Communication data encryption method and device, computer readable storage medium and vehicle

Abstract

The invention discloses a communication data encryption method and device, a computer readable storage medium and a vehicle, and relates to the technical field of communication, the method is applied to a domain node of a distributed service system, and the method comprises the following steps: receiving a service request of a client; generating a token key according to the attribute of the client, and determining an access address of the target service based on the service request; and sending the token key and the access address to the client, so that the client carries out authority verification according to the access address, the token key and the level token of the target service, and each service has the access address and the level token. Therefore, according to the method, the level permission is set for service access, permission verification is carried out according to the access address, the token key and the level token of the target service, and the data security of the distributed server system is greatly enhanced.

Description

Technical Field

[0001] This application relates to the field of communication technology, and in particular to a method for encrypting communication data, an encryption device, a computer-readable storage medium, and a vehicle. Background Technology

[0002] Distributed services in intelligent cockpits are a key technology in future automotive electronic architectures. They integrate various functional modules within the cockpit into a collaborative intelligent system through distributed computing and communication technologies. However, many current distributed communications transmit messages in plaintext, which could lead to information leaks and significant security vulnerabilities if someone illegally eavesdrops on network packets. Summary of the Invention

[0003] This application aims to at least partially address one of the technical problems in related technologies. To this end, the first objective of this application is to propose a method for encrypting communication data that significantly enhances the data security of a distributed server system by establishing graded access permissions for service access and verifying permissions based on the access address and token key against the graded token of the target service.

[0004] The second objective of this application is to propose a method for encrypting communication data.

[0005] The third objective of this application is to propose an encryption device for communication data.

[0006] The fourth objective of this application is to provide an encryption device for communication data.

[0007] The fifth objective of this application is to provide a computer-readable storage medium.

[0008] The sixth objective of this application is to propose a vehicle.

[0009] To achieve the above objectives, the first aspect of this application proposes a method for encrypting communication data, applied to a domain node of a distributed service system. The method includes: receiving a service request from a client; generating a token key based on the client's attributes and determining the access address of the target service based on the service request; and sending the token key and access address to the client so that the client can perform permission verification with the level token of the target service based on the access address and token key, wherein each service has an access address and a level token.

[0010] The communication data encryption method according to embodiments of this application is applied to domain nodes of a distributed service system. Upon receiving a service request from a client, the method generates a token key based on the client's attributes, determines the access address of the target service based on the service request, and then sends the token key and access address to the client. The client then uses the access address and token key to verify permissions against the target service's access level token. Each service has an access address and an access level token. Therefore, this method establishes access levels for service access, setting corresponding access permissions for each service to clients in different domains. Only clients with the appropriate permissions can access the corresponding service or perform the corresponding operation, greatly enhancing the data security of the distributed server system.

[0011] In addition, the encryption method for communication data according to the above embodiments of this application may also have the following additional technical features: According to one embodiment of this application, the method for encrypting communication data further includes: receiving a service registration request; assigning an access address to the service according to the registration request; and determining a level token according to the service's business type.

[0012] According to one embodiment of this application, the encryption method for communication data further includes: obtaining a pre-set shared AES key; generating a random initialization vector, and encrypting the registration information using the shared AES (Advanced Encryption Standard) key and the initialization vector to generate ciphertext; sending the ciphertext and the initialization vector to the root node so that the root node can separate the initialization vector and the ciphertext, and perform a decryption operation based on the AES key and the initialization vector to obtain the original plaintext.

[0013] According to one embodiment of this application, the encryption method for communication data further includes: storing a shared AES key and a token key in a trusted execution environment; updating the shared AES key and the token key upon receiving an update key instruction, wherein the trusted execution environment stores the validity period of the shared AES key and the token key, and generates an update key instruction if the validity period is greater than a preset period.

[0014] According to one embodiment of this application, the encryption method for communication data further includes: transmitting data with services and clients within the domain based on a pre-set shared AES key.

[0015] To achieve the above objectives, a second aspect of this application proposes a method for encrypting communication data, applied to a client. The method includes: sending a service request to a domain node; receiving a token key and an access address of a target service, and sending a connection request to the target service based on the access address, so that the target service can perform authorization verification based on the token key; after successfully establishing a connection, encrypting the data using AES based on the token key, and sending the ciphertext to the target service.

[0016] The communication data encryption method according to embodiments of this application, applied to a client, first sends a service request to a domain node. Upon receiving a token key and the access address of the target service, it sends a connection request to the target service based on the access address. This allows the target service to perform authorization verification based on the token key. After successfully establishing a connection, the method performs AES data encryption based on the token key and sends the ciphertext to the target service. Therefore, this method significantly enhances the data security of the distributed server system by establishing access levels for service access, verifying authorization based on the access address and token key against the target service's level token to determine whether to establish communication, and encrypting data based on the token key after communication is established.

[0017] To achieve the above objectives, a third aspect of this application provides an encryption device for communication data, applied to a domain node of a distributed service system. The device includes: a first receiving module for receiving a service request from a client; a determining module for generating a token key based on the client's attributes and determining the access address of the target service based on the service request; and a first sending module for sending the token key and the access address to the client, so that the client can perform permission verification with the level token of the target service based on the access address and the token key, wherein each service has an access address and a level token.

[0018] The communication data encryption device according to an embodiment of this application is applied to a domain node of a distributed service system. In this device, a first receiving module receives a service request from a client, a determining module generates a token key based on the client's attributes, and determines the access address of the target service based on the service request. A first sending module sends the token key and access address to the client, so that the client can perform permission verification against the target service's level token based on the access address and token key. Each service has an access address and a level token. Therefore, this device greatly enhances the data security of the distributed server system by establishing level permissions for service access and verifying permissions against the target service's level token based on the access address and token key.

[0019] To achieve the above objectives, a fourth aspect of this application provides an encryption device for communication data, applied to a client. The device includes: a second sending module for sending a service request to a domain node; a second receiving module for receiving a token key and an access address of a target service; the second sending module is further configured to send a connection request to the target service based on the access address, so that the target service can perform authorization verification based on the token key, and after successfully establishing a connection, perform AES data encryption based on the token key and send the ciphertext to the target service.

[0020] The communication data encryption device according to an embodiment of this application is applied to a client. In this device, a second sending module sends a service request to a domain node, and a second receiving module receives a token key and the access address of the target service. The second sending module is also used to send a connection request to the target service based on the access address, so that the target service can perform authorization verification based on the token key. After successfully establishing a connection, the device performs AES data encryption based on the token key and sends the ciphertext to the target service. Therefore, this device greatly enhances the data security of the distributed server system by establishing access levels for service access, verifying authorization based on the access address and token key against the target service's level token to determine whether to establish communication, and encrypting data based on the token key after communication is established.

[0021] To achieve the above objectives, a fifth aspect of this application provides a computer-readable storage medium storing a computer program, wherein the computer program, when executed by a processor, implements the encryption method for communication data described above.

[0022] The computer-readable storage medium according to the embodiments of this application implements the above-described method for encrypting communication data when the computer program stored therein is executed by a processor. Based on the above-described method for encrypting communication data, the data security of the distributed server system is greatly enhanced by establishing access levels for service access.

[0023] To achieve the above objectives, a sixth aspect of this application provides a vehicle comprising: a memory, a processor, and an encryption program for communication data stored in the memory and executable on the processor; when the processor executes the encryption program for communication data, it implements the above-described method for encrypting communication data.

[0024] According to the embodiments of this application, when the processor executes the encryption program for communication data, the above-mentioned encryption method for communication data is implemented. Based on the above-mentioned encryption method for communication data, the data security of the vehicle is greatly enhanced by establishing graded permissions for service access.

[0025] Additional aspects and advantages of this application will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of this application. Attached Figure Description

[0026] Figure 1 This is a schematic diagram of the architecture of a distributed service system according to an embodiment of this application; Figure 2 This is a flowchart illustrating a method for encrypting communication data of domain nodes in a distributed service system according to an embodiment of this application; Figure 3 This is a flowchart of a method for encrypting communication data applied to a client according to an embodiment of this application; Figure 4 This is an interactive schematic diagram of a method for encrypting communication data according to a specific embodiment of this application.

[0027] Figure 5 This is a connection diagram of an encryption device for communication data of domain nodes in a distributed service system according to an embodiment of this application; Figure 6 This is a schematic diagram of the connection of an encryption device for information data applied to a client according to an embodiment of this application; Figure 7 This is a block diagram of a vehicle according to one embodiment of the present application. Detailed Implementation

[0028] The embodiments of this application are described in detail below. Examples of these embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and intended to explain this application, and should not be construed as limiting this application.

[0029] The following description, with reference to the accompanying drawings, outlines a method for encrypting communication data, an encryption device, a computer-readable storage medium, and a vehicle according to embodiments of this application.

[0030] The encryption method for communication data in this application embodiment is applied to a domain node of a distributed service system.

[0031] Specifically, with Figure 1 For example, we will illustrate the concept of a distributed service system.

[0032] Figure 1This diagram illustrates an SOA (Service-Oriented Architecture) connection between various domains within an in-vehicle system. Each domain has a ServiceManager / domain node responsible for managing the services and clients within that domain. The entire SOA architecture has only one SuperManager / root node, deployed in the most stable domain. The SuperManager is the parent of the ServiceManagers, and each ServiceManager reports the status of its domain's services and clients to the SuperManager. Within a domain, services register and publish their service capabilities with the ServiceManager, and clients request service addresses from the ServiceManager to make service requests. The TEE OS (Trusted Execution Environment Operating System) runs in the intelligent cockpit domain. Its function is to store the AES keys used for channel encryption and the tokens generated for client-server data encryption, ensuring key security. It also manages the lifecycle of the token keys and random keys.

[0033] Figure 2 This is a flowchart of a method for encrypting communication data applied to a client according to an embodiment of this application.

[0034] like Figure 2 As shown, the encryption method for communication data in this application embodiment includes: S101, A service request was received from the client; In other words, when a client requests a service from the service management terminal, i.e., the domain node, it sends the corresponding service request.

[0035] S102, Generate a token key based on the client's attributes, and determine the access address of the target service based on the service request; Specifically, upon receiving a service request, the system identifies the request to obtain the attributes of the client that sent the request, such as the client's UID (User Identifier) ​​and GID (Group Identifier). A token key is generated based on the client's attributes for encrypted communication between the client and the server. Finally, the system determines the target service the user wishes to execute based on the service request and obtains the access address for that target service.

[0036] S103, send the token key and access address to the client so that the client can perform permission verification with the level token of the target service based on the access address and token key, wherein each service has an access address and level token.

[0037] In other words, the token key and access address are sent to the client. The client verifies the access address and token key against the target service's level token. Only after the permission verification is successful can the client access the target service; otherwise, the client has no permission to access it, thereby improving the data security of the distributed service system.

[0038] In some embodiments of this application, the method for encrypting communication data further includes: receiving a service registration request; assigning an access address to the service according to the registration request; and determining a level token according to the service's business type.

[0039] In other words, once a service is written, it must be registered with a domain node before it can be addressed and used by clients. The service registers with the domain node, and after receiving the service registration request, the domain node will assign the service an address that can be accessed by clients as the access address for the service, and set a level token according to the service level.

[0040] Service levels can be categorized based on actual circumstances. Figure 1 In the system architecture of the vehicle shown, the service level can be divided into five levels from low to high, such as classifying the autonomous driving / power domain as SL5 and the infotainment service as SL1.

[0041] In one embodiment of this application, the encryption method for communication data further includes: obtaining a pre-set shared AES key; generating a random initialization vector, and encrypting the registration information using the shared AES key and the initialization vector to generate ciphertext; sending the ciphertext and the initialization vector to the root node so that the root node can separate the initialization vector and the ciphertext, and perform a decryption operation based on the AES key and the initialization vector to obtain the original plaintext.

[0042] Specifically, the domain node first obtains a shared AES key pre-negotiated with the root node. Then, the domain node generates a random, unpredictable initialization vector and uses the obtained shared AES key and the generated random initialization vector to encrypt the original registration information (plaintext). The domain node sends the generated ciphertext and the initialization vector to the root node. Upon receiving the data packet, the root node first separates the initialization vector and the ciphertext. Using the same shared AES key as the sender and the separated IV, the root node decrypts the received ciphertext to obtain the original plaintext.

[0043] In other words, in this embodiment, when a client requests a service from the service management node, the service management node generates a corresponding level token based on the client's attributes. For the server, this token is used for data encryption; for the client, it is used for decryption. Furthermore, the data transmission between domain nodes and the root node employs end-to-end channel encryption, which is not plaintext, greatly enhancing data security and tamper resistance. This also avoids the performance overhead caused by frequent encryption and decryption, enabling rapid processing of large amounts of data and significantly improving the trunk's high-speed and efficient data transmission capabilities.

[0044] In one embodiment of this application, the encryption method for communication data further includes: storing a shared AES key and a token key in a trusted execution environment; updating the shared AES key and the token key upon receiving an update key instruction, wherein the trusted execution environment stores the validity period of the shared AES key and the token key, and generates an update key instruction if the validity period is greater than a preset period.

[0045] In other words, the key consists of two parts: a token and a random key (shared AES key). All data encryption tokens and channel encryption random keys are stored in the TEE OS to ensure key security and manage the key's lifecycle. For example, with a preset period of 7 days, as the key nears expiration, the key management terminal (TEE) updates its cache and notifies the relevant users to update their keys. Once the key management terminal confirms that the user has received the new key, the old key becomes invalid, and both parties use the new key.

[0046] In one embodiment of this application, the encryption method for communication data further includes: transmitting data with services and clients within the domain based on a pre-set shared AES key.

[0047] In other words, the same shared AES key can be pre-configured on both the service and the client. The sender retrieves the pre-set shared AES key from secure storage, generates a random initialization vector, and then uses the AES key and initialization vector to encrypt the plaintext data, generating ciphertext. The ciphertext and initialization vector are then sent to the receiver. The receiver also retrieves the same shared AES key, separates the initialization vector and ciphertext from the received data, and uses the AES key and initialization vector to decrypt the ciphertext, restoring the original plaintext.

[0048] In summary, the communication data encryption method according to the embodiments of this application is applied to domain nodes of a distributed service system. Upon receiving a service request from a client, the method generates a token key based on the client's attributes, determines the access address of the target service based on the service request, and then sends the token key and access address to the client. The client then uses the access address and token key to verify permissions against the target service's level token. Each service has an access address and a level token. Therefore, this method establishes a hierarchical permission system for service access, setting corresponding access permissions for each service to clients in different domains. Only clients with the appropriate permissions can access the corresponding service or perform the corresponding operation, significantly enhancing the data security of the distributed server system.

[0049] Corresponding to the above embodiments, this application also proposes a method for encrypting communication data.

[0050] The encryption method for communication data in this application embodiment is applied to the client.

[0051] Combination Figure 3 The encryption method for communication data in this application includes: S201, Send a service request to the domain node; S202, Receive the token key and the access address of the target service, and send a connection request to the target service based on the access address so that the target service can perform authorization verification based on the token key; S203 After successfully establishing a connection, AES data encryption is performed based on the token key, and the ciphertext is sent to the target service.

[0052] As a specific embodiment of this application, Figure 1 Taking the distributed service system shown as an example, combined with Figure 4 The specific implementation method of the encryption of this communication data is as follows: 1. In Figure 1 In this architecture, each domain has a ServiceManager / domain node, responsible for managing the services and clients within that domain. The entire SOA architecture has one and only one SuperManager / root node, deployed in the most stable domain. The SuperManager is the parent of the ServiceManagers, and each ServiceManager reports the status of its domain's services and clients to the SuperManager. Within the domain, services register and publish their service capabilities with the ServiceManager, and clients request service addresses from the ServiceManager to make service requests. 2. The TEE OS runs in the intelligent cockpit domain. Its function is to store the shared AES key used for channel encryption and the token data generated for client-server data encryption, thereby ensuring key security. It also manages the lifecycle of the token key and the random key.

[0053] 3. Channel Encryption. Communication between domain nodes, between the ServiceManager and the root SuperManager, uses channel encryption. The encryption method is AES symmetric encryption, and the key is a 128-bit random number. This key is a periodic key that automatically expires and is replaced by a new key generated by the Key Management Entity (TEE).

[0054] 4. Service Level and Token Generation. Each ServiceManager runs a service level policy with two functions: First, it configures an access level permission for each Service within the domain (5 levels in total, T1 to T5, with T5 being the highest; permission is divided based on intra-domain and inter-domain, and can be set according to business needs); Second, it generates a level access token based on the domain to which the Client belongs, as well as the Uid (user ID) and Gid (group, which can be understood as domain ID). The token is a randomly generated 128-character string, and the configuration policy records which level the token belongs to and stores the token in the TEE OS. 5. Service Address Request. Once a Service is written, it must be registered with the ServiceManager in order to be addressed and used by clients. As shown in Figure 4, firstly, the Service registers with the ServiceManager. The ServiceManager will assign this service an address that can be accessed by the client and set a level token according to the service level policy. 6. Client permission generation strategy. When a client makes a service request to the ServiceManager, the ServiceManager generates an access token according to the client permission generation strategy and returns the address of the requested service; 7. Data Encryption. After obtaining the service address and token, the client requests a connection based on the address. The service determines whether it has permission based on the client token. If it does, a connection can be established for data exchange. During data transmission, both parties use the client token as the key to encrypt the data using AES to prevent plaintext transmission. After the service receives the data, it uses the token to decrypt it in reverse. 8. Five Safety Levels. Abbreviations SL1 to SL5, with SL5 being the highest and SL1 the lowest. The level classification is as follows: SL5: Autonomous Driving / Powertrain Domain: Functions related to driving safety; SL4: Gateway and Personal Privacy Information: Privacy information such as personal account / facial information / payment information; SL3: Commonly used user functions: such as navigation / voice / telephone; SL2: Non-driving safety related vehicle control and device services: such as opening the sunroof; SL1: Infotainment services: such as turning on music.

[0055] Therefore, the encryption method for this communication data includes the following characteristics: 1. Hybrid Encryption Method. This scheme employs a hybrid encryption method combining data encryption and channel encryption. The data encryption key is a token (128-bit random string) generated during the client's data request to the server, and the algorithm uses AES symmetric encryption, used for communication between the client and the server. Channel encryption uses end-to-end encryption on the link, also using AES encryption, with a randomly generated key. Both ends use the same key for encryption and decryption, used for communication between domain nodes and the root node.

[0056] 2. Key Lifecycle Management. A key consists of two parts: a token and a random key. The default validity period is 7 days. Nearing expiration, the Key Management Equipment (TEE) updates its cache and notifies the relevant users to update their keys. Once the TEE confirms that the user has received the new key, the old key becomes invalid, and both parties use the new key.

[0057] 3. TEE OS storage security mechanism. All data encryption tokens and channel encryption random keys are stored in TEE storage. TEE ensures key security and manages the key lifecycle.

[0058] 4. Service Level Policy. This policy defines services into five levels (see point 8 below for details on implementation). It runs on the service management platform, generating a level token when a service registers with the platform. Higher levels offer higher security. For example, services in the powertrain / autonomous driving domain, which are related to driving safety, will have a very high access level. Services in the intelligent cockpit domain, which involve entertainment, will have a lower access level.

[0059] 5. Client Permission Generation Strategy. Clients can obtain five levels of permissions, corresponding to service levels. When a client requests a service from the service management system, the system generates an access token of the corresponding level based on the client's attributes (UID / GID). Clients with the same or higher level permissions can access the corresponding service; otherwise, they lack access.

[0060] Therefore, this embodiment, based on data encryption, can ensure that the data transmitted in the distributed service access system is legitimate and free from the potential risk of being tampered with or replaced. At the same time, it establishes permission levels for data access and execution operations, and only those with authorized permissions can access the corresponding services / execute the corresponding operations, which greatly improves the security operation capability of the distributed system.

[0061] In summary, the communication data encryption method according to the embodiments of this application, applied to a client, first sends a service request to the domain node. Upon receiving the token key and the access address of the target service, it sends a connection request to the target service based on the access address, so that the target service can perform authorization verification based on the token key. After successfully establishing a connection, it performs AES data encryption based on the token key and sends the ciphertext to the target service. Therefore, this method significantly enhances the data security of the distributed server system by establishing access levels for service access, verifying authorization based on the access address and token key against the target service's level token to determine whether to establish communication, and encrypting data based on the token key after communication is established.

[0062] Corresponding to the above embodiments, this application also proposes an encryption device for communication data.

[0063] The encryption device for communication data in this application embodiment is applied to a domain node of a distributed service system.

[0064] like Figure 5 As shown, the encryption device for communication data in this application embodiment includes: a first receiving module 101, a determining module 102, and a first sending module 103.

[0065] The first receiving module 101 is used to receive the service request from the client; the determining module 102 is used to generate a token key according to the client's attributes and determine the access address of the target service based on the service request; the first sending module 103 is used to send the token key and the access address to the client so that the client can perform permission verification with the level token of the target service according to the access address and the token key, wherein each service has an access address and a level token.

[0066] According to one embodiment of this application, the encryption device for communication data further includes: a service registration module, configured to: receive a service registration request; assign an access address to the service according to the registration request; and determine a level token according to the service's business type.

[0067] According to one embodiment of this application, the encryption device for communication data further includes: a communication module, configured to: obtain a pre-set shared AES key; generate a random initialization vector, and encrypt the registration information using the shared AES key and the initialization vector to generate ciphertext; send the ciphertext and the initialization vector to the root node, so that the root node can separate the initialization vector and the ciphertext, and perform a decryption operation based on the AES key and the initialization vector to obtain the original plaintext.

[0068] According to one embodiment of this application, the encryption device for communication data further includes: a key management module, configured to: store a shared AES key and a token key based on a trusted execution environment; and update the shared AES key and the token key upon receiving an update key instruction, wherein the trusted execution environment stores the validity period of the shared AES key and the token key, and generates an update key instruction if the validity period is greater than a preset period.

[0069] According to one embodiment of this application, the communication module is also used to: transmit data with services and clients within the domain based on a pre-set shared AES key.

[0070] It should be noted that for details not disclosed in the encryption device for communication data in the embodiments of this application, please refer to the details disclosed in the encryption method for communication data in the above embodiments of this application, which will not be repeated here.

[0071] The communication data encryption device according to an embodiment of this application is applied to a domain node of a distributed service system. In this device, a first receiving module receives a service request from a client, a determining module generates a token key based on the client's attributes, and determines the access address of the target service based on the service request. A first sending module sends the token key and access address to the client, so that the client can perform permission verification against the target service's level token based on the access address and token key. Each service has an access address and a level token. Therefore, this device greatly enhances the data security of the distributed server system by establishing level permissions for service access and verifying permissions against the target service's level token based on the access address and token key.

[0072] Corresponding to the above embodiments, this application also proposes an encryption device for communication data.

[0073] The encryption device for communication data in this application embodiment is applied to the client.

[0074] like Figure 6As shown, the encryption device for communication data in this application embodiment includes: a second sending module 201, used to send a service request to a domain node; a second receiving module 202, used to receive a token key and an access address of a target service; the second sending module 201 is also used to send a connection request to the target service based on the access address, so that the target service can perform authorization verification based on the token key, and after successfully establishing a connection, perform AES data encryption based on the token key and send the ciphertext to the target service.

[0075] It should be noted that for details not disclosed in the encryption device for communication data in the embodiments of this application, please refer to the details disclosed in the encryption method for communication data in the above embodiments of this application, which will not be repeated here.

[0076] The communication data encryption device according to an embodiment of this application is applied to a client. In this device, a second sending module sends a service request to a domain node, and a second receiving module receives a token key and the access address of the target service. The second sending module is also used to send a connection request to the target service based on the access address, so that the target service can perform authorization verification based on the token key. After successfully establishing a connection, the device performs AES data encryption based on the token key and sends the ciphertext to the target service. Therefore, this device greatly enhances the data security of the distributed server system by establishing access levels for service access, verifying authorization based on the access address and token key against the target service's level token to determine whether to establish communication, and encrypting data based on the token key after communication is established.

[0077] Corresponding to the above embodiments, this application also proposes a computer-readable storage medium.

[0078] The computer-readable storage medium of this application embodiment stores a computer program, wherein the computer program, when executed by a processor, implements the encryption method for communication data described above.

[0079] The computer-readable storage medium according to the embodiments of this application implements the above-described method for encrypting communication data when the computer program stored therein is executed by a processor. Based on the above-described method for encrypting communication data, the data security of the distributed server system is greatly enhanced by establishing access levels for service access.

[0080] Corresponding to the above embodiments, this application also proposes a vehicle.

[0081] like Figure 7 As shown, the vehicle 100 in this embodiment includes a memory 110, a processor 120, and an encryption program for communication data stored in the memory 110 and executable on the processor 120. When the processor 120 executes the encryption program for communication data, it implements the above-described encryption method for communication data.

[0082] According to the embodiments of this application, when the processor executes the encryption program for communication data, the above-mentioned encryption method for communication data is implemented. Based on the above-mentioned encryption method for communication data, the data security of the vehicle is greatly enhanced by establishing graded permissions for service access.

[0083] It should be noted that the logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing logical functions, and can be specifically implemented in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus, or device (such as a computer-based system, a processor-included system, or other system that can fetch and execute instructions from, an instruction execution system, apparatus, or device). For the purposes of this specification, "computer-readable medium" can be any means that can contain, store, communicate, propagate, or transmit programs for use by, or in conjunction with, an instruction execution system, apparatus, or device. More specific examples (a non-exhaustive list) of computer-readable media include: an electrical connection having one or more wires (electronic device), a portable computer disk drive (magnetic device), random access memory (RAM), read-only memory (ROM), erasable and editable read-only memory (EPROM or flash memory), fiber optic devices, and portable optical disc read-only memory (CDROM). Alternatively, the computer-readable medium may be paper or other suitable media on which the program can be printed, since the program can be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, interpreting, or otherwise processing as necessary, and then stored in a computer memory.

[0084] It should be understood that various parts of this application can be implemented using hardware, software, firmware, or a combination thereof. In the above embodiments, multiple steps or methods can be implemented using software or firmware stored in memory and executed by a suitable instruction execution system. For example, if implemented in hardware, as in another embodiment, it can be implemented using any one or a combination of the following techniques known in the art: discrete logic circuits having logic gates for implementing logical functions on data signals, application-specific integrated circuits (ASICs) having suitable combinational logic gates, programmable gate arrays (PGAs), field-programmable gate arrays (FPGAs), etc.

[0085] In the description of this specification, the references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of this application. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.

[0086] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of that feature. In the description of this application, "multiple" means at least two, such as two, three, etc., unless otherwise explicitly specified.

[0087] In this application, unless otherwise expressly specified and limited, the terms "installation," "connection," "joining," and "fixing," etc., should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral part; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or an indirect connection through an intermediate medium; they can refer to the internal communication of two components or the interaction between two components, unless otherwise expressly limited. Those skilled in the art can understand the specific meaning of the above terms in this application according to the specific circumstances.

[0088] Although embodiments of this application have been shown and described above, it is understood that the above embodiments are exemplary and should not be construed as limiting this application. Those skilled in the art can make changes, modifications, substitutions and variations to the above embodiments within the scope of this application.

Claims

1. A method for encrypting communication data, characterized in that, The method, applied to domain nodes in a distributed service system, includes: Received a service request from the client; Generate a token key based on the client's attributes, and determine the access address of the target service based on the service request; The token key and the access address are sent to the client so that the client can perform permission verification with the level token of the target service based on the access address and the token key, wherein each service has an access address and a level token.

2. The encryption method for communication data according to claim 1, characterized in that, The method further includes: Receive service registration request; The service is assigned an access address based on the registration request, and a level token is determined based on the service's business type.

3. The method for encrypting communication data according to claim 1, characterized in that, The method further includes: Obtain the pre-set shared AES key; A random initialization vector is generated, and the registration information is encrypted using the shared AES key and the initialization vector to generate ciphertext; The ciphertext and the initialization vector are sent to the root node so that the root node can separate the initialization vector and the ciphertext, and perform a decryption operation based on the AES key and the initialization vector to obtain the original plaintext.

4. The method for encrypting communication data according to claim 3, characterized in that, The method further includes: The shared AES key and the token key are stored in a trusted execution environment. Upon receiving an update key instruction, the shared AES key and the token key are updated. The trusted execution environment stores and monitors the validity period of the shared AES key and the token key. If the validity period is greater than a preset period, an update key instruction is generated.

5. The method for encrypting communication data according to claim 1, characterized in that, The method further includes: Data is transmitted with services and clients within the domain based on a pre-configured shared AES key.

6. A method for encrypting communication data, characterized in that, Applied to a client, the method includes: Send a service request to the domain node; Receive the token key and the access address of the target service, and send a connection request to the target service based on the access address so that the target service can perform permission verification based on the token key; After a successful connection is established, AES data encryption is performed based on the token key, and the ciphertext is sent to the target service.

7. A device for encrypting communication data, characterized in that, The device, used in domain nodes of a distributed service system, includes: The first receiving module is used to receive service requests from clients; The determination module is used to generate a token key based on the client's attributes and determine the access address of the target service based on the service request; The first sending module is used to send the token key and the access address to the client, so that the client can perform permission verification with the level token of the target service based on the access address and the token key, wherein each service has an access address and a level token.

8. A device for encrypting communication data, characterized in that, Applied to a client, the device includes: The second sending module is used to send service requests to domain nodes; The second receiving module is used to receive the token key and the access address of the target service; The second sending module is further configured to send a connection request to the target service based on the access address, so that the target service can perform authorization verification based on the token key, and after successfully establishing a connection, perform AES data encryption based on the token key and send the ciphertext to the target service.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, wherein the computer program, when executed by a processor, implements the encryption method for communication data as described in any one of claims 1 to 6.

10. A vehicle, characterized in that, include: The method includes a memory, a processor, and an encryption program for communication data stored in the memory and executable on the processor. When the processor executes the encryption program for the communication data, it implements the method for encrypting communication data according to any one of claims 1-6.

Images