Data processing method, communication module, device, and readable storage medium
By introducing a resource pool and parallel processing of multiple hardware security modules into the V2X device communication module, the problem of low data processing efficiency in existing technologies is solved, achieving efficient data processing and security protection while reducing costs.
Patent Information
- Authority / Receiving Office
- WO · WO
- Patent Type
- Applications
- Current Assignee / Owner
- FIBOCOM AUTO SOFTWARE INC
- Filing Date
- 2025-04-29
- Publication Date
- 2026-06-04
AI Technical Summary
In existing V2X devices, the NAD platform and V2X modules cannot meet the performance requirements for message signature verification, and high-performance HSM chips are expensive, resulting in low data processing efficiency.
A resource pool is introduced into the communication module of the V2X device. The resource pool is connected to multiple hardware security modules. Through the sending interface, query interface, receiving queue and return queue, the parallel processing of multiple hardware security modules is realized, including selecting the target hardware security module and allocating data processing requests and returning results.
It improves the data processing efficiency of V2X devices, meets the security and privacy protection requirements in the V2X communication process, and reduces costs by eliminating the need for a high-performance HSM chip.
Smart Images
Figure CN2025092020_04062026_PF_FP_ABST
Abstract
Description
Data processing methods, communication modules, devices, and readable storage media
[0001] Citation of relevant applications
[0002] This disclosure claims the entire benefits of Chinese Patent Application No. 202411731564.2, filed on November 27, 2024, with the State Intellectual Property Office of the People's Republic of China, entitled "A Data Processing Method, Communication Module, Device and Readable Storage Medium", the entire contents of which are incorporated herein by reference.
[0003] field
[0004] This disclosure generally relates to the field of vehicular communication technology, and more specifically to data processing methods, communication modules, devices and readable storage media. Background Technology
[0005] With the development of V2X (Vehicle-to-X) technology, an increasing number of transportation devices are participating in the vehicle communication systems of intelligent transportation systems. These include vehicles, pedestrians, road infrastructure, network infrastructure, service networks, and commercial satellites. Key participants include onboard units (OBUs), roadside units (RSUs), and personal wearable devices. These various types of devices exchange data through cellular networks and short-range communication technologies, collecting real-time road information and providing real-time traffic condition information, including road conditions, congestion, and construction, by communicating with other vehicles and infrastructure. This allows drivers to make informed decisions and avoid accidents.
[0006] V2X communication involves a large amount of sensitive information, such as vehicle speed and location information. Therefore, it is necessary to ensure the security and privacy protection of the communication process. This involves technologies such as encryption, digital signatures, and access control to prevent information from being stolen or tampered with.
[0007] Current NAD (Network Access Device, such as a 5G communication module) platforms, including existing modules like TEE and eHSM (V2X module), cannot meet the message signature verification performance requirements. While using high-performance HSM hardware chips can meet these requirements, these chips are expensive.
[0008] In summary, the data processing efficiency issue in V2X devices is a technical problem that urgently needs to be solved by those skilled in the art.
[0009] Overview
[0010] On one hand, this disclosure provides a data processing method applied to a resource pool located in the communication module of a V2X device. The resource pool is communicatively connected to multiple hardware security modules capable of processing data processing requests in parallel. The resource pool includes a sending interface, a query interface, a receiving queue, and a return queue. The data processing method includes:
[0011] The V2X protocol stack in the communication module is provided with the sending interface so that the V2X protocol stack can write data processing requests to the receiving queue;
[0012] Read the data processing request to be processed from the receiving queue;
[0013] Identify the target hardware security module from multiple hardware security modules;
[0014] The data processing request is sent to the target hardware security module so that the target hardware security module can process the data processing request;
[0015] Write the returned result after processing by the target hardware security module into the return queue;
[0016] The query interface is provided to the V2X protocol stack so that the V2X protocol stack can obtain return results from the return queue.
[0017] In some implementations, the target hardware security module is determined from a plurality of hardware security modules, including:
[0018] Obtain the resource consumption indicators of the communication module;
[0019] If the resource consumption index is greater than or equal to a preset threshold, a target hardware security module located outside the communication module is selected from multiple hardware security modules.
[0020] If the resource consumption index is less than the preset threshold, a target hardware security module located within the communication module is selected from multiple hardware security modules.
[0021] In some implementations, the target hardware security module is determined from a plurality of hardware security modules, including:
[0022] Obtain computing resource information for the hardware security module;
[0023] Using the computing power resource information, the target hardware security module with the most abundant computing power resources is determined from multiple hardware security modules.
[0024] In some implementations, the target hardware security module is determined from a plurality of hardware security modules, including:
[0025] Determine the request type of the data processing request;
[0026] If the request type is a request signature, the target hardware security module is determined from multiple hardware security modules according to the signature allocation strategy;
[0027] If the request type is a signature verification request, the target hardware security module is determined from multiple hardware security modules according to the signature verification allocation strategy.
[0028] In some implementations, reading a data processing request to be processed from the receiving queue includes:
[0029] Read the data processing request to be processed and the packet sequence number of the data processing request from the receiving queue;
[0030] Accordingly, the return result processed by the target hardware security module is written into the return queue, including:
[0031] Write the return result processed by the target hardware security module and the packet sequence number corresponding to the return result into the return queue;
[0032] The V2X protocol stack matches requests and results in the receive queue and the query queue using packet sequence numbers.
[0033] In some implementations, before providing the transmit interface to the V2X protocol stack in the communication module, the following is also included:
[0034] Get the configuration file;
[0035] Load the configuration file to determine the allocation strategy;
[0036] Accordingly, the target hardware security module is determined from multiple hardware security modules, including:
[0037] According to the allocation strategy, the target hardware security module is determined from multiple hardware security modules.
[0038] In some implementations, the data processing method further includes:
[0039] Key execution steps during request processing are recorded in the log.
[0040] On the other hand, this disclosure provides a communication module for use in V2X devices, which includes:
[0041] A resource pool is located in the communication module and is communicatively connected to multiple hardware security modules capable of processing data processing requests in parallel. The resource pool includes a sending interface, a query interface, a receiving queue, a return queue, and a processing module.
[0042] The processing module includes:
[0043] The queue management module is configured to provide the sending interface to the V2X protocol stack in the communication module, so that the V2X protocol stack can write data processing requests to the receiving queue.
[0044] The task dispatch strategy module is configured to read data processing requests to be processed from the receiving queue; determine a target hardware security module from multiple hardware security modules; and send the data processing request to the target hardware security module so that the target hardware security module can process the data processing request.
[0045] The queue management module is configured to write the return result processed by the target hardware security module into a return queue; and to provide the query interface to the V2X protocol stack so that the V2X protocol stack can obtain the return result from the return queue.
[0046] Furthermore, this disclosure provides V2X equipment, including:
[0047] The system includes a V2X module, multiple hardware security modules, and a communication module as described above, wherein the communication module includes a resource pool.
[0048] The V2X module is communicatively connected to the V2X protocol stack in the communication module, and the eHSM in the V2X module is communicatively connected to the resource pool.
[0049] The resource pool implements the steps of the data processing method described above.
[0050] In another aspect, this disclosure provides a readable storage medium on which a computer program is stored, which, when executed by a processor, implements the data processing method described in this disclosure.
[0051] In some implementations, the communication module of a V2X device includes a resource pool. This resource pool communicates with multiple hardware security modules that can process data requests in parallel. The resource pool has a send interface, a query interface, a receive queue, and a return queue. The resource pool provides the send and query interfaces to the V2X protocol stack within the communication module, enabling the V2X protocol stack to write data processing requests to the receive queue and retrieve return results from the return queue. After reading the data processing requests from the receive queue, the resource pool can determine the target hardware security module from among the multiple hardware security modules according to an allocation strategy. Then, it sends the data processing request to the target hardware security module for processing, thereby obtaining the processed return result, which is written to the return queue. In this way, the resource pool allows for the effective integration of multiple hardware security modules, enabling them to process data in parallel, thus improving the data processing efficiency in the V2X device and meeting the security and privacy protection requirements of V2X communication.
[0052] Brief description of the attached figures
[0053] To more clearly illustrate the technical solutions of the embodiments of this disclosure, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this disclosure. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0054] Figure 1 is a flowchart of the implementation of a data processing method in one embodiment of this disclosure;
[0055] Figure 2 is a schematic diagram of the structure of a V2X device according to an embodiment of this disclosure.
[0056] Figure 3 is a schematic diagram of request scheduling in one embodiment of this disclosure;
[0057] Figure 4 is a schematic diagram of a data processing method according to an embodiment of this disclosure;
[0058] Figure 5 is a schematic diagram of the structure of a data processing apparatus according to an embodiment of the present disclosure; and
[0059] Figure 6 is a schematic diagram of the specific structure of a V2X device in one embodiment of this disclosure.
[0060] Detailed Explanation
[0061] To enable those skilled in the art to better understand the solutions of this disclosure, the following detailed description is provided in conjunction with the accompanying drawings and specific embodiments. Obviously, the described embodiments are merely some embodiments of this disclosure, and not all embodiments. Based on the embodiments of this disclosure, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this disclosure.
[0062] To facilitate understanding, the technical terms used in this article will be explained below:
[0063] V2X (Vehicle to X) is a key technology for future intelligent transportation systems, enabling communication between vehicles, between vehicles and base stations, and between base stations.
[0064] OBU (Onboard Unit) is a vehicle-mounted unit.
[0065] RSU (Road Side Unit).
[0066] HSM (Hardware Security Module) is a hardware security module.
[0067] NAD (Network Access Device) is a network access device.
[0068] TEE (Trusted Execution Environment)
[0069] REE (Rich Execution Environment) is a common environment for all mobile devices, running a common operating system such as Android or Linux.
[0070] SMC (Secure Monitor Call) is a security monitoring call.
[0071] GP (Global Platform) is a cross-industry international standards organization.
[0072] CA (Client Application) refers to the application within the REE in TEE.
[0073] TA (Trusted Application) refers to an application within a trusted execution environment.
[0074] OPTEE (Open Portable Trusted Execution Environment) is an open, portable, trusted execution environment.
[0075] SPI (Serial Peripheral Interface) is a serial peripheral interface.
[0076] I2C (Inter-Integrated Circuit) is a serial communication bus.
[0077] 7816 is a widely used smart card communication and data interaction protocol.
[0078] Please refer to Figure 1, which is a flowchart of a data processing method in one embodiment of this disclosure. The method is applied to a resource pool (HSM resource pool), located in the communication module of the V2X device shown in Figure 2. The resource pool is communicatively connected to multiple hardware security modules capable of processing data processing requests in parallel. The resource pool includes a sending interface, a query interface, a receiving queue, and a return queue, comprising:
[0079] S101. Provide a sending interface for the V2X protocol stack in the communication module so that the V2X protocol stack can write data processing requests to the receiving queue;
[0080] S102. Read the data processing request to be processed from the receiving queue;
[0081] S103. Determine the target hardware security module from multiple hardware security modules;
[0082] S104. Send the data processing request to the target hardware security module so that the target hardware security module can process the data processing request;
[0083] S105. Write the return result processed by the target hardware security module into the return queue; and
[0084] S106. Provide a query interface for the V2X protocol stack so that the V2X protocol stack can obtain return results from the return queue.
[0085] In some implementations, a resource pool located within the communication module of a V2X device can provide a sending interface to the V2X protocol stack within the communication module. In this way, the V2X protocol stack can write data processing requests to the receive queue of the resource pool.
[0086] In some implementations, the V2X protocol stack writes data processing requests to the receive queue, either sequentially or according to different priorities.
[0087] In some implementations, the V2X device can be an onboard device located inside the vehicle, or it can be another device located outside the vehicle, such as a roadside device.
[0088] In some implementations, the specific type of the data processing request includes: a request to sign data, and a request to verify a signature on data. In this embodiment, there is no specific limitation on the specific type of the data processing request; that is, the data processing request can be either a request to sign or a request to verify a signature.
[0089] In some implementations, the previous data processing request to be read is a request for signature, and the next data processing request to be read is a request for signature or a request for verification.
[0090] In some implementations, the resource pool can sequentially read data processing requests from a receiving queue. Processed data processing requests can then be deleted from the receiving queue. The length of this receiving queue can be capped by the total computing power that the resource pool can integrate; alternatively, it can be the length corresponding to the optimal performance in actual application testing.
[0091] In some implementations, as shown in Figure 3, the hardware security module may include a TEE in the communication module, an eHSM in the V2X module, a national cryptographic HSM connected to the resource pool via SPI or USB, and other HSMs connected to the resource pool via 7816 or I2C.
[0092] In some implementations, the communication interface between the resource pool and other HSM resource modules can be determined by the actual NAD environment. For example, NAD and V2X eHSM modules communicate via an SPI interface; the NAD platform has a built-in TEE called OPTEE, which provides cryptographic services to the outside world via a GP standard interface; cryptographic calculations are completed through logical calls from the CA module interface, driver, SMC, TA module, OPTEE OS, and HSM; NAD can have an external national cryptographic HSM or other HSMs, generally using standard protocol interfaces such as SPI, I2C, and 7816.
[0093] In some implementations, a data processing request only requires one hardware security module to process. Therefore, each time a data processing request is read from the receive queue, a target hardware security module can be identified for that request. In this embodiment, since multiple hardware security modules can execute in parallel, a target hardware security module can be selected from among them to process the request.
[0094] In some implementation schemes, multiple allocation strategies can be set according to requirements, and a specific strategy can be selected based on actual needs. For example, allocation strategies may include: Allocation Strategy 1, considering that V2X eHSM consumes V2X module computing power and TEE consumes NAD computing power in practical applications, priority can be given to using national cryptographic HSM chips and other types of HSM modules; Allocation Strategy 2, overall, round-robin sequential calls can be made, and different modules can be called to handle computing requests proportionally according to the processing capacity of the configured modules; Allocation Strategy 3, the specified module can be used for computing based on the module identifier in the requested data service protocol.
[0095] In some implementations, the target hardware security module is determined from a plurality of hardware security modules, including:
[0096] Obtain resource consumption metrics for the communication module;
[0097] When the resource consumption index is greater than or equal to the preset threshold, select the target hardware security module located outside the communication module from multiple hardware security modules;
[0098] If the resource consumption index is less than the preset threshold, select the target hardware security module located within the communication module from multiple hardware security modules.
[0099] For ease of description, the above steps will be combined below.
[0100] In some implementation schemes, the selection of target hardware security modules can be determined based on the resource consumption indicators of the communication modules.
[0101] Since the communication module has hardware security modules both internally and externally, and both hardware security modules can handle data processing requests, the selection of hardware security modules can be determined based on the current resource consumption of the communication module. The resource consumption indicators can be either the communication module's storage resource consumption (percentage) or computing resource consumption (percentage).
[0102] A preset threshold can be set in advance. The size of this preset threshold can be set through experience or based on actual experiments to find the maximum resource consumption index for the communication module to maintain normal operation.
[0103] When the resource consumption index of the communication module is found to be greater than or equal to the preset threshold, it indicates that the current communication module can no longer handle more data processing tasks. At this time, the data processing request can be assigned to a hardware security module located outside the communication module. Therefore, a target hardware security module located outside the communication module can be selected from multiple hardware security modules.
[0104] When the resource consumption index of the communication module is found to be less than the preset threshold, it indicates that the current communication module can handle more data processing tasks. At this time, the data processing request can be assigned to the hardware security module located within the communication module. Therefore, the target hardware security module located within the communication module can be selected from multiple hardware security modules.
[0105] Of course, if the resource consumption index of the communication module is found to be less than the preset threshold, a hardware security module can be randomly selected from multiple hardware security modules as the target hardware security module.
[0106] In some implementations, the target hardware security module is determined from a plurality of hardware security modules, including:
[0107] Obtain computing resource information for the hardware security module;
[0108] By utilizing computing power resource information, the target hardware security module with the most abundant computing power resources is identified from multiple hardware security modules.
[0109] For ease of description, the above steps will be combined below.
[0110] In some implementations, hardware security modules can be different types of encryption and decryption modules. Different types of hardware security modules have different processing performance. If a polling-based sequential allocation method is used directly, high-performance hardware security modules may remain relatively idle for a long time, while low-performance hardware security modules may be in a busy or even overloaded state for a long time.
[0111] To effectively improve data processing efficiency, this embodiment acquires the computing power resource information of hardware security modules. Then, when selecting a target hardware security module, based on this information, the module with the most abundant computing power is chosen from among multiple modules. This allows for matched task allocation based on the computing power resources of each hardware security module, thereby accelerating data processing efficiency.
[0112] In some implementations, since NAD is a network access module with an operating system, system resource consumption can be monitored using Linux system commands (such as the `top` command). Therefore, the strategy for calling NAD platform TEE computations can be adjusted based on CPU or memory usage.
[0113] In some implementations, the target hardware security module is determined from a plurality of hardware security modules, including:
[0114] Determine the request type for the data processing request;
[0115] If the request type is a request signature, the target hardware security module is determined from multiple hardware security modules according to the signature allocation strategy;
[0116] If the request type is a signature verification request, the target hardware security module is determined from multiple hardware security modules according to the signature verification allocation strategy.
[0117] For ease of description, the above steps will be combined below.
[0118] Considering the different requirements for data signing and data verification, the processing efficiency requirements for data signing are generally lower than those for data verification. For example, some evaluation schemes specify processing 2000+ message verifications per second, but do not set clear indicators for signing efficiency.
[0119] Therefore, when allocating data processing requests, requests for signature verification can be prioritized for hardware security modules with higher processing efficiency, while requests for signatures can be allocated to hardware security modules with lower processing efficiency.
[0120] In some implementations, different allocation strategies can be set for different request types. After reading the data processing request, the request type can be clearly identified. Specifically, it can be determined whether a signature request or a signature verification request is needed based on the protocol parameters carried in the data processing request.
[0121] Once the request type of the data processing request is determined, a corresponding allocation strategy can be adopted to select the target hardware security module from multiple hardware security modules. For example, if the allocation strategy for request signatures specifies that a particular hardware security module is dedicated to handling signatures, then if it is determined that the request type of the currently read data processing request is a request signature, the specified hardware security module can be directly identified as the target hardware security module.
[0122] In some implementations, data processing requests can be sent to the target hardware security module based on the communication protocol of the specific communication connection between the resource pool and the target hardware security module.
[0123] After receiving a data processing request, the target hardware security module can use a specified algorithm to sign or verify the data, and after completing the data processing, return the processed result to the resource pool.
[0124] In some implementations, once the return result is obtained, it can be written to a return queue.
[0125] In some implementations, to facilitate the V2X protocol stack in obtaining data processing results, the resource pool provides a query interface for V2X in this embodiment. The V2X protocol stack can obtain return results from the return queue through this query interface.
[0126] As shown in Figure 4, the V2X device can process data processing requests from N vehicles in parallel and provide feedback. Specifically, it improves data signing and verification by integrating the computing power of the NAD's TEE, the eHSM computing power of the V2X module, the national cryptographic HSM chip, and other HSM types. Specifically, parallel computing of multiple HSMs increases V2X cryptographic computing performance. It is compatible with existing V2X implementations, enabling rapid application integration. It saves costs by eliminating the need for expensive high-performance HSM chips. It meets current hardware HSM signature regulations. It allows for flexible expansion with other HSM resources. The resource pool can be implemented in software, allowing scheduling strategies to be adjusted based on the characteristics of different HSMs.
[0127] In some implementations, the communication module of a V2X device includes a resource pool. This resource pool communicates with multiple hardware security modules that can process data requests in parallel. The resource pool has a send interface, a query interface, a receive queue, and a return queue. The resource pool provides the send and query interfaces to the V2X protocol stack within the communication module, enabling the V2X protocol stack to write data processing requests to the receive queue and retrieve return results from the return queue. After reading the data processing requests from the receive queue, the resource pool can determine the target hardware security module from among the multiple hardware security modules according to an allocation strategy. Then, it sends the data processing request to the target hardware security module for processing, thereby obtaining the processed return result, which is written to the return queue. In this way, the resource pool allows for the effective integration of multiple hardware security modules, enabling them to process data in parallel, thus improving the data processing efficiency in the V2X device and meeting the security and privacy protection requirements of V2X communication.
[0128] It should be noted that, based on the above embodiments, this disclosure also provides corresponding improvements. In the preferred / improved embodiments, steps that are the same as or corresponding to those in the above embodiments can be referred to each other, and the corresponding beneficial effects can also be referred to each other; however, these will not be elaborated upon in the preferred / improved embodiments herein.
[0129] In some implementations, reading pending data processing requests from the receive queue includes:
[0130] Read the data processing requests to be processed and their packet sequence numbers from the receive queue;
[0131] Accordingly, the return result processed by the target hardware security module is written to the return queue, including:
[0132] Write the return result processed by the target hardware security module and the packet sequence number corresponding to the return result into the return queue;
[0133] The V2X protocol stack uses packet sequence numbers to match requests and results in the receive queue and query queue.
[0134] For ease of description, the above steps will be combined below.
[0135] In other words, when a data processing request is written to the receive queue, its corresponding sequence number must also be written to the receive queue. The resource pool can then retrieve the sequence number along with the data processing request from the receive queue. Similarly, when the return result processed by the target hardware security module is written to the return queue, the corresponding sequence number is also written to the return queue. In this way, the V2X protocol stack can match requests and results in the receive queue and query queue using the sequence number.
[0136] In some implementations, before providing a transmit interface to the V2X protocol stack in the communication module, the following steps are also included:
[0137] Get the configuration file;
[0138] Load the configuration file to determine the allocation strategy;
[0139] Accordingly, the target hardware security module is determined from multiple hardware security modules, including:
[0140] According to the allocation strategy, the target hardware security module is determined from multiple hardware security modules.
[0141] In other words, in this embodiment, the allocation strategy can be determined based on the configuration file. Thus, when selecting a target hardware security module, the allocation strategy can be used to determine the target hardware security module from among multiple hardware security modules.
[0142] In some implementations, the configuration file can record available HSM resources. By loading the configuration file during resource pool initialization, the specified resources, queue parameters, and task scheduling timeout parameters can be configured.
[0143] In some implementations, key execution steps during request processing can also be logged. That is, recording key execution steps during task execution can primarily involve logging error logs.
[0144] Corresponding to the above method embodiments, this disclosure also provides a communication module, and the communication module described below can be referred to in correspondence with the data processing method described above.
[0145] As shown in Figure 5, this communication module 500 is used in V2X devices and includes:
[0146] Resource pool 510 is located in the communication module. The resource pool has communication connections with multiple hardware security modules that can process data processing requests in parallel. The resource pool includes a sending interface 511, a query interface 512, a receiving queue 513, a return queue 514, and a processing module 515.
[0147] The processing module includes:
[0148] The queue management module 515a is configured to provide a sending interface to the V2X protocol stack in the communication module, so that the V2X protocol stack can write data processing requests to the receiving queue.
[0149] The task dispatch strategy module 515b is configured to read data processing requests to be processed from the receiving queue; determine the target hardware security module from multiple hardware security modules; and send the data processing request to the target hardware security module so that the target hardware security module can process the data processing request.
[0150] The queue management module 515a is configured to write the return result processed by the target hardware security module into the return queue; and to provide a query interface for the V2X protocol stack so that the V2X protocol stack can obtain the return result from the return queue.
[0151] In some implementations, the communication module of a V2X device includes a resource pool. This resource pool communicates with multiple hardware security modules that can process data requests in parallel. The resource pool has a send interface, a query interface, a receive queue, and a return queue. The resource pool provides the send and query interfaces to the V2X protocol stack within the communication module, enabling the V2X protocol stack to write data processing requests to the receive queue and retrieve return results from the return queue. After reading the data processing requests from the receive queue, the resource pool can determine the target hardware security module from among the multiple hardware security modules according to an allocation strategy. Then, it sends the data processing request to the target hardware security module for processing, thereby obtaining the processed return result, which is written to the return queue. In this way, the resource pool allows for the effective integration of multiple hardware security modules, enabling them to process data in parallel, thus improving the data processing efficiency in the V2X device and meeting the security and privacy protection requirements of V2X communication.
[0152] In some implementations, the task assignment strategy module is configured to obtain the resource consumption index of the communication module; if the resource consumption index is greater than or equal to a preset threshold, select a target hardware security module located outside the communication module from multiple hardware security modules; if the resource consumption index is less than the preset threshold, select a target hardware security module located within the communication module from multiple hardware security modules.
[0153] In some implementations, the task assignment strategy module is configured to obtain computing resource information of the hardware security module; and use the computing resource information to determine the target hardware security module with the most abundant computing resources from multiple hardware security modules.
[0154] In some implementations, the task assignment strategy module is configured to determine the request type of the data processing request; if the request type is a request signature, then the target hardware security module is determined from multiple hardware security modules according to the signature allocation strategy; if the request type is a request signature verification, then the target hardware security module is determined from multiple hardware security modules according to the signature verification allocation strategy.
[0155] In some implementations, the queue management module 515a is configured to read the data processing request to be processed and the packet sequence number of the data processing request from the receiving queue; accordingly, it writes the return result processed by the target hardware security module into the return queue, including: writing the return result processed by the target hardware security module and the packet sequence number corresponding to the return result into the return queue; wherein, the V2X protocol stack matches the request and the result in the receiving queue and the query queue by the packet sequence number.
[0156] In some implementations, the processing module further includes:
[0157] The resource configuration management module is configured to obtain the configuration file before providing a sending interface to the V2X protocol stack in the communication module; and load the configuration file to determine the allocation strategy.
[0158] Accordingly, the task assignment strategy module is configured to determine the target hardware security module from multiple hardware security modules according to the assignment strategy.
[0159] In some implementations, the processing module further includes:
[0160] The log management module is configured to record key execution steps during request processing in the log.
[0161] This disclosure also provides an embodiment of a V2X device, and the V2X device described below can be referred to in correspondence with the data processing method described above.
[0162] Referring to Figure 6, the V2X device 600 includes:
[0163] The system includes a V2X module 601, multiple hardware security modules 602, and a communication module 500 as described above, the communication module including a resource pool 510.
[0164] The V2X module communicates with the V2X protocol stack 603 in the communication module, and the eHSM in the V2X module communicates with the resource pool.
[0165] The resource pool implements the data processing method described in this disclosure.
[0166] Corresponding to the above method embodiments, this disclosure also provides a readable storage medium. The readable storage medium described below corresponds to and can be referred to in relation to the data processing method described above.
[0167] A readable storage medium storing a computer program that, when executed by a processor, implements the data processing method described in this disclosure.
[0168] In some implementations, the readable storage medium can be a USB flash drive, a portable hard drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, or any other readable storage medium capable of storing program code.
[0169] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to in the method section.
[0170] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this disclosure.
[0171] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein can be implemented directly by hardware, a software module executed by a processor, or a combination of both. The software module can be located in random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other form of storage medium known in the art.
[0172] Finally, it should be noted that in this document, relationships such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "include," "contain," or any other variations are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus.
[0173] This document uses specific examples to illustrate the principles and implementation methods of this disclosure. The descriptions of the above embodiments are only for the purpose of helping to understand the methods and core ideas of this disclosure. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this disclosure. Therefore, the content of this specification should not be construed as a limitation of this disclosure.
Claims
1. A data processing method applied to a resource pool, the resource pool being located in the communication module of a V2X device, the resource pool being communicatively connected to multiple hardware security modules capable of processing data processing requests in parallel, the resource pool including a sending interface, a query interface, a receiving queue, and a return queue, the data processing method comprising: The V2X protocol stack in the communication module is provided with the sending interface so that the V2X protocol stack can write data processing requests to the receiving queue; Read the data processing request to be processed from the receiving queue; Identify the target hardware security module from multiple hardware security modules; The data processing request is sent to the target hardware security module so that the target hardware security module can process the data processing request; Write the returned result after processing by the target hardware security module into the return queue; as well as The query interface is provided to the V2X protocol stack so that the V2X protocol stack can obtain return results from the return queue.
2. The data processing method as described in claim 1, wherein determining the target hardware security module from a plurality of hardware security modules includes: Obtain the resource consumption indicators of the communication module; If the resource consumption index is greater than or equal to a preset threshold, a target hardware security module located outside the communication module is selected from multiple hardware security modules. as well as If the resource consumption index is less than the preset threshold, a target hardware security module located within the communication module is selected from multiple hardware security modules.
3. The data processing method as described in claim 1 or 2, wherein determining the target hardware security module from a plurality of hardware security modules includes: Obtain computing resource information for the hardware security module; as well as Using the computing power resource information, the target hardware security module with the most abundant computing power resources is determined from multiple hardware security modules.
4. The data processing method according to any one of claims 1 to 3, wherein determining the target hardware security module from a plurality of hardware security modules includes: Determine the request type of the data processing request; If the request type is a request signature, the target hardware security module is determined from multiple hardware security modules according to the signature allocation strategy; If the request type is a signature verification request, the target hardware security module is determined from multiple hardware security modules according to the signature verification allocation strategy.
5. The data processing method according to any one of claims 1 to 4, wherein reading a data processing request to be processed from the receiving queue includes: Read the data processing request to be processed and the packet sequence number of the data processing request from the receiving queue; Accordingly, the return result processed by the target hardware security module is written into the return queue, including: Write the return result processed by the target hardware security module and the packet sequence number corresponding to the return result into the return queue; The V2X protocol stack matches requests and results in the receive queue and the query queue using packet sequence numbers.
6. The data processing method according to any one of claims 1 to 5, wherein before providing the transmission interface to the V2X protocol stack in the communication module, it further comprises: Get the configuration file; Load the configuration file to determine the allocation strategy; Accordingly, the target hardware security module is determined from multiple hardware security modules, including: According to the allocation strategy, the target hardware security module is determined from multiple hardware security modules.
7. The data processing method according to any one of claims 1 to 6, further comprising: Key execution steps during request processing are recorded in the log.
8. A communication module, used in V2X devices, the communication module comprising: A resource pool is located in the communication module and is communicatively connected to multiple hardware security modules capable of processing data processing requests in parallel. The resource pool includes a sending interface, a query interface, a receiving queue, a return queue, and a processing module. The processing module includes: The queue management module is configured to provide the sending interface to the V2X protocol stack in the communication module, so that the V2X protocol stack can write data processing requests to the receiving queue. The task dispatch strategy module is configured to: read data processing requests to be processed from the receiving queue; determine a target hardware security module from multiple hardware security modules; send the data processing request to the target hardware security module so that the target hardware security module can process the data processing request; and The queue management module is configured to write the return result processed by the target hardware security module into a return queue; and to provide the query interface to the V2X protocol stack so that the V2X protocol stack can obtain the return result from the return queue.
9. V2X devices, including: The system comprises a V2X module, multiple hardware security modules, and a communication module as described in claim 8, wherein the communication module includes a resource pool. The V2X module is communicatively connected to the V2X protocol stack in the communication module, and the eHSM in the V2X module is communicatively connected to the resource pool. The resource pool implements the data processing method described in any one of claims 1 to 7.
10. A readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the data processing method of any one of claims 1 to 7.