An access control method and device, electronic equipment and storage medium

Abstract

The application discloses an access control method and device, electronic equipment and a storage medium. The method comprises the following steps: when a target secure U disk is detected to be inserted into a target vehicle test terminal, performing a two-way identity authentication process on the target secure U disk and the target vehicle test terminal to obtain a two-way identity authentication result; if the two-way identity authentication result indicates that the authentication is passed, generating a temporary session key between the target secure U disk and the target vehicle test terminal; determining a target access right of the target secure U disk to the target vehicle test terminal based on permission configuration information corresponding to the target secure U disk; the permission configuration information represents access rights of the target secure U disk to at least one vehicle test terminal; and determining an access operation of the target secure U disk to the target vehicle test terminal based on the temporary session key and the target access right. The application enhances the security of data interaction in a vehicle test scene.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data security, in particular to an access control method and device, electronic equipment and storage medium. BACKGROUND

[0002] In the process of modern vehicle research and testing, U disks, as a convenient data storage and transmission tool, are widely used in scenarios such as vehicle system log pulling, firmware flashing, and software installation. With the rapid development of intelligent and networked automobile technology, data security and permission management become particularly important. Although the traditional use of U disks is convenient, it gradually exposes its limitations when facing complex cross-platform environments and high security requirements. In particular, in the vehicle testing environment, the U disk access control in the related art mainly focuses on the user level, which can easily lead to unauthorized access and data tampering, thereby reducing data security. SUMMARY

[0003] To solve the problems of the prior art, the embodiments of the present application provide an access control method and device, electronic equipment and storage medium. The technical solution is as follows:

[0004] In one aspect, an access control method is provided, which includes:

[0005] When a target secure U disk is detected to be inserted into a target vehicle testing terminal, performing a bidirectional identity authentication process on the target secure U disk and the target vehicle testing terminal to obtain a bidirectional identity authentication result;

[0006] If the bidirectional identity authentication result indicates that the authentication is passed, generating a temporary session key between the target secure U disk and the target vehicle testing terminal;

[0007] Based on permission configuration information corresponding to the target secure U disk, determining a target access permission of the target secure U disk to the target vehicle testing terminal; the permission configuration information represents an access permission of the target secure U disk to at least one vehicle testing terminal;

[0008] Based on the temporary session key and the target access permission, determining an access operation of the target secure U disk to the target vehicle testing terminal.

[0009] In some exemplary embodiments, the permission configuration information includes first permission configuration information and second permission configuration information, the first permission configuration information represents an access permission of the target secure U disk to at least one preset test vehicle, and the second permission configuration information represents an access permission of the target secure U disk to at least one preset office terminal; and the determining of the target access permission of the target secure U disk to the target vehicle testing terminal based on the permission configuration information corresponding to the target secure U disk includes:

[0010] In a case where the test connection environment corresponding to the target vehicle test terminal is a vehicle-side test, the target access authority of the target secure U disk to the target vehicle test terminal is determined based on the first authority configuration information.

[0011] In a case where the test connection environment corresponding to the target vehicle test terminal is an office equipment-side test, the target access authority of the target secure U disk to the target vehicle test terminal is determined based on the second authority configuration information.

[0012] In some example embodiments, the authority configuration information corresponding to the target secure U disk is generated by a cloud management server in response to a use application request for the target secure U disk and stored in the secure area of the target secure U disk; wherein the use application request carries a vehicle identification code and an office terminal identification, the vehicle identification code is used to identify the preset test vehicle, and the office terminal identification is used to identify the preset office terminal.

[0013] In some example embodiments, the access operation of the target secure U disk to the target vehicle test terminal is determined based on the temporary session key and the target access authority, and includes:

[0014] In a case where the target access authority indicates that access is allowed, test data interaction between the target secure U disk and the target vehicle test terminal is performed based on the temporary session key.

[0015] In some example embodiments, the method further includes:

[0016] During the test data interaction, the authority configuration information in the target secure U disk is updated based on an authority update request sent by the cloud management server to the target vehicle test terminal.

[0017] In some example embodiments, before the bidirectional identity authentication processing of the target secure U disk and the target vehicle test terminal, the method further includes:

[0018] adjusting the current state of the target secure U disk to a locked state;

[0019] After the bidirectional identity authentication processing of the target secure U disk and the target vehicle test terminal, the method further includes:

[0020] if the bidirectional identity authentication result indicates that the authentication is passed, updating the current state of the target secure U disk to an enabled state;

[0021] If the bidirectional identity authentication result indicates that the authentication fails, maintaining the current state of the target secure U disk as the locked state.

[0022] In some example embodiments, the method further includes:

[0023] Upon detecting that the target secure U disk is unplugged from the target vehicle test terminal, updating the current state of the target secure U disk as an offline state.

[0024] In another aspect, an access control apparatus is provided, the apparatus comprising:

[0025] an identity authentication module configured to, upon detecting that a target secure U disk is plugged into a target vehicle test terminal, perform bidirectional identity authentication processing on the target secure U disk and the target vehicle test terminal, and obtain a bidirectional identity authentication result;

[0026] a temporary session key generation module configured to, if the bidirectional identity authentication result indicates that the authentication passes, generate a temporary session key between the target secure U disk and the target vehicle test terminal;

[0027] an access right determination module configured to determine a target access right of the target secure U disk to the target vehicle test terminal based on permission configuration information corresponding to the target secure U disk, the permission configuration information representing access rights of the target secure U disk to at least one vehicle test terminal;

[0028] an access operation module configured to determine an access operation of the target secure U disk to the target vehicle test terminal based on the temporary session key and the target access right.

[0029] In some example embodiments, the permission configuration information includes first permission configuration information and second permission configuration information, the first permission configuration information representing access rights of the target secure U disk to at least one preset test vehicle, and the second permission configuration information representing access rights of the target secure U disk to at least one preset office terminal; and the access right determination module is specifically configured to:

[0030] if a test connection environment corresponding to the target vehicle test terminal is a vehicle-side test, determine the target access right of the target secure U disk to the target vehicle test terminal based on the first permission configuration information;

[0031] if the test connection environment corresponding to the target vehicle test terminal is an office equipment-side test, determine the target access right of the target secure U disk to the target vehicle test terminal based on the second permission configuration information.

[0032] In some example embodiments, the permission configuration information corresponding to the target secure U disk is generated by the cloud management server and stored in the secure area of the target secure U disk in response to a use application request for the target secure U disk, wherein the use application request carries a vehicle identification code and an office terminal identification, the vehicle identification code is used to identify the preset test vehicle, and the office terminal identification is used to identify the preset office terminal.

[0033] In some example embodiments, the access operation module is specifically configured to, in a case where the target access permission indicates that access is allowed, perform test data interaction between the target secure U disk and the target vehicle test terminal based on the temporary session key.

[0034] In some example embodiments, the device further comprises:

[0035] The permission updating module is configured to update the permission configuration information in the target secure U disk based on a permission updating request sent by the cloud management server to the target vehicle test terminal during the test data interaction.

[0036] In some example embodiments, the device further comprises:

[0037] The state adjusting module is configured to adjust the current state of the target secure U disk to a locked state before the bidirectional identity authentication processing of the target secure U disk and the target vehicle test terminal, and update the current state of the target secure U disk to an enabled state if the bidirectional identity authentication result indicates that the authentication is passed after the bidirectional identity authentication processing of the target secure U disk and the target vehicle test terminal, and maintain the current state of the target secure U disk as the locked state if the bidirectional identity authentication result indicates that the authentication is not passed.

[0038] In some example embodiments, the state adjusting module is further configured to update the current state of the target secure U disk to an offline state when it is detected that the target secure U disk is pulled out of the target vehicle test terminal.

[0039] On the other hand, an electronic device is provided, which comprises a processor and a memory, the memory stores at least one instruction or at least one program, the at least one instruction or the at least one program is loaded and executed by the processor to implement the access control method of any one of the above aspects.

[0040] In another aspect, a computer-readable storage medium is provided, and the computer-readable storage medium stores at least one instruction or at least one program, which is loaded and executed by a processor to implement the access control method according to any one of the above aspects.

[0041] In another aspect, a computer program product is provided, and the computer program product includes a computer program stored in a computer-readable storage medium. A processor of an electronic device reads the computer program from the computer-readable storage medium, and the processor executes the computer program to cause the electronic device to perform the access control method according to any one of the above aspects.

[0042] When the target secure U disk is detected to be inserted into the target vehicle test terminal, the target secure U disk and the target vehicle test terminal are subjected to bidirectional identity authentication processing to obtain a bidirectional identity authentication result. When the bidirectional identity authentication result indicates that the authentication is passed, a temporary session key between the target secure U disk and the target vehicle test terminal is generated. Then, based on the permission configuration information corresponding to the target secure U disk, the target access permission of the target secure U disk to the target vehicle test terminal is determined. Based on the temporary session key and the target access permission, the access operation of the target secure U disk to the target vehicle test terminal is determined. The permission configuration information corresponding to the target secure U disk represents the access permission of the target secure U disk to at least one vehicle test terminal. Thus, the U disk fine access control in the vehicle test scenario is realized. The precision of the access control permission management is improved. Unauthorized access and data tampering are effectively prevented. The security of data interaction in the vehicle test scenario is significantly enhanced. BRIEF DESCRIPTION OF DRAWINGS

[0043] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings needed in the embodiment description will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the present application. Other drawings can be obtained by those skilled in the art without creative labor.

[0044] Figure 1 is a schematic diagram of an implementation environment provided by some embodiments of the present application;

[0045] Figure 2 is a flowchart of an access control method provided by some embodiments of the present application;

[0046] Figure 3 is a flowchart of another access control method provided by some embodiments of the present application;

[0047] Figure 4is a flowchart of another access control method provided by some embodiments of the present application;

[0048] Figure 5 is a flowchart of another access control method provided by some embodiments of the present application;

[0049] Figure 6 is a structural diagram of an access control apparatus provided by some embodiments of the present application. DETAILED DESCRIPTION

[0050] The technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only some of the embodiments of the present application, but not all the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work fall within the scope of protection of the present application.

[0051] It should be noted that the terms "first", "second", and the like in the specification and claims of the present application and the above-described drawings are used to distinguish similar objects, and do not necessarily indicate a specific order or a chronological sequence. It should be understood that the data thus used can be interchanged under appropriate circumstances, so that the embodiments of the present application described herein can be implemented in an order other than that illustrated or described herein. In addition, the terms "include" and "have" and any variations thereof are intended to cover non-exclusive inclusion, for example, a process, method, system, product or server including a series of steps or units does not have to be limited to those steps or units clearly listed, but can include other steps or units not clearly listed or inherent to the process, method, product or device.

[0052] In the embodiments of the present application, the term "module" or "unit" refers to a computer program or a part of a computer program with a predetermined function, and works together with other related parts to achieve a predetermined target, and can be implemented entirely or partially by using software, hardware (such as a processing circuit or a memory) or a combination thereof. Similarly, one processor (or multiple processors or memories) can be used to implement one or more modules or units. In addition, each module or unit can be a part of an integral module or unit that includes the functions of the module or unit.

[0053] In this application, the word "exemplary" is used to mean "serving as an example, instance, or illustration." Any implementation described as "exemplary" in this application is not necessarily to be construed as preferred or advantageous over other implementations. The following description is presented to enable any person skilled in the art to make and use the application. In the following description, for purposes of explanation, numerous specific details are set forth in order to provide a thorough understanding of the present application. It will be apparent, however, to one skilled in the art that the present application can be practiced without using these specific details. In other instances, well-known structures and processes are not elaborated

[0054] Referring to Figure 1 , which is a schematic diagram of an implementation environment provided by the embodiments of the present application, the implementation environment includes a secure U disk 110, a vehicle test terminal 120, and a cloud management server 130, wherein the vehicle test terminal 120 corresponds to a terminal in a vehicle test scenario, and can include a test vehicle 121 and an office terminal 122 (such as a PC terminal) for implementing vehicle testing. The vehicle test terminal 120 and the cloud management server 130 can communicate through wired or wireless network connection.

[0055] Specifically, the secure U disk (Secure USB Drive) 110 is not a common storage device, but a "smart security terminal" with identity authentication and permission judgment capabilities, which can implement the access control method of the embodiments of the present application.

[0056] The cloud management server 130 can be a remote communication service platform TSP (Telematics Service Platform), which is the "cloud brain" of the entire system and is responsible for unified management of the entire life cycle of all secure U disks. It has the highest permission, including: approving the U disk application of the user, assigning read-write permission, binding employee and device information, generating digital certificates and keys, remotely updating U disk permission policies, and recording all use logs. It is equivalent to a "remote administrator", and even if the U disk is on a test vehicle thousands of miles away, it can also achieve remote management and control through the access control method of the embodiments of the present application. Details will be described later.

[0057] It should be noted that the server involved in the embodiments of the present application can be a stand-alone physical server, or a server cluster or distributed system formed by multiple physical servers, or a cloud server providing cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN (Content Delivery Network), and basic cloud computing services such as big data and artificial intelligence platforms.

[0058] In an exemplary embodiment, the secure U disk 110, the vehicle test terminal 120, and the cloud management server 130 can all be node devices in a blockchain system, capable of sharing the acquired and generated information to other node devices in the blockchain system, realizing information sharing between multiple node devices. The multiple node devices in the blockchain system can be configured with the same blockchain, which is composed of multiple blocks, and the adjacent blocks have an association relationship, so that when the data in any block is tampered with, it can be detected through the next block, thereby avoiding the data in the blockchain being tampered with, and ensuring the security and reliability of the data in the blockchain.

[0059] Referring to Figure 2 , which shows a flowchart of an access control method provided by the embodiments of the present application. It should be noted that the present specification provides method operation steps as described in the embodiments or flowcharts, but more or fewer operation steps can be included based on conventional or non-creative labor. The order of steps listed in the embodiments is only one of the many execution orders of the steps, and does not represent the only execution order. In actual system or product execution, the method order shown in the embodiments or the drawings can be executed in sequence or in parallel (for example, in a parallel processor or multi-threaded processing environment). Specifically, as shown in Figure 2 , the method can include:

[0060] S201, when detecting that a target secure U disk is inserted into a target vehicle test terminal, performing bidirectional identity authentication processing on the target secure U disk and the target vehicle test terminal, to obtain a bidirectional identity authentication result.

[0061] Among them, the target vehicle test terminal is a terminal device in a vehicle test scenario, which can specifically include a test vehicle and an office terminal such as a PC (Personal Computer) terminal for realizing vehicle testing.

[0062] The bidirectional identity authentication processing includes identity authentication of the target secure U disk to the target vehicle test terminal and identity authentication of the target vehicle test terminal to the target secure U disk, and the bidirectional identity authentication result indicates whether the authentication is passed or not. Specifically, in the case that the identity authentication of the target secure U disk to the target vehicle test terminal is passed and the identity authentication of the target vehicle test terminal to the target secure U disk is also passed, the bidirectional identity authentication result indicates that the authentication is passed. Otherwise, if the identity authentication of any party is not passed, the bidirectional identity authentication result indicates that the authentication is not passed.

[0063] In a specific implementation, the identity authentication can be based on the security credential information (such as a digital certificate or an encryption key) of the party to be authenticated, which is stored in advance.

[0064] S203, if the bidirectional identity authentication result indicates that the authentication is passed, a temporary session key between the target secure U disk and the target vehicle test terminal is generated.

[0065] Specifically, in the case that the bidirectional identity authentication result indicates that the authentication is passed, a temporary session key between the target secure U disk and the target vehicle test terminal is generated. The temporary session key can be used for the interaction of test data between the target secure U disk and the target vehicle test terminal in the subsequent test process, so as to establish a secure data channel between the target secure U disk and the target vehicle test terminal.

[0066] In a specific implementation, the temporary session key can be generated by using a Diffie-Hellman key exchange algorithm. Through the key exchange algorithm, the two parties can negotiate a shared secret key (i.e., the temporary session key) in an insecure network environment, which is used to encrypt the subsequent data transmission, so as to ensure the secure communication between the target secure U disk and the target vehicle test terminal, thereby preventing the data from being eavesdropped or tampered.

[0067] It can be understood that in the case that the bidirectional identity authentication result indicates that the authentication is not passed, the process is ended.

[0068] S205, based on the permission configuration information corresponding to the target secure U disk, a target access permission of the target secure U disk to the target vehicle test terminal is determined, and the permission configuration information represents the access permission of the target secure U disk to at least one vehicle test terminal.

[0069] The access permission can include but is not limited to read-only, read-write, and prohibited access. The permission configuration information corresponding to the target secure U disk can be pre-stored in the target secure U disk.

[0070] The permission configuration information represents the access permission of the target secure U disk to at least one vehicle test terminal, and specifically records which vehicle test terminals the secure U disk can use, what permission (such as read-only, read-write) the secure U disk has, the current state (enabled, locked, offline, etc.) of the secure U disk, and the update time. It is the basis for implementing fine-grained access control and ensuring that the secure U disk can only be used within the authorized range.

[0071] For example, the permission configuration information can include first permission configuration information and second permission configuration information, the first permission configuration information representing the access permission of the target secure U disk to at least one preset test vehicle, and the second permission configuration information representing the access permission of the target secure U disk to at least one preset office terminal. Further, the above step S205 can include, when implemented:

[0072] In the case that the test connection environment corresponding to the target vehicle test terminal is vehicle end test, based on the first permission configuration information, the target access permission of the target secure U disk to the target vehicle test terminal is determined;

[0073] In the case that the test connection environment corresponding to the target vehicle test terminal is office equipment end test, based on the second permission configuration information, the target access permission of the target secure U disk to the target vehicle test terminal is determined.

[0074] In a specific implementation, the first permission configuration information can be in the form of a table, including the following fields: Id: unique identifier of the permission table entry, used for counting and indexing the number of records in the table; Uid: unique number of the secure U disk (USB DeviceID), used to uniquely identify the secure U disk; Vin: vehicle identification number (Vehicle Identification Number), identifying the preset test vehicle bound to the secure U disk; Pre: access permission field, defining the operation permission of the secure U disk on the corresponding test vehicle, such as read-only, read-write, prohibited access, etc.; Date: timestamp field, recording the creation or most recent update date of the permission table; State: current state of the U disk, including "enabled", "disabled", "locked", "offline", and "expired", which can be used to dynamically control the availability of the secure U disk. Of course, other fields can also be set according to actual needs, such as setting the expiration time corresponding to each access permission.

[0075] The second permission configuration information can be in the form of a table, including the following fields: Id, a unique identifier of the permission table entry, used for counting and indexing the number of records in the table; Uid, a unique number of the secure USB device (USB Device ID), used for uniquely identifying the secure USB device; Adid, which can be a preset office terminal domain account, such as a unique account identifier of an employee in an enterprise domain environment (such as an AD account ID), used to identify the preset office terminal, thereby associating the secure USB device with the preset office terminal and the user; Pre, an access permission field, defining the operation permission of the secure USB device on the corresponding office terminal, such as read-only, read-write, and prohibited access; Date, a timestamp field, recording the creation or most recent update date of the permission table; State, the current state of the USB device, including "enable", "disable", "lock", "offline", and "expired", which can be used to dynamically control the availability of the secure USB device. Of course, other fields can also be set according to actual needs, such as setting an expiration time for each access permission.

[0076] In the above embodiments, the first permission configuration information and the second permission configuration information corresponding to the test connection environment for vehicle-side testing and office equipment-side testing are set, thereby multi-dimensionally binding the secure USB device with the test vehicle and the office terminal, further improving the refinement of access control. When the same secure USB device is switched between the office equipment test environment and the vehicle-side test environment, the access permission can be automatically adjusted, so that the interaction can be smoothly completed without worrying about permission issues, thereby improving the user experience and simplifying the security management process.

[0077] In some exemplary embodiments, the permission configuration information corresponding to the target secure USB device can be generated by the cloud management server in response to a use application request for the target secure USB device and stored in the security area of the target secure USB device; wherein the use application request carries a vehicle identification code and an office terminal identification, the vehicle identification code is used to identify the preset test vehicle, and the office terminal identification is used to identify the preset office terminal.

[0078] The partition structure of the target secure USB device in the embodiments of the present application can include a data area, a control area, and a security area, wherein the data area is used to store all data operation contents of the target secure USB device, the control area is used to store system running logs, operation audit logs, and device control information, etc., and the security area is used to store all encryption keys, permission configuration information, digital certificates, and encryption algorithm configurations, etc. core security information. Through this partitioned and hierarchical storage mechanism, physical isolation of user data, operation logs, and core keys is achieved, preventing unauthorized access and data leakage, ensuring data integrity and operation traceability, and further improving the overall security of data access.

[0079] Specifically, the cloud management server can receive a use application request initiated by a user (such as an enterprise employee) for a target secure U disk, the use application request carrying a vehicle identification code Vin and an office terminal identification (such as a domain account of the employee in the enterprise), and in response to the use application request, generate permission configuration information of the target secure U disk and store the permission configuration information in the secure area of the target secure U disk.

[0080] In actual application, the cloud management server can also generate a pair of public key and private key for each interactive object (including the secure U disk, the preset test vehicle and the preset office terminal) involved, and distribute the key information to the corresponding devices. Specifically, the cloud management server generates and publishes the security credential information such as the public key and the private key of the target secure U disk, and sends the public key of the target secure U disk to the preset test vehicle and the preset office terminal indicated by the use application request, so that the preset test vehicle and the preset office terminal store the public key of the target secure U disk respectively, for example, the preset test vehicle and the preset office terminal can store the public key of the target secure U disk in the respective Trusted Execution Environment (TEE). The TEE is a "security isolation area" inside the test vehicle and the office terminal, which is equivalent to a "safe" in the device, and ordinary programs cannot access the data and operation process therein. In the embodiments of the present application, the security credential information such as the key and the authentication algorithm of the preset test vehicle and the preset office terminal runs in the respective TEE, so as to ensure that even if the operating system is attacked, the attacker cannot steal the core security information required for secure U authentication, thereby ensuring the security of the entire authentication process.

[0081] Meanwhile, the cloud management server can also send the security credential information such as the public key of the preset test vehicle and the preset office terminal for identity authentication to the target secure U disk, so as to store the public key of the respective preset test vehicle and preset office terminal in the secure area of the target secure U disk, and then perform the identity authentication based on the stored public key and private key.

[0082] For example, the cloud management server can also generate a preset public parameter, for example, select a set of public mathematical parameters (such as a large prime number p and a generator g), and share the preset public parameter among the target secure U disk, the preset test vehicle and the preset office terminal indicated by the use application request, so as to generate a temporary session key. In a specific implementation, the generation process of the temporary session key can include the following steps 1) to 3):

[0083] 1) Generate a temporary public-private key pair

[0084] Target secure U disk generates a temporary key pair: the target secure U disk generates a new temporary private key a and calculates the corresponding temporary public key A = g^a mod p using the preset public parameters.

[0085] Target vehicle test terminal generates a temporary key pair: likewise, the target vehicle test terminal also generates a temporary private key b and calculates the corresponding temporary public key B = g^b mod p using the preset public parameters.

[0086] 2) Exchange temporary public keys

[0087] The target secure U disk sends the temporary public key A calculated by it to the target vehicle test terminal.

[0088] The target vehicle test terminal sends the temporary public key B calculated by it to the target secure U disk.

[0089] 3) Calculate temporary session key

[0090] Target secure U disk calculates temporary session key: the target secure U disk uses the received temporary public key B and its own private key a to calculate the temporary session key K = B^a mod p.

[0091] Target vehicle test terminal calculates shared key: the target vehicle test terminal uses the received temporary public key A and its own private key b to calculate the temporary session key K = A^b mod p.

[0092] Due to the nature of the discrete logarithm problem, K = g^{ab} mod p = g^{ba} mod p, so the temporary session keys calculated on both sides are the same.

[0093] S207, based on the temporary session key and the target access permission, determining the access operation of the target secure U disk to the target vehicle test terminal.

[0094] For example, as shown in the figure, Figure 3 S301: in the case where the target access permission indicates that access is allowed, based on the temporary session key, the target secure U disk and the target vehicle test terminal interact test data.

[0095] Specifically, in the case where the target access permission indicates that access is allowed, such as the target access permission being read-only or read-write, the target secure U disk and the target vehicle test terminal can interact test data in the test process based on the secure data channel established between them using the temporary session key K. Specifically, using the calculated temporary session key, both parties can use a symmetric encryption algorithm (such as AES) to encrypt the test data to be exchanged before transmission, thereby ensuring the security of data transmission.

[0096] It can be understood that if the target access permission indicates that access is not allowed, such as the target access permission being forbidden access, no data interaction is performed between the target secure U disk and the target vehicle test terminal.

[0097] In actual application, if the access permission is provided with a corresponding expiration time, the target access permission whether indicates that access is allowed can also be determined in combination with the expiration time, for example, although the access permission is read-only or read-write, the current time has exceeded the expiration time, it can be determined that the target access permission indicates that access is not allowed, and only when the current time does not exceed the expiration time, it is determined that access is allowed, thereby improving the flexibility of access control.

[0098] The technical scheme of the embodiment of the application realizes fine access control of the U disk in the vehicle test scene, not only improves the accuracy of access control permission management, but also effectively prevents unauthorized access and data tampering, and significantly enhances the security of data interaction in the vehicle test scene.

[0099] In some example embodiments, as shown in Figure 4 The method can further include:

[0100] S401, in the process of the test data interaction, based on the permission update request sent by the cloud management server to the target vehicle test terminal, the permission configuration information in the target secure U disk is updated.

[0101] Specifically, the permission update request is used to request to update the permission configuration information in the target secure U disk, and the update can include operations such as addition, deletion, and modification, for example, a permission entry can be added, and an expiration time can be set or changed for each permission.

[0102] Considering that the secure U disk itself does not have networking capability, the cloud management server cannot directly send a permission update request to it, in the embodiment of the application, the cloud management server sends a permission update request for the target secure U disk to the target vehicle test terminal, and uses the secure data channel between the target vehicle test terminal and the target secure U disk to send the permission update request to the target secure U disk, so that the target secure U disk updates the permission configuration information stored in the secure area thereof in response to the permission update request, thereby using the target vehicle test terminal as a stepping stone to realize remote dynamic update of the permission configuration information on the secure U disk in an offline environment of the secure U disk, making the permission management of access control more flexible, and being able to adjust the permission configuration in real time according to the actual use scene, and ensuring that the system always maintains high security in a complex and changeable test environment.

[0103] In some example embodiments, in order to further improve the security of data, as shown in Figure 5As shown, before the two-way identity authentication process of the target secure U disk and the target vehicle test terminal in step S201, the method can further include:

[0104] S501, adjust the current state of the target secure U disk to a locked state.

[0105] Correspondingly, after the two-way identity authentication process of the target secure U disk and the target vehicle test terminal in step S201, the method can further include:

[0106] S503, if the two-way identity authentication result indicates that the authentication is passed, update the current state of the target secure U disk to an enabled state; if the two-way identity authentication result indicates that the authentication is not passed, maintain the current state of the target secure U disk as the locked state.

[0107] Wherein, the secure U disk in the locked state is not available, and the secure U disk in the enabled state is available, after updating the current state of the target secure U disk to the enabled state, the foregoing steps S203 to S207 can be executed, so that tampering of data in the target secure U disk in the two-way identity authentication process can be avoided, and the security of access control is further improved.

[0108] In some exemplary embodiments, continuing to refer to Figure 5 The method can further include:

[0109] S505, when detecting that the target secure U disk is pulled out of the target vehicle test terminal, update the current state of the target secure U disk to an offline state.

[0110] The above embodiments guarantee data security and operation auditability through the state machine mechanism of the secure U disk.

[0111] Corresponding to the access control method provided by the above several embodiments, the embodiment of the application further provides an access control device. Since the access control device provided by the embodiment of the application corresponds to the access control method provided by the above several embodiments, the implementation of the foregoing access control method is also applicable to the access control device provided by the embodiment of the application, which will not be described in detail in the embodiment.

[0112] Please refer to Figure 6 As shown, the access control device provided by the embodiment of the application is a structure schematic diagram of an access control device, which has the function of realizing the access control method in the above method embodiments. The function can be realized by hardware, or the corresponding software can be executed by hardware. As shown Figure 6 The access control device 600 can include:

[0113] The identity authentication module 610 is configured to perform two-way identity authentication processing on the target secure U disk and the target vehicle test terminal when it is detected that the target secure U disk is inserted into the target vehicle test terminal, to obtain a two-way identity authentication result.

[0114] The temporary session key generation module 620 is configured to generate a temporary session key between the target secure U disk and the target vehicle test terminal when the two-way identity authentication result indicates that the authentication is passed.

[0115] The access permission determination module 630 is configured to determine a target access permission of the target secure U disk to the target vehicle test terminal based on permission configuration information corresponding to the target secure U disk, wherein the permission configuration information represents access permissions of the target secure U disk to at least one vehicle test terminal.

[0116] The access operation module 640 is configured to determine an access operation of the target secure U disk to the target vehicle test terminal based on the temporary session key and the target access permission.

[0117] In some example embodiments, the permission configuration information includes first permission configuration information and second permission configuration information, the first permission configuration information represents access permissions of the target secure U disk to at least one preset test vehicle, and the second permission configuration information represents access permissions of the target secure U disk to at least one preset office terminal; and the access permission determination module 630 is specifically configured to:

[0118] In a case where a test connection environment corresponding to the target vehicle test terminal is vehicle-side testing, determine the target access permission of the target secure U disk to the target vehicle test terminal based on the first permission configuration information.

[0119] In a case where a test connection environment corresponding to the target vehicle test terminal is office equipment-side testing, determine the target access permission of the target secure U disk to the target vehicle test terminal based on the second permission configuration information.

[0120] In some example embodiments, the permission configuration information corresponding to the target secure U disk is generated by a cloud management server in response to a use application request for the target secure U disk and is stored in a secure area of the target secure U disk, wherein the use application request carries a vehicle identification code and an office terminal identification, the vehicle identification code is used to identify the preset test vehicle, and the office terminal identification is used to identify the preset office terminal.

[0121] In some example embodiments, the access operation module 640 is specifically configured to: in a case where the target access permission indicates that access is allowed, perform test data interaction between the target secure U disk and the target vehicle test terminal based on the temporary session key.

[0122] In some example embodiments, the apparatus 600 further includes:

[0123] The permission updating module is configured to update the permission configuration information in the target secure U disk based on a permission updating request sent by the cloud management server to the target vehicle test terminal during the test data interaction.

[0124] In some example embodiments, the apparatus 600 further includes:

[0125] The state adjusting module is configured to: before the bidirectional identity authentication processing of the target secure U disk and the target vehicle test terminal, adjust the current state of the target secure U disk to a locked state; and after the bidirectional identity authentication processing of the target secure U disk and the target vehicle test terminal, if the bidirectional identity authentication result indicates that the authentication is passed, update the current state of the target secure U disk to an enabled state; and if the bidirectional identity authentication result indicates that the authentication is not passed, maintain the current state of the target secure U disk as the locked state.

[0126] In some example embodiments, the state adjusting module is further configured to: when detecting that the target secure U disk is pulled out of the target vehicle test terminal, update the current state of the target secure U disk to an offline state.

[0127] It should be noted that the apparatus provided in the above examples, in realizing its functions, only takes the above-mentioned division of each functional module as an example for illustration, and in actual application, the above-mentioned functions can be completed by different functional modules according to needs, that is, the internal structure of the device is divided into different functional modules to complete all or part of the above-described functions. In addition, the apparatus and method embodiments provided in the above examples belong to the same concept, and the specific implementation process is detailed in the method embodiments, which will not be repeated here.

[0128] The electronic device includes a processor and a memory. The memory stores at least one instruction or at least one program. The at least one instruction or the at least one program is loaded and executed by the processor to implement any one of the access control methods provided in the embodiments of the present application.

[0129] The memory can be used to store software programs and modules, and the processor executes various function applications and data processing by running the software programs and modules stored in the memory. The memory can mainly include a program storage area and a data storage area, wherein the program storage area can store an operating system, application programs required by functions, etc., and the data storage area can store data created according to the use of the device, etc. In addition, the memory can include a high-speed random access memory, and can also include a non-volatile memory, such as at least one magnetic disk storage device, a flash memory device, or other volatile solid-state memory device. Accordingly, the memory can also include a memory controller to provide access of the processor to the memory.

[0130] The embodiment of the present application further provides a computer readable storage medium, at least one instruction or at least one program is stored in the computer readable storage medium, the at least one instruction or the at least one program is loaded and executed by the processor to realize any one of the access control methods provided by the embodiment of the present application.

[0131] Optionally, in the embodiment, the storage medium can include but is not limited to a U disk, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk or an optical disk, and various media that can store program codes.

[0132] The embodiment of the present application further provides a computer program product, including a computer program, when the computer program is executed by the processor, any one of the access control methods provided by the embodiment of the present application is realized.

[0133] It should be noted that: the above-mentioned sequence of the embodiments of the present application is only for description, not representing the advantages and disadvantages of the embodiments. And the above-mentioned describes the specific embodiments of the present application. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be executed in different order from the embodiments and still can achieve the desired results. In addition, the processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multi-task processing and parallel processing are possible or can be advantageous.

[0134] Each embodiment in the present specification is described in a progressive manner, and the same or similar parts of each embodiment can be referred to each other, and each embodiment mainly describes the difference from other embodiments. Especially, for the device embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the related parts can be referred to the part of the method embodiments.

[0135] The above provides a detailed introduction to the access control method, device, electronic equipment and storage medium provided by the embodiment of the application. The principle and implementation mode of the application are described in this paper by applying specific examples. The above embodiment is only used to help understand the method and core idea of the application. At the same time, for those skilled in the art, according to the idea of the application, the specific implementation mode and application range will be changed. In conclusion, the content of the specification should not be understood as a limitation of the application.

Claims

1. An access control method characterized by, The method is implemented by a target secure U disk, and the method comprises: When detecting that the target secure U disk is inserted into a target vehicle test terminal, performing bidirectional identity authentication processing on the target secure U disk and the target vehicle test terminal to obtain a bidirectional identity authentication result; the target vehicle test terminal comprises a test vehicle and an office terminal used to implement vehicle testing; If the bidirectional identity authentication result indicates that the authentication is passed, generating a temporary session key between the target secure U disk and the target vehicle test terminal; Based on permission configuration information corresponding to the target secure U disk, determining a target access permission of the target secure U disk to the target vehicle test terminal; the permission configuration information represents an access permission of the target secure U disk to at least one vehicle test terminal; the permission configuration information is generated by a cloud management server in response to a use application request for the target secure U disk and is stored in a secure area of the target secure U disk; wherein the use application request carries a vehicle identification code and an office terminal identification, the vehicle identification code is used to identify a preset test vehicle, and the office terminal identification is used to identify a preset office terminal in a vehicle test scene; the temporary session key is generated based on a preset public parameter generated by the cloud management server and shared among the target secure U disk, the preset test vehicle and the preset office terminal; Based on the temporary session key and the target access permission, determining an access operation of the target secure U disk to the target vehicle test terminal; if the access operation is test data interaction, in the process of the test data interaction, updating the permission configuration information in the target secure U disk based on a permission update request sent by the cloud management server to the target vehicle test terminal.

2. The method of claim 1, wherein, The permission configuration information comprises first permission configuration information and second permission configuration information, the first permission configuration information represents an access permission of the target secure U disk to at least one preset test vehicle, and the second permission configuration information represents an access permission of the target secure U disk to at least one preset office terminal; The method comprises: In a case where a test connection environment corresponding to the target vehicle test terminal is vehicle end testing, determining the target access permission of the target secure U disk to the target vehicle test terminal based on the first permission configuration information; In a case where the test connection environment corresponding to the target vehicle test terminal is office equipment end testing, determining the target access permission of the target secure U disk to the target vehicle test terminal based on the second permission configuration information.

3. The method of claim 1, wherein, The method comprises: In a case where the target access permission indicates that the access is allowed, performing test data interaction between the target secure U disk and the target vehicle test terminal based on the temporary session key.

4. The method according to any one of claims 1 to 3, characterized in that, Before the two-way identity authentication processing on the target secure U disk and the target vehicle test terminal, the method further comprises: adjusting the current state of the target secure U disk to a locked state; After the two-way identity authentication processing on the target secure U disk and the target vehicle test terminal, the method further comprises: if the two-way identity authentication result indicates that the authentication is passed, updating the current state of the target secure U disk to an enabled state; if the two-way identity authentication result indicates that the authentication is not passed, maintaining the current state of the target secure U disk as the locked state.

5. The method of claim 4, wherein, The method further comprises: when detecting that the target secure U disk is pulled out of the target vehicle test terminal, updating the current state of the target secure U disk to an offline state.

6. An access control device, characterized by The device is implemented by a target secure U disk, and the device comprises: an identity authentication module, configured to, when detecting that a target secure U disk is inserted into a target vehicle test terminal, perform two-way identity authentication processing on the target secure U disk and the target vehicle test terminal, and obtain a two-way identity authentication result; the target vehicle test terminal comprises a test vehicle and an office terminal used for implementing vehicle testing; a temporary session key generation module, configured to, when the two-way identity authentication result indicates that the authentication is passed, generate a temporary session key between the target secure U disk and the target vehicle test terminal; an access permission determination module, configured to determine a target access permission of the target secure U disk to the target vehicle test terminal based on permission configuration information corresponding to the target secure U disk; the permission configuration information represents an access permission of the target secure U disk to at least one vehicle test terminal; the permission configuration information is generated by a cloud management server and stored in a secure area of the target secure U disk in response to a use application request for the target secure U disk; the use application request carries a vehicle identification code and an office terminal identification, the vehicle identification code is used to identify a preset test vehicle, and the office terminal identification is used to identify a preset office terminal in a vehicle test scene; the temporary session key is generated based on a preset public parameter generated by the cloud management server and shared among the target secure U disk, the preset test vehicle, and the preset office terminal; an access operation module, configured to determine an access operation of the target secure U disk to the target vehicle test terminal based on the temporary session key and the target access permission; if the access operation is test data interaction, in a process of the test data interaction, the permission configuration information in the target secure U disk is updated based on a permission update request sent by the cloud management server to the target vehicle test terminal.

7. An electronic device, comprising: A device comprises a processor and a memory, the memory stores at least one instruction or at least one program, the at least one instruction or the at least one program is loaded and executed by the processor to implement the access control method in any one of claims 1-5.

8. A computer-readable storage medium, characterized in that, The computer readable storage medium stores at least one instruction or at least one program, which is loaded and executed by the processor to implement the access control method according to any one of claims 1-5.

Images