WO2021184865A1 - 一种证书申请方法及装置 - Google Patents

一种证书申请方法及装置 Download PDF

Info

Publication number
WO2021184865A1
WO2021184865A1 PCT/CN2020/137283 CN2020137283W WO2021184865A1 WO 2021184865 A1 WO2021184865 A1 WO 2021184865A1 CN 2020137283 W CN2020137283 W CN 2020137283W WO 2021184865 A1 WO2021184865 A1 WO 2021184865A1
Authority
WO
WIPO (PCT)
Prior art keywords
internet
domain
vehicles
application
certificate
Prior art date
Application number
PCT/CN2020/137283
Other languages
English (en)
French (fr)
Inventor
周巍
Original Assignee
大唐移动通信设备有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 大唐移动通信设备有限公司 filed Critical 大唐移动通信设备有限公司
Publication of WO2021184865A1 publication Critical patent/WO2021184865A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/321—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving a third party or a trusted authority
    • H04L9/3213—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving a third party or a trusted authority using tickets or tokens, e.g. Kerberos
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0807—Network architectures or network communication protocols for network security for authentication of entities using tickets, e.g. Kerberos
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0823—Network architectures or network communication protocols for network security for authentication of entities using certificates
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/12—Protocols specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3263—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3263—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements
    • H04L9/3268—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]

Definitions

  • the present disclosure relates to the field of communication technology, and in particular to a certificate application method and device.
  • the embodiments of the present disclosure provide a certificate application method and device to realize the cross-system entry process of car networking equipment.
  • the embodiment of the present disclosure provides a certificate application method, which is applied to a connected car device, and includes:
  • the embodiment of the present disclosure provides a certificate application method, which is applied to the first Internet of Vehicles system, including:
  • the out-of-domain authorization token contains the device signature certificate of the Internet of Vehicles device, so that the Internet of Vehicles device can
  • the second Internet of Vehicles system sends a domain entry application message and obtains a domain entry authorization token, the domain entry application message includes the domain exit authorization token, and the domain entry application message passes the device signature certificate
  • the corresponding private key is digitally signed.
  • the embodiment of the present disclosure provides a certificate application method, which is applied to the second Internet of Vehicles system, including:
  • an Internet of Vehicles device When an Internet of Vehicles device applies to enter the second Internet of Vehicles system from the first Internet of Vehicles system, it sends a domain entry authorization token to the Internet of Vehicles device, so that the Internet of Vehicles device obtains the domain access authorization token based on the Internet of Vehicles The registration certificate of the second car networking system.
  • the embodiment of the present disclosure provides a certificate application device, which is applied to car networking equipment, and includes:
  • the receiving module is used for receiving the domain entry authorization token sent by the second Internet of Vehicles system when the Internet of Vehicles equipment applies to enter the second Internet of Vehicles system from the first Internet of Vehicles system;
  • the obtaining module is configured to obtain the registration certificate of the second Internet of Vehicles system based on the domain entry authorization token.
  • the embodiment of the present disclosure provides a certificate application device, which is applied to the first Internet of Vehicles system, and includes:
  • the receiving module is used to receive the out-of-domain application message sent by the Internet of Vehicles device when the Internet of Vehicles device applies for entering the second Internet of Vehicles system from the first Internet of Vehicles system;
  • the sending module is configured to send an out-of-domain authorization token to the Internet of Vehicles device based on the out-of-domain application message, wherein the out-of-domain authorization token contains the device signature certificate of the Internet of Vehicles device, so that all The Internet of Vehicles device sends a domain entry application message to the second Internet of Vehicles system and obtains a domain entry authorization token, the domain entry application message includes the domain exit authorization token, and the domain entry application message passes The private key corresponding to the device signing certificate is digitally signed.
  • the embodiment of the present disclosure provides a certificate application device applied to a second Internet of Vehicles system, including:
  • the sending module is used to send an entry authorization token to the Internet of Vehicles device when the Internet of Vehicles device applies to enter the second Internet of Vehicles system from the first Internet of Vehicles system, so that the Internet of Vehicles device is based on the entry authorization
  • the token obtains the registration certificate of the second Internet of Vehicles system.
  • the embodiments of the present disclosure provide an Internet of Vehicles device, including a memory, a processor, and a computer program stored on the memory and capable of running on the processor, and the processor implements the steps of the certificate application method when the program is executed .
  • the embodiment of the present disclosure provides a first Internet of Vehicles system, including a memory, a processor, and a computer program stored in the memory and capable of running on the processor, and the processor implements the certificate application method when the program is executed A step of.
  • the embodiment of the present disclosure provides a second Internet of Vehicles system, including a memory, a processor, and a computer program stored in the memory and capable of running on the processor, and the processor implements the certificate application method when the program is executed A step of.
  • the embodiment of the present disclosure provides a non-transitory computer-readable storage medium on which a computer program is stored, and when the computer program is executed by a processor, the steps of the certificate application method are realized.
  • the Internet of Vehicles device when the Internet of Vehicles device needs to enter the second Internet of Vehicles system from the first Internet of Vehicles system, it receives the domain entry authorization token sent by the second Internet of Vehicles system, and passes the entry authorization token.
  • the domain authorization token obtains the registration certificate of the second car networking system, and realizes that the car networking device located in the first car networking system can obtain the domain entry authorization token and registration certificate of the second car networking system, thereby realizing cross-system
  • the application process of the secure communication certificate can realize the cross-system entry from the first Internet of Vehicles system to the second Internet of Vehicles system.
  • FIG. 1 is a flow chart of the steps of a certificate application method applied to a connected car device in an embodiment of the disclosure
  • FIG. 2 is a flowchart of the steps of a certificate application method applied to the first Internet of Vehicles system in an embodiment of the disclosure
  • FIG. 3 is a flowchart of the steps of a certificate application method applied to a second Internet of Vehicles system in an embodiment of the disclosure
  • FIG. 4 is a reference architecture diagram of a specific embodiment in the embodiments of the disclosure.
  • FIG. 5 is a block diagram of a module of a certificate application device applied to a connected car device in an embodiment of the disclosure
  • FIG. 6 is a block diagram of a module of a certificate application device applied to the first Internet of Vehicles system in an embodiment of the disclosure
  • FIG. 7 is a block diagram of a module of a certificate application device applied to a second Internet of Vehicles system in an embodiment of the disclosure
  • FIG. 8 is a schematic diagram of the structure of a connected car device in an embodiment of the disclosure.
  • FIG. 9 is a schematic structural diagram of the first Internet of Vehicles system in an embodiment of the disclosure.
  • FIG. 10 is a schematic structural diagram of a second Internet of Vehicles system in an embodiment of the disclosure.
  • OBU On Board Unit
  • RSU Road Side Unit
  • OBU is a communication device installed on the vehicle, which is responsible for the information of the vehicle to the outside world.
  • Exchange vehicle to everything, V2X
  • RSU is a communication device installed on the roadside equipment, responsible for sending and receiving V2X messages from the roadside equipment.
  • the certificate issuing entities in the Internet of Vehicles PKI system include Root Certificate Authority (Root CA), Registration CA (Enrollment CA, ECA), and Application CA (Application CA, ACA).
  • the root CA is the Internet of Vehicles security PKI system.
  • the security anchor is used to issue sub-CA certificates to subordinate sub-CAs; during the security initialization (Security Bootstrap) phase of the OBU and RSU systems, the registration CA issues registration certificates to these entities, and OBU and RSU use the registration certificates to apply for application certificates;
  • the CA issues its certificates to OBU and RSU to sign the broadcasted V2X messages.
  • the corresponding certificate types include root certificates, registration certificates, and application certificates.
  • the root certificate is the self-signed certificate of the root CA.
  • the root certificate is the root node of a PKI system certificate chain, also known as the trust anchor of the PKI system; the registration certificate is issued by the registration CA to the OBU and RSU, and the registration certificate is uniquely corresponding to the device.
  • the device uses the registration certificate from each authorization Organizations obtain other application certificates related to the secure communication of the Internet of Vehicles; application certificates are certificates issued to OBU and RSU to digitally sign the messages they broadcast. For example, OBU digitally signs the vehicle driving status information that it broadcasts, RSU Digitally sign the status information of the traffic lights that it broadcasts.
  • the existing application certificate issuance process is usually: OBU/RSU applies for a registration certificate from a registered CA, and after the registration CA reviews, issues a registration certificate to OBU/RSU; OBU/RSU uses the registration certificate to issue a registration certificate to the application CA responsible for a certain Internet of Vehicles application field.
  • OBU/RSU uses the application certificate to digitally sign the V2X message it broadcasts, and the signed message together with the signature certificate
  • the OBU/RSU that receives the V2X signed message first uses the pre-stored application CA certificate to verify the signature certificate in the message, and then uses the verified signature certificate to verify the validity of the signed message.
  • the above process can realize the IoV communication, it does not involve cross-system communication, that is, the IoV device enters from one IoV system to another IoV system.
  • the embodiments of the present disclosure describe how to communicate across systems.
  • FIG. 1 it is a certificate application method applied to a connected car device in an embodiment of the present disclosure.
  • the method includes the following steps:
  • Step 101 When an Internet of Vehicles device applies to enter the second Internet of Vehicles system from the first Internet of Vehicles system, receive the domain entry authorization token sent by the second Internet of Vehicles system.
  • the Internet of Vehicles equipment may refer to entities participating in Internet of Vehicles communications, such as an OBU installed on a vehicle with a time slot vehicle communication capability or an RSU installed on a roadside traffic device to achieve device communication capabilities.
  • entities participating in Internet of Vehicles communications such as an OBU installed on a vehicle with a time slot vehicle communication capability or an RSU installed on a roadside traffic device to achieve device communication capabilities.
  • first Internet of Vehicles system and the second Internet of Vehicles system are two different Internet of Vehicles systems, and the first Internet of Vehicles system can be regarded as the source domain, and the second Internet of Vehicles system can be regarded as the destination domain, that is, for the second Internet of Vehicles system.
  • entry refers to entering the second Internet of Vehicles system from the first Internet of Vehicles system
  • exit refers to entering the second Internet of Vehicles system from the first Internet of Vehicles system.
  • the Internet of Vehicles devices in the same Internet of Vehicles system can use mutually recognized safety communication certificates for Internet of Vehicles safety communications.
  • the Internet of Vehicles equipment is initially located in the first Internet of Vehicles system. At this time, if the Internet of Vehicles equipment needs to enter the second Internet of Vehicles system from the first Internet of Vehicles system, it can receive the entry authorization order sent by the second Internet of Vehicles system. Card.
  • the second Internet of Vehicles system may include different functional entities to realize the division of different functions.
  • the second Internet of Vehicles system may include a cross-domain application authorization entity, which is used for The networking system is responsible for issuing out-of-domain authorization tokens to out-of-domain Internet-of-vehicle devices or issuing entry-level authorization tokens to entry-in The domain entry authorization token sent by the domain application authorization entity.
  • the domain entry authorization token refers to a token issued by the Internet of Vehicles system that allows Internet of Vehicles devices to apply for a secure communication certificate in the system.
  • the domain entry authorization token can be issued by a cross-domain application authorization entity, and its private key can be used to digitally sign the authorization information to provide the integrity, authentication, and non-repudiation of the token data.
  • Step 102 Obtain a registration certificate of the second Internet of Vehicles system based on the domain entry authorization token.
  • the Internet of Vehicles device can obtain the registration certificate of the second Internet of Vehicles system, so that it can enter the second Internet of Vehicles system based on the registration certificate, and realize the cross-system
  • the application process of the secure communication certificate can realize the cross-system entry from the first Internet of Vehicles system to the second Internet of Vehicles system.
  • the Internet of Vehicles device in this embodiment needs to enter the second Internet of Vehicles system from the first Internet of Vehicles system, it receives the entry authorization token sent by the second Internet of Vehicles system, and obtains the first entry authorization token through the entry authorization token.
  • the registration certificate of the Internet of Vehicles system realizes that the Internet of Vehicles devices located in the first Internet of Vehicles system can obtain the domain entry authorization token and registration certificate of the second Internet of Vehicles system, thereby realizing the application process of cross-system secure communication certificates , So as to achieve cross-system access from the first Internet of Vehicles system to the second Internet of Vehicles system.
  • the Internet of Vehicles device may also send an outbound application message to the first Internet of Vehicles system and receive the first Internet of Vehicles system.
  • the system is based on the out-of-domain authorization token sent by the out-of-domain application message, where the out-of-domain authorization token contains the device signature certificate of the Internet of Vehicles device, and then sends an entry application message to the second Internet of Vehicles system, where the entry application message It contains the out-domain authorization token, and the domain-in application message is digitally signed by the private key corresponding to the device signature certificate.
  • the Internet of Vehicles device when the Internet of Vehicles device needs to enter the second Internet of Vehicles system, it can first send an out-domain application message to the first Internet of Vehicles system. Of course, at this time, it can send an out-of-domain application to the cross-domain application authorization entity in the first Internet of Vehicles system. Application message, and then the cross-domain application authorization entity in the first Internet of Vehicles system can send an out-of-domain authorization token to the Internet of Vehicles device based on the out-of-domain application message, so that the Internet of Vehicles device can send an out-of-domain authorization token to the second Internet of Vehicles through the out-of-domain authorization token.
  • the Internet of Vehicles system sends a domain entry application message, and obtains the domain entry authorization token sent by the second Internet of Vehicles system based on the domain entry application message.
  • out-of-domain authorization token refers to the token issued by the cross-domain authorization entity in the first Internet of Vehicles system to the Internet of Vehicles devices in this system to allow them to apply for secure communication certificates in other Internet of Vehicles systems.
  • the cross-domain authorization entity in the first Internet of Vehicles system can use its private key to digitally sign the authorization information to provide the integrity, authentication and non-repudiation of the token data.
  • each car networking system can also maintain a trusted certificate list, and the trusted certificate list stores signature certificates (public key certificates) of other car networking systems. That is, the cross-domain application authorization entity in other Internet of Vehicles systems can use the private key corresponding to the signature certificate to digitally sign the domain entry authorization token or exit domain authorization token issued by it. At this time, the corresponding Internet of Vehicles system The cross-domain application authorization entity can use the certificate stored in the trusted certificate list to verify the domain entry authorization token or the exit domain authorization token from other car networking systems. That is, the domain entry authorization token and the domain exit authorization token in this embodiment are both security tokens.
  • the outbound authorization token contains the device signature certificate of the car networking device (ie, the device signature public key certificate), and the domain entry application message is digitally signed by the private key corresponding to the device signature certificate.
  • the second Internet of Vehicles system receives the domain entry application message, it can first obtain the outbound authorization token in the domain entry application message, and obtain the first Internet of Vehicles system from the pre-stored trusted certificate list.
  • the signed public key certificate can obtain the signed public key certificate of the cross-domain application authorization entity in the first Internet of Vehicles system, so as to verify whether the out-of-domain authorization token is valid through the signed public key certificate of the first Internet of Vehicles system;
  • verifying that the domain authorization token is valid you can extract the device signature certificate of the car networking device in the domain authorization token, and then use the device signature certificate to verify the digital signature of the domain entry application message.
  • you enter the domain If the digital signature of the application message is valid, you can continue to extract other information contained in the domain authorization token. This makes it possible to determine the car networking device corresponding to each entry application message, and realizes the safety and effectiveness in the cross-system application process.
  • out-of-domain authorization token also contains the device information of the car networking device and/or the registration certificate application message.
  • the out-of-domain authorization token may also include device information of the Internet of Vehicles equipment, such as OBU-related information, vehicle-related information, etc.; in addition, the out-of-domain authorization token may also include a registration certificate application message, that is, at this time
  • the process of applying for the domain entry authorization token is combined with the process of applying for the registration certificate.
  • the registration certificate application message on the day may be the public key in the key pair generated by applying for the registration certificate.
  • the Internet of Vehicles device may also send an identity application message to the second Internet of Vehicles system, and then receive the second Internet of Vehicles system based on the identity.
  • the cross-domain application identifier sent by the application message where the cross-domain application identifier corresponds to this entry application; wherein, both the out-domain application message and the out-domain authorization token contain the cross-domain application identifier.
  • the second Internet of Vehicles system may also include a cross-domain application identification generating entity responsible for generating a unique cross-domain application identification corresponding to the process of applying for a cross-system Internet of Vehicles communication certificate for the Internet of Vehicles device.
  • the cross-domain application identifier is an identifier that uniquely identifies the process of applying for a communication security certificate for a connected vehicle communication system by a connected vehicle device.
  • the generation of the cross-domain application identifier may be generated in a manner related to the cryptographic protocol, or may be generated in a manner independent of the cryptographic protocol, and is not specifically limited here.
  • the method related to the cryptographic protocol means that the cross-domain application identifier is generated by cryptographic operations on the device information of the connected car equipment and/or the information related to the application process.
  • the outbound application message sent by the Internet of Vehicles device to the first Internet of Vehicles system and the outbound authorization order issued by the first Internet of Vehicles system at this time contains the cross-domain application identification, that is, the first Internet of Vehicles system can bind the cross-domain application identification generated by the second Internet of Vehicles system with the out-of-domain authorization token generated by the second Internet of Vehicles system.
  • the out-of-domain authorization token may also include device information of the Internet of Vehicles device and/or registration certificate application message.
  • the Internet of Vehicles device when the Internet of Vehicles device receives the domain entry authorization token sent by the second Internet of Vehicles system, it can receive the domain entry response message sent by the second Internet of Vehicles system based on the entry application message, where:
  • the domain entry response message includes the domain entry authorization token
  • the domain entry authorization token includes the device signature certificate and the cross-domain application identifier corresponding to this entry application.
  • the domain entry authorization token also includes the device information of the car networking device and/or the device identification of the car networking device in the second car networking system.
  • the domain entry response message also contains the address information of the registered CA in the second Internet of Vehicles system and/or the address information of the application CA in the second Internet of Vehicles system. This enables IoT devices to send registration certificate request messages and application certificate request messages based on address information.
  • the Internet of Vehicles device when it obtains the registration certificate of the second Internet of Vehicles system based on the domain entry authorization token, it can send a registration certificate application message to the second Internet of Vehicles system, where the registration certificate application message contains The domain entry authorization token, and the registration certificate application message is digitally signed by the private key corresponding to the device signature certificate, and then the registration certificate sent by the second car networking system based on the registration certificate application message is received.
  • the second Internet of Vehicles system may also include a registration CA, that is, the Internet of Vehicles device can send a registration certificate application message to the registered CA in the second Internet of Vehicles system to apply for the registration certificate of the second Internet of Vehicles system.
  • the registered CA in the second Internet of Vehicles system receives the registration certificate application message, it can obtain the domain entry authorization token in the registration certificate application message, and obtain the device signature certificate in the domain entry authorization token, and then use
  • the device signature certificate verifies the digital signature of the registration certificate application message, and issues a registration certificate to the car networking device after the verification is passed, thereby ensuring the security in the certificate application process.
  • the Internet of Vehicles device After the Internet of Vehicles device obtains the registration certificate of the second Internet of Vehicles system based on the domain entry authorization token, it can also send an application certificate application message to the second Internet of Vehicles system, where the application certificate application message contains the registration certificate, and then receives The second Internet of Vehicles system is based on the application certificate sent by the application certificate application message.
  • the application certificate application message can also be digitally signed with the private key corresponding to the device signing certificate.
  • the process is the same as the registration certificate application process, and no specific explanation is given here.
  • the Internet of Vehicles device obtains the registration certificate of the second Internet of Vehicles system, it can use the registration certificate of the second Internet of Vehicles system to apply to the application CA of the second Internet of Vehicles system to implement the application of Internet of Vehicles secure communication in the second Internet of Vehicles system. Certificates to achieve cross-system secure communication of connected car devices.
  • the Internet of Vehicles device in this embodiment receives the domain access authorization token sent by the second Internet of Vehicles system, and obtains the registration certificate of the second Internet of Vehicles system through the domain access authorization token, thereby realizing that it is located in the first vehicle.
  • the Internet of Vehicles devices in the connected system can obtain the domain entry authorization token and registration certificate of the second Internet of Vehicles system, thereby realizing the application process of the cross-system secure communication certificate, so as to realize the transition from the first Internet of Vehicles system to the second vehicle.
  • Cross-system entry of networked systems are examples of networked systems.
  • FIG. 2 it is a flow chart of the steps of the certificate application method applied to the first Internet of Vehicles system in the embodiments of the present disclosure.
  • the method includes the following steps:
  • Step 201 When the Internet of Vehicles device applies for entering the second Internet of Vehicles system from the first Internet of Vehicles system, receive the out-of-domain application message sent by the Internet of Vehicles device.
  • the Internet of Vehicles device when it needs to perform cross-system communication, it may first send an out-of-domain application message to the first Internet of Vehicles system, and at this time, the first Internet of Vehicles system accesses the out-of-domain application message.
  • the specific content of the first Internet of Vehicles system, the second Internet of Vehicles system and the out-of-domain application message can refer to the relevant content on the side of the aforementioned Internet of Vehicles equipment, which is not specifically limited here.
  • Step 202 Based on the out-of-domain application message, send an out-of-domain authorization token to the Internet of Vehicles device.
  • the first Internet of Vehicles system may send an out-of-domain authorization token to the Internet of Vehicles device.
  • the outbound authorization token contains the device signature certificate of the Internet of Vehicles device, so that the Internet of Vehicles device sends an entry application message to the second Internet of Vehicles system and obtains the entry authorization token.
  • the entry request message contains the exit The domain authorization token, and the domain entry application message is digitally signed by the private key corresponding to the device signature certificate.
  • both the out-of-domain application message and the out-of-domain authorization token contain a cross-domain application identifier; wherein, the cross-domain application identifier is obtained by the Internet of Vehicles device from the second Internet of Vehicles system, and the cross-domain application identifier Corresponding to this entry application.
  • the out-of-domain authorization token also contains the device information of the car networking device and/or the registration certificate application message.
  • the first Internet of Vehicles system in this embodiment receives the exit application message sent by the Internet of Vehicles device, and sends the exit authorization token to the Internet of Vehicles device based on the exit application message, so that the Internet of Vehicles device can be based on the exit application message.
  • the domain authorization token acquires the domain entry authorization token of the second Internet of Vehicles system, thereby realizing the application process of the cross-system security communication certificate, so as to realize the cross-system entry from the first Internet of Vehicles system to the second Internet of Vehicles system.
  • FIG. 3 it is a flow chart of the steps of the certificate application method applied to the second Internet of Vehicles system in the embodiment of the present disclosure.
  • the method includes the following steps:
  • Step 301 When the Internet of Vehicles device applies to enter the second Internet of Vehicles system from the first Internet of Vehicles system, the domain entry authorization token is sent to the Internet of Vehicles device.
  • the second Internet of Vehicles system may send an entry authorization token to the Internet of Vehicles device, so that the Internet of Vehicles device can obtain the access of the second Internet of Vehicles system based on the entry authorization token. Certificate of Registration.
  • the second Internet of Vehicles system when it sends a domain entry authorization token to the Internet of Vehicles device, it can receive a domain entry application message sent by the Internet of Vehicles device, where the entry application message contains the exit domain authorization token, and the exit domain authorization
  • the token is obtained by the Internet of Vehicles device applying to the first Internet of Vehicles system, and the out-of-domain authorization token contains the device signature certificate of the Internet of Vehicles device, and the entry application message is digitally signed by the private key corresponding to the device signature certificate;
  • a domain entry response message is sent to the Internet of Vehicles device, where the domain entry response message contains the domain entry authorization token, and the domain entry authorization token contains the device signature certificate and information related to this entry application.
  • Corresponding cross-domain application identifier when the second Internet of Vehicles system sends a domain entry authorization token to the Internet of Vehicles device, it can receive a domain entry application message sent by the Internet of Vehicles device, where the entry application message contains the exit domain authorization token, and the exit domain authorization
  • the token is obtained by
  • the second Internet of Vehicles system can also obtain the domain out authorization token in the domain entry application message, and obtain the domain out authorization token.
  • the digital signature of the domain entry application message is verified as a valid signature through the device signature certificate verification, it is determined that the domain entry application message is a valid message.
  • the second Internet of Vehicles system needs to verify the validity of the domain entry application message before issuing the domain entry authorization token to the Internet of Vehicles device, that is, it needs to determine the identity information of the Internet of Vehicles device applying for the domain entry authorization token.
  • the car networking system can first obtain the domain authorization token from the domain entry application message, and verify whether the domain authorization token is valid based on the signed public key certificate of the first car networking system in the pre-stored trusted certificate list; When the out-domain authorization token is valid, the device signature certificate in the out-domain authorization token can be obtained, so that the validity of the digital signature of the domain entry application message can be verified through the device signature certificate; at this time, if the verification gets the entry If the digital signature of the domain application message is a valid signature, it can be determined that the domain application message is a valid message, and the identity information of the car networking device can be determined. At this time, the domain entry authorization token can be further issued.
  • the second Internet of Vehicles system may also receive the identity application message sent by the Internet of Vehicles device, and send the identity application message to the Internet of Vehicles device based on the identity application message.
  • the out-domain authorization token also contains a cross-domain application identifier.
  • the out-of-domain authorization token also contains the device information of the car networking device and/or the registration certificate application message.
  • the domain entry authorization token also contains the device information of the car networking device and/or the device identification of the car networking device in the second car networking system.
  • the domain entry response message also contains the address information of the registration certificate authority CA in the second Internet of Vehicles system; the address information of the CA used in the second Internet of Vehicles system.
  • the second Internet of Vehicles system sends the domain access authorization token to the Internet of Vehicles device, it can receive the registration certificate application message sent by the Internet of Vehicles device, where the registration certificate application message contains the domain access authorization token, And the registration certificate application message is digitally signed by the private key corresponding to the device signing certificate; then the domain entry authorization token in the registration certificate application message is obtained, and the device signing certificate in the domain entry authorization token is obtained, and when it is signed by the device
  • the certificate verification obtains that the digital signature of the registration certificate application message is a valid signature, it is determined that the registration certificate application message is a valid message, and the registration certificate is sent to the car networking device.
  • the second Internet of Vehicles system sends the registration certificate to the Internet of Vehicles device, it can also receive the application certificate application message sent by the Internet of Vehicles device, where the application certificate application message contains the registration certificate; then, based on the application certificate application message, The networked device sends the application certificate.
  • the second Internet of Vehicles system in this embodiment realizes the cross-system security communication certificate application process by sending the domain entry authorization token to the Internet of Vehicles device, so as to realize the transition from the first Internet of Vehicles system to the second Internet of Vehicles system.
  • Cross-system entry of the system
  • the application process can include the following steps:
  • the Internet of Vehicles device applies to the cross-domain application identification generating entity in the second Internet of Vehicles system for the cross-domain application identification.
  • the identification application message used to apply for the cross-domain application logo can also contain some information related to the certificate application, such as the country where the car networking equipment is located, the license plate number, the entry time and the departure time Wait.
  • the cross-domain application identifier generating entity assigns a cross-domain application identifier uniquely corresponding to this application to the Internet of Vehicles device, and can also provide the cross-domain application identifier to the cross-domain application authorization entity in the system.
  • the generation of the cross-domain application ID can be generated by a method based on cryptography, or generated by a method not based on cryptography, which is not limited here.
  • the Internet of Vehicles device applies for an out-of-domain authorization token to the cross-domain application authorization entity in the first Internet of Vehicles system.
  • the out-of-domain application message may include the cross-domain application identifier assigned by the cross-domain application authorization entity in the second Internet of Vehicles system.
  • the exit application message may need to provide some relevant information, such as the country to enter, license plate number, vehicle type, vehicle use, entry time and departure time, etc.
  • the cross-domain application authorization entity in the first Internet of Vehicles system checks the out-of-domain application message, and if allowed, generates an out-of-domain authorization token for the Internet of Vehicles device.
  • the out-of-domain authorization token may contain the following information: the cross-domain application identifier assigned by the cross-domain application identifier generating entity in the second Internet of Vehicles system; the device signature certificate of the Internet of Vehicles device, and the Internet of Vehicles device will use the corresponding certificate
  • the private key digitally signs the domain entry application message; the device information of the car networking equipment, such as OBU-related information and vehicle-related information, etc.; other information, such as token issuer ID, token validity period, signature certificate information, entry time And departure time etc.
  • the Internet of Vehicles device applies for a domain entry authorization token to the cross-domain application authorization entity in the second Internet of Vehicles system, that is, sends a domain entry application message.
  • the domain entry application message is digitally signed using the private key corresponding to the device signature certificate contained in the exit domain authorization token.
  • the domain entry application message contains the domain exit authorization token.
  • the cross-domain application authorization entity in the second Internet of Vehicles system verifies the domain entry application message.
  • the specific operations include: obtaining the domain entry authorization token in the domain entry application message, and obtaining the first certificate from the pre-stored trusted certificate list.
  • the cross-domain application of the Internet of Vehicles system for the signature public key certificate of the authorized entity, and then use the public key certificate to verify whether the out-domain authorization token is valid; if the out-domain authorization token is valid, extract the signed public key in the domain authorization token Then use the certificate to verify whether the digital signature of the domain entry application message is valid; if the digital signature is valid, extract the device and vehicle parameters carried in the token, and use the "domain mapping strategy" to map the parameters of the first Internet of Vehicles system To the second car networking system, such as vehicle type, vehicle usage, date and time format, etc.
  • the cross-domain application authorization entity of the second Internet of Vehicles system generates a domain entry authorization token for the Internet of Vehicles devices, which contains: the cross-domain application ID; the device signature certificate of the Internet of Things device; the second Internet of Vehicles system is the Internet of Things A newly assigned device ID used in this system by the device; device information of IoT devices that have been mapped to this system; other information, such as token issuer ID, token validity period, signature certificate information, entry time and departure time Etc.;
  • the second Internet of Vehicles system sends the domain access authorization token through a domain access response message, and the domain access response message may also include information such as the address of the registered CA and/or application CA and the protocol used in the system.
  • the Internet of Things device applies for a registration certificate from the registered CA in the second Internet of Vehicles system according to the protocol specified by the second Internet of Vehicles system, and the registration certificate application message uses the device signature corresponding to the device signature certificate contained in the domain entry authorization token Private key signature.
  • the registration certificate application message may include the domain entry authorization token and the public key in the key pair generated by the Internet of Things device to apply for the registration certificate.
  • the registered CA in the second Internet of Vehicles system verifies the registration certificate application message.
  • the specific operations include: the registered CA obtains the domain entry authorization token in the registration certificate application message, and uses the cross-domain application authorization entity in the second Internet of Vehicles system.
  • the public key certificate verifies whether the domain entry authorization token is valid. If the token is valid, extract the device signature certificate of the IoT device in the token, and then use the device signature certificate to verify whether the digital signature of the registration certificate application message is valid; If the signature is valid, various device parameters and vehicle parameters in the domain authorization token are extracted, as well as information such as the public key provided in the token to issue a registration certificate for the car networking device.
  • the Internet of Vehicles device uses the received registration certificate to apply for a corresponding application certificate from the application CA in the second Internet of Vehicles system in accordance with the protocol specified by the second Internet of Vehicles system.
  • the application CA verifies the application certificate application message, and then issues the corresponding application certificate to the IoT device in accordance with the rules of this system.
  • the Internet of Things device uses the application certificate to realize the secure communication of the Internet of Vehicles in the second Internet of Vehicles system.
  • another application process can also be that the Internet of Things device applies to the cross-domain authorization entity of the first Internet of Vehicles system for an out-of-domain authorization token, and the latter issues a domain authorization token to the Internet of Things device.
  • the token contains the device Signing certificate; then, the IoT device provides the prepared domain authorization token to the cross-domain authorization entity of the second Internet of Vehicles system.
  • the latter first generates the cross-domain application ID, and then issues the domain access authorization token to the IoT device, and then issues
  • the token contains a cross-domain application ID and a device signing certificate; then, the Internet of Things device uses the domain entry authorization token to apply for the registration certificate and application certificate of the second Internet of Vehicles system.
  • another application process may also be that the process of applying for the domain entry authorization token is combined with the process of applying for the registration certificate, that is, the domain exit authorization token may also include the registration certificate application message.
  • FIG. 5 it is a module block diagram of a certificate application device applied to a connected car device in an embodiment of the present disclosure, and the device includes:
  • the receiving module 501 is configured to receive the domain entry authorization token sent by the second Internet of Vehicles system when the Internet of Vehicles device applies to enter the second Internet of Vehicles system from the first Internet of Vehicles system;
  • the obtaining module 502 is configured to obtain the registration certificate of the second Internet of Vehicles system based on the domain entry authorization token.
  • the device further includes:
  • the first sending module is configured to send an out-of-domain application message to the first Internet of Vehicles system
  • the first receiving unit is configured to receive the out-of-domain authorization token sent by the first Internet of Vehicles system based on the out-of-domain application message, wherein the out-of-domain authorization token contains the device signature of the Internet of Vehicles device Certificate;
  • the second sending module is configured to send a domain entry application message to the second Internet of Vehicles system, wherein the domain entry application message includes the domain exit authorization token, and the domain entry application message passes through the device
  • the private key corresponding to the signing certificate is digitally signed.
  • the device can implement all the method steps on the side of the method embodiment of the car networking equipment, and can achieve the same technical effect, which will not be repeated here.
  • FIG. 6 it is a module block diagram of a certificate application device applied to the first Internet of Vehicles system in an embodiment of the present disclosure, and the device includes:
  • the receiving module 601 is configured to receive an out-of-domain application message sent by the Internet of Vehicles device when the Internet of Vehicles device applies to enter the second Internet of Vehicles system from the first Internet of Vehicles system;
  • the sending module 602 is configured to send an out-of-domain authorization token to the Internet of Vehicles device based on the out-of-domain application message, where the out-of-domain authorization token contains the device signature certificate of the Internet of Vehicles device, so that The Internet of Vehicles device sends a domain entry application message to the second Internet of Vehicles system and obtains a domain entry authorization token, the domain entry application message includes the domain exit authorization token, and the domain entry application message Digital signature is performed by the private key corresponding to the device signature certificate.
  • both the out-domain application message and the out-domain authorization token include a cross-domain application identifier; wherein, the cross-domain application identifier is that the Internet of Vehicles device applies to the second Internet of Vehicles system Obtained, and the cross-domain application identifier corresponds to this entry application.
  • the device can implement all the method steps on the side of the method embodiment of the first Internet of Vehicles system, and can achieve the same technical effect, which will not be repeated here.
  • FIG. 7 it is a module block diagram of a certificate application device applied to the second Internet of Vehicles system in an embodiment of the present disclosure, and the device includes:
  • the sending module 701 is used to send an entry authorization token to the Internet of Vehicles device when the Internet of Vehicles device applies to enter the second Internet of Vehicles system from the first Internet of Vehicles system, so that the Internet of Vehicles device is based on the entry of the Internet of Vehicles.
  • the authorization token obtains the registration certificate of the second Internet of Vehicles system.
  • the sending module 701 is specifically configured to receive a domain entry application message sent by the Internet of Vehicles device, wherein the domain entry application message contains an out-domain authorization token, and the out-domain authorization token is controlled by the The Internet of Vehicles device applies to the first Internet of Vehicles system, and the out-of-domain authorization token contains the device signature certificate of the Internet of Vehicles device, and the entry application message corresponds to the device signature certificate.
  • send an entry response message to the Internet of Vehicles device wherein the entry response message contains an entry authorization token, and the entry authorization
  • the token includes the device signature certificate and the cross-domain application identifier corresponding to this entry application, and the entry response message is digitally signed by the private key corresponding to the device signature certificate.
  • the device can implement all the method steps of the second vehicle networking system method embodiment side, and can achieve the same technical effect, which will not be repeated here.
  • FIG. 8 is a schematic structural diagram of a car networking device provided by an embodiment of the present disclosure.
  • the car networking device 800 may include at least one processor 801, a memory 802, at least one other user interface 803, and a transceiver 804.
  • the various components in the vehicle networking device 800 are coupled together through the bus system 805.
  • the bus system 805 is used to implement connection and communication between these components.
  • the bus system 805 also includes a power bus, a control bus, and a status signal bus. However, for the sake of clarity, various buses are marked as the bus system 805 in FIG. 8.
  • the bus system may include any number of interconnected buses and bridges, specifically one or more processors represented by the processor 801 and the memory 802
  • the various circuits of the representative memory are linked together.
  • the bus system can also link various other circuits such as peripherals, voltage regulators, power management circuits, etc., which are all known in the art. Therefore, the embodiments of the present disclosure will not further describe them.
  • the bus interface provides the interface.
  • the transceiver 804 may be a plurality of elements, that is, including a transmitter and a receiver, and provide a unit for communicating with various other devices on the transmission medium.
  • the user interface 803 may also be an interface capable of connecting externally and internally with the required equipment.
  • the connected equipment includes but not limited to a keypad, a display, a speaker, a microphone, a joystick, and the like.
  • the memory 802 in the embodiment of the present disclosure may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memory.
  • the non-volatile memory can be read-only memory (Read-Only Memory, ROM), programmable read-only memory (Programmable ROM, PROM), erasable programmable read-only memory (Erasable PROM, EPROM), and electrically available Erase programmable read-only memory (Electrically EPROM, EEPROM) or flash memory.
  • the volatile memory may be a random access memory (Random Access Memory, RAM), which is used as an external cache.
  • RAM static random access memory
  • DRAM dynamic random access memory
  • DRAM synchronous dynamic random access memory
  • Synchronous DRAM Double Data Rate Synchronous Dynamic Random Access Memory
  • Double Data Rate SDRAM Double Data Rate SDRAM
  • DDRSDRAM Double Data Rate Synchronous Dynamic Random Access Memory
  • Enhanced SDRAM Enhanced SDRAM, ESDRAM
  • Synchronous Link Dynamic Random Access Memory Synchronous Link Dynamic Random Access Memory
  • Synchlink DRAM Synchronous Link Dynamic Random Access Memory
  • SLDRAM Direct Rambus RAM
  • the memory 802 of the system and method described in the various embodiments of the present disclosure is intended to include, but is not limited to, these and any other suitable types of memory.
  • the processor 801 is responsible for managing the bus system and general processing.
  • the memory 802 can store computer programs or instructions used by the processor 801 when performing operations.
  • the processor 801 can be used to: When the networking system enters the second Internet of Vehicles system, it receives the domain entry authorization token sent by the second Internet of Vehicles system; based on the domain entry authorization token, obtains the registration certificate of the second Internet of Vehicles system.
  • the methods disclosed in the foregoing embodiments of the present disclosure may be applied to the processor 801 or implemented by the processor 801.
  • the processor 801 may be an integrated circuit chip with signal processing capabilities. In the implementation process, the steps of the foregoing method can be completed by an integrated logic circuit of hardware in the processor 801 or instructions in the form of software.
  • the aforementioned processor 801 may be a general-purpose processor, a digital signal processor (Digital Signal Processor, DSP), an application specific integrated circuit (ASIC), a ready-made programmable gate array (Field Programmable Gate Array, FPGA) or other Programmable logic devices, discrete gates or transistor logic devices, discrete hardware components.
  • DSP Digital Signal Processor
  • ASIC application specific integrated circuit
  • FPGA Field Programmable Gate Array
  • the methods, steps, and logical block diagrams disclosed in the embodiments of the present disclosure can be implemented or executed.
  • the general-purpose processor may be a microprocessor or the processor may also be any conventional processor or the like.
  • the steps of the method disclosed in the embodiments of the present disclosure can be directly embodied as executed by a hardware decoding processor, or executed by a combination of hardware and software modules in the decoding processor.
  • the software module can be located in a mature storage medium in the field, such as random access memory, flash memory, read-only memory, programmable read-only memory, or electrically erasable programmable memory, registers.
  • the storage medium is located in the memory 802, and the processor 801 reads the information in the memory 802, and completes the steps of the above method in combination with its hardware.
  • the embodiments described in the present disclosure can be implemented by hardware, software, firmware, middleware, microcode, or a combination thereof.
  • the processing unit can be implemented in one or more application specific integrated circuits (ASIC), digital signal processor (Digital Signal Processing, DSP), digital signal processing equipment (DSP Device, DSPD), programmable Logic devices (Programmable Logic Device, PLD), Field-Programmable Gate Array (Field-Programmable Gate Array, FPGA), general-purpose processors, controllers, microcontrollers, microprocessors, and others for performing the functions described in this application Electronic unit or its combination.
  • ASIC application specific integrated circuits
  • DSP Digital Signal Processing
  • DSP Device digital signal processing equipment
  • PLD programmable Logic Device
  • PLD Field-Programmable Gate Array
  • FPGA Field-Programmable Gate Array
  • the described technology can be implemented by modules (for example, procedures, functions, etc.) that perform the functions described in the embodiments of the present disclosure.
  • the software codes can be stored in the memory and executed by the processor.
  • the memory can be implemented in the processor or external to the processor.
  • the processor 801 before the receiving the domain entry authorization token sent by the second Internet of Vehicles system, is further configured to: send an outbound application message to the first Internet of Vehicles system Receiving the out-of-domain authorization token sent by the first Internet of Vehicles system based on the out-of-domain application message, wherein the out-of-domain authorization token contains the device signature certificate of the Internet of Vehicles device; 2.
  • the Internet of Vehicles system sends a domain entry application message, wherein the domain entry application message includes the domain exit authorization token, and the domain entry application message is digitally signed by the private key corresponding to the device signature certificate.
  • the processor 801 before the sending an out-of-domain application message to the first Internet of Vehicles system, is further configured to: send an identification application message to the second Internet of Vehicles system; and receive the The second Internet of Vehicles system is based on the cross-domain application identification sent by the identification application message, wherein the cross-domain application identification corresponds to this entry application; wherein, the out-of-domain application message and the out-of-domain authorization token Both include the cross-domain application identifier.
  • the out-of-domain authorization token further includes the device information of the car networking device and/or the registration certificate application message.
  • the processor 801 is further configured to: receive an entry response message sent by the second Internet of Vehicles system based on the entry application message, where the entry response message includes There is the domain entry authorization token, and the domain entry authorization token includes the device signature certificate and the cross-domain application identifier corresponding to this entry application.
  • the domain entry authorization token further includes the device information of the Internet of Vehicles device and/or the device identification of the Internet of Vehicles device in the second Internet of Vehicles system;
  • the domain entry response message also contains the address information of the registration certificate authority CA in the second Internet of Vehicles system and/or the address information of the application CA in the second Internet of Vehicles system.
  • the processor 801 is further configured to: send a registration certificate application message to the second Internet of Vehicles system, wherein the registration certificate application message includes the domain entry authorization token, and The registration certificate application message is digitally signed by the private key corresponding to the device signature certificate; the registration certificate sent by the second Internet of Vehicles system based on the registration certificate application message is received.
  • the processor 801 is further configured to: send an application certificate application message to the second Internet of Vehicles system, where the application certificate application message includes the registration certificate; and receive the first 2.
  • the Internet of Vehicles system is based on the application certificate sent by the application certificate application message.
  • the Internet of Vehicles device provided in the embodiments of the present disclosure can implement the various processes implemented by the Internet of Vehicles device in the foregoing embodiments. To avoid repetition, details are not described herein again.
  • FIG. 9 is a schematic structural diagram of a first Internet of Vehicles system provided by an embodiment of the present disclosure.
  • the first Internet of Vehicles system 900 may include at least one processor 901, a memory 902, and at least one other user interface 903. , And transceiver 904.
  • the various components in the first Internet of Vehicles system 900 are coupled together through the bus system 905.
  • the bus system 905 is used to implement connection and communication between these components.
  • the bus system 905 also includes a power bus, a control bus, and a status signal bus. However, for the sake of clarity, various buses are marked as the bus system 905 in FIG. 9.
  • the bus system may include any number of interconnected buses and bridges, specifically one or more processors represented by the processor 901 and the memory 902
  • the various circuits of the representative memory are linked together.
  • the bus system can also link various other circuits such as peripherals, voltage regulators, power management circuits, etc., which are all known in the art. Therefore, the embodiments of the present disclosure will not further describe them.
  • the bus interface provides the interface.
  • the transceiver 904 may be a plurality of elements, that is, including a transmitter and a receiver, and provide a unit for communicating with various other devices on the transmission medium.
  • the user interface 903 may also be an interface capable of connecting externally and internally with the required equipment.
  • the connected equipment includes but is not limited to a keypad, a display, a speaker, a microphone, a joystick, and the like.
  • the memory 902 in the embodiment of the present disclosure may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memory.
  • the non-volatile memory can be read-only memory (Read-Only Memory, ROM), programmable read-only memory (Programmable ROM, PROM), erasable programmable read-only memory (Erasable PROM, EPROM), and electrically available Erase programmable read-only memory (Electrically EPROM, EEPROM) or flash memory.
  • the volatile memory may be a random access memory (Random Access Memory, RAM), which is used as an external cache.
  • RAM static random access memory
  • DRAM dynamic random access memory
  • DRAM synchronous dynamic random access memory
  • Synchronous DRAM Double Data Rate Synchronous Dynamic Random Access Memory
  • Double Data Rate SDRAM Double Data Rate SDRAM
  • DDRSDRAM Double Data Rate Synchronous Dynamic Random Access Memory
  • Enhanced SDRAM Enhanced SDRAM, ESDRAM
  • Synchronous Link Dynamic Random Access Memory Synchronous Link Dynamic Random Access Memory
  • Synchlink DRAM Synchronous Link Dynamic Random Access Memory
  • SLDRAM Direct Rambus RAM
  • the memory 902 of the system and method described in the various embodiments of the present disclosure is intended to include, but is not limited to, these and any other suitable types of memory.
  • the processor 901 is responsible for managing the bus system and general processing.
  • the memory 902 can store computer programs or instructions used by the processor 901 when performing operations.
  • the processor 901 can be used to: When the networking system enters the second Internet of Vehicles system, it receives an out-of-domain application message sent by the Internet of Vehicles device; based on the out-of-domain application message, sends an out-of-domain authorization token to the Internet of Vehicles device, wherein the out-of-domain authorization token
  • the device signature certificate of the Internet of Vehicles device is included in the Internet of Vehicles, so that the Internet of Vehicles device sends an entry application message to the second Internet of Vehicles system and obtains an entry authorization token.
  • the entry application message contains The exit domain authorization token and the domain entry application message are digitally signed by the private key corresponding to the device signature certificate.
  • both the out-domain application message and the out-domain authorization token include a cross-domain application identifier; wherein, the cross-domain application identifier is the The second Internet of Vehicles system application is obtained, and the cross-domain application identifier corresponds to this entry application.
  • the out-of-domain authorization token further includes the device information of the car networking device and/or the registration certificate application message.
  • the first Internet of Vehicles system provided by the embodiments of the present disclosure can implement the various processes implemented by the first Internet of Vehicles system in the foregoing embodiments. To avoid repetition, details are not described herein again.
  • FIG. 10 is a schematic structural diagram of a second Internet of Vehicles system provided by an embodiment of the present disclosure.
  • the second Internet of Vehicles system 1000 may include at least one processor 1001, a memory 1002, and at least one other user interface 1003. , And the transceiver 1004.
  • the various components in the second vehicle networking system 1000 are coupled together through the bus system 1005.
  • the bus system 1005 is used to implement connection and communication between these components.
  • the bus system 1005 also includes a power bus, a control bus, and a status signal bus. However, for the sake of clarity, various buses are marked as the bus system 1005 in FIG. 10.
  • the bus system may include any number of interconnected buses and bridges, specifically one or more processors represented by the processor 1001 and the memory 1002
  • the various circuits of the representative memory are linked together.
  • the bus system can also link various other circuits such as peripherals, voltage regulators, power management circuits, etc., which are all known in the art. Therefore, the embodiments of the present disclosure will not further describe them.
  • the bus interface provides the interface.
  • the transceiver 1004 may be a plurality of elements, including a transmitter and a receiver, and provide a unit for communicating with various other devices on the transmission medium.
  • the user interface 1003 may also be an interface capable of connecting externally and internally with the required equipment.
  • the connected equipment includes but not limited to a keypad, a display, a speaker, a microphone, a joystick, and the like.
  • the memory 1002 in the embodiment of the present disclosure may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memory.
  • the non-volatile memory can be read-only memory (Read-Only Memory, ROM), programmable read-only memory (Programmable ROM, PROM), erasable programmable read-only memory (Erasable PROM, EPROM), and electrically available Erase programmable read-only memory (Electrically EPROM, EEPROM) or flash memory.
  • the volatile memory may be a random access memory (Random Access Memory, RAM), which is used as an external cache.
  • RAM static random access memory
  • DRAM dynamic random access memory
  • DRAM synchronous dynamic random access memory
  • Synchronous DRAM Double Data Rate Synchronous Dynamic Random Access Memory
  • Double Data Rate SDRAM Double Data Rate SDRAM
  • DDRSDRAM Double Data Rate Synchronous Dynamic Random Access Memory
  • Enhanced SDRAM Enhanced SDRAM, ESDRAM
  • Synchronous Link Dynamic Random Access Memory Synchronous Link Dynamic Random Access Memory
  • Synchlink DRAM Synchronous Link Dynamic Random Access Memory
  • SLDRAM Direct Rambus RAM
  • the memory 1002 of the system and method described in the various embodiments of the present disclosure is intended to include, but is not limited to, these and any other suitable types of memory.
  • the processor 1001 is responsible for managing the bus system and general processing.
  • the memory 1002 can store computer programs or instructions used by the processor 1001 when performing operations.
  • the processor 1001 can be used to: When the networking system enters the second Internet of Vehicles system, it sends a domain access authorization token to the Internet of Vehicles device, so that the Internet of Vehicles device obtains the registration certificate of the second Internet of Vehicles system based on the domain access authorization token.
  • the processor 1001 is further configured to: receive an entry application message sent by the Internet of Vehicles device, wherein the entry application message includes an exit authorization token, and the exit The domain authorization token is obtained by the Internet of Vehicles device applying to the first Internet of Vehicles system, and the outbound authorization token contains the device signature certificate of the Internet of Vehicles device, and the domain entry application message passes all The private key corresponding to the device signature certificate is digitally signed; based on the domain entry application message, an entry response message is sent to the Internet of Vehicles device, wherein the entry response message includes a domain entry authorization token, And the domain entry authorization token includes the device signature certificate and the cross-domain application identifier corresponding to this entry application.
  • the processor 1001 before the receiving the domain entry application message sent by the Internet of Vehicles device, the processor 1001 is further configured to: receive the identification application message sent by the Internet of Vehicles device; based on the An identification application message, sending a cross-domain application identification to the Internet of Vehicles device, wherein the cross-domain application identification corresponds to this entry application; correspondingly, the out-domain authorization token also contains the cross-domain application Logo.
  • the out-of-domain authorization token further includes the device information of the car networking device and/or the registration certificate application message.
  • the domain entry authorization token further includes device information of the Internet of Vehicles device and/or device identification of the Internet of Vehicles device in the second Internet of Vehicles system;
  • the domain entry response message also includes the address information of the registration certificate authority CA in the second Internet of Vehicles system and/or the address information of the application CA in the second Internet of Vehicles system.
  • the processor 1001 before the sending an entry response message to the Internet of Vehicles device based on the entry application message, the processor 1001 is further configured to: obtain the exit value in the entry application message. Domain authorization token, and obtain the device signature certificate in the exit domain authorization token; when the digital signature of the domain entry application message is verified by the device signature certificate to be a valid signature, the domain entry application message is determined Is a valid message.
  • the processor 1001 is further configured to: receive a registration certificate application message sent by the Internet of Vehicles device, where the The registration certificate application message includes the domain entry authorization token, and the registration certificate application message is digitally signed by the private key corresponding to the device signing certificate; acquiring the domain entry in the registration certificate application message Authorization token, and obtain the device signature certificate in the domain entry authorization token; when the digital signature of the registration certificate application message is a valid signature through the device signature certificate verification, it is determined that the registration certificate application message is A valid message, and send a registration certificate to the car networking device.
  • the processor 1001 is further configured to: receive an application certificate application message sent by the Internet of Vehicles device, wherein the application certificate application The message includes the registration certificate; based on the application certificate application message, the application certificate is sent to the car networking device.
  • the second Internet of Vehicles system provided by the embodiments of the present disclosure can implement each process implemented by the second Internet of Vehicles system in the foregoing embodiments. To avoid repetition, details are not described herein again.
  • the electronic device provided by the embodiments of the present disclosure includes hardware structures and/or software modules corresponding to each function.
  • the present disclosure can be implemented in the form of hardware or a combination of hardware and computer software.
  • each functional module can be divided corresponding to each function, or two or more functions can be integrated into one processing module.
  • the above-mentioned integrated modules can be implemented in the form of hardware or software functional modules.
  • the disclosed device and method may be implemented in other ways.
  • the device embodiments described above are merely illustrative.
  • the division of the modules or units is only a logical function division. In actual implementation, there may be other division methods, for example, multiple units or components may be divided. It can be combined or integrated into another system, or some features can be ignored or not implemented.
  • the displayed or discussed mutual couplings or direct couplings or communication connections may be indirect couplings or communication connections between devices or units through some interfaces.
  • the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the objectives of the solutions of the embodiments.
  • the functional units in the various embodiments of the present disclosure may be integrated into one processing unit, or each unit may exist alone physically, or two or more units may be integrated into one unit.
  • the above-mentioned integrated unit can be implemented in the form of a software functional unit.
  • the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer readable storage medium.
  • the computer software product is stored in a storage medium and includes several instructions to enable a computer device (which can be a personal computer, a server, Or a network device, etc.) or a processor executes all or part of the steps of the methods described in the various embodiments of the present disclosure.
  • the computer storage medium is a non-transitory (English: nontransitory) medium, including: flash memory, mobile hard disk, read-only memory, random access memory, magnetic disk or optical disk and other media that can store program codes.
  • the embodiments of the present disclosure also provide a non-transitory computer-readable storage medium on which a computer program is stored.
  • a computer program is stored on which a computer program is stored.
  • the method steps provided in the above embodiments are implemented and can achieve the same The technical effects of, will not be repeated here.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computing Systems (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • Health & Medical Sciences (AREA)
  • General Health & Medical Sciences (AREA)
  • Medical Informatics (AREA)
  • Mobile Radio Communication Systems (AREA)
  • Traffic Control Systems (AREA)

Abstract

本公开实施例提供一种证书申请方法及装置，其中方法包括：当车联网设备申请从第一车联网***进入第二车联网***时，接收所述第二车联网***所发送的入域授权令牌；基于所述入域授权令牌，获取所述第二车联网***的注册证书。本公开实施例实现了跨***的证书申请过程。

Description

一种证书申请方法及装置
相关申请的交叉引用
本申请要求于2020年03月18日提交的申请号为2020101934358，发明名称为“一种证书申请方法及装置”的中国专利申请的优先权，其通过引用方式全部并入本文。
技术领域
本公开涉及通信技术领域，尤其涉及一种证书申请方法及装置。
背景技术
在车联网安全通信领域，车辆分属于不同的车联网通信***。当车辆需要跨国行驶时，车辆需要跨***进入其他国家的车联网***。另外，即使在同一个国家内，也可能有属于不同车联网通信***的车辆因某种原因需要进入其他车联网通信***的场景存在。此时需要考虑到车辆的跨***进入，但是现有技术并未涉及到。
发明内容
本公开实施例提供一种证书申请方法及装置，以实现车联网设备的跨***进入过程。
本公开实施例提供一种证书申请方法，应用于车联网设备，包括：
当车联网设备申请从第一车联网***进入第二车联网***时，接收所述第二车联网***所发送的入域授权令牌；
基于所述入域授权令牌，获取所述第二车联网***的注册证书。
本公开实施例提供一种证书申请方法，应用于第一车联网***，包括：
当车联网设备申请从第一车联网***进入第二车联网***时，接收车联网设备发送的出域申请消息；
基于所述出域申请消息，向所述车联网设备发送出域授权令牌，其中所述出域授权令牌中包含有所述车联网设备的设备签名证书，以使所述车联网 设备向所述第二车联网***发送入域申请消息并获取入域授权令牌，所述入域申请消息中包含有所述出域授权令牌，且所述入域申请消息通过所述设备签名证书所对应的私钥进行数字签名。
本公开实施例提供一种证书申请方法，应用于第二车联网***，包括：
当车联网设备申请从第一车联网***进入第二车联网***时，向所述车联网设备发送入域授权令牌，以使所述车联网设备基于所述入域授权令牌获取所述第二车联网***的注册证书。
本公开实施例提供一种证书申请装置，应用于车联网设备，包括：
接收模块，用于当车联网设备申请从第一车联网***进入第二车联网***时，接收所述第二车联网***所发送的入域授权令牌；
获取模块，用于基于所述入域授权令牌，获取所述第二车联网***的注册证书。
本公开实施例提供一种证书申请装置，应用于第一车联网***，包括：
接收模块，用于当车联网设备申请从第一车联网***进入第二车联网***时，接收车联网设备发送的出域申请消息；
发送模块，用于基于所述出域申请消息，向所述车联网设备发送出域授权令牌，其中所述出域授权令牌中包含有所述车联网设备的设备签名证书，以使所述车联网设备向所述第二车联网***发送入域申请消息并获取入域授权令牌，所述入域申请消息中包含有所述出域授权令牌，且所述入域申请消息通过所述设备签名证书所对应的私钥进行数字签名。
本公开实施例提供一种证书申请装置，应用于第二车联网***，包括：
发送模块，用于当车联网设备申请从第一车联网***进入第二车联网***时，向所述车联网设备发送入域授权令牌，以使所述车联网设备基于所述入域授权令牌获取所述第二车联网***的注册证书。
本公开实施例提供一种车联网设备，包括存储器、处理器及存储在存储器上并可在处理器上运行的计算机程序，所述处理器执行所述程序时实现所述的证书申请方法的步骤。
本公开实施例提供一种第一车联网***，包括存储器、处理器及存储在 存储器上并可在处理器上运行的计算机程序，所述处理器执行所述程序时实现所述的证书申请方法的步骤。
本公开实施例提供一种第二车联网***，包括存储器、处理器及存储在存储器上并可在处理器上运行的计算机程序，所述处理器执行所述程序时实现所述的证书申请方法的步骤。
本公开实施例提供一种非暂态计算机可读存储介质，其上存储有计算机程序，该计算机程序被处理器执行时实现所述的证书申请方法的步骤。
本公开实施例提供的证书申请方法及装置，车联网设备在需要从第一车联网***进入第二车联网***时通过接收第二车联网***所发送的入域授权令牌，并通过该入域授权令牌获取第二车联网***的注册证书，实现了位于第一车联网***中的车联网设备能够获取第二车联网***的入域授权令牌和注册证书，从而实现了跨***的安全通信证书的申请过程，从而能够实现从第一车联网***至第二车联网***的跨***进入。
附图说明
为了更清楚地说明本公开实施例或现有技术中的技术方案，下面将对实施例或现有技术描述中所需要使用的附图作一简单地介绍，显而易见地，下面描述中的附图是本公开的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1为本公开实施例中应用于车联网设备的证书申请方法的步骤流程图；
图2为本公开实施例中应用于第一车联网***的证书申请方法的步骤流程图；
图3为本公开实施例中应用于第二车联网***的证书申请方法的步骤流程图；
图4为本公开实施例中具体实施例的参考架构图；
图5为本公开实施例中应用于车联网设备的证书申请装置的模块框图；
图6为本公开实施例中应用于第一车联网***的证书申请装置的模块框图；
图7为本公开实施例中应用于第二车联网***的证书申请装置的模块框图；
图8为本公开实施例中车联网设备的结构示意图；
图9为本公开实施例中第一车联网***的结构示意图；
图10为本公开实施例中第二车联网***的结构示意图。
具体实施方式
为使本公开实施例的目的、技术方案和优点更加清楚，下面将结合本公开实施例中的附图，对本公开实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例是本公开一部分实施例，而不是全部的实施例。基于本公开中的实施例，本领域普通技术人员在没有作出创造性劳动前提下所获得的所有其他实施例，都属于本公开保护的范围。
为了便于清楚描述本公开实施例的技术方案，在本公开的各实施例中，若采用了“第一”、“第二”等字样对功能和作用基本相同的相同项或相似项进行区分，本领域技术人员可以理解“第一”、“第二”等字样并不对数量和执行次序进行限定。
在车联网领域，车联网安全通信是基于公钥基础设施(Public Key Infrastructure，PKI)实现的，且车联网PKI的基本构成也都相同。
其中，车联网***中证书申请实体包括：车载单元(On Board Unit，OBU)和路侧单元(Road Side Unit，RSU)，其中OBU为安装在车辆上的通信设备，负责车辆车对外界的信息交换(vehicle to everything，V2X)消息的发送和接收；RSU安装在在路侧设备上的通信设备，负责路侧设备V2X消息的发送和接收。
此外，车联网PKI***中证书颁发实体包括根证书颁发机构(Root Certificate Authority，Root CA)、注册CA(Enrollment CA，ECA)和应用CA(Application CA，ACA)，根CA是车联网安全PKI体系的安全锚点，用于向下级子CA颁发子CA证书；注册CA在OBU和RSU***的安全初始化(Security Bootstrap)阶段，向这些实体颁发注册证书，OBU和RSU使 用注册证书申请应用证书；应用CA向OBU和RSU颁发其用于对播发的V2X消息进行签名的证书。对应的证书种类包括根证书、注册证书和应用证书，其中根证书是根CA的自签证书。根证书是一个PKI***证书链的根节点，又称PKI***的信任锚点(trust anchor)；注册证书由注册CA颁发给OBU和RSU，注册证书与设备唯一对应，设备使用注册证书从各授权机构获取其他与车联网安全通信相关的应用证书；应用证书是颁发给OBU和RSU的用于对其播发的消息进行数字签名的证书，例如OBU对其播发的车辆行驶状态信息进行数字签名，RSU对其播发的交通信号灯状态信息进行数字签名。
此外，现有的应用证书颁发过程通常为，OBU/RSU向注册CA申请注册证书，注册CA审核后向OBU/RSU颁发注册证书；OBU/RSU利用注册证书向负责某车联网应用领域的应用CA申请具体用于对V2X消息进行数字签名的应用证书，应用CA审核后向OBU/RSU颁发应用证书；OBU/RSU利用应用证书对其播发的V2X消息进行数字签名，并将签名消息连同签名证书一同播发出去；接收V2X签名消息的OBU/RSU首先利用预先存储的应用CA证书对消息中的签名证书进行验证，然后利用通过验证的签名证书验证签名消息的有效性。
上述过程虽然能够实现车联网通信，但是并未涉及到跨***通信，即车联网设备从一个车联网***进入到另一个车联网***，在此本公开实施例对如何跨***通信进行说明。
如图1所示，为本公开实施例中应用于车联网设备的证书申请方法，该方法包括如下步骤：
步骤101：当车联网设备申请从第一车联网***进入第二车联网***时，接收第二车联网***所发送的入域授权令牌。
具体的，车联网设备可以指参与车联网通信的实体，例如安装在车辆上的时隙车辆通信能力的OBU或安装在路侧交通设备上的实现设备通信能力的RSU。
此外，第一车联网***和第二车联网***为两个不同的车联网***，且可以将第一车联网***当做源域，将第二车联网***当做目的域，即针对第 二车联网***而言，入域指从第一车联网***进入第二车联网***，针对第一车联网***而言，出域指从第一车联网***进入第二车联网***。当然，针对同一车联网***中的车联网设备能够使用能够互认的安全通信证书进行车联网安全通信。
在本步骤中车联网设备初始位于第一车联网***，此时若车联网设备需要从第一车联网***进入第二车联网***，则可以接收第二车联网***所发送的入域授权令牌。
在此需要说明的是，第二车联网***中可以包括不同的功能实体，以实现对不同功能的划分，例如第二车联网***中可以包括跨域申请授权实体，该实体用于在一个车联网***内负责向出域的车联网设备颁发出域授权令牌或者向入域的车联网设备颁发入域授权令牌；即在本步骤中车联网设备可以接收第二车联网***中的跨域申请授权实体所发送的入域授权令牌。
另外，入域授权令牌指车联网***颁发的允许车联网设备申请本***中安全通信证书的令牌。当然，该入域授权令牌可以由跨域申请授权实体颁发，且可以使用其私钥对授权信息进行数字签名，以提供令牌数据的完整性、认证性和不可否认性。
步骤102：基于入域授权令牌，获取第二车联网***的注册证书。
在本步骤中，具体的，车联网设备在接收到入域授权令牌之后，可以获取第二车联网***的注册证书，从而使得能够基于该注册证书进入第二车联网***，实现了跨***的安全通信证书的申请过程，从而能够实现从第一车联网***至第二车联网***的跨***进入。
这样，本实施例中的车联网设备在需要从第一车联网***进入第二车联网***时接收第二车联网***所发送的入域授权令牌，并通过该入域授权令牌获取第二车联网***的注册证书，实现了位于第一车联网***中的车联网设备能够获取第二车联网***的入域授权令牌和注册证书，从而实现了跨***的安全通信证书的申请过程，从而能够实现从第一车联网***至第二车联网***的跨***进入。
此外，进一步地，在本实施例中车联网设备在接收第二车联网***所发 送的入域授权令牌之前，还可以向第一车联网***发送出域申请消息，并接收第一车联网***基于出域申请消息所发送的出域授权令牌，其中出域授权令牌中包含有车联网设备的设备签名证书，然后向第二车联网***发送入域申请消息，其中入域申请消息中包含有出域授权令牌，且入域申请消息通过设备签名证书所对应的私钥进行数字签名。
具体的，车联网设备在需要进入第二车联网***时，可以先向第一车联网***发送出域申请消息，当然此时可以向第一车联网***中的跨域申请授权实体发送出域申请消息，然后第一车联网***中的跨域申请授权实体可以基于该出域申请消息向车联网设备发送出域授权令牌，从而使得车联网设备能够通过该出域授权令牌向第二车联网***发送入域申请消息，且获取第二车联网***基于该入域申请消息所发送的入域授权令牌。
在此需要说明的是，出域授权令牌指第一车联网***中的跨域授权实体向本***中的车联网设备颁发的允许其申请其他车联网***中安全通信证书的令牌。当然，第一车联网***中的跨域授权实体可以使用其私钥对授权信息进行数字签名，以提供令牌数据的完整性、认证性和不可否认性。
此外，每个车联网***中还可以维护一可信证书列表，该可信证书列表中存储有其他车联网***的签名证书(公钥证书)。即其他车联网***中的跨域申请授权实体可以使用与签名证书对应的私钥来对其颁发的入域授权令牌或出域授权令牌进行数字签名，此时对应的车联网***中的跨域申请授权实体则可以使用存储在可信证书列表中的证书验证来自于其他车联网***的入域授权令牌或出域授权令牌。即本实施例中的入域授权令牌和出域授权令牌均为安全令牌。
具体的，出域授权令牌中包含有车联网设备的设备签名证书(即设备签名公钥证书)，且入域申请消息通过设备签名证书所对应的私钥进行数字签名。此时当第二车联网***接收到该入域申请消息时，可以先获取该入域申请消息中的出域授权令牌，并从预先存储的可信证书列表中获取第一车联网***的签名公钥证书，即可以获取第一车联网***中跨域申请授权实体的签名公钥证书，从而通过该第一车联网***的签名公钥证书验证该出域授权令 牌是否有效；此时当验证出域授权令牌有效时，则可以提取出域授权令牌中的车联网设备的设备签名证书，然后使用该设备签名证书对入域申请消息的数字签名进行验证，此时若入域申请消息的数字签名有效，则可以继续提取出域授权令牌中所包含的其他信息。这样使得能够确定每条入域申请消息所对应的车联网设备，且实现了跨***申请过程中的安全性和有效性。
还需要说明的是，出域授权令牌中还包含有车联网设备的设备信息和/或注册证书申请消息。
即该出域授权令牌中还可以包括车联网设备的设备信息，例如OBU相关信息、车辆相关信息等；另外，该出域授权令牌中还可以包括注册证书申请消息，即此时可以将申请入域授权令牌的过程与申请注册证书的过程合并，当日该注册证书申请消息可以为申请注册证书而生成的密钥对中的公钥。
另外，进一步地，在本实施例中，车联网设备在向第一车联网***发送出域申请消息之前，还可以向第二车联网***发送标识申请消息，然后接收第二车联网***基于标识申请消息所发送的跨域申请标识，其中跨域申请标识与本次进入申请相对应；其中，出域申请消息和出域授权令牌中均包含有跨域申请标识。
具体的，第二车联网***中还可以包括跨域申请标识生成实体，负责生成车联网设备申请跨***车联网通信证书过程唯一对应的跨域申请标识。
此外，跨域申请标识为唯一标识车联网设备申请车联网通信***通信安全证书过程的标识。具体的，该跨域申请标识的生成可采用与密码协议相关的方式生成，也可以是与密码协议无关的方式生成，在此不进行具体限定。与密码协议相关的方式是指跨域申请标识是经将车联网设备的设备信息和/或申请过程相关的信息经密码运算后生成。
具体的，当车联网设备先向第二车联网***申请跨域申请标识时，此时车联网设备向第一车联网***发送的出域申请消息以及第一车联网***颁发的出域授权令牌中均包含有跨域申请标识，即第一车联网***可以将第二车联网***生成的跨域申请标识与其生成的出域授权令牌进行绑定。
在上述实施例的基础上，出域授权令牌中还可以包含有车联网设备的设 备信息和/或注册证书申请消息。
另外，在本实施例中，车联网设备在接收第二车联网***所发送的入域授权令牌时，可以接收第二车联网***基于入域申请消息所发送的入域响应消息，其中，入域响应消息中包含有入域授权令牌，且入域授权令牌中包含有设备签名证书和与本次进入申请所对应的跨域申请标识。
当然，入域授权令牌中还包含车联网设备的设备信息和/或车联网设备在第二车联网***中的设备标识。
此外，入域响应消息中还包含有第二车联网***中注册CA的地址信息和/或第二车联网***中应用CA的地址信息。这使得物联网设备能够基于地址信息发送注册证书申请消息以及应用证书申请消息。
另外，在本实施例中，车联网设备在基于入域授权令牌获取第二车联网***的注册证书时，可以向第二车联网***发送注册证书申请消息，其中注册证书申请消息中包含有入域授权令牌，且注册证书申请消息通过设备签名证书所对应的私钥进行数字签名，然后接收第二车联网***基于注册证书申请消息所发送的注册证书。
具体的，第二车联网***中还可以包括注册CA，即车联网设备可以向第二车联网***中的注册CA发送注册证书申请消息，以便申请第二车联网***的注册证书。此时，第二车联网***中的注册CA在接收到注册证书申请消息时，可以获取注册证书申请消息中的入域授权令牌，并获取入域授权令牌中的设备签名证书，然后采用该设备签名证书对注册证书申请消息的数字签名进行验证，并在验证通过后向车联网设备颁发注册证书，从而保证了证书申请过程中的安全性。
当然，车联网设备在基于入域授权令牌获取第二车联网***的注册证书之后，还可以向第二车联网***发送应用证书申请消息，其中应用证书申请消息中包含有注册证书，然后接收第二车联网***基于应用证书申请消息所发送的应用证书。
当然在此需要说明的是，该应用证书申请消息同样可以采用设备签名证书所对应的私钥进行数字签名，过程同注册证书申请过程，在此不再进行具 体说明。
即车联网设备在得到第二车联网***的注册证书之后，可以利用该第二车联网***的注册证书向第二车联网***的应用CA申请在第二车联网***实现车联网安全通信的应用证书，从而实现车联网设备的跨***安全通信。
这样，本实施例中的车联网设备通过接收第二车联网***所发送的入域授权令牌，并通过该入域授权令牌获取第二车联网***的注册证书，实现了位于第一车联网***中的车联网设备能够获取第二车联网***的入域授权令牌和注册证书，从而实现了跨***的安全通信证书的申请过程，从而能够实现从第一车联网***至第二车联网***的跨***进入。
如图2所示，为本公开实施例中应用于第一车联网***的证书申请方法的步骤流程图，该方法包括如下步骤：
步骤201：当车联网设备申请从第一车联网***进入第二车联网***时，接收车联网设备发送的出域申请消息。
具体的，当车联网设备需要进行跨***通信时，可以先向第一车联网***发送出域申请消息，此时第一车联网***接入该出域申请消息。
在此需要说明的是，关于第一车联网***、第二车联网***及出域申请消息的具体内容可以参见上述车联网设备侧的相关内容，在此不再进行具体限定。
步骤202：基于出域申请消息，向车联网设备发送出域授权令牌。
具体的，第一车联网***在获取到出域申请消息时，可以向车联网设备发送出域授权令牌。
其中，出域授权令牌中包含有车联网设备的设备签名证书，以使车联网设备向第二车联网***发送入域申请消息并获取入域授权令牌，入域申请消息中包含有出域授权令牌，且入域申请消息通过设备签名证书所对应的私钥进行数字签名。
在此需要说明的是，上述内容的相关介绍可以参见上述车联网设备侧的相关内容，在此不再进行具体限定。
此外，需要说明的是，出域申请消息和出域授权令牌中均包含有跨域申 请标识；其中，跨域申请标识为车联网设备向第二车联网***申请得到，且跨域申请标识与本次进入申请相对应。
当然，还需要补充的是，出域授权令牌中还包含有车联网设备的设备信息和/或注册证书申请消息。
在此需要说明的是，上述各项信息的具体内容可以参见车联网设备侧方法实施例的具体相关内容，在此不再进行具体介绍。
这样，本实施例中的第一车联网***通过接收车联网设备发送的出域申请消息，并基于该出域申请消息向车联网设备发送出域授权令牌，使得车联网设备能够基于该出域授权令牌获取第二车联网***的入域授权令牌，从而实现了跨***的安全通信证书的申请过程，从而能够实现从第一车联网***至第二车联网***的跨***进入。
此外，如图3所示，为本公开实施例中应用于第二车联网***的证书申请方法的步骤流程图，该方法包括如下步骤：
步骤301：当车联网设备申请从第一车联网***进入第二车联网***时，向车联网设备发送入域授权令牌。
具体的，当车联网设备需要进行跨域通信时，第二车联网***可以向车联网设备发送入域授权令牌，从而使得车联网设备能够基于入域授权令牌获取第二车联网***的注册证书。
具体的，第二车联网***向车联网设备发送入域授权令牌时，可以接收车联网设备所发送的入域申请消息，其中入域申请消息中包含有出域授权令牌，出域授权令牌由车联网设备向第一车联网***申请得到，且出域授权令牌中包含有车联网设备的设备签名证书，入域申请消息通过设备签名证书所对应的私钥进行数字签名；然后基于入域申请消息，向车联网设备发送入域响应消息，其中，入域响应消息中包含有入域授权令牌，且入域授权令牌中包含有设备签名证书和与本次进入申请所对应的跨域申请标识。
在此需要说明的是，该实施例中的相关内容可以参见车联网设备侧实施例的相关内容，在此不再进行具体赘述。
此外，进一步地，第二车联网***在基于入域申请消息，向车联网设备 发送入域响应消息之前，还可以获取入域申请消息中的出域授权令牌，并获取出域授权令牌中的设备签名证书；当通过设备签名证书验证得到入域申请消息的数字签名为有效签名时，确定入域申请消息为有效消息。
即第二车联网***在向车联网设备颁发入域授权令牌之前，需要验证入域申请消息的有效性，即需要确定申请入域授权令牌的车联网设备的身份信息，此时第二车联网***可以先从入域申请消息中获取出域授权令牌，并基于预先存储的可信证书列表中第一车联网***的签名公钥证书验证该出域授权令牌是否有效；当验证得到出域授权令牌有效时则可以获取出域授权令牌中的设备签名证书，从而能够通过该设备签名证书对入域申请消息的数字签名的有效性进行验证；此时，若验证得到入域申请消息的数字签名为有效签名，则可以确定入域申请消息为有效消息，即可以确定车联网设备的身份信息，此时则可以进一步颁发入域授权令牌。
此外，在本实施例中，第二车联网***在接收车联网设备所发送的入域申请消息之前，还可以接收车联网设备所发送的标识申请消息，并基于标识申请消息，向车联网设备发送跨域申请标识，其中跨域申请标识与本次进入申请相对应。相应地，出域授权令牌中还包含有跨域申请标识。
当然，具体的，出域授权令牌中还包含有车联网设备的设备信息和/或注册证书申请消息。
此外，具体的，入域授权令牌中还包含有车联网设备的设备信息和/或车联网设备在所述第二车联网***中的设备标识。入域响应消息中还包含有第二车联网***中注册证书颁发机构CA的地址信息；第二车联网***中应用CA的地址信息。
在此需要说明的是，关于上述信息的具体介绍可以参见车联网设备侧实施例的相关内容，在此不再进行具体介绍。
此外，具体的，第二车联网***在向车联网设备发送入域授权令牌之后，可以接收车联网设备所发送的注册证书申请消息，其中注册证书申请消息中包含有入域授权令牌，且注册证书申请消息通过设备签名证书所对应的私钥进行数字签名；然后获取注册证书申请消息中的入域授权令牌，并获取入域 授权令牌中的设备签名证书，并当通过设备签名证书验证得到注册证书申请消息的数字签名为有效签名时，确定注册证书申请消息为有效消息，并向车联网设备发送注册证书。
当然，第二车联网***向车联网设备发送注册证书之后，还可以接收车联网设备所发送的应用证书申请消息，其中应用证书申请消息中包含有注册证书；然后基于应用证书申请消息，向车联网设备发送应用证书。
在此需要说明的是，上述过程的具体内容可以参见车联网设备侧实施例的相关内容，在此不再进行赘述。
这样，本实施例中的第二车联网***通过向车联网设备发送入域授权令牌，实现了跨***的安全通信证书的申请过程，从而能够实现从第一车联网***至第二车联网***的跨***进入。
下面通过完整的证书申请流程对上述实施例进行具体说明。
参见图4所示的框架图，在车联网设备跨***申请安全通信证书的过程中，假设第一车联网***中的车联网设备申请第二车联网***中的安全通信证书，则其中一种申请过程可以包括如下步骤：
1，车联网设备向第二车联网***中的跨域申请标识生成实体申请跨域申请标识。当然依据第二车联网***的要求，用于申请跨域申请标识的标识申请消息中还可以包含有与证书申请相关的一些信息，例如车联网设备所在国别、车牌号、进入时间和离开时间等。
此外，跨域申请标识生成实体向车联网设备分配一个与本次申请唯一对应的跨域申请标识，同时还可将该跨域申请标识提供给本***中的跨域申请授权实体。跨域申请标识的生成可以是基于密码学的方法生成，也可以是不基于密码学的方法生成，在此不做限定。
2，车联网设备向第一车联网***中的跨域申请授权实体申请出域授权令牌。该出域申请消息中可包含由第二车联网***中的跨域申请授权实体分配的跨域申请标识。当然依据第一车联网***的要求，该出域申请消息中可能需提供一些相关信息，例如欲进入的国别、车牌号、车辆类型、车辆用途、进入时间和离开时间等。
3，第一车联网***中的跨域申请授权实体检查出域申请消息，若允许，则为该车联网设备生成一个出域授权令牌。该出域授权令牌可包含如下信息：由第二车联网***中的跨域申请标识生成实体分配的跨域申请标识；车联网设备的设备签名证书，车联网设备将使用与该证书对应的私钥对入域申请消息进行数字签名；车联网设备的设备信息，例如OBU相关的信息和车辆相关的信息等；其他信息，例如令牌颁发者标识、令牌有效期、签名证书信息、进入时间和离开时间等。
4，车联网设备向第二车联网***中的跨域申请授权实体申请入域授权令牌，即发送入域申请消息。该入域申请消息使用与出域授权令牌中包含的设备签名证书相对应的私钥进行数字签名。该入域申请消息中包含有出域授权令牌。
5，第二车联网***中的跨域申请授权实体验证该入域申请消息，具体操作包括：获取入域申请消息中的出域授权令牌，从预先存储的可信证书列表中获取第一车联网***的跨域申请授权实体的签名公钥证书，然后使用该公钥证书验证出域授权令牌是否有效；若出域授权令牌有效，则提取出域授权令牌中的签名公钥证书，然后使用该证书验证入域申请消息的数字签名是否有效；若数字签名有效，则提取令牌中携带的设备和车辆参数，并利用“域映射策略”将第一车联网***的参数映射至第二车联网***，例如车辆类型、车辆用途，日期和时间格式等。
6，第二车联网***的跨域申请授权实体为车联网设备生成一个入域授权令牌，其中包含有：跨域申请标识；物联网设备的设备签名证书；第二车联网***为物联网设备新分配的一个在本***中使用的设备标识；已经映射至本***的物联网设备的设备信息；其他信息，例如令牌颁发者标识、令牌有效期、签名证书信息、进入时间和离开时间等；第二车联网***通过入域响应消息发送该入域授权令牌，且入域响应消息还可包含有本***中注册CA和/或应用CA的地址和所使用的协议等信息。
7，物联网设备依据第二车联网***规定的协议向第二车联网***中的注册CA申请注册证书，注册证书申请消息使用与入域授权令牌中包含的设备签 名证书相对应的设备签名私钥签名。该注册证书申请消息中可包含入域授权令牌以及物联网设备为申请注册证书而生成的密钥对中的公钥。
8，第二车联网***中的注册CA验证注册证书申请消息，具体操作包括：注册CA获取注册证书申请消息中的入域授权令牌，利用第二车联网***中的跨域申请授权实体的公钥证书验证入域授权令牌是否有效，若令牌有效，则提取令牌中的物联网设备的设备签名证书，然后使用该设备签名证书验证注册证书申请消息的数字签名是否有效；若数字签名有效，则提取入域授权令牌中的各种设备参数和车辆参数，以及令牌中提供的公钥等信息为车联网设备颁发注册证书。
9，车联网设备利用收到的注册证书，依据第二车联网***规定的协议向第二车联网***中的应用CA申请相应的应用证书。应用CA验证该应用证书申请消息，然后依据本***规则向物联网设备颁发相应应用证书。
10，物联网设备利用应用证书实现在第二车联网***的车联网安全通信。
至此，完成整个证书申请过程。
此外，另一申请过程还可以为，物联网设备向第一车联网***的跨域授权实体申请出域授权令牌，后者向物联网设备颁发出域授权令牌，令牌中包含有设备签名证书；然后，物联网设备将备出域授权令牌提供给第二车联网***的跨域授权实体，后者首先生成跨域申请标识，然后向物联网设备颁发入域授权令牌，颁发的令牌中包含有跨域申请标识和设备签名证书；再然后，物联网设备利用入域授权令牌申请第二车联网***的注册证书和应用证书。
此外，另一申请过程还可以为，申请入域授权令牌的过程与申请注册证书的过程合并，即出域授权令牌中还可以包含注册证书申请消息。
此外，如图5所示，为本公开实施例中应用于车联网设备的证书申请装置的模块框图，该装置包括：
接收模块501，用于当车联网设备申请从第一车联网***进入第二车联网***时，接收所述第二车联网***所发送的入域授权令牌；
获取模块502，用于基于所述入域授权令牌，获取所述第二车联网***的注册证书。
可选地，装置还包括：
第一发送模块，用于向所述第一车联网***发送出域申请消息；
第一接收单元，用于接收所述第一车联网***基于所述出域申请消息所发送的出域授权令牌，其中所述出域授权令牌中包含有所述车联网设备的设备签名证书；
第二发送模块，用于向所述第二车联网***发送入域申请消息，其中所述入域申请消息中包含有所述出域授权令牌，且所述入域申请消息通过所述设备签名证书所对应的私钥进行数字签名。
在此需要说明的是，该装置能够实现车联网设备方法实施例侧的所有方法步骤，并能够达到相同的技术效果，在此不再进行赘述。
如图6所示，为本公开实施例中应用于第一车联网***的证书申请装置的模块框图，该装置包括：
接收模块601，用于当车联网设备申请从第一车联网***进入第二车联网***时，接收车联网设备发送的出域申请消息；
发送模块602，用于基于所述出域申请消息，向所述车联网设备发送出域授权令牌，其中所述出域授权令牌中包含有所述车联网设备的设备签名证书，以使所述车联网设备向所述第二车联网***发送入域申请消息并获取入域授权令牌，所述入域申请消息中包含有所述出域授权令牌，且所述入域申请消息通过所述设备签名证书所对应的私钥进行数字签名。
可选地，所述出域申请消息和所述出域授权令牌中均包含有跨域申请标识；其中，所述跨域申请标识为所述车联网设备向所述第二车联网***申请得到，且所述跨域申请标识与本次进入申请相对应。
在此需要说明的是，该装置能够实现第一车联网***方法实施例侧的所有方法步骤，并能够达到相同的技术效果，在此不再进行赘述。
如图7所示，为本公开实施例中应用于第二车联网***的证书申请装置的模块框图，该装置包括：
发送模块701，用于当车联网设备申请从第一车联网***进入第二车联网***时，向所述车联网设备发送入域授权令牌，以使所述车联网设备基于 所述入域授权令牌获取所述第二车联网***的注册证书。
可选地，发送模块701具体用于，接收所述车联网设备所发送的入域申请消息，其中所述入域申请消息中包含有出域授权令牌，所述出域授权令牌由所述车联网设备向所述第一车联网***申请得到，且所述出域授权令牌中包含有所述车联网设备的设备签名证书，所述入域申请消息通过所述设备签名证书所对应的私钥进行数字签名；基于所述入域申请消息，向所述车联网设备发送入域响应消息，其中，所述入域响应消息中包含有入域授权令牌，且所述入域授权令牌中包含有所述设备签名证书和与本次进入申请所对应的跨域申请标识，所述入域响应消息通过所述设备签名证书所对应的私钥进行数字签名。
在此需要说明的是，该装置能够实现第二车联网***方法实施例侧的所有方法步骤，并能够达到相同的技术效果，在此不再进行赘述。
图8为本公开一实施例提供的车联网设备的结构示意图，如图8所示，该车联网设备800可以包括至少一个处理器801、存储器802、至少一个其他的用户接口803，以及收发机804。车联网设备800中的各个组件通过总线***805耦合在一起。可理解，总线***805用于实现这些组件之间的连接通信。总线***805除包括数据总线之外，还包括电源总线、控制总线和状态信号总线。但是为了清楚说明起见，在图8中将各种总线都标为总线***805，总线***可以包括任意数量的互联的总线和桥，具体由处理器801代表的一个或多个处理器和存储器802代表的存储器的各种电路链接在一起。总线***还可以将诸如***设备、稳压器和功率管理电路等之类的各种其他电路链接在一起，这些都是本领域所公知的，因此，本公开实施例不再对其进行进一步描述。总线接口提供接口。收发机804可以是多个元件，即包括发送机和接收机，提供用于在传输介质上与各种其他装置通信的单元。针对不同的用户设备，用户接口803还可以是能够外接内接需要设备的接口，连接的设备包括但不限于小键盘、显示器、扬声器、麦克风、操纵杆等。
可以理解，本公开实施例中的存储器802可以是易失性存储器或非易失性存储器，或可包括易失性和非易失性存储器两者。其中，非易失性存储器 可以是只读存储器(Read-Only Memory，ROM)、可编程只读存储器(Programmable ROM，PROM)、可擦除可编程只读存储器(Erasable PROM，EPROM)、电可擦除可编程只读存储器(Electrically EPROM，EEPROM)或闪存。易失性存储器可以是随机存取存储器(Random Access Memory，RAM)，其用作外部高速缓存。通过示例性但不是限制性说明，许多形式的RAM可用，例如静态随机存取存储器(Static RAM，SRAM)、动态随机存取存储器(Dynamic RAM，DRAM)、同步动态随机存取存储器(Synchronous DRAM，SDRAM)、双倍数据速率同步动态随机存取存储器(Double Data Rate SDRAM，DDRSDRAM)、增强型同步动态随机存取存储器(Enhanced SDRAM，ESDRAM)、同步连接动态随机存取存储器(Synchlink DRAM，SLDRAM)和直接内存总线随机存取存储器(Direct Rambus RAM，DRRAM)。本公开各实施例所描述的***和方法的存储器802旨在包括但不限于这些和任意其它适合类型的存储器。
处理器801负责管理总线***和通常的处理，存储器802可以存储处理器801在执行操作时所使用的计算机程序或指令，具体地，处理器801可以用于：当车联网设备申请从第一车联网***进入第二车联网***时，接收所述第二车联网***所发送的入域授权令牌；基于所述入域授权令牌，获取所述第二车联网***的注册证书。
上述本公开实施例揭示的方法可以应用于处理器801中，或者由处理器801实现。处理器801可能是一种集成电路芯片，具有信号的处理能力。在实现过程中，上述方法的各步骤可以通过处理器801中的硬件的集成逻辑电路或者软件形式的指令完成。上述的处理器801可以是通用处理器、数字信号处理器(Digital Signal Processor，DSP)、专用集成电路(Application Specific Integrated Circuit，ASIC)、现成可编程门阵列(Field Programmable Gate Array，FPGA)或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件。可以实现或者执行本公开实施例中的公开的各方法、步骤及逻辑框图。通用处理器可以是微处理器或者该处理器也可以是任何常规的处理器等。结合本公开实施例所公开的方法的步骤可以直接体现为硬件译码处理器执行完 成，或者用译码处理器中的硬件及软件模块组合执行完成。软件模块可以位于随机存储器，闪存、只读存储器，可编程只读存储器或者电可擦写可编程存储器、寄存器等本领域成熟的存储介质中。该存储介质位于存储器802，处理器801读取存储器802中的信息，结合其硬件完成上述方法的步骤。
可以理解的是，本公开描述的这些实施例可以用硬件、软件、固件、中间件、微码或其组合来实现。对于硬件实现，处理单元可以实现在一个或多个专用集成电路(Application Specific Integrated Circuits，ASIC)、数字信号处理器(Digital Signal Processing，DSP)、数字信号处理设备(DSP Device，DSPD)、可编程逻辑设备(Programmable Logic Device，PLD)、现场可编程门阵列(Field-Programmable Gate Array，FPGA)、通用处理器、控制器、微控制器、微处理器、用于执行本申请所述功能的其它电子单元或其组合中。
对于软件实现，可通过执行本公开实施例中所述功能的模块(例如过程、函数等)来实现所述的技术。软件代码可存储在存储器中并通过处理器执行。存储器可以在处理器中或在处理器外部实现。
可选地，作为另一个实施例，所述接收所述第二车联网***所发送的入域授权令牌之前，处理器801还用于：向所述第一车联网***发送出域申请消息；接收所述第一车联网***基于所述出域申请消息所发送的出域授权令牌，其中所述出域授权令牌中包含有所述车联网设备的设备签名证书；向所述第二车联网***发送入域申请消息，其中所述入域申请消息中包含有所述出域授权令牌，且所述入域申请消息通过所述设备签名证书所对应的私钥进行数字签名。
可选地，作为另一个实施例，所述向所述第一车联网***发送出域申请消息之前，处理器801还用于：向所述第二车联网***发送标识申请消息；接收所述第二车联网***基于所述标识申请消息所发送的跨域申请标识，其中所述跨域申请标识与本次进入申请相对应；其中，所述出域申请消息和所述出域授权令牌中均包含有所述跨域申请标识。
可选地，作为另一个实施例，所述出域授权令牌中还包含有所述车联网设备的设备信息和/或注册证书申请消息。
可选地，作为另一个实施例，处理器801还用于：接收所述第二车联网***基于所述入域申请消息所发送的入域响应消息，其中，所述入域响应消息中包含有所述入域授权令牌，且所述入域授权令牌中包含有所述设备签名证书和与本次进入申请所对应的跨域申请标识。
可选地，作为另一个实施例，所述入域授权令牌中还包含所述车联网设备的设备信息和/或所述车联网设备在所述第二车联网***中的设备标识；所述入域响应消息中还包含有所述第二车联网***中注册证书颁发机构CA的地址信息和/或所述第二车联网***中应用CA的地址信息。
可选地，作为另一个实施例，处理器801还用于：向所述第二车联网***发送注册证书申请消息，其中所述注册证书申请消息中包含有所述入域授权令牌，且所述注册证书申请消息通过所述设备签名证书所对应的私钥进行数字签名；接收所述第二车联网***基于所述注册证书申请消息所发送的注册证书。
可选地，作为另一个实施例，处理器801还用于：向所述第二车联网***发送应用证书申请消息，其中所述应用证书申请消息中包含有所述注册证书；接收所述第二车联网***基于所述应用证书申请消息所发送的应用证书。
本公开实施例提供的车联网设备能够实现前述实施例中车联网设备实现的各个过程，为避免重复，此处不再赘述。
图9为本公开一实施例提供的第一车联网***的结构示意图，如图9所示，该第一车联网***900可以包括至少一个处理器901、存储器902、至少一个其他的用户接口903，以及收发机904。第一车联网***900中的各个组件通过总线***905耦合在一起。可理解，总线***905用于实现这些组件之间的连接通信。总线***905除包括数据总线之外，还包括电源总线、控制总线和状态信号总线。但是为了清楚说明起见，在图9中将各种总线都标为总线***905，总线***可以包括任意数量的互联的总线和桥，具体由处理器901代表的一个或多个处理器和存储器902代表的存储器的各种电路链接在一起。总线***还可以将诸如***设备、稳压器和功率管理电路等之类的各种其他电路链接在一起，这些都是本领域所公知的，因此，本公开实施 例不再对其进行进一步描述。总线接口提供接口。收发机904可以是多个元件，即包括发送机和接收机，提供用于在传输介质上与各种其他装置通信的单元。针对不同的用户设备，用户接口903还可以是能够外接内接需要设备的接口，连接的设备包括但不限于小键盘、显示器、扬声器、麦克风、操纵杆等。
可以理解，本公开实施例中的存储器902可以是易失性存储器或非易失性存储器，或可包括易失性和非易失性存储器两者。其中，非易失性存储器可以是只读存储器(Read-Only Memory，ROM)、可编程只读存储器(Programmable ROM，PROM)、可擦除可编程只读存储器(Erasable PROM，EPROM)、电可擦除可编程只读存储器(Electrically EPROM，EEPROM)或闪存。易失性存储器可以是随机存取存储器(Random Access Memory，RAM)，其用作外部高速缓存。通过示例性但不是限制性说明，许多形式的RAM可用，例如静态随机存取存储器(Static RAM，SRAM)、动态随机存取存储器(Dynamic RAM，DRAM)、同步动态随机存取存储器(Synchronous DRAM，SDRAM)、双倍数据速率同步动态随机存取存储器(Double Data Rate SDRAM，DDRSDRAM)、增强型同步动态随机存取存储器(Enhanced SDRAM，ESDRAM)、同步连接动态随机存取存储器(Synchlink DRAM，SLDRAM)和直接内存总线随机存取存储器(Direct Rambus RAM，DRRAM)。本公开各实施例所描述的***和方法的存储器902旨在包括但不限于这些和任意其它适合类型的存储器。
处理器901负责管理总线***和通常的处理，存储器902可以存储处理器901在执行操作时所使用的计算机程序或指令，具体地，处理器901可以用于：当车联网设备申请从第一车联网***进入第二车联网***时，接收车联网设备发送的出域申请消息；基于所述出域申请消息，向所述车联网设备发送出域授权令牌，其中所述出域授权令牌中包含有所述车联网设备的设备签名证书，以使所述车联网设备向所述第二车联网***发送入域申请消息并获取入域授权令牌，所述入域申请消息中包含有所述出域授权令牌，且所述入域申请消息通过所述设备签名证书所对应的私钥进行数字签名。
可选地，作为另一个实施例，所述出域申请消息和所述出域授权令牌中均包含有跨域申请标识；其中，所述跨域申请标识为所述车联网设备向所述第二车联网***申请得到，且所述跨域申请标识与本次进入申请相对应。
可选地，作为另一个实施例，所述出域授权令牌中还包含有所述车联网设备的设备信息和/或注册证书申请消息。
本公开实施例提供的第一车联网***能够实现前述实施例中第一车联网***实现的各个过程，为避免重复，此处不再赘述。
图10为本公开一实施例提供的第二车联网***的结构示意图，如图10所示，该第二车联网***1000可以包括至少一个处理器1001、存储器1002、至少一个其他的用户接口1003，以及收发机1004。第二车联网***1000中的各个组件通过总线***1005耦合在一起。可理解，总线***1005用于实现这些组件之间的连接通信。总线***1005除包括数据总线之外，还包括电源总线、控制总线和状态信号总线。但是为了清楚说明起见，在图10中将各种总线都标为总线***1005，总线***可以包括任意数量的互联的总线和桥，具体由处理器1001代表的一个或多个处理器和存储器1002代表的存储器的各种电路链接在一起。总线***还可以将诸如***设备、稳压器和功率管理电路等之类的各种其他电路链接在一起，这些都是本领域所公知的，因此，本公开实施例不再对其进行进一步描述。总线接口提供接口。收发机1004可以是多个元件，即包括发送机和接收机，提供用于在传输介质上与各种其他装置通信的单元。针对不同的用户设备，用户接口1003还可以是能够外接内接需要设备的接口，连接的设备包括但不限于小键盘、显示器、扬声器、麦克风、操纵杆等。
可以理解，本公开实施例中的存储器1002可以是易失性存储器或非易失性存储器，或可包括易失性和非易失性存储器两者。其中，非易失性存储器可以是只读存储器(Read-Only Memory，ROM)、可编程只读存储器(Programmable ROM，PROM)、可擦除可编程只读存储器(Erasable PROM，EPROM)、电可擦除可编程只读存储器(Electrically EPROM，EEPROM)或闪存。易失性存储器可以是随机存取存储器(Random Access Memory，RAM)， 其用作外部高速缓存。通过示例性但不是限制性说明，许多形式的RAM可用，例如静态随机存取存储器(Static RAM，SRAM)、动态随机存取存储器(Dynamic RAM，DRAM)、同步动态随机存取存储器(Synchronous DRAM，SDRAM)、双倍数据速率同步动态随机存取存储器(Double Data Rate SDRAM，DDRSDRAM)、增强型同步动态随机存取存储器(Enhanced SDRAM，ESDRAM)、同步连接动态随机存取存储器(Synchlink DRAM，SLDRAM)和直接内存总线随机存取存储器(Direct Rambus RAM，DRRAM)。本公开各实施例所描述的***和方法的存储器1002旨在包括但不限于这些和任意其它适合类型的存储器。
处理器1001负责管理总线***和通常的处理，存储器1002可以存储处理器1001在执行操作时所使用的计算机程序或指令，具体地，处理器1001可以用于：当车联网设备申请从第一车联网***进入第二车联网***时，向所述车联网设备发送入域授权令牌，以使所述车联网设备基于所述入域授权令牌获取所述第二车联网***的注册证书。
可选地，作为另一个实施例，处理器1001还用于：接收所述车联网设备所发送的入域申请消息，其中所述入域申请消息中包含有出域授权令牌，所述出域授权令牌由所述车联网设备向所述第一车联网***申请得到，且所述出域授权令牌中包含有所述车联网设备的设备签名证书，所述入域申请消息通过所述设备签名证书所对应的私钥进行数字签名；基于所述入域申请消息，向所述车联网设备发送入域响应消息，其中，所述入域响应消息中包含有入域授权令牌，且所述入域授权令牌中包含有所述设备签名证书和与本次进入申请所对应的跨域申请标识。
可选地，作为另一个实施例，所述接收所述车联网设备所发送的入域申请消息之前，处理器1001还用于：接收所述车联网设备所发送的标识申请消息；基于所述标识申请消息，向所述车联网设备发送跨域申请标识，其中所述跨域申请标识与本次进入申请相对应；相应地，所述出域授权令牌中还包含有所述跨域申请标识。
可选地，作为另一个实施例，所述出域授权令牌中还包含有所述车联网 设备的设备信息和/或注册证书申请消息。
可选地，作为另一个实施例，所述入域授权令牌中还包含有所述车联网设备的设备信息和/或所述车联网设备在所述第二车联网***中的设备标识；所述入域响应消息中还包含有所述第二车联网***中注册证书颁发机构CA的地址信息和/或所述第二车联网***中应用CA的地址信息。
可选地，作为另一个实施例，所述基于所述入域申请消息，向所述车联网设备发送入域响应消息之前，处理器1001还用于：获取所述入域申请消息中的出域授权令牌，并获取所述出域授权令牌中的设备签名证书；当通过所述设备签名证书验证得到所述入域申请消息的数字签名为有效签名时，确定所述入域申请消息为有效消息。
可选地，作为另一个实施例，所述向所述车联网设备发送入域授权令牌之后，处理器1001还用于：接收所述车联网设备所发送的注册证书申请消息，其中所述注册证书申请消息中包含有所述入域授权令牌，且所述注册证书申请消息通过所述设备签名证书所对应的私钥进行数字签名；获取所述注册证书申请消息中的所述入域授权令牌，并获取所述入域授权令牌中的设备签名证书；当通过所述设备签名证书验证得到所述注册证书申请消息的数字签名为有效签名时，确定所述注册证书申请消息为有效消息，并向所述车联网设备发送注册证书。
可选地，作为另一个实施例，所述向所述车联网设备发送注册证书之后，处理器1001还用于：接收所述车联网设备所发送的应用证书申请消息，其中所述应用证书申请消息中包含有所述注册证书；基于所述应用证书申请消息，向所述车联网设备发送应用证书。
本公开实施例提供的第二车联网***能够实现前述实施例中第二车联网***实现的各个过程，为避免重复，此处不再赘述。
上述主要从电子设备的角度对本公开实施例提供的方案进行了介绍。可以理解的是，本公开实施例提供的电子设备为了实现上述功能，其包含了执行各个功能相应的硬件结构和/或软件模块。本领域技术人员应该很容易意识到，结合本公开中所公开的实施例描述的各示例的单元及算法步骤，本公开 能够以硬件或硬件和计算机软件的结合形式来实现。
某个功能究竟以硬件还是计算机软件驱动硬件的方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本公开的范围。
本公开实施例可以根据上述方法示例对电子设备等进行功能模块的划分，例如，可以对应各个功能划分各个功能模块，也可以将两个或两个以上的功能集成在一个处理模块中。上述集成的模块既可以采用硬件的形式实现，也可以采用软件功能模块的形式实现。
需要说明的是，本公开实施例中对模块的划分是示意性的，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，仅以上述各功能模块的划分进行举例说明，实际应用中，可以根据需要而将上述功能分配由不同的功能模块完成，即将装置的内部结构划分成不同的功能模块，以完成以上描述的全部或者部分功能。上述描述的***，装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在本公开所提供的几个实施例中，应该理解到，所揭露的装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述模块或单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个***，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本公开各个实施例中的各功能单元可以集成在一个处理单元中， 也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。上述集成的单元可以采用软件功能单元的形式实现。
所述集成的单元如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，该技术方案的全部或部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)或处理器执行本公开各个实施例所述方法的全部或部分步骤。所述计算机存储介质是非短暂性(英文：nontransitory)介质，包括：快闪存储器、移动硬盘、只读存储器、随机存取存储器、磁碟或者光盘等各种可以存储程序代码的介质。
另一方面，本公开实施例还提供一种非暂态计算机可读存储介质，其上存储有计算机程序，该计算机程序被处理器执行时实现上述各实施例提供的方法步骤，并能够达到相同的技术效果，在此不再进行赘述。
最后应说明的是：以上实施例仅用以说明本公开的技术方案，而非对其限制；尽管参照前述实施例对本公开进行了详细的说明，本领域的普通技术人员应当理解：其依然可以对前述各实施例所记载的技术方案进行修改，或者对其中部分技术特征进行等同替换；而这些修改或者替换，并不使相应技术方案的本质脱离本公开各实施例技术方案的精神和范围。

Claims (58)

  1. 一种证书申请方法，应用于车联网设备，其特征在于，包括：
    当车联网设备申请从第一车联网***进入第二车联网***时，接收所述第二车联网***所发送的入域授权令牌；
    基于所述入域授权令牌，获取所述第二车联网***的注册证书。
  2. 根据权利要求1所述的证书申请方法，其特征在于，所述接收所述第二车联网***所发送的入域授权令牌之前，还包括：
    向所述第一车联网***发送出域申请消息；
    接收所述第一车联网***基于所述出域申请消息所发送的出域授权令牌，其中所述出域授权令牌中包含有所述车联网设备的设备签名证书；
    向所述第二车联网***发送入域申请消息，其中所述入域申请消息中包含有所述出域授权令牌，且所述入域申请消息通过所述设备签名证书所对应的私钥进行数字签名。
  3. 根据权利要求2所述的证书申请方法，其特征在于，所述向所述第一车联网***发送出域申请消息之前，还包括：
    向所述第二车联网***发送标识申请消息；
    接收所述第二车联网***基于所述标识申请消息所发送的跨域申请标识，其中所述跨域申请标识与本次进入申请相对应；
    其中，所述出域申请消息和所述出域授权令牌中均包含有所述跨域申请标识。
  4. 根据权利要求2或3所述的证书申请方法，其特征在于，所述出域授权令牌中还包含有所述车联网设备的设备信息和/或注册证书申请消息。
  5. 根据权利要求2所述的证书申请方法，其特征在于，所述接收所述第二车联网***所发送的入域授权令牌，包括：
    接收所述第二车联网***基于所述入域申请消息所发送的入域响应消息，其中，所述入域响应消息中包含有所述入域授权令牌，且所述入域授权令牌中包含有所述设备签名证书和与本次进入申请所对应的跨域申请标识。
  6. 根据权利要求5所述的证书申请方法，其特征在于，所述入域授权令 牌中还包含有所述车联网设备的设备信息和/或所述车联网设备在所述第二车联网***中的设备标识；
    所述入域响应消息中还包含有所述第二车联网***中注册证书颁发机构CA的地址信息和/或所述第二车联网***中应用CA的地址信息。
  7. 根据权利要求5所述的证书申请方法，其特征在于，所述基于所述入域授权令牌，获取所述第二车联网***的注册证书，包括：
    向所述第二车联网***发送注册证书申请消息，其中所述注册证书申请消息中包含有所述入域授权令牌，且所述注册证书申请消息通过所述设备签名证书所对应的私钥进行数字签名；
    接收所述第二车联网***基于所述注册证书申请消息所发送的注册证书。
  8. 根据权利要求1或7所述的证书申请方法，其特征在于，所述基于所述入域授权令牌，获取所述第二车联网***的注册证书之后，还包括：
    向所述第二车联网***发送应用证书申请消息，其中所述应用证书申请消息中包含有所述注册证书；
    接收所述第二车联网***基于所述应用证书申请消息所发送的应用证书。
  9. 一种证书申请方法，应用于第一车联网***，其特征在于，包括：
    当车联网设备申请从第一车联网***进入第二车联网***时，接收车联网设备发送的出域申请消息；
    基于所述出域申请消息，向所述车联网设备发送出域授权令牌，其中所述出域授权令牌中包含有所述车联网设备的设备签名证书，以使所述车联网设备向所述第二车联网***发送入域申请消息并获取入域授权令牌，所述入域申请消息中包含有所述出域授权令牌，且所述入域申请消息通过所述设备签名证书所对应的私钥进行数字签名。
  10. 根据权利要求9所述的证书申请方法，其特征在于，所述出域申请消息和所述出域授权令牌中均包含有跨域申请标识；其中，所述跨域申请标识为所述车联网设备向所述第二车联网***申请得到，且所述跨域申请标识与本次进入申请相对应。
  11. 根据权利要求9或10所述的证书申请方法，其特征在于，所述出域 授权令牌中还包含有所述车联网设备的设备信息和/或注册证书申请消息。
  12. 一种证书申请方法，应用于第二车联网***，其特征在于，包括：
    当车联网设备申请从第一车联网***进入第二车联网***时，向所述车联网设备发送入域授权令牌，以使所述车联网设备基于所述入域授权令牌获取所述第二车联网***的注册证书。
  13. 根据权利要求12所述的证书申请方法，其特征在于，所述向所述车联网设备发送入域授权令牌，包括：
    接收所述车联网设备所发送的入域申请消息，其中所述入域申请消息中包含有出域授权令牌，所述出域授权令牌由所述车联网设备向所述第一车联网***申请得到，且所述出域授权令牌中包含有所述车联网设备的设备签名证书，所述入域申请消息通过所述设备签名证书所对应的私钥进行数字签名；
    基于所述入域申请消息，向所述车联网设备发送入域响应消息，其中，所述入域响应消息中包含有入域授权令牌，且所述入域授权令牌中包含有所述设备签名证书和与本次进入申请所对应的跨域申请标识。
  14. 根据权利要求13所述的证书申请方法，其特征在于，所述接收所述车联网设备所发送的入域申请消息之前，还包括：
    接收所述车联网设备所发送的标识申请消息；
    基于所述标识申请消息，向所述车联网设备发送跨域申请标识，其中所述跨域申请标识与本次进入申请相对应；
    相应地，所述出域授权令牌中还包含有所述跨域申请标识。
  15. 根据权利要求13或14所述的证书申请方法，其特征在于，所述出域授权令牌中还包含有所述车联网设备的设备信息和/或注册证书申请消息。
  16. 根据权利要求13所述的证书申请方法，其特征在于，所述入域授权令牌中还包含有所述车联网设备的设备信息和/或所述车联网设备在所述第二车联网***中的设备标识；
    所述入域响应消息中还包含有所述第二车联网***中注册证书颁发机构CA的地址信息和/或所述第二车联网***中应用CA的地址信息。
  17. 根据权利要求13所述的证书申请方法，其特征在于，所述基于所述 入域申请消息，向所述车联网设备发送入域响应消息之前，还包括：
    获取所述入域申请消息中的出域授权令牌，并获取所述出域授权令牌中的设备签名证书；
    当通过所述设备签名证书验证得到所述入域申请消息的数字签名为有效签名时，确定所述入域申请消息为有效消息。
  18. 根据权利要求13所述的证书申请方法，其特征在于，所述向所述车联网设备发送入域授权令牌之后，还包括：
    接收所述车联网设备所发送的注册证书申请消息，其中所述注册证书申请消息中包含有所述入域授权令牌，且所述注册证书申请消息通过所述设备签名证书所对应的私钥进行数字签名；
    获取所述注册证书申请消息中的所述入域授权令牌，并获取所述入域授权令牌中的设备签名证书；
    当通过所述设备签名证书验证得到所述注册证书申请消息的数字签名为有效签名时，确定所述注册证书申请消息为有效消息，并向所述车联网设备发送注册证书。
  19. 根据权利要求18所述的证书申请方法，其特征在于，所述向所述车联网设备发送注册证书之后，还包括：
    接收所述车联网设备所发送的应用证书申请消息，其中所述应用证书申请消息中包含有所述注册证书；
    基于所述应用证书申请消息，向所述车联网设备发送应用证书。
  20. 一种证书申请装置，应用于车联网设备，其特征在于，包括：
    接收模块，用于当车联网设备申请从第一车联网***进入第二车联网***时，接收所述第二车联网***所发送的入域授权令牌；
    获取模块，用于基于所述入域授权令牌，获取所述第二车联网***的注册证书。
  21. 根据权利要求20所述的证书申请装置，其特征在于，在所述接收模块之前，所述证书申请装置还包括：
    第一发送模块，用于向所述第一车联网***发送出域申请消息；
    第一接收单元，用于接收所述第一车联网***基于所述出域申请消息所发送的出域授权令牌，其中所述出域授权令牌中包含有所述车联网设备的设备签名证书；
    第二发送模块，用于向所述第二车联网***发送入域申请消息，其中所述入域申请消息中包含有所述出域授权令牌，且所述入域申请消息通过所述设备签名证书所对应的私钥进行数字签名。
  22. 根据权利要求21所述的证书申请装置，其特征在于，在所述第一发送模块之前，所述证书申请装置还包括：
    第三发送模块，用于向所述第二车联网***发送标识申请消息；
    第二接收单元，用于接收所述第二车联网***基于所述标识申请消息所发送的跨域申请标识，其中所述跨域申请标识与本次进入申请相对应；
    其中，所述出域申请消息和所述出域授权令牌中均包含有所述跨域申请标识。
  23. 根据权利要求21或22所述的证书申请装置，其特征在于，所述出域授权令牌中还包含有所述车联网设备的设备信息和/或注册证书申请消息。
  24. 根据权利要求21所述的证书申请装置，其特征在于，所述接收模块具体用于：
    接收所述第二车联网***基于所述入域申请消息所发送的入域响应消息，其中，所述入域响应消息中包含有所述入域授权令牌，且所述入域授权令牌中包含有所述设备签名证书和与本次进入申请所对应的跨域申请标识。
  25. 根据权利要求24所述的证书申请装置，其特征在于，所述入域授权令牌中还包含有所述车联网设备的设备信息和/或所述车联网设备在所述第二车联网***中的设备标识；
    所述入域响应消息中还包含有所述第二车联网***中注册证书颁发机构CA的地址信息和/或所述第二车联网***中应用CA的地址信息。
  26. 根据权利要求24所述的证书申请装置，其特征在于，所述获取模块包括：
    发送子模块，用于向所述第二车联网***发送注册证书申请消息，其中 所述注册证书申请消息中包含有所述入域授权令牌，且所述注册证书申请消息通过所述设备签名证书所对应的私钥进行数字签名；
    接收子模块，用于接收所述第二车联网***基于所述注册证书申请消息所发送的注册证书。
  27. 根据权利要求20或26所述的证书申请装置，其特征在于，所述获取模块之后，所述证书申请装置还包括：
    第四发送模块，用于向所述第二车联网***发送应用证书申请消息，其中所述应用证书申请消息中包含有所述注册证书；
    第三接收单元，用于接收所述第二车联网***基于所述应用证书申请消息所发送的应用证书。
  28. 一种证书申请装置，应用于第一车联网***，其特征在于，包括：
    接收模块，用于当车联网设备申请从第一车联网***进入第二车联网***时，接收车联网设备发送的出域申请消息；
    发送模块，用于基于所述出域申请消息，向所述车联网设备发送出域授权令牌，其中所述出域授权令牌中包含有所述车联网设备的设备签名证书，以使所述车联网设备向所述第二车联网***发送入域申请消息并获取入域授权令牌，所述入域申请消息中包含有所述出域授权令牌，且所述入域申请消息通过所述设备签名证书所对应的私钥进行数字签名。
  29. 根据权利要求28所述的证书申请装置，其特征在于，所述出域申请消息和所述出域授权令牌中均包含有跨域申请标识；其中，所述跨域申请标识为所述车联网设备向所述第二车联网***申请得到，且所述跨域申请标识与本次进入申请相对应。
  30. 根据权利要求28或29所述的证书申请装置，其特征在于，所述出域授权令牌中还包含有所述车联网设备的设备信息和/或注册证书申请消息。
  31. 一种证书申请装置，应用于第二车联网***，其特征在于，包括：
    发送模块，用于当车联网设备申请从第一车联网***进入第二车联网***时，向所述车联网设备发送入域授权令牌，以使所述车联网设备基于所述入域授权令牌获取所述第二车联网***的注册证书。
  32. 根据权利要求31所述的证书申请装置，其特征在于，所述发送模块包括：
    第一接收子模块，用于接收所述车联网设备所发送的入域申请消息，其中所述入域申请消息中包含有出域授权令牌，所述出域授权令牌由所述车联网设备向所述第一车联网***申请得到，且所述出域授权令牌中包含有所述车联网设备的设备签名证书，所述入域申请消息通过所述设备签名证书所对应的私钥进行数字签名；
    第一发送子模块，用于基于所述入域申请消息，向所述车联网设备发送入域响应消息，其中，所述入域响应消息中包含有入域授权令牌，且所述入域授权令牌中包含有所述设备签名证书和与本次进入申请所对应的跨域申请标识。
  33. 根据权利要求32所述的证书申请装置，其特征在于，所述第一接收子模块之前，还包括：
    第二接收子模块，用于接收所述车联网设备所发送的标识申请消息；
    第二发送子模块，用于基于所述标识申请消息，向所述车联网设备发送跨域申请标识，其中所述跨域申请标识与本次进入申请相对应；
    相应地，所述出域授权令牌中还包含有所述跨域申请标识。
  34. 根据权利要求32或33所述的证书申请装置，其特征在于，所述出域授权令牌中还包含有所述车联网设备的设备信息和/或注册证书申请消息。
  35. 根据权利要求32所述的证书申请装置，其特征在于，所述入域授权令牌中还包含有所述车联网设备的设备信息和/或所述车联网设备在所述第二车联网***中的设备标识；
    所述入域响应消息中还包含有所述第二车联网***中注册证书颁发机构CA的地址信息和/或所述第二车联网***中应用CA的地址信息。
  36. 根据权利要求32所述的证书申请装置，其特征在于，所述第一发送子模块之前，还包括：
    获取子模块，用于获取所述入域申请消息中的出域授权令牌，并获取所述出域授权令牌中的设备签名证书；
    确定子模块，用于当通过所述设备签名证书验证得到所述入域申请消息的数字签名为有效签名时，确定所述入域申请消息为有效消息。
  37. 根据权利要求32所述的证书申请装置，其特征在于，所述发送模块之后，所述证书申请装置还包括：
    第一接收模块，用于接收所述车联网设备所发送的注册证书申请消息，其中所述注册证书申请消息中包含有所述入域授权令牌，且所述注册证书申请消息通过所述设备签名证书所对应的私钥进行数字签名；
    获取模块，用于获取所述注册证书申请消息中的所述入域授权令牌，并获取所述入域授权令牌中的设备签名证书；
    确定模块，用于当通过所述设备签名证书验证得到所述注册证书申请消息的数字签名为有效签名时，确定所述注册证书申请消息为有效消息，并向所述车联网设备发送注册证书。
  38. 根据权利要求37所述的证书申请装置，其特征在于，所述确定模块之后，所述证书申请装置还包括：
    第二接收模块，用于接收所述车联网设备所发送的应用证书申请消息，其中所述应用证书申请消息中包含有所述注册证书；
    基于所述应用证书申请消息，向所述车联网设备发送应用证书。
  39. 一种车联网设备，包括存储器、处理器及存储在存储器上并可在处理器上运行的计算机程序，其特征在于，所述处理器执行所述计算机程序时实现如下步骤：
    当车联网设备申请从第一车联网***进入第二车联网***时，接收所述第二车联网***所发送的入域授权令牌；
    基于所述入域授权令牌，获取所述第二车联网***的注册证书。
  40. 根据权利要求39所述的车联网设备，其特征在于，所述接收所述第二车联网***所发送的入域授权令牌之前，还包括：
    向所述第一车联网***发送出域申请消息；
    接收所述第一车联网***基于所述出域申请消息所发送的出域授权令牌，其中所述出域授权令牌中包含有所述车联网设备的设备签名证书；
    向所述第二车联网***发送入域申请消息，其中所述入域申请消息中包含有所述出域授权令牌，且所述入域申请消息通过所述设备签名证书所对应的私钥进行数字签名。
  41. 根据权利要求40所述的车联网设备，其特征在于，所述向所述第一车联网***发送出域申请消息之前，还包括：
    向所述第二车联网***发送标识申请消息；
    接收所述第二车联网***基于所述标识申请消息所发送的跨域申请标识，其中所述跨域申请标识与本次进入申请相对应；
    其中，所述出域申请消息和所述出域授权令牌中均包含有所述跨域申请标识。
  42. 根据权利要求40或41所述的车联网设备，其特征在于，所述出域授权令牌中还包含有所述车联网设备的设备信息和/或注册证书申请消息。
  43. 根据权利要求40所述的车联网设备，其特征在于，所述接收所述第二车联网***所发送的入域授权令牌，包括：
    接收所述第二车联网***基于所述入域申请消息所发送的入域响应消息，其中，所述入域响应消息中包含有所述入域授权令牌，且所述入域授权令牌中包含有所述设备签名证书和与本次进入申请所对应的跨域申请标识。
  44. 根据权利要求43所述的车联网设备，其特征在于，所述入域授权令牌中还包含有所述车联网设备的设备信息和/或所述车联网设备在所述第二车联网***中的设备标识；
    所述入域响应消息中还包含有所述第二车联网***中注册证书颁发机构CA的地址信息和/或所述第二车联网***中应用CA的地址信息。
  45. 根据权利要求43所述的车联网设备，其特征在于，所述基于所述入域授权令牌，获取所述第二车联网***的注册证书，包括：
    向所述第二车联网***发送注册证书申请消息，其中所述注册证书申请消息中包含有所述入域授权令牌，且所述注册证书申请消息通过所述设备签名证书所对应的私钥进行数字签名；
    接收所述第二车联网***基于所述注册证书申请消息所发送的注册证书。
  46. 根据权利要求39或45所述的车联网设备，其特征在于，所述基于所述入域授权令牌，获取所述第二车联网***的注册证书之后，还包括：
    向所述第二车联网***发送应用证书申请消息，其中所述应用证书申请消息中包含有所述注册证书；
    接收所述第二车联网***基于所述应用证书申请消息所发送的应用证书。
  47. 一种第一车联网***，包括存储器、处理器及存储在存储器上并可在处理器上运行的计算机程序，其特征在于，所述处理器执行所述计算机程序时实现如下步骤：
    当车联网设备申请从第一车联网***进入第二车联网***时，接收车联网设备发送的出域申请消息；
    基于所述出域申请消息，向所述车联网设备发送出域授权令牌，其中所述出域授权令牌中包含有所述车联网设备的设备签名证书，以使所述车联网设备向所述第二车联网***发送入域申请消息并获取入域授权令牌，所述入域申请消息中包含有所述出域授权令牌，且所述入域申请消息通过所述设备签名证书所对应的私钥进行数字签名。
  48. 根据权利要求47所述的第一车联网***，其特征在于，所述出域申请消息和所述出域授权令牌中均包含有跨域申请标识；其中，所述跨域申请标识为所述车联网设备向所述第二车联网***申请得到，且所述跨域申请标识与本次进入申请相对应。
  49. 根据权利要求47或48所述的第一车联网***，其特征在于，所述出域授权令牌中还包含有所述车联网设备的设备信息和/或注册证书申请消息。
  50. 一种第二车联网***，包括存储器、处理器及存储在存储器上并可在处理器上运行的计算机程序，其特征在于，所述处理器执行所述计算机程序时实现如下步骤：
    当车联网设备申请从第一车联网***进入第二车联网***时，向所述车联网设备发送入域授权令牌，以使所述车联网设备基于所述入域授权令牌获取所述第二车联网***的注册证书。
  51. 根据权利要求50所述的第二车联网***，其特征在于，所述向所述车联网设备发送入域授权令牌，包括：
    接收所述车联网设备所发送的入域申请消息，其中所述入域申请消息中包含有出域授权令牌，所述出域授权令牌由所述车联网设备向所述第一车联网***申请得到，且所述出域授权令牌中包含有所述车联网设备的设备签名证书，所述入域申请消息通过所述设备签名证书所对应的私钥进行数字签名；
    基于所述入域申请消息，向所述车联网设备发送入域响应消息，其中，所述入域响应消息中包含有入域授权令牌，且所述入域授权令牌中包含有所述设备签名证书和与本次进入申请所对应的跨域申请标识。
  52. 根据权利要求51所述的第二车联网***，其特征在于，所述接收所述车联网设备所发送的入域申请消息之前，还包括：
    接收所述车联网设备所发送的标识申请消息；
    基于所述标识申请消息，向所述车联网设备发送跨域申请标识，其中所述跨域申请标识与本次进入申请相对应；
    相应地，所述出域授权令牌中还包含有所述跨域申请标识。
  53. 根据权利要求51或52所述的第二车联网***，其特征在于，所述出域授权令牌中还包含有所述车联网设备的设备信息和/或注册证书申请消息。
  54. 根据权利要求51所述的第二车联网***，其特征在于，所述入域授权令牌中还包含有所述车联网设备的设备信息和/或所述车联网设备在所述第二车联网***中的设备标识；
    所述入域响应消息中还包含有所述第二车联网***中注册证书颁发机构CA的地址信息和/或所述第二车联网***中应用CA的地址信息。
  55. 根据权利要求51所述的第二车联网***，其特征在于，所述基于所述入域申请消息，向所述车联网设备发送入域响应消息之前，还包括：
    获取所述入域申请消息中的出域授权令牌，并获取所述出域授权令牌中的设备签名证书；
    当通过所述设备签名证书验证得到所述入域申请消息的数字签名为有效 签名时，确定所述入域申请消息为有效消息。
  56. 根据权利要求51所述的第二车联网***，其特征在于，所述向所述车联网设备发送入域授权令牌之后，还包括：
    接收所述车联网设备所发送的注册证书申请消息，其中所述注册证书申请消息中包含有所述入域授权令牌，且所述注册证书申请消息通过所述设备签名证书所对应的私钥进行数字签名；
    获取所述注册证书申请消息中的所述入域授权令牌，并获取所述入域授权令牌中的设备签名证书；
    当通过所述设备签名证书验证得到所述注册证书申请消息的数字签名为有效签名时，确定所述注册证书申请消息为有效消息，并向所述车联网设备发送注册证书。
  57. 根据权利要求56所述的第二车联网***，其特征在于，所述向所述车联网设备发送注册证书之后，还包括：
    接收所述车联网设备所发送的应用证书申请消息，其中所述应用证书申请消息中包含有所述注册证书；
    基于所述应用证书申请消息，向所述车联网设备发送应用证书。
  58. 一种非暂态计算机可读存储介质，其上存储有计算机程序，其特征在于，该计算机程序被处理器执行时实现如权利要求1至8任一项所述的证书申请方法的步骤，或者实现如权利要求9至11任一项所述的证书申请方法的步骤，或者实现如权利要求12至19任一项所述的证书申请方法的步骤。
PCT/CN2020/137283 2020-03-18 2020-12-17 一种证书申请方法及装置 WO2021184865A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202010193435.8 2020-03-18
CN202010193435.8A CN113497708B (zh) 2020-03-18 2020-03-18 一种证书申请方法及装置

Publications (1)

Publication Number Publication Date
WO2021184865A1 true WO2021184865A1 (zh) 2021-09-23

Family

ID=77771872

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/137283 WO2021184865A1 (zh) 2020-03-18 2020-12-17 一种证书申请方法及装置

Country Status (2)

Country Link
CN (1) CN113497708B (zh)
WO (1) WO2021184865A1 (zh)

Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1835438A (zh) * 2006-03-22 2006-09-20 阿里巴巴公司 一种在***间实现单次登录的方法及***
CN107359996A (zh) * 2016-05-09 2017-11-17 阿里巴巴集团控股有限公司 多网站间的自动登录方法及装置

Family Cites Families (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN100546245C (zh) * 2006-01-11 2009-09-30 西安电子科技大学 跨安全域的网络认证和密钥分配方法
US8869252B2 (en) * 2008-05-19 2014-10-21 Nokia Corporation Methods, apparatuses, and computer program products for bootstrapping device and user authentication
US9769153B1 (en) * 2015-08-07 2017-09-19 Amazon Technologies, Inc. Validation for requests
CN109743172B (zh) * 2018-12-06 2021-10-15 国网山东省电力公司电力科学研究院 基于联盟区块链v2g网络跨域认证方法、信息数据处理终端

Patent Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1835438A (zh) * 2006-03-22 2006-09-20 阿里巴巴公司 一种在***间实现单次登录的方法及***
CN107359996A (zh) * 2016-05-09 2017-11-17 阿里巴巴集团控股有限公司 多网站间的自动登录方法及装置

Also Published As

Publication number Publication date
CN113497708B (zh) 2022-11-08
CN113497708A (zh) 2021-10-12

Similar Documents

Publication Publication Date Title
WO2020224621A1 (zh) 一种申请数字证书的方法
Zhang et al. Blockchain based secure data sharing system for Internet of vehicles: A position paper
US20190363896A1 (en) Blockchain based decentralized and distributed certificate authority
US20200177398A1 (en) System, certification authority, vehicle-mounted computer, vehicle, public key certificate issuance method, and program
CN112399382A (zh) 基于区块链网络的车联网认证方法、装置、设备和介质
KR101837338B1 (ko) Vanet을 위한 클라우드 지원 조건부 프라이버시를 보호하는 인증 방법 및 시스템
CN111224781B (zh) 用于管理安全凭证管理***中的注册证书的方法和装置
EP2747377B1 (en) Trusted certificate authority to create certificates based on capabilities of processes
US20160127353A1 (en) Method and apparatus for enabling secured certificate enrollment in a hybrid cloud public key infrastructure
Sánchez-García et al. On-siteDriverID: A secure authentication scheme based on Spanish eID cards for vehicular ad hoc networks
EP4007319B1 (en) Vehicle communication method, apparatus, storage medium and program product
JP2023544529A (ja) 認証方法およびシステム
CN115694891B (zh) 一种基于中央计算平台的路侧设备通信***及方法
CN112784310A (zh) 证书的管理方法、证书授权中心、管理节点及车联网终端
CN113497707B (zh) 一种应用证书申请方法及装置
CN115580488A (zh) 基于区块链和物理不可克隆函数的车载网消息认证方法
CN114615642A (zh) 车车通信中车辆的身份认证方法、装置、车辆及存储介质
CN113395160B (zh) 证书管理方法、装置、颁发实体、管理实体及车联网设备
CN114205162A (zh) 一种基于区块链pki互信认证的方法和***
CN114915418A (zh) 业务证书管理方法、装置、***及电子设备
WO2021184865A1 (zh) 一种证书申请方法及装置
CN116761148A (zh) 一种基于区块链的v2x身份管理***及认证方法
CN116828451A (zh) 基于区块链的网联车队身份认证方法、装置和介质
CN116743387A (zh) 一种基于区块链的车辆雾服务安全通信***、方法及终端
Das et al. Design of a trust-based authentication scheme for blockchain-enabled iov system

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20925056

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 20925056

Country of ref document: EP

Kind code of ref document: A1