Vehicle data sharing method and system based on quantum key and proxy re-encryption

Abstract

The application relates to the technical field of quantum cryptography communication, and discloses a vehicle data sharing method and system based on a quantum key and proxy re-encryption. The method comprises the following steps: S1, a quantum key infrastructure injects a quantum seed into a vehicle-mounted privacy proxy; S2, the vehicle-mounted privacy proxy acquires vehicle privacy data, encrypts the vehicle privacy data into ciphertext data, packs the key ciphertext and the ciphertext data into an original ciphertext object; S3, the quantum key infrastructure receives a data sharing request of a data consumer end, forwards the data sharing request to a vehicle owner end, and receives an authorization credential of the vehicle owner end; S4, the vehicle-mounted privacy proxy sends a new ciphertext object to the data consumer end; and S5, the data consumer end accesses the vehicle-mounted privacy proxy through a URL to acquire the ciphertext data and decrypts the ciphertext data to obtain the vehicle privacy data, so that the sharing of the vehicle privacy data is completed. The application can consider both quantum security and cross-domain lightweight conversion of vehicle privacy data, and improves the security of vehicle data sharing.

Description

Technical Field

[0001] This invention relates to the field of quantum cryptography communication technology, specifically a vehicle data sharing method and system based on quantum keys and proxy re-encryption. Background Technology

[0002] Research on Internet of Vehicles (IoV) information security has formed a comprehensive protection system with multiple dimensions and the entire chain, fully covering core aspects such as architecture and protocols, communication encryption, data encryption and privacy protection, and hardware security components.

[0003] The flow of vehicle privacy data across vehicles, mobile devices, the cloud, and even third-party nodes is becoming increasingly open, creating a structural contradiction between the data owner's control and the efficiency of multi-node circulation. At the same time, the expectation that quantum computing can break classical public-key cryptography systems continues to increase, posing a fundamental security threat to existing encryption schemes based on the Rivest–Shamir–Adleman algorithm (RSA) and elliptic curve cryptography (ECC).

[0004] Traditional "decrypt-reencrypt" sharing models suffer from drawbacks such as the short-lived plaintext state, complex key distribution, and high computational overhead on the owner's side, making it difficult to simultaneously meet the dual requirements of strong quantum security and efficient cross-domain sharing. While proxy reencryption technology can achieve offline authorization and lightweight sharing by converting ciphertext in the cloud, its underlying key protection still relies on traditional cryptographic assumptions and is equally vulnerable to quantum threats. Summary of the Invention

[0005] To address the technical problems existing in the prior art, this invention provides a vehicle data sharing method and system based on quantum key distribution and proxy re-encryption, which can balance the quantum-resistant security of vehicle privacy data and lightweight cross-domain conversion, thereby improving the security of vehicle data sharing.

[0006] To achieve the above objectives, the present invention provides the following technical solution: This invention discloses a vehicle data sharing method based on quantum key distribution and proxy re-encryption, comprising: S1. Quantum key infrastructure injects quantum seeds into in-vehicle privacy agents and issues quantum identity certificates containing public keys to data consumers. S2. After the vehicle is powered on, the in-vehicle privacy agent establishes a communication with the quantum key infrastructure based on the quantum seed to obtain the session quantum key; obtains vehicle privacy data, generates a one-time key, and encrypts the vehicle privacy data into ciphertext data; uses the session quantum key to encrypt the one-time key to obtain the key ciphertext; and packages the key ciphertext and the ciphertext data into the original ciphertext object. S3. The quantum key infrastructure receives data sharing requests from data consumers, verifies the quantum identity certificate, forwards the data sharing request to the vehicle owner, and receives the authorization credentials from the vehicle owner and sends them to the in-vehicle privacy agent. S4. The vehicle privacy agent receives the authorization credentials and sends the key header containing the key ciphertext to the agent re-encryption service node. The agent re-encryption service node requests the session quantum key from the quantum key infrastructure, decrypts the key ciphertext to obtain the one-time key, and re-encrypts the one-time key using the encryption public key of the data consumer to obtain the updated key ciphertext. The access address of the ciphertext data body and the updated key ciphertext are assembled into a new ciphertext object and sent to the data consumer. S5. The data consumer decrypts the new ciphertext object to obtain the access address and one-time key of the ciphertext data body. It then obtains the ciphertext data body through the access address and decrypts it to obtain the vehicle privacy data, thus completing the sharing of vehicle privacy data.

[0007] Preferably, the in-vehicle privacy agent establishes a call with the quantum key infrastructure based on the quantum seed after the vehicle is powered on, and obtains the session quantum key specifically includes: The in-vehicle privacy agent (VPA) generates random challenge numbers after the vehicle is powered on. And random challenge number The vehicle's VIN code is sent to the quantum key infrastructure (QKI); QKI retrieves the corresponding quantum seed for a vehicle based on its VIN code. Using quantum seeds Encrypted Random Challenge Number and session quantum key Constructing a structure containing quantum seeds Encrypted random challenge number and session quantum key The response packet is sent to the in-vehicle privacy agent (VPA); In-vehicle privacy agent VPA via quantum seed Decrypt the response packet to obtain the random challenge number from the response packet. The verification process is then completed. Upon successful verification, a session is established with QKI, and the session quantum key is obtained. .

[0008] Preferably, the QKI retrieves the quantum seed corresponding to the vehicle based on the vehicle's VIN code. Specifically, it includes: Quantum seed for computing in-vehicle privacy agent The hash value is used as the seed fingerprint; QKI will use quantum seeds Vehicle VIN code and seed fingerprint are written into an encrypted database to generate a vehicle quantum seed ledger; QKI retrieves the corresponding quantum seed for a vehicle from the vehicle quantum seed register based on the vehicle's VIN code. .

[0009] Preferably, S3 specifically includes: S301, The data consumer terminal (DC) construct includes the target vehicle's VIN code and the target's original encrypted object. The data consumer's (DC) quantum identity certificate and the signed sharing request message are sent to the quantum key infrastructure (QKI). S302, QKI receives and verifies the signature of the sharing request message and the validity of the quantum identity certificate, and then queries whether the data consumer has the authorization credentials for the target vehicle. If not, it encapsulates the sharing request message into an authorization query and sends it to the vehicle owner; if so, it executes S305. S303: The vehicle owner receives the authorization request, sets the authorization rules, generates the authorization credential, signs it, and sends it to QKI; S304, QKI receives authorization credentials; S305 and QKI send authorization credentials to the in-vehicle privacy agent.

[0010] Preferably, the process by which the proxy re-encryption service node requests the session quantum key from the quantum key infrastructure and decrypts the key ciphertext to obtain the one-time key specifically includes: The key header contains an authorization credential signed by the vehicle owner. The proxy re-encryption service node PREN verifies the signature of the authorization credential in the key header. After successful verification, it requests the session quantum key from the quantum key infrastructure (QKI). Quantum Key Infrastructure (QKI) returns the transport public key to the PREN (Proximity Re-encryption Service Node) via a proxy. Encrypted session quantum key ; The proxy re-encryption service node PREN uses the transmission private key. Decryption yields the session quantum key .

[0011] Preferably, when there are multiple data consumers making shared data requests, The proxy re-encryption service node PREN obtains each data consumer from the quantum key infrastructure (QKI). public key ; PREN for one-time keys Use each data consumer end public key Encrypt the updated key ciphertext : PREN assembles the new encrypted object. New encrypted object include and the access address of the ciphertext data body, and the new ciphertext object Send them to the corresponding data consumers respectively. .

[0012] Preferably, when the new encrypted object After being sent to the data consumer (DC), it also includes: PREN will record this operation in the anti-tampering log.

[0013] Preferably, the encrypted data body is stored in an in-vehicle privacy agent or a cloud control platform; The data consumer obtains encrypted data from the in-vehicle privacy agent or cloud control platform by accessing the address and then decrypts it to obtain vehicle privacy data.

[0014] This invention also proposes a vehicle data sharing system based on quantum key distribution and proxy re-encryption, comprising: Quantum key infrastructure for injecting quantum seeds into in-vehicle privacy agents; issuing quantum identity certificates containing public keys for data consumers; The in-vehicle privacy agent is used to establish a communication with the quantum key infrastructure based on a quantum seed after the vehicle is powered on, obtain a session quantum key; obtain vehicle privacy data, generate a one-time key and encrypt the vehicle privacy data into a ciphertext data body; use the session quantum key to encrypt the one-time key to obtain the key ciphertext; and package the key ciphertext and the ciphertext data body into an original ciphertext object. The quantum key infrastructure is also used to receive data sharing requests from data consumers, verify the quantum identity certificate, forward the data sharing request to the vehicle owner, and receive the authorization credentials from the vehicle owner to send to the in-vehicle privacy agent. The vehicle owner's terminal is used to receive data sharing requests sent by the quantum key infrastructure and send authorization credentials to the quantum key infrastructure after authorization is approved; The in-vehicle privacy agent is also used to receive authorization credentials sent by the quantum key infrastructure and send a key header containing the key ciphertext to the agent re-encryption service node; The proxy re-encryption service node is used to request the session quantum key from the quantum key infrastructure, decrypt the key ciphertext to obtain the one-time key, and re-encrypt the one-time key using the encryption public key of the data consumer to obtain the updated key ciphertext. The access address of the ciphertext data body and the updated key ciphertext are assembled into a new ciphertext object and sent to the data consumer. On the data consumer side, it is used to send data sharing requests; it receives new ciphertext objects sent by the proxy re-encryption service node, decrypts the new ciphertext objects to obtain the access address and one-time key of the ciphertext data body, obtains the ciphertext data body through the access address and decrypts it to obtain vehicle privacy data, thus completing the sharing of vehicle privacy data.

[0015] The present invention also proposes a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements any of the steps of a vehicle data sharing method based on quantum key distribution and proxy re-encryption.

[0016] Compared with the prior art, the beneficial effects of the present invention are: (1) The vehicle data sharing method and system based on quantum key distribution and proxy re-encryption proposed in this invention protects the shared transmission of vehicle privacy data between the vehicle and the data consumer through a deep integration of quantum key distribution and proxy re-encryption. The vehicle only performs symmetric encryption operations, and the public key re-encryption operation is completely offloaded to the proxy re-encryption service node, which effectively improves the lightweight adaptability of vehicle privacy data storage and encryption on the vehicle. The proxy re-encryption service node only handles key layer conversion and does not touch the plaintext data throughout the process, which solves the problems of quantum computing attacks and single point of failure threats that may be faced during transmission and sharing.

[0017] (2) Before the vehicle leaves the factory, a unique quantum seed is injected into the vehicle privacy agent through the quantum key infrastructure in a physically isolated manner, and a "vehicle quantum seed ledger" is formed within the quantum key infrastructure. This process is equivalent to completing vehicle identity registration and key pre-setting, which can provide a root of trust for the secure derivation of quantum session keys while achieving fast and secure identity verification in the future.

[0018] (3) The vehicle sends its vehicle identifier and random challenge number to the quantum key infrastructure. The quantum key infrastructure retrieves the corresponding quantum seed through the vehicle identifier, encrypts the random challenge number and the newly generated session quantum key with the quantum seed, and returns it to the vehicle. The vehicle decrypts and verifies the data using the quantum seed within the trusted execution environment. In this process, the session key used to encrypt the data is a random quantum key, and the quantum seed protecting the session key is not transmitted over the network but appears only in ciphertext form on the line, ensuring the reliability of key distribution.

[0019] (4) When a data consumer wants to view encrypted data, it needs to initiate a signature request to the quantum key infrastructure and obtain dynamic authorization from the vehicle owner's mobile terminal. The vehicle owner's terminal provides an instruction to "authorize". After receiving the authorization credential, the proxy re-encryption node requests the encrypted form of the session quantum key from the quantum key infrastructure, decrypts it in the hardware security module to obtain the session key, and then decrypts the data encryption key. It then re-encrypts the data using the data consumer's public key and distributes it to the consumer. In this process, neither the vehicle terminal nor the consumer terminal participates in key tracing and re-encryption operations. The authorization credential and ciphertext conversion are completed independently by the proxy node, ensuring the reliability of key security.

[0020] (5) After being encrypted with a data encryption key, the privacy data is directly transmitted between the vehicle and the cloud control platform. The encrypted data body is never re-encrypted, ensuring data storage consistency. After obtaining the converted key header, the data consumer retrieves the encrypted data body from the vehicle or cloud control platform according to the storage location, decrypts the key header with its own private key to obtain the data encryption key, and then uses it to decrypt the data body. During this process, the cloud only stores the encrypted data and does not hold or obtain any decryption keys. Only the key header protected by quantum key and the encrypted data body exist on the network path, and each ciphertext conversion operation is recorded with an anti-tampering log, ensuring the security and traceability of privacy data transmission and sharing. Attached Figure Description

[0021] Figure 1 This is a flowchart of the vehicle data sharing method based on quantum key distribution and proxy re-encryption proposed in Embodiment 1 of the present invention.

[0022] Figure 2 This is a block diagram of the vehicle data sharing system based on quantum key distribution and proxy re-encryption proposed in Embodiment 2 of the present invention; Figure 3 This is a control experiment diagram. Detailed Implementation

[0023] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0024] To facilitate understanding of the technical solution of this invention, some components of the system in this invention are defined as follows: Quantum Key Infrastructure (QKI): Responsible for global quantum random number generation, quantum key issuance, lifecycle management, and entity identity mapping. It includes a quantum hardware source (QRNG), a key escrow module, and a policy control point.

[0025] Proxy Re-Encryption Node (PREN): A trusted computing node deployed in the cloud or at the edge, with a built-in Hardware Security Module (HSM) dedicated to performing ciphertext conversion operations. PREN does not have any plaintext access capabilities; it only handles re-encryption operations at the encryption key layer.

[0026] The Vehicle Privacy Agent (VPA) operates within the TEE environment of the smart cockpit's main control chip. It is responsible for classifying, encrypting, and storing in-vehicle privacy data locally, as well as interacting with external systems. Internally, the VPA maintains a quantum key vault, readable only by the TEE.

[0027] Data Consumer (DC): This includes vehicle owner mobile devices, service station terminals, third-party service systems, etc. Each DC has a unique quantum identity certificate and a public-private key pair bound to it, obtained through post-quantum algorithms or ECC.

[0028] Cloud Control Platform (CCP): A business cloud provided by the vehicle manufacturer, storing encrypted historical data but not holding any decryption keys. The cloud control platform connects to the in-vehicle privacy agent to store the encrypted ciphertext data.

[0029] Example 1 Please see Figure 1 This embodiment provides a vehicle data sharing method based on quantum key distribution and proxy re-encryption, including the following steps; S1, Quantum Key Infrastructure (QKI) injects quantum seeds into the in-vehicle privacy agent and issues quantum identity certificates containing public keys to data consumers.

[0030] The purpose of this step is to perform key pre-configuration and device registration, including vehicle quantum seed injection, data consumer identity issuance, and proxy re-encryption node PREN initialization; specifically, it includes the following steps: Vehicle Quantum Seed Injection: Before vehicles leave the factory, the quantum key infrastructure securely injects a 256-bit quantum seed into each vehicle's onboard privacy agent (VPA) using physically isolated writing devices. Simultaneously calculate The SM3 hash value is used as the seed fingerprint. Meanwhile, the Quantum Key Infrastructure (QKI) can... The vehicle's VIN code, seed fingerprint, and injection time are written into an internal encrypted database to form a "vehicle quantum seed ledger".

[0031] Consumer Identity Issuance: Each data consumer (DC) (e.g., a car owner's mobile phone, a repair shop's HSM device) submits a registration application to the Quantum Key Infrastructure (QKI). After verifying the entity's legitimacy, the QKI issues a quantum identity certificate to the DC. The certificate contains a globally unique DC identifier. Public key (Can be obtained using Kyber-768 or SM9 algorithms), certificate validity period; corresponding private key. The TEE or security chip is injected into the DC through a secure channel and never leaves the data consumer device.

[0032] Additionally, the PREN re-encryption node can be initialized: PREN can obtain a pair of transport key pairs (public key) specifically for transmitting session keys from QKI. private key ), and the public key Register with the Quantum Key Infrastructure (QKI). After PREN is launched, it establishes a two-way certified gRPC encrypted channel with QKI, and the channel key can be derived by QKI in real time.

[0033] S2. After the vehicle is powered on, the in-vehicle privacy agent establishes a call with the quantum key infrastructure based on the quantum seed, obtains the session quantum key, obtains the vehicle privacy data, generates a one-time key and encrypts the vehicle privacy data into a ciphertext data body, uses the session quantum key to encrypt the one-time key to obtain the key ciphertext, and packages the key ciphertext and the ciphertext data body into the original ciphertext object.

[0034] Once the vehicle is powered on, the VPA can automatically execute the following process without manual intervention.

[0035] The in-vehicle privacy agent (VPA) generates random challenge numbers after the vehicle is powered on. And random challenge number The vehicle's VIN code is sent to the quantum key infrastructure (QKI); QKI retrieves the corresponding quantum seed for a vehicle based on its VIN code. Using quantum seeds Encrypted Random Challenge Number and session quantum key Constructing a structure containing quantum seeds Encrypted random challenge number and session quantum key The response packet is sent to the in-vehicle privacy agent (VPA); In-vehicle privacy agent VPA via quantum seed Decrypt the response packet to obtain the random challenge number from the response packet. The verification process is then completed. Upon successful verification, a session is established with QKI, and the session quantum key is obtained. .

[0036] Specifically, this can be achieved through the following methods: Quantum session establishment: VPA generates a 32-byte random challenge number. The vehicle's VIN code, along with the information, is sent to the quantum key infrastructure (QKI). QKI then retrieves the corresponding quantum seed for the vehicle from the vehicle quantum seed register based on the VIN code. .

[0037] Using quantum seeds Encrypted Random Challenge Number and the newly generated session quantum key (This can be a 256-bit quantum random number), and then construct the response packet. This is returned to the VPA. It should be noted that this response packet contains... This is optional. VPA uses local memory within the TEE. Decrypt, Verify Check if it matches the sent data; if it matches, the session is successfully established and received. .

[0038] The session validity period can be the current driving cycle (which expires when the engine is turned off) or the maximum threshold time, such as 4 hours.

[0039] In this embodiment, the vehicle privacy data can be data acquired by the smart cockpit. As the core data hub of the Internet of Vehicles (IoV), the smart cockpit continuously aggregates multi-dimensional vehicle privacy data streams, including driving behavior, cockpit audio and video, and passenger identity, through onboard sensor arrays, biometric modules, and high-precision positioning units. Vehicle data is divided into L1 and L2 categories. Category L1 data is highly sensitive and shareable, such as facial images of occupants, complete voice conversations, and precise trajectories. This is the privacy data that requires subsequent cross-domain authorization in this application.

[0040] Category L2 is low-sensitivity and cannot be shared: such as vehicle instantaneous speed, door and window status, etc. It is only used locally on the vehicle and is not uploaded or shared.

[0041] For ease of description, this application denotes vehicle privacy data category as L.

[0042] When a sensor in the cabin, such as an in-car microphone array, generates a piece of audio data At that time, the data is sent to the VPA. The VPA executes: Generate one-time key One-time key It can be a one-time symmetric encryption key (SM4, 256-bit).

[0043] Compute ciphertext data body It should be noted that in calculating the ciphertext data body... At that time, the data timestamp and data source ID are optional.

[0044] Using the current session quantum key encryption , obtain the key ciphertext It should be noted that in calculating the key ciphertext... When this is the case, the data type label is optional.

[0045] Will and Packaged into raw ciphertext object This information is stored in the vehicle's in-vehicle privacy agent or cloud control platform. Simultaneously, the VPA can calculate... hash value It serves as the unique index for this data object.

[0046] S3. The quantum key infrastructure receives data sharing requests from data consumers, verifies the quantum identity certificate, forwards the data sharing request to the vehicle owner, and receives the authorization credentials from the vehicle owner.

[0047] When external consumer-end DC (e.g., the backend service of an insurance company's loss assessment system) ) Request access to a specific part of the vehicle At that time, the following process will be initiated.

[0048] S301, The data consumer terminal (DC) construct includes the target vehicle's VIN code and the target's original encrypted object. The data consumer's (DC) quantum identity certificate and the signed sharing request message are sent to the quantum key infrastructure (QKI). Specifically, the data consumer (DC) initiates a sharing request: the DC constructs a sharing request message. This includes: the target vehicle's VIN code, and the information to be accessed. hash value List, purpose of request (signed by DC), expected validity period. DC uses its own private key. Sign the entire request and Along with the certificate It is sent together to the Quantum Key Infrastructure (QKI).

[0049] S302, QKI receives and verifies the signature of the sharing request message and the validity of the quantum identity certificate, and then queries whether the data consumer has the authorization credentials for the target vehicle. If not, it encapsulates the sharing request message into an authorization query and sends it to the vehicle owner; if so, it executes S305. QKI Verification and Forwarding: QKI Verification The system checks the validity and signature for correctness, then queries the policy database to determine if the vehicle owner has previously authorized this type of data center (DC). If no pre-authorization rule exists, QKI will... It is packaged into an "authorization request" and pushed to the car owner's mobile device APP through a high-strength encrypted push channel.

[0050] S303: The vehicle owner receives the authorization request, sets the authorization rules, generates the authorization credential, signs it, and sends it to QKI; Dynamic authorization on the vehicle owner's end: After receiving an inquiry, the vehicle owner's app displays the request details: subject, data scope, and validity period. The vehicle owner can choose: ① Allow this access; ② Allow similar data centers to access without approval within the next 30 days; ③ Deny. After the vehicle owner confirms permission, the app generates an authorization credential. The content includes: vehicle VIN, DC markings, and permitted information. List, authorization validity period, authorization time period: such as only weekdays from 9 am to 5 pm, and using the vehicle owner's private key. Signature. It was sent to QKI and PREN.

[0051] It should be noted that the vehicle owner's mobile device also belongs to the data consumer (DC) category, receiving the quantum identity certificate issued by QKI in step S1. Therefore, in this application, the vehicle owner's mobile device can access the device via a private key. sign.

[0052] S304, QKI receives authorization credentials; S305 and QKI send authorization credentials to the in-vehicle privacy agent.

[0053] S4. The vehicle-mounted privacy agent receives the authorization credentials sent by the quantum key infrastructure and sends the key header containing the key ciphertext to the agent re-encryption service node. The agent re-encryption service node requests the session quantum key from the quantum key infrastructure, decrypts the key ciphertext to obtain a one-time key, and re-encrypts the one-time key using the encryption public key of the data consumer to obtain the updated key ciphertext. The access address of the ciphertext data body (in this application, a Uniform Resource Locator (URL) can be used to locate the complete URL of the network resource) and the updated key ciphertext are assembled into a new ciphertext object and sent to the data consumer.

[0054] In this application, after receiving the authorization approval signal, the VPA can receive a notification from the quantum key infrastructure (QKI) carrying the authorization information. Hash, read target from local storage , and Extracted, along with and Send them together to PREN. Note that in this step, the encrypted data body... The encrypted audio and video data remains on the vehicle or has been uploaded to the cloud control platform. It does not need to be transmitted at this time to avoid redundant bandwidth usage.

[0055] The proxy re-encryption service node PREN verifies the signature of the authorization credential in the key header. After successful verification, it requests the session quantum key from the quantum key infrastructure (QKI). Quantum Key Infrastructure (QKI) returns the transport public key to the PREN (Proximity Re-encryption Service Node) via a proxy. Encrypted session quantum key ; PREN, a proxy re-encryption service node Decryption yields the session quantum key .

[0056] PREN received the key header: , , Next, the owner's public key is obtained from QKI for verification. The digital signature. After successful verification, PREN requests from QKI: based on the session identifier (from... The session ID attached to the structure is used to obtain the session ID at that time. Quantum Key Infrastructure (QKI) returns Enc( , That is, encrypted using PREN's public key for transmission. PREN Decryption Plaintext. This step can be completed in the protected memory of the Hardware Security Module (HSM), which is inaccessible to any external process.

[0057] The proxy re-encryption service node PREN obtains the public key of the data consumer DC from the quantum key infrastructure QKI. PREN for one-time keys The updated key ciphertext is obtained by encrypting the public key of the data consumer's DC. ; PREN assembles the new encrypted object. New encrypted object include and the URL of the ciphertext data body, and the new ciphertext object Send to the data consumer (DC).

[0058] PREN obtains the public key of the target DC from QKI. Then, PREN performs the calculations directly within the HSM: .

[0059] This step will restore the original useful Encrypted Re-encrypt using the DC's public key. PREN does not need to... Any operation performed achieves zero-contact transformation of the data ontology.

[0060] PREN assembles a new ciphertext object. =( , , The storage location URL), and will Send to DC. Once the transmission is complete, PREN is immediately erased from memory. , , All temporary sensitive data will be processed, and this conversion operation will be recorded in the anti-tampering log. The log may contain: Timestamp, Vehicle VIN, , , Hash.

[0061] When it is necessary to share the same data with multiple different data consumers. , … When n is the number of data consumers, the vehicle only needs to upload once. Give PREN, PREN to the one-time key Use each data consumer end public key Encrypt the updated key ciphertext : =Enc( , ); in, This is the identifier for the data consumer.

[0062] PREN assembles the new encrypted object. New encrypted object include and the URL of the ciphertext data body, and the new ciphertext object Send them to the corresponding data consumers respectively. .

[0063] S5. The data consumer decrypts the new ciphertext object to obtain the URL of the ciphertext data body and a one-time key. It then obtains the ciphertext data body through the URL and decrypts it to obtain the vehicle privacy data, thus completing the sharing of vehicle privacy data.

[0064] In this embodiment, the encrypted data body is stored in the vehicle privacy agent or cloud control platform; the data consumer obtains the encrypted data body from the vehicle privacy agent or cloud control platform through the access address and decrypts it to obtain the vehicle privacy data.

[0065] DC received a new encrypted object Then, extract from it as well as The URL.

[0066] DC uses its own private key Decryption ,get This process is executed in a local TEE or HSM within the DC.

[0067] DC retrieves data from the in-vehicle privacy agent or from the cloud control platform CCP based on the URL. It is worth noting that, It has never been re-encrypted and has always been Enc( , DC obtained through decryption Decryption Ultimately, vehicle privacy data is obtained. .

[0068] DC needs to follow The data is used for the purposes and within the validity period agreed upon in the agreement. After the validity period expires, it will be deleted locally from the data center. and Cache.

[0069] Example 2 like Figure 2 As shown, this embodiment of the invention also proposes a vehicle data sharing system based on quantum key distribution and proxy re-encryption, comprising: Quantum key infrastructure 1, used to inject quantum seeds into in-vehicle privacy agents; and to issue quantum identity certificates containing public keys for data consumers; The in-vehicle privacy agent 2 is used to establish a call with the quantum key infrastructure based on the quantum seed after the vehicle is powered on, obtain the session quantum key; obtain vehicle privacy data, generate a one-time key and encrypt the vehicle privacy data into ciphertext data body; use the session quantum key to encrypt the one-time key to obtain the key ciphertext; and package the key ciphertext and the ciphertext data body into the original ciphertext object. The Quantum Key Infrastructure 1 facility is also used to receive data sharing requests from data consumers, verify the quantum identity certificate, forward the data sharing request to the vehicle owner, and receive the authorization credentials from the vehicle owner and send them to the in-vehicle privacy agent. Vehicle owner terminal 3 is used to receive data sharing requests sent by the quantum key infrastructure, and send authorization credentials to the quantum key infrastructure after authorization is approved; The vehicle-mounted privacy agent 2 is also used to receive authorization credentials sent by the quantum key infrastructure and send a key header containing the key ciphertext to the agent re-encryption service node; The proxy re-encryption service node 4 is used to request the session quantum key from the quantum key infrastructure 1, decrypt the key ciphertext to obtain a one-time key, and re-encrypt the one-time key using the encryption public key of the data consumer to obtain an updated key ciphertext. The access address of the ciphertext data body and the updated key ciphertext are assembled into a new ciphertext object and sent to the data consumer 5. Data consumer 5 is used to send data sharing requests; it receives new ciphertext objects sent by proxy re-encryption service node 4, decrypts the new ciphertext objects to obtain the access address and one-time key of the ciphertext data body, obtains the ciphertext data body through the access address and decrypts it to obtain vehicle privacy data, thus completing the sharing of vehicle privacy data.

[0070] Example 3 This embodiment provides a computer-readable storage medium storing a computer program thereon. When the program is executed by a processor, it implements the steps of the vehicle data sharing method based on quantum key and proxy re-encryption as described in Embodiment 1.

[0071] Control experiment To further verify the effectiveness of the technical solution of this invention, a comparative experiment was conducted. The comparative scheme selected was the industry-standard "cloud-based decryption-re-encryption sharing scheme based on PKI / RSA". This scheme is the mainstream practice in the current field of vehicle network data sharing, employing the RSA-2048 asymmetric cryptographic system, where the cloud platform centrally holds the decryption key and performs the decryption-re-encryption operation. The parameter settings are as follows: Size of a single L1 privacy data entry: 1 MB, approximately 10 seconds of in-car audio / 1 frame of facial image Symmetric algorithms: SM4-256 / AES-128; this scheme uses SM4, the comparison scheme uses AES. Public key algorithm: This scheme uses Kyber-768 / SM2; the reference scheme is RSA-2048. Single-use scenario: 1 consumer; Multi-receiver scenario: 10 consumer terminals; Test data volume: 100 L1 data points.

[0072] like Figure 3 As shown, the total computation time for a single data sharing operation in this scheme is approximately 2.78ms, with only 0.07ms required on the vehicle side (symmetric operations only), fully meeting the constraints of in-vehicle embedded computing. The total computation time for concurrent sharing by 10 receivers is only 4.33ms, with minimal incremental overhead. This scheme significantly outperforms traditional PKI / RSA cloud decryption-re-encryption schemes in core dimensions such as computational efficiency, storage efficiency, communication bandwidth, and scalability, while maintaining comparable or lower deployment costs. This fully validates the technical feasibility and engineering superiority of the quantum key distribution and proxy re-encryption fusion architecture in privacy-preserving data sharing scenarios.

[0073] Through the above description of the embodiments, those skilled in the art can clearly understand that this application can be implemented by means of software plus necessary general-purpose hardware, and of course, it can also be implemented by special hardware including application-specific integrated circuits, special CPUs, special memory, special components, etc. Generally, any function performed by a computer program can be easily implemented by corresponding hardware, and the specific hardware structure used to implement the same function can also be diverse, such as analog circuits, digital circuits, or special-purpose circuits. However, for this application, software program implementation is more often the preferred implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a readable storage medium, such as a computer floppy disk, USB flash drive, mobile hard disk, ROM, RAM, magnetic disk, or optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods of the various embodiments of this application.

[0074] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented in software, it can be implemented, in whole or in part, as a computer program product. A computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the flow or function according to the embodiments of this application is generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can store or a data storage device such as a server or data center that integrates one or more available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., solid-state disk (SSD)).

[0075] Finally, it should be noted that the above description is merely a preferred embodiment of the present invention and is only used to illustrate the technical solution of the present invention, and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention are included within the scope of protection of the present invention.

Claims

1. A vehicle data sharing method based on quantum key distribution and proxy re-encryption, characterized in that, include: S1. Quantum key infrastructure injects quantum seeds into in-vehicle privacy agents and issues quantum identity certificates containing public keys to data consumers. S2. After the vehicle is powered on, the in-vehicle privacy agent establishes a communication with the quantum key infrastructure based on the quantum seed to obtain the session quantum key; obtains vehicle privacy data, generates a one-time key, and encrypts the vehicle privacy data into ciphertext data; uses the session quantum key to encrypt the one-time key to obtain the key ciphertext; and packages the key ciphertext and the ciphertext data into the original ciphertext object. S3. The quantum key infrastructure receives data sharing requests from data consumers, verifies the quantum identity certificate, forwards the data sharing request to the vehicle owner, and receives the authorization credentials from the vehicle owner and sends them to the in-vehicle privacy agent. S4. The vehicle privacy agent receives the authorization credentials and sends the key header containing the key ciphertext to the agent re-encryption service node. The agent re-encryption service node requests the session quantum key from the quantum key infrastructure, decrypts the key ciphertext to obtain the one-time key, and re-encrypts the one-time key using the encryption public key of the data consumer to obtain the updated key ciphertext. The access address of the ciphertext data body and the updated key ciphertext are assembled into a new ciphertext object and sent to the data consumer. S5. The data consumer decrypts the new ciphertext object to obtain the access address and one-time key of the ciphertext data body. It then obtains the ciphertext data body through the access address and decrypts it to obtain the vehicle privacy data, thus completing the sharing of vehicle privacy data.

2. The vehicle data sharing method based on quantum key distribution and proxy re-encryption as described in claim 1, characterized in that, The in-vehicle privacy agent establishes a call with the quantum key infrastructure based on the quantum seed after the vehicle is powered on, and obtains the session quantum key specifically including: The in-vehicle privacy agent (VPA) generates random challenge numbers after the vehicle is powered on. And random challenge number The vehicle's VIN code is sent to the quantum key infrastructure (QKI); QKI retrieves the corresponding quantum seed for a vehicle based on its VIN code. Using quantum seeds Encrypted Random Challenge Number and session quantum key Constructing a structure containing quantum seeds Encrypted random challenge number and session quantum key The response packet is sent to the in-vehicle privacy agent (VPA); In-vehicle privacy agent VPA via quantum seed Decrypt the response packet to obtain the random challenge number from the response packet. The verification process is then completed. Upon successful verification, a session is established with QKI, and the session quantum key is obtained. .

3. The vehicle data sharing method based on quantum key distribution and proxy re-encryption as described in claim 2, characterized in that, The QKI retrieves the quantum seed corresponding to a vehicle based on its VIN code. Specifically, it includes: Quantum seed for computing in-vehicle privacy agent The hash value is used as the seed fingerprint; QKI will use quantum seeds Vehicle VIN code and seed fingerprint are written into an encrypted database to generate a vehicle quantum seed ledger; QKI retrieves the corresponding quantum seed for a vehicle from the vehicle quantum seed register based on the vehicle's VIN code. .

4. The vehicle data sharing method based on quantum key distribution and proxy re-encryption as described in claim 1, characterized in that, S3 specifically includes: S301, The data consumer terminal (DC) construct includes the target vehicle's VIN code and the target's original encrypted object. The data consumer's (DC) quantum identity certificate and the signed sharing request message are sent to the quantum key infrastructure (QKI). S302, QKI receives and verifies the signature of the sharing request message and the validity of the quantum identity certificate, and then queries whether the data consumer has the authorization credentials for the target vehicle. If not, it encapsulates the sharing request message into an authorization query and sends it to the vehicle owner; if so, it executes S305. S303: The vehicle owner receives the authorization request, sets the authorization rules, generates the authorization credential, signs it, and sends it to QKI; S304, QKI receives authorization credentials; S305 and QKI send authorization credentials to the in-vehicle privacy agent.

5. The vehicle data sharing method based on quantum key distribution and proxy re-encryption as described in claim 1, characterized in that, The proxy re-encryption service node requests the session quantum key from the quantum key infrastructure, and decrypts the key ciphertext to obtain the one-time key, specifically including: The key header contains an authorization credential signed by the vehicle owner. The proxy re-encryption service node PREN verifies the signature of the authorization credential in the key header. After successful verification, it requests the session quantum key from the quantum key infrastructure (QKI). Quantum Key Infrastructure (QKI) returns the transport public key to the PREN (Proximity Re-encryption Service Node) via a proxy. Encrypted session quantum key ; The proxy re-encryption service node PREN uses the transmission private key. Decryption yields the session quantum key .

6. The vehicle data sharing method based on quantum key distribution and proxy re-encryption as described in claim 1, characterized in that, When there are multiple data consumers making shared data requests The proxy re-encryption service node PREN obtains each data consumer from the quantum key infrastructure (QKI). public key ; PREN for one-time keys Use each data consumer end public key Encrypt the updated key ciphertext : PREN assembles the new encrypted object. New encrypted object include and the access address of the ciphertext data body, and the new ciphertext object Send them to the corresponding data consumers respectively. .

7. The vehicle data sharing method based on quantum key distribution and proxy re-encryption as described in claim 6, characterized in that, In the new encrypted object After being sent to the data consumer (DC), it also includes: PREN will record this operation in the anti-tampering log.

8. The vehicle data sharing method based on quantum key distribution and proxy re-encryption as described in claim 1, characterized in that, The encrypted data body is stored in an in-vehicle privacy agent or a cloud control platform; The data consumer obtains encrypted data from the in-vehicle privacy agent or cloud control platform by accessing the address and then decrypts it to obtain vehicle privacy data.

9. A vehicle data sharing system based on quantum key distribution and proxy re-encryption, characterized in that, include: Quantum key infrastructure for injecting quantum seeds into in-vehicle privacy agents; Issue quantum identity certificates containing public keys to data consumers; The in-vehicle privacy agent is used to establish a communication with the quantum key infrastructure based on a quantum seed after the vehicle is powered on, obtain a session quantum key; obtain vehicle privacy data, generate a one-time key and encrypt the vehicle privacy data into a ciphertext data body; use the session quantum key to encrypt the one-time key to obtain the key ciphertext; and package the key ciphertext and the ciphertext data body into an original ciphertext object. The quantum key infrastructure is also used to receive data sharing requests from data consumers, verify the quantum identity certificate, forward the data sharing request to the vehicle owner, and receive the authorization credentials from the vehicle owner to send to the in-vehicle privacy agent. The vehicle owner's terminal is used to receive data sharing requests sent by the quantum key infrastructure and send authorization credentials to the quantum key infrastructure after authorization is approved; The in-vehicle privacy agent is also used to receive authorization credentials sent by the quantum key infrastructure and send a key header containing the key ciphertext to the agent re-encryption service node; The proxy re-encryption service node is used to request the session quantum key from the quantum key infrastructure and decrypt the key ciphertext to obtain a one-time key. The one-time key is re-encrypted using the public key of the data consumer to obtain the updated key ciphertext. The access address of the ciphertext data body and the updated key ciphertext are then assembled into a new ciphertext object and sent to the data consumer. The data consumer is used to send data sharing requests; Receive a new ciphertext object sent by the proxy re-encryption service node, decrypt the new ciphertext object to obtain the access address and one-time key of the ciphertext data body, obtain the ciphertext data body through the access address and decrypt it to obtain the vehicle privacy data, and complete the sharing of vehicle privacy data.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the steps of the vehicle data sharing method based on quantum key and proxy re-encryption as described in any one of claims 1 to 8.

Images