext or plaintext, specifically including:

[0091] Perform two hash operations on part of the plaintext or the plaintext record file to obtain a decrypted composite hash value;

[0092] Based on the decrypted composite hash value and the composite hash value, determine whether part of the plaintext or the plaintext has been tampered with;

[0093] If the decrypted composite hash value and the composite hash value are inconsistent, it is determined that part of the plaintext or the plaintext has been tampered with; if the decrypted composite hash value and the composite hash value are consistent, it is determined that part of the plaintext or the plaintext has not been tampered with;

[0094] When it is determined that the part of the plaintext or the plaintext has not been tampered with, determining whether the part of the plaintext or the plaintext has been deleted;

[0095] When the file sequence numbers of part of the plaintext or the plaintext are discontinuous, it is determined that the part of the plaintext or the plaintext has been deleted; when the file sequence numbers of part of the plaintext or the plaintext are continuous, it is determined that the part of the plaintext or the plaintext has not been deleted;

[0096] If it is determined that part of the plaintext or plaintext has not been deleted, determine whether the part of the plaintext or plaintext has been forged in a time attack;

[0097] When part of the plaintext or the file sequence number in the plaintext is out of order with the time, it is determined that part of the plaintext or the plaintext has a forged time attack;

[0098] When the file sequence number and time in the partial plaintext or the plaintext are not out of order, it is determined that the partial plaintext or the plaintext does not have a forged time attack;

[0099] When it is determined that there is no forged time attack on the part of the plaintext or plaintext, the data integrity verification of the part of the plaintext or plaintext passes.

[0100] Specifically, to determine whether a portion of plaintext or a file sequence number within the plaintext is out of sequence with respect to time, the system extracts the time and sequence number from that portion of plaintext or the file sequence number within it and compares them with the time and sequence number from another portion of plaintext or the file sequence number within it to check whether the time and sequence number are out of sequence. If they are out of sequence, this indicates a time forgery attack. A time forgery attack involves the autonomous driving system sending an incorrect time to the data storage device in order to deceive regulators.

[0101] In order to defend against potential attacks against a single hash function, in this embodiment, the composite hash value is obtained by two hash calculations.

[0102] Specifically, the calculation process of the composite hash value includes:

[0103] Use the SHA-256 algorithm to calculate the record file and obtain a 256-bit hash value;

[0104] The 256-bit hash value is then calculated using the RIPMED-160 cryptographic hash function to obtain a 160-bit hash value.

[0105] Of course, the tamper-proof autonomous driving data recording method proposed in the present invention can be applied not only to the field of autonomous driving data recording, but also to the tamper-proofing of other time series files.

[0106] In a second aspect, the present invention provides a tamper-proof autonomous driving data recording system, comprising:

[0107] A data acquisition module, used to acquire data sets and images with timestamps during the activation of the autonomous driving system at a preset fixed frequency;

[0108] The data processing module is used to divide the data sets and images obtained each time into preset time periods to obtain data sets and images of multiple preset time periods; and to package the data sets and images of multiple preset time periods into multiple record files;

[0109] The hardware security module is used to calculate the composite hash value, time and file serial number of each record file respectively; combine each record file and the corresponding composite hash value, time and file serial number into a plaintext; encrypt each plaintext according to the preset access control policy and the system public key, obtain the ciphertext corresponding to each plaintext, and store the ciphertext.

[0110] The present invention encrypts the recorded files, composite hash values, time, and file serial numbers of the autonomous driving data recording system through CP-ABE (Cipher Policy Attribute-Based Encryption), which can meet the decryption strategies of various types of users in the process of extracting files, and allows users to only obtain plaintext content within their own authority without being aware of it.

[0111] The hardware security module in this embodiment is also used to receive a user's access request; wherein the access request includes a user's attribute set; based on the user's access request, determine whether the user's attribute set meets a preset attribute set; if not, directly return a decryption failure; if so, determine the user's access rights based on the user's attribute set and the access control policy; based on the user's access rights, extract a ciphertext fragment or ciphertext that matches the user's access rights from the ciphertext; call the user's private key based on the user's attribute set, and use the user's private key to decrypt the ciphertext fragment or ciphertext to obtain a partial plaintext or plaintext that matches the user's attribute set.

[0112] Participating entities of the autonomous driving data recording system in this embodiment include the manufacturer, the regulator, and external data readers;

[0113] The hardware security module is also used to obtain and store the master key and system public key generated in advance by the manufacturer according to the key policy attribute-based encryption algorithm;

[0114] Defining a preset attribute set; wherein each attribute in the preset attribute set is represented by a unique identifier;

[0115] Constructing a preset access control policy; wherein the access control policy includes the access policy for external data readers, manufacturers, and regulators; wherein the access policy indicates the corresponding user's access rights to the data;

[0116] Based on each user's attribute set, access policy and master key, a private key for each user is generated and stored in the hardware security module, so that when the hardware security module receives a user's access request and determines that the user's attribute set meets the preset attribute set, it automatically calls the corresponding user's private key for decryption based on the user's attribute set.

[0117] In the access control policy of this embodiment, the manufacturer can access the time and file serial number, but cannot access the record file and composite hash value; the regulatory agency can access the record file, composite hash value, time and file serial number; and external data readers can access the record file.

[0118] When the user is a regulatory agency, after obtaining the partial plaintext or plaintext that matches the user's attribute set, the following is also included:

[0119] Perform data integrity verification on part of the plaintext or plaintext.

[0120] Among them, data integrity verification is performed on part of the plaintext or plaintext, specifically including:

[0121] Perform two hash operations on part of the plaintext or the plaintext record file to obtain a decrypted composite hash value;

[0122] Based on the decrypted composite hash value and the composite hash value, determine whether part of the plaintext or the plaintext has been tampered with;

[0123] If the decrypted composite hash value and the composite hash value are inconsistent, it is determined that part of the plaintext or the plaintext has been tampered with; if the decrypted composite hash value and the composite hash value are consistent, it is determined that part of the plaintext or the plaintext has not been tampered with;

[0124] When it is determined that the part of the plaintext or the plaintext has not been tampered with, determining whether the part of the plaintext or the plaintext has been deleted;

[0125] When the file sequence numbers of part of the plaintext or the plaintext are discontinuous, it is determined that the part of the plaintext or the plaintext has been deleted; when the file sequence numbers of part of the plaintext or the plaintext are continuous, it is determined that the part of the plaintext or the plaintext has not been deleted;

[0126] If it is determined that part of the plaintext or plaintext has not been deleted, determine whether the part of the plaintext or plaintext has been forged in a time attack;

[0127] When part of the plaintext or the file sequence number in the plaintext is out of order with the time, it is determined that part of the plaintext or the plaintext has a forged time attack;

[0128] When the file sequence number and time in the partial plaintext or the plaintext are not out of order, it is determined that the partial plaintext or the plaintext does not have a forged time attack;

[0129] When it is determined that there is no forged time attack on the part of the plaintext or plaintext, the data integrity verification of the part of the plaintext or plaintext passes.

[0130] Specifically, to determine whether a portion of plaintext or a file sequence number within the plaintext is out of sequence with respect to time, the system extracts the time and sequence number from that portion of plaintext or the file sequence number within it and compares them with the time and sequence number from another portion of plaintext or the file sequence number within it to check whether the time and sequence number are out of sequence. If they are out of sequence, this indicates a time forgery attack. A time forgery attack involves the autonomous driving system sending an incorrect time to the data storage device in order to deceive regulators.

[0131] The calculation process of the composite hash value in this embodiment includes:

[0132] Use the SHA-256 algorithm to calculate the record file and obtain a 256-bit hash value;

[0133] The 256-bit hash value is then calculated using the RIPMED-160 cryptographic hash function to obtain a 160-bit hash value.

[0134] The autonomous driving data recording system in this embodiment is equipped on a vehicle having an autonomous driving function.

[0135] In a third aspect, the present invention further proposes a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the tamper-proof autonomous driving data recording method as described in any one of the first aspects.

[0136] In a fourth aspect, the present invention further proposes a computer program product, comprising a computer program, which, when executed by a processor, implements the steps of the tamper-proof autonomous driving data recording method as described in any one of the first aspects.

[0137] The above description is only a preferred specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any technician familiar with the technical field, within the technical scope disclosed by the present invention, who makes equivalent replacements or changes based on the technical solution and inventive concept of the present invention, should be covered by the scope of protection of the present invention.

Claims

1. A tamper-proof autonomous driving data recording method, characterized in that: include: Obtaining time-stamped datasets and images during the activation of the autonomous driving system at a preset fixed frequency; Divide the data sets and images obtained each time into preset time periods to obtain data sets and images of multiple preset time periods; Packing data sets and images of multiple preset time periods into multiple record files; Calculate the composite hash value, time and file sequence number of each record file respectively; Combine each record file and its corresponding composite hash value, time, and file serial number into a plaintext; Each plaintext is encrypted according to the preset access control policy and the system public key to obtain the ciphertext corresponding to each plaintext; wherein, in the access control policy, the manufacturer can access the time and file serial number, but cannot access the record file and the composite hash value; the regulatory agency can access the record file, the composite hash value, the time and the file serial number; and the external data reader can access the record file; Store the ciphertext.

2. The tamper-proof autonomous driving data recording method according to claim 1, characterized in that: After storing the ciphertext, it also includes: Receiving an access request from a user; wherein the access request includes a set of attributes of the user; According to the user's access request, determine whether the user's attribute set meets the preset attribute set; If not, it will directly return decryption failure; If so, determining the user's access rights according to the user's attribute set and the access control policy; extracting the ciphertext fragment or ciphertext that matches the user's access rights from the ciphertext according to the user's access rights; The user's private key is called according to the user's attribute set, and the ciphertext fragment or ciphertext is decrypted using the user's private key to obtain a partial plaintext or plaintext that matches the user's attribute set.

3. The tamper-proof autonomous driving data recording method according to claim 1, characterized in that: Before encrypting each plaintext according to the preset access control policy and the system public key to obtain the ciphertext corresponding to each plaintext, it also includes: Obtain the master key and system public key pre-generated by the manufacturer according to the key policy attribute-based encryption algorithm and store them; Defining a preset attribute set; wherein each attribute in the preset attribute set is represented by a unique identifier; Constructing a preset access control policy; wherein the access control policy includes the access policy for external data readers, manufacturers, and regulators; wherein the access policy indicates the corresponding user's access rights to the data; Generate and store each user's private key based on each user's attribute set, access policy, and master key.

4. The tamper-proof autonomous driving data recording method according to claim 3, characterized in that: When the user is a regulatory agency, after obtaining the partial plaintext or plaintext that matches the user's attribute set, it also includes: Perform data integrity verification on part of the plaintext or plaintext.

5. The tamper-proof autonomous driving data recording method according to claim 4, characterized in that: Data integrity verification is performed on parts of plaintext or plaintext, specifically including: Perform two hash operations on part of the plaintext or the plaintext record file to obtain a decrypted composite hash value; Based on the decrypted composite hash value and the composite hash value, determine whether part of the plaintext or the plaintext has been tampered with; if the decrypted composite hash value and the composite hash value are inconsistent, determine that part of the plaintext or the plaintext has been tampered with; if the decrypted composite hash value and the composite hash value are consistent, determine that part of the plaintext or the plaintext has not been tampered with; When it is determined that part of the plaintext or plaintext has not been tampered with, it is determined whether the part of the plaintext or plaintext has been deleted; when the file sequence numbers of the part of the plaintext or the plaintext are not continuous, it is determined that the part of the plaintext or the plaintext has been deleted; when the file sequence numbers of the part of the plaintext or the plaintext are continuous, it is determined that the part of the plaintext or the plaintext has not been deleted; If it is determined that part of the plaintext or plaintext has not been deleted, determine whether the part of the plaintext or plaintext has been subjected to a forged time attack; when the part of the plaintext or the file sequence number in the plaintext is out of sequence with the time, determine that the part of the plaintext or plaintext has been subjected to a forged time attack; when the part of the plaintext or the file sequence number in the plaintext is not out of sequence with the time, determine that the part of the plaintext or plaintext has not been subjected to a forged time attack; When it is determined that the partial plaintext or plaintext does not have a forged time attack, the data integrity verification of the partial plaintext or plaintext passes.

6. A tamper-proof autonomous driving data recording system, characterized in that: include: A data acquisition module, used to acquire data sets and images with timestamps during the activation of the autonomous driving system at a preset fixed frequency; The data processing module is used to divide the data sets and images obtained each time into preset time periods to obtain data sets and images of multiple preset time periods; and to package the data sets and images of multiple preset time periods into multiple record files; The hardware security module is used to calculate the composite hash value, time and file serial number of each record file respectively; combine each record file and the corresponding composite hash value, time and file serial number into a plaintext; encrypt each plaintext according to the preset access control policy and the system public key to obtain the ciphertext corresponding to each plaintext, and store the ciphertext; wherein, in the access control policy, the manufacturer can access the time and file serial number, but cannot access the record file and the composite hash value; the regulatory agency can access the record file, the composite hash value, the time and the file serial number; and the external data reader can access the record file.

7. The tamper-proof autonomous driving data recording system according to claim 6, characterized in that: The hardware security module is also used to receive a user's access request; wherein the access request includes a user's attribute set; based on the user's access request, determine whether the user's attribute set meets a preset attribute set; if not, directly return a decryption failure; if so, determine the user's access rights based on the user's attribute set and the access control policy; based on the user's access rights, extract a ciphertext fragment or ciphertext that matches the user's access rights from the ciphertext; call the user's private key based on the user's attribute set, and use the user's private key to decrypt the ciphertext fragment or ciphertext to obtain a partial plaintext or plaintext that matches the user's attribute set.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the tamper-proof autonomous driving data recording method described in any one of claims 1 to 5 are implemented.

9. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the tamper-proof autonomous driving data recording method described in any one of claims 1 to 5 are implemented.

Images