CN114817998A

CN114817998A - Data security calling method and device, electronic equipment and storage medium

Info

Publication number: CN114817998A
Application number: CN202210738355.5A
Authority: CN
Inventors: 张大为; 杨柯
Original assignee: Guoqi Intelligent Control Beijing Technology Co Ltd
Current assignee: Guoqi Intelligent Control Beijing Technology Co Ltd
Priority date: 2022-06-28
Filing date: 2022-06-28
Publication date: 2022-07-29

Abstract

The application provides a data security calling method, a data security calling device, electronic equipment and a storage medium, wherein target data are received, and storage information of the target data is acquired, wherein the storage information represents data use of the target data; based on the storage information, storing the target data to a corresponding target storage position to generate formatted data, wherein the target storage position has a safety protection level corresponding to the storage information; and acquiring the formatted data, and executing the corresponding target application based on the formatted data. After the target data are received, the target data are stored to the corresponding target storage positions based on the storage information, formatted data with different safety protection levels are formed, leakage and tampering of the key data are avoided, and then the formatted data are called based on a request of a target application, so that the safety of the data is ensured, and the driving safety and stability of a vehicle are improved.

Description

Data security calling method and device, electronic equipment and storage medium

Technical Field

The present application relates to the field of automatic driving technologies, and in particular, to a method and an apparatus for safely invoking data, an electronic device, and a storage medium.

Background

Currently, in various levels of automatic driving scenarios, smart cars need to generate and use numerous data to realize various automatic driving functions, such as various sensor sensing data, vehicle control data, and the like. In the prior art, data generated in a vehicle automatic driving scene is generally uniformly stored at a vehicle end for being called in the execution process of various applications.

However, in the scheme in the prior art, when the smart car is attacked from the outside, data leakage and tampering problems can be caused, and data safety, driving safety of the vehicle and system stability are affected.

Disclosure of Invention

The application provides a data security calling method and device, electronic equipment and a storage medium, which are used for solving the problems of data leakage and tampering.

In a first aspect, the present application provides a data security calling method, including:

receiving target data and acquiring storage information of the target data, wherein the storage information represents the data use of the target data; storing the target data to a corresponding target storage position based on the storage information, and generating formatted data; and acquiring the formatted data, and executing the corresponding target application based on the formatted data.

In one possible implementation, the storage information includes a data type of the target data; the storing the target data to a corresponding target storage location based on the storage information, and generating formatted data, including: determining a corresponding target storage position according to the data type of the target data; and storing the target data to the target storage position to generate the formatted data.

In one possible implementation, the determining the corresponding target storage location according to the data type of the target data includes: determining storage demand information according to the data type of the sensor data, wherein the storage demand information represents the unit time storage amount for storing the sensor data; and determining a corresponding target storage position according to the storage demand information, wherein the target storage position is a cloud storage medium or a local storage medium.

In one possible implementation, the method further includes: encrypting the target data based on the storage information to generate encrypted data; the storing the target data to a corresponding target storage location based on the storage information, and generating formatted data, including: and storing the encrypted data to a corresponding target storage position based on the storage information to generate the formatted data.

In a possible implementation manner, encrypting the target data based on the storage information to generate encrypted data includes: determining a corresponding target encryption algorithm according to the storage information, wherein the storage information and the complexity of the encryption algorithm have a preset mapping relation; and encrypting the target data based on the target encryption algorithm to generate encrypted data.

In one possible implementation, the method further includes: acquiring running environment information of the target application, wherein the running environment information represents the security level of a communication network used by the target application during running; the storing the target data to a corresponding target storage location based on the storage information, and generating formatted data, including: and storing the target data to a corresponding target storage position according to the running environment information and the storage information of the target application to generate the formatted data.

In a possible implementation manner, the storing the target data to a corresponding target storage location according to the running environment information and the storage information of the target application, and generating the formatted data includes: if the operating environment information represents a high safety level, storing target data to a target storage position of a vehicle end according to the storage information; and if the operating environment information represents a low security level, storing and uploading target data to a target storage position of a cloud according to the storage information.

In a possible implementation manner, the obtaining the formatted data and executing a corresponding target application based on the formatted data includes: determining a target data type required for running the target application; requesting the formatted data based on the target data type to obtain target formatted data belonging to the target data type; executing the target application based on the target formatted data.

In a second aspect, the present application provides a data security calling apparatus, including:

the communication module is used for receiving target data and acquiring storage information of the target data, wherein the storage information represents the data use of the target data;

the storage module is used for storing the target data to a corresponding target storage position based on the storage information and generating formatted data;

and the execution module is used for acquiring the formatted data and executing the corresponding target application based on the formatted data.

In one possible implementation, the storage information includes a data type of the target data; the storage module is specifically configured to: determining a corresponding target storage position according to the data type of the target data; and storing the target data to the target storage position to generate the formatted data.

In a possible implementation manner, the target data includes sensor data, and when the storage module determines a corresponding target storage location according to a data type of the target data, the storage module is specifically configured to: determining storage demand information according to the data type of the sensor data, wherein the storage demand information represents the unit time storage amount for storing the sensor data; and determining a corresponding target storage position according to the storage demand information, wherein the target storage position is a cloud storage medium or a local storage medium.

In a possible implementation manner, the storage module is further configured to: encrypting the target data based on the storage information to generate encrypted data; the storage module is specifically configured to, when storing the target data to a corresponding target storage location based on the storage information and generating formatted data: and storing the encrypted data to a corresponding target storage position based on the storage information to generate the formatted data.

In a possible implementation manner, when the storage module encrypts the target data based on the storage information to generate encrypted data, the storage module is specifically configured to: determining a corresponding target encryption algorithm according to the storage information, wherein the storage information and the complexity of the encryption algorithm have a preset mapping relation; and encrypting the target data based on the target encryption algorithm to generate encrypted data.

In a possible implementation manner, the storage module is further configured to: acquiring running environment information of the target application, wherein the running environment information represents the security level of a communication network used by the target application during running; based on the storage information, the storage module is specifically configured to: and storing the target data to a corresponding target storage position according to the running environment information and the storage information of the target application to generate the formatted data.

In a possible implementation manner, when the storage module stores the target data to a corresponding target storage location according to the running environment information of the target application and the storage information, and generates the formatted data, the storage module is specifically configured to: if the operating environment information represents a high safety level, storing target data to a target storage position of a vehicle end according to the storage information; and if the operating environment information represents a low security level, storing and uploading target data to a target storage position of a cloud according to the storage information.

In a possible implementation manner, the execution module is specifically configured to: determining a target data type required for running the target application; requesting the formatted data based on the target data type to obtain target formatted data belonging to the target data type; executing the target application based on the target formatted data.

In a third aspect, the present application provides an electronic device, comprising: a processor, and a memory communicatively coupled to the processor;

the memory stores computer-executable instructions;

the processor executes computer-executable instructions stored in the memory to implement the data security call method according to any one of the first aspect of the embodiments of the present application.

In a fourth aspect, the present application provides a computer-readable storage medium, in which computer-executable instructions are stored, and when executed by a processor, the computer-executable instructions are used to implement the data security call method according to any one of the first aspect of the embodiments of the present application.

According to a fifth aspect of embodiments of the present application, there is provided a computer program product comprising a computer program that, when executed by a processor, implements the data security call method as described in any one of the first aspects above.

According to the data security calling method, the data security calling device, the electronic equipment and the storage medium, target data are received, and storage information of the target data is obtained, wherein the storage information represents data use of the target data; storing the target data to a corresponding target storage position based on the storage information, and generating formatted data, wherein the target storage position has a safety protection level corresponding to the storage information; and acquiring the formatted data, and executing the corresponding target application based on the formatted data. After the target data are received, the target data are stored to the corresponding target storage positions based on the storage information, formatted data with different safety protection levels are formed, leakage and tampering of the key data are avoided, and then the formatted data are called based on a request of a target application, so that the safety of the data is ensured, and the driving safety and stability of a vehicle are improved.

Drawings

The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and together with the description, serve to explain the principles of the application.

Fig. 1 is a schematic diagram of an intelligent vehicle data call provided in an embodiment of the present application;

fig. 2 is a flowchart of a data security call method according to an embodiment of the present application;

FIG. 3 is a flowchart illustrating a specific implementation step of step S102 in the embodiment shown in FIG. 2;

fig. 4 is a flowchart of a data security call method according to another embodiment of the present application;

FIG. 5 is a flowchart illustrating a specific implementation step of step S202 in the embodiment shown in FIG. 4;

fig. 6 is a schematic diagram of an encryption algorithm mapping table according to an embodiment of the present application;

fig. 7 is a schematic diagram of a communication network with a high security level according to an embodiment of the present application;

fig. 8 is a schematic structural diagram of a data security call device according to an embodiment of the present application;

FIG. 9 is a schematic view of an electronic device provided by an embodiment of the present application;

fig. 10 is a block diagram of a terminal device according to an exemplary embodiment of the present application.

With the above figures, there are shown specific embodiments of the present application, which will be described in more detail below. These drawings and written description are not intended to limit the scope of the inventive concepts in any manner, but rather to illustrate the inventive concepts to those skilled in the art by reference to specific embodiments.

Detailed Description

Reference will now be made in detail to the exemplary embodiments, examples of which are illustrated in the accompanying drawings. When the following description refers to the accompanying drawings, like numbers in different drawings represent the same or similar elements unless otherwise indicated. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present application. Rather, they are merely examples of apparatus and methods consistent with certain aspects of the present application, as detailed in the appended claims.

In the technical scheme of the application, the collection, storage, use, processing, transmission, provision, disclosure and other processing of the personal information of the related user are all in accordance with the regulations of related laws and regulations and do not violate the good custom of the public order.

The following explains an application scenario of the embodiment of the present application:

the data security calling method provided by the embodiment of the application can be applied to an automatic driving application scene, and more specifically, can be applied to an automatic driving application scene based on vehicle cloud computing. Fig. 1 is a schematic diagram of data call of an intelligent vehicle according to an embodiment of the present application, and as shown in fig. 1, various sensors (e.g., a camera and a laser radar) and human-computer interaction devices (e.g., a touch screen and a microphone) are mounted on the intelligent vehicle, and when the intelligent vehicle is started, various sensing data, instruction data and network data are generated based on operations of the various sensors and the human-computer interaction devices. The various data are transmitted to a domain controller of the intelligent vehicle through the middleware so as to support the execution of various automatic driving applications. Meanwhile, the vehicle operating system may also generate various types of data, such as decision data for automatic driving, vehicle state data, and the like, based on execution of various instructions, trigger conditions, and applications. Such data may also support the execution of various types of autopilot applications.

In the prior art, the data generated in the above process is generally stored in a vehicle end, for example, in a vehicle end storage medium fixedly arranged. The domain controller is used for calling when executing various applications, however, when the domain controller of the intelligent automobile is attacked from the outside, the data stored at the automobile end has the risk of leakage and tampering, and therefore the data safety, the driving safety of the automobile and the system stability are affected.

The following describes the technical solutions of the present application and how to solve the above technical problems with specific embodiments. The following several specific embodiments may be combined with each other, and details of the same or similar concepts or processes may not be repeated in some embodiments. Embodiments of the present application will be described below with reference to the accompanying drawings.

Fig. 2 is a flowchart of a data security call method according to an embodiment of the present application, where an execution subject of the embodiment may be a domain controller of an intelligent vehicle, as shown in fig. 2, the data security call method according to the embodiment includes the following steps:

step S101, receiving target data and obtaining storage information of the target data, wherein the storage information represents data usage of the target data.

The target data, i.e. the data to be stored, may be sensed data collected by external sensors such as a camera and a radar, or may be internal data generated by the vehicle during driving, such as vehicle operation data, driver operation data, automatic driving control decision data, and the like. Illustratively, the target data may include static data associated with the vehicle, such as vehicle identification data, vehicle attribute data, core component data, and the like.

Further, the storage information is information for characterizing data usage of the target data, and may be a flag, or a combination of flags, or higher dimensional information, such as an array, a matrix, and a higher dimensional data structure. In a possible implementation manner, the domain controller receives the data, and may obtain storage information of the target data, that is, a data usage of the target data, based on the identification field in the data signaling corresponding to the number. For example, when the storage information includes the identifier #01, the characterization target data is sensor data; when the storage information comprises an identifier #02, representing the target data as control data;

in another possible implementation manner, after receiving the data, the domain controller processes and extracts features of the data, so as to generate storage information representing the data purpose of the target data. For example, after receiving image data transmitted from an image sensor (camera), the domain controller determines that the image data is image data for implementing a short-distance obstacle avoidance function by extracting a physical sign of the image data, and more specifically, the domain controller characterizes corresponding data usage by storing information such as a size of the image and an identification target in the image.

And step S102, storing the target data to a corresponding target storage position based on the storage information, and generating formatted data.

Illustratively, after the storage information is obtained, the target data is stored to a location corresponding to the security protection level, i.e. the target storage location, based on the description of the storage information on the data usage of the target data. For example, user data, such as user phone calls, communication records, etc., will be stored to the cloud based on the stored information; and storing the radar data in the driving process to the local vehicle end. Further, the target storage location may also be a cloud or a different location of the vehicle, for example, based on the storage information, the user data is stored in a first local storage medium that can only be accessed by a high authority, and the radar data during driving is stored in a second local storage medium that can be accessed by a low authority. Similarly, the target data may be stored in different storage media of the cloud based on the storage information, which is not described herein again.

The storage process is implemented by a middleware, and illustratively, the middleware is a service running in an intelligent automobile operating system, and is used for formatting different data (for example, data output by different manufacturers, sensors of different models, and vehicle-mounted devices) so as to meet the requirement of the intelligent automobile operating system for processing data. And the domain controller processes the target data through the middleware and stores the processed target data in a corresponding target storage position to generate formatted data.

Illustratively, the storage information includes a data type of the target data, and the step of determining the corresponding target storage location based on the storage information includes: determining a corresponding target storage position according to the data type of the target data; and storing the target data to a target storage position to generate formatted data.

Illustratively, the data type of the target data may be represented by a type identifier, for example, and according to preset configuration information representing a mapping relationship between the data type and the storage location, a target storage location corresponding to the data type of the target data may be determined, and then the target data is stored in the target storage location to generate formatted data.

More specifically, in a possible implementation manner, the target data includes sensor data, and the storage information includes a data type of the sensor data, as shown in fig. 3, the specific implementation step of step S102 includes:

step S1021: and determining storage demand information according to the data type of the sensor data, wherein the storage demand information represents the unit time storage amount of the stored sensor data.

Step S1022: and determining a corresponding target storage position according to the storage demand information, wherein the target storage position is a cloud storage medium or a local storage medium.

Step S1023: and storing the sensor data to a target storage position to generate formatted data.

For example, in an application scenario of automatic driving, when an automatic driving function (i.e., a target function) is operated, sensor data needs to be obtained in real time to support the operation of the automatic driving function, such as radar data, camera data, and the like. However, when the sensor data is stored, in consideration of the limitation of network transmission conditions, when the amount of data stored in real time is too large, the problem of data loss or failure to upload and store the data in time may be caused, and the system stability is affected by the increase of the network load of the cloud.

In order to solve the above problem, in this embodiment, first, storage requirement information representing the storage amount of the sensor data per unit time is determined according to the data type, and then, the corresponding target storage location is determined based on the storage requirement information, so that the data type of the sensor data matches the target storage location. For example, when the data type of the sensor data is high-definition image data for realizing close-range avoidance, determining that the corresponding storage amount per unit time is 100 storage units (i.e., storage requirement information), and is greater than a preset storage amount threshold per unit time (e.g., 50), determining that the corresponding target storage position is a local storage medium; when the data type of the sensor data is a vehicle speed value, the corresponding unit time storage amount is determined to be 10 storage units (namely storage demand information), and the corresponding unit time storage amount is smaller than a preset unit time storage amount threshold value, the corresponding target storage position is determined to be a cloud storage medium.

In this embodiment, different storage strategies are adopted for storing different types of data, so that sensor data of different data types are stored to the cloud or the vehicle end based on the storage capacity per unit time, and the problems that the data are lost or cannot be uploaded for storage and the network load of the cloud is increased to affect the stability of the system are avoided.

Step S103, acquiring the formatted data, and executing the corresponding target application based on the formatted data.

Illustratively, after the target data is stored to the corresponding target storage location, the formatted data is generated, and in response to a request of the target application, the corresponding formatted data is read from the target storage location, and the specific function of the corresponding target application is realized based on the formatted data. For example, the formatted data is, for example, laser radar data and image data, the target application is used for implementing the adaptive cruise function, and the domain controller responds to the request of the target application, controls the intelligent vehicle to perform adaptive cruise by acquiring the laser radar data and the image data and performing calculation, so as to achieve the purpose of executing the target application. Meanwhile, in the process, the formatted data are stored to the storage positions with different safety protection levels, so that the storage screening and the grading protection of different data are realized, and the loss and the tampering of important data caused by the attack are avoided.

In the embodiment, target data is received, and storage information of the target data is acquired, wherein the storage information represents data use of the target data; based on the storage information, storing the target data to a corresponding target storage position to generate formatted data, wherein the target storage position has a safety protection level corresponding to the storage information; and acquiring the formatted data, and executing the corresponding target application based on the formatted data. After the target data are received, the target data are stored to the corresponding target storage positions based on the storage information, formatted data with different safety protection levels are formed, leakage and tampering of the key data are avoided, and then the formatted data are called based on a request of a target application, so that the safety of the data is ensured, and the driving safety and stability of a vehicle are improved.

In an application scenario of automatic driving, the method provided by the embodiment shown in fig. 2 can implement partitioned storage of target data storage, and generate formatted data stored in a corresponding location, thereby implementing safe invocation of data. However, in the process of executing the automatic driving function, the data is stored in a storage location with a higher security level, which can improve the data security, but also inevitably causes consumption of computing resources and network resources. Therefore, how to accurately store different data is a problem to be further solved, which reduces the consumption of computing resources and network resources while ensuring the data security.

To solve the above technical problem, fig. 4 is a flowchart of a data security invoking method according to another embodiment of the present application, and as shown in fig. 4, the data security invoking method according to the embodiment further refines steps S102 and S103 on the basis of the data security invoking method according to the embodiment shown in fig. 2, so as to solve the above technical problem, specifically, the data security invoking method according to the embodiment includes the following steps:

step S201, receiving the target data, and acquiring storage information of the target data, where the storage information represents a data use of the target data.

Step S202, based on the storage information, the target data is encrypted to generate encrypted data.

For example, after the target data is obtained, to avoid leakage and tampering of the data, the target data may be encrypted first to generate encrypted data, and then the encrypted data may be stored, so as to improve data security. However, the encryption process of the data (and the decryption process in the process of calling the data later) causes consumption of computing resources, and therefore, in the embodiment, the target data is selectively encrypted based on the stored information, for example, the user data related to the privacy of the user is encrypted; for the sensing data which needs to be stored and called frequently in the local storage, such as real-time map data, V2X data and sensor data, encryption is not carried out.

In one possible implementation manner, as shown in fig. 5, the specific implementation steps of step S202 include:

step S2021, determining a corresponding target encryption algorithm according to the storage information, where the storage information and the complexity of the encryption algorithm have a preset mapping relationship.

Step S2022, encrypts the target data based on the target encryption algorithm to generate encrypted data.

Illustratively, the storage information is information characterizing a data type of the target data, the data type including at least one of: vehicle basic data, perception data, decision data, execution data and user data. Exemplarily, wherein the vehicle basic data comprises: vehicle identification data, vehicle attribute data, core component data; the perception data includes: sensor data, high-precision map data, GNSS data, V2X data; the decision data includes: driver operational data, system decision data; the execution data includes: vehicle state data, vehicle performance data, component and system operation data, and safety/other log data.

And accurately mapping the data type represented by the storage information based on the data type represented by the storage information, and determining an encryption algorithm with corresponding complexity. Fig. 6 is a schematic diagram of a mapping table of an encryption algorithm provided in an embodiment of the present application, and as shown in fig. 6, for example, an encryption algorithm corresponding to vehicle basic data is a first hash algorithm, that is, for static vehicle basic data, a preset hash algorithm (first hash algorithm) is used for encryption, and the encrypted vehicle basic data is a first hash value. And then, when the vehicle basic data is required to be called to run the target application, restoring the vehicle basic data corresponding to the first hash value through a preset first hash mapping table. Similarly, the encryption algorithm corresponding to the user data is a second hash algorithm, wherein the algorithm complexity of the second hash algorithm is higher than that of the first hash algorithm, so that the protection degree of the user data is improved. And then, when the user data is required to be called to run the target application, restoring through a preset second hash mapping table, wherein the restoring mode is the same as that of the basic data of the vehicle, and the description is omitted. And the decision data is used as more critical data, the corresponding encryption algorithm is a block chain encryption algorithm, the target data is encrypted based on the distributed block chain network to obtain block chain data, and when the decision data needs to be called, a request needs to be sent to the distributed block chain network for decryption.

Referring to fig. 6, different encryption algorithms are used for encrypting different types of target data, so as to achieve different levels of protection, and for key data, such as decision data, encryption algorithms which are more complex and consume more computing resources are used for encrypting, so as to ensure data security; and for (relative) non-critical data, a relatively simple encryption algorithm is used for encryption, so that the consumption of computing resources is reduced, and the balance between data security and computing resource consumption is realized.

Step S203, obtaining the running environment information of the target application, wherein the running environment information represents the security level of the communication network used by the target application during running.

And step S204, determining a corresponding target storage position according to the running environment information and the storage information of the target application.

For example, in an application scenario of automatic driving based on vehicle cloud computing, an intelligent vehicle is generally required to access a communication network and implement operation of a target application through a service provided by a network side. However, when the smart car accesses an external communication network, the smart car also faces a higher risk of cyber attack. Based on the above reasons, the domain controller first obtains the operating environment information of the target application, i.e. the security level of the communication network used by the target application when operating, and then determines the corresponding target storage location according to the operating environment information and the storage information of the target application. In a possible implementation manner, if the operating environment information represents a high security level, storing target data to a target storage position of a vehicle end according to the storage information; and if the operating environment information represents a low security level, storing and uploading target data to a target storage position of a cloud according to the storage information.

Specifically, for example, the target application a is used for implementing path planning of an intelligent automobile, and the communication network used by the target application a is a communication network with a high security level when the target application a is in operation. Fig. 7 is a schematic diagram of a high-security-level communication network provided in an embodiment of the present application, and as shown in fig. 7, the high-security-level communication network is a Net-1 network, where the Net-1 network is exemplarily composed of network nodes such as a roadside device, an edge cloud server, a center cloud server, and the like, and an intelligent vehicle accesses the Net-1 network by communicating with the roadside device, so as to implement data interaction with the edge cloud server and the center cloud server, and further run a target application a (path planning) based on services (computing resources, algorithm services, and the like) provided by the edge cloud server and/or the center cloud server. In this scenario, the Net-1 network is a relatively closed network, and only authorized vehicles can access the Net-1 network through the roadside device and further communicate with the edge cloud server and/or the center cloud server (which is equivalent to a private network), so that the Net-1 network is a communication network with a high security level. After determining that the communication network for operating the target application A is a communication network with a high security level according to the operating environment information of the target application A, the domain controller can store the target data in the cloud, so that the security in the data transmission process is ensured.

Another possible scenario is that the target application B is used to implement an AR navigation function of a vehicle, and the communication network used by the target application B is the internet, i.e. a communication network with a low security level when the target application B is running. Specifically, for example, a smart car accesses the internet through a cellular network, and communicates with a third party server (corresponding to a public network) through the internet, thereby obtaining landmark information in AR navigation. After determining that the communication network for running the target application B is a communication network with a low security level according to the running environment information of the target application B, the domain controller encrypts target data through a complex encryption algorithm and stores the encrypted target data in a local vehicle end, so that data leakage caused by attack is avoided; or the data is transmitted to a special network server for storage through a special communication network, so that the data security is ensured.

It should be noted that the high security level and the low security level in this embodiment are only used to describe the meaning of the operating environment information, and in terms of specific implementation, the high security level and the low security level may be determined by specific identifiers, for example, the operating environment information includes an HL identifier to represent the high security level, and the operating environment information includes an LL identifier to represent the low security level. Meanwhile, the high security level and the low security level can be realized through other implementation modes, wherein the first security level, the second security level and the third security level are higher than a preset security level threshold value and are high security levels, and the first security level, the second security level and the third security level are lower than or equal to the preset security level threshold value and are low security levels. The operation environment information comprises a security level identifier corresponding to the first security level, the second security level and the like.

Further, on the basis of the operating environment information, the corresponding target storage position can be further determined by combining the storage information. For example, the data type of the storage information representation target data is stored, when the operating environment information representation communication network is a communication network with a low security level, if the target data is critical data such as decision data, the encrypted data obtained in the above step is uploaded to a storage medium with a high security protection level at the cloud end; and if the target data are non-critical data such as perception data, uploading the encrypted data obtained in the step to a storage medium with a low security protection level at the cloud end. On this basis, a more accurate target storage location may be further determined by combining storage requirement information corresponding to the target data, and a specific implementation manner may refer to related descriptions in the embodiment shown in fig. 2, which is not described herein again.

The target application and the corresponding operating environment information have a preset mapping relationship, and the corresponding operating environment information may be obtained through an application identifier of the target application, for example, which is not described herein again.

In the embodiment, by acquiring the running environment information of the target application and determining the corresponding target storage position based on the running environment information, the safety in the data storage and transmission process is further improved, and the data leakage and tampering are avoided. Meanwhile, for different target applications, the network environments required to be accessed are different, so that the target storage position is determined according to the running environment information corresponding to the target applications, data can be stored in the local vehicle end under the secure network environment, the data safety is ensured, meanwhile, the consumption of network resources is reduced, and the server load is reduced.

Step S205 stores the encrypted data to the corresponding target storage location, and generates formatted data.

In step S206, a target data type required for running the target application is determined.

Step S207, based on the target data type, requests the formatted data to obtain the target formatted data belonging to the target data type.

In step S208, the target application is executed based on the target formatted data.

Illustratively, through the above steps, after storing the encrypted data and generating the formatted data, the domain controller may call the formatted data obtained through the above process based on the request of the target application. The data required by the running of the target application is only one part of the formatted data generated in the previous step, and in order to avoid illegal access of the domain controller to the formatted data under the condition of receiving an attack, the corresponding target data type is determined based on the target application before the formatted data is called. For example, the target application is used for implementing a vehicle adaptive navigation function, and the types of target data required by the target application are radar data, camera data, decision data and execution data. The domain controller requests data corresponding to the above-mentioned target data type, for example, formatted radar data, formatted decision data, formatted camera data, decision data formatted execution data, i.e., target formatted data, from all the formatted data based on the request of the target application. And the user data, the vehicle basic data and the like and the data which cannot be obtained by the target application cannot be obtained by the domain controller.

In the embodiment, the target data type required by the target application is determined, and the data request is carried out based on the target data type, so that the operation access range of the data is limited, the illegal access after the attack is avoided, the data security is further improved, and the vehicle driving security is further improved.

In this embodiment, implementation manners of step S201 and step S205 are already described in the embodiment shown in fig. 2 of this application, and are not described in detail here.

Fig. 8 is a schematic structural diagram of a data security call device according to an embodiment of the present application, and as shown in fig. 8, the data security call device 3 according to the embodiment includes:

the communication module 31 is configured to receive target data and obtain storage information of the target data, where the storage information represents a data purpose of the target data;

the storage module 32 is configured to store the target data to a corresponding target storage location based on the storage information, and generate formatted data;

and the execution module 33 is configured to obtain the formatted data and execute the corresponding target application based on the formatted data.

In one possible implementation, the storage information includes a data type of the target data; the storage module 32 is specifically configured to: determining a corresponding target storage position according to the data type of the target data; and storing the target data to a target storage position to generate formatted data.

In a possible implementation manner, the target data includes sensor data, and when determining the corresponding target storage location according to the data type of the target data, the storage module 32 is specifically configured to: determining storage demand information according to the data type of the sensor data, wherein the storage demand information represents the unit time storage amount of the stored sensor data; and determining a corresponding target storage position according to the storage demand information, wherein the target storage position is a cloud storage medium or a local storage medium.

In one possible implementation, the storage module 32 is further configured to: encrypting the target data based on the storage information to generate encrypted data; the storage module is specifically configured to, when storing the target data to the corresponding target storage location based on the storage information and generating the formatted data: and storing the encrypted data to the corresponding target storage position based on the storage information to generate formatted data.

In a possible implementation manner, the storage module 32, when encrypting the target data based on the storage information and generating the encrypted data, is specifically configured to: determining a corresponding target encryption algorithm according to the storage information, wherein the storage information and the complexity of the encryption algorithm have a preset mapping relation; and encrypting the target data based on the target encryption algorithm to generate encrypted data.

In one possible implementation, the storage module 32 is further configured to: acquiring running environment information of the target application, wherein the running environment information represents the security level of a communication network used when the target application runs; based on the storage information, the storage module is specifically configured to: and storing the target data to a corresponding target storage position according to the running environment information and the storage information of the target application to generate formatted data.

In a possible implementation manner, when the storage module 32 stores the target data to the corresponding target storage location according to the running environment information and the storage information of the target application, and generates the formatted data, it is specifically configured to: if the operating environment information represents a high security level, storing the target data to a cloud storage medium; and if the operating environment information represents a low security level, storing and encrypting the target data according to the storage information and then storing the encrypted target data into a vehicle-end storage medium, or uploading the encrypted target data to a cloud storage medium through a special communication network.

In a possible implementation manner, the execution module 33 is specifically configured to: determining a target data type required by running a target application; based on the target data type, requesting formatted data to obtain target formatted data belonging to the target data type; executing the target application based on the target formatted data.

The communication module 31, the storage module 32 and the execution module 33 are connected in sequence. The data security call apparatus provided in this embodiment may execute the technical solution of the method embodiment shown in any one of fig. 2 to 7, and the implementation principle and the technical effect are similar, and are not described herein again.

Fig. 9 is a schematic view of an electronic device according to an embodiment of the present application, and as shown in fig. 9, an electronic device 4 according to the embodiment includes: a processor 41, and a memory 42 communicatively coupled to the processor 41.

Wherein the memory 42 stores computer-executable instructions;

the processor 41 executes computer-executable instructions stored in the memory 42 to implement the data security calling method provided in any one of the embodiments corresponding to fig. 2 to 7 of the present application.

The memory 42 and the processor 41 are connected by a bus 43.

The relevant descriptions and effects corresponding to the steps in the embodiments corresponding to fig. 2 to fig. 7 can be understood, and are not described in detail herein.

One embodiment of the present application provides a computer-readable storage medium, on which a computer program is stored, where the computer program is executed by a processor to implement the data security call method provided in any embodiment corresponding to fig. 2 to fig. 7 of the present application.

The computer readable storage medium may be, among others, ROM, Random Access Memory (RAM), CD-ROM, magnetic tape, floppy disk, optical data storage device, and the like.

An embodiment of the present application provides a computer program product, which includes a computer program, and when the computer program is executed by a processor, the computer program implements the data security call method provided in any embodiment of the present application corresponding to fig. 2 to fig. 7.

Fig. 10 is a block diagram of a terminal device 800, which may be a mobile phone, a computer, a digital broadcast terminal, a messaging device, a game console, a tablet device, a medical device, a fitness device, a personal digital assistant, etc., according to an exemplary embodiment of the present application.

Terminal device 800 may include one or more of the following components: a processing component 802, a memory 804, a power component 806, a multimedia component 808, an audio component 810, an input/output (I/O) interface 812, a sensor component 814, and a communication component 816.

The processing component 802 generally controls overall operation of the terminal device 800, such as operations associated with display, telephone calls, data communications, camera operations, and recording operations. The processing components 802 may include one or more processors 820 to execute instructions to perform all or a portion of the steps of the methods described above. Further, the processing component 802 can include one or more modules that facilitate interaction between the processing component 802 and other components. For example, the processing component 802 may include a multimedia module to facilitate interaction between the multimedia component 808 and the processing component 802.

The memory 804 is configured to store various types of data to support operations at the terminal device 800. Examples of such data include instructions for any application or method operating on terminal device 800, contact data, phonebook data, messages, pictures, videos, and so forth. The memory 804 may be implemented by any type or combination of volatile or non-volatile memory devices such as Static Random Access Memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic or optical disks.

Power components 806 provide power to the various components of terminal device 800. Power components 806 may include a power management system, one or more power sources, and other components associated with generating, managing, and distributing power for terminal device 800.

The multimedia component 808 includes a screen providing an output interface between the terminal device 800 and the user. In some embodiments, the screen may include a Liquid Crystal Display (LCD) and a Touch Panel (TP). If the screen includes a touch panel, the screen may be implemented as a touch screen to receive an input signal from a user. The touch panel includes one or more touch sensors to sense touch, slide, and gestures on the touch panel. The touch sensor may not only sense the boundary of a touch or slide action, but also detect the duration and pressure associated with the touch or slide operation. In some embodiments, the multimedia component 808 includes a front facing camera and/or a rear facing camera. When the terminal device 800 is in an operation mode, such as a shooting mode or a video mode, the front camera and/or the rear camera may receive external multimedia data. Each front camera and rear camera may be a fixed optical lens system or have a focal length and optical zoom capability.

The audio component 810 is configured to output and/or input audio signals. For example, the audio component 810 includes a Microphone (MIC) configured to receive an external audio signal when the terminal device 800 is in an operation mode, such as a call mode, a recording mode, and a voice recognition mode. The received audio signals may further be stored in the memory 804 or transmitted via the communication component 816. In some embodiments, audio component 810 also includes a speaker for outputting audio signals.

The I/O interface 812 provides an interface between the processing component 802 and peripheral interface modules, which may be keyboards, click wheels, buttons, etc. These buttons may include, but are not limited to: a home button, a volume button, a start button, and a lock button.

Sensor component 814 includes one or more sensors for providing various aspects of state assessment for terminal device 800. For example, sensor assembly 814 can detect an open/closed state of terminal device 800, the relative positioning of components, such as a display and keypad of terminal device 800, sensor assembly 814 can also detect a change in position of terminal device 800 or a component of terminal device 800, the presence or absence of user contact with terminal device 800, orientation or acceleration/deceleration of terminal device 800, and a change in temperature of terminal device 800. Sensor assembly 814 may include a proximity sensor configured to detect the presence of a nearby object without any physical contact. The sensor assembly 814 may also include a light sensor, such as a CMOS or CCD image sensor, for use in imaging applications. In some embodiments, the sensor assembly 814 may also include an acceleration sensor, a gyroscope sensor, a magnetic sensor, a pressure sensor, or a temperature sensor.

Communication component 816 is configured to facilitate communications between terminal device 800 and other devices in a wired or wireless manner. The terminal device 800 may access a wireless network based on a communication standard, such as WiFi, 3G, 4G, 5G, or other standard communication networks, or a combination thereof. In an exemplary embodiment, the communication component 816 receives a broadcast signal or broadcast related information from an external broadcast management system via a broadcast channel. In an exemplary embodiment, communications component 816 further includes a Near Field Communications (NFC) module to facilitate short-range communications. For example, the NFC module may be implemented based on Radio Frequency Identification (RFID) technology, infrared data association (IrDA) technology, Ultra Wideband (UWB) technology, Bluetooth (BT) technology, and other technologies.

In an exemplary embodiment, the terminal device 800 may be implemented by one or more Application Specific Integrated Circuits (ASICs), Digital Signal Processors (DSPs), Digital Signal Processing Devices (DSPDs), Programmable Logic Devices (PLDs), Field Programmable Gate Arrays (FPGAs), controllers, micro-controllers, microprocessors or other electronic components for performing the methods provided by any of the embodiments of fig. 2-7 of the present application.

In an exemplary embodiment, a non-transitory computer-readable storage medium comprising instructions, such as the memory 804 comprising instructions, executable by the processor 820 of the terminal device 800 to perform the above-described method is also provided. For example, the non-transitory computer readable storage medium may be a ROM, a Random Access Memory (RAM), a CD-ROM, a magnetic tape, a floppy disk, an optical data storage device, and the like.

An embodiment of the present application further provides a non-transitory computer-readable storage medium, where instructions in the storage medium, when executed by a processor of a terminal device, enable the terminal device 800 to perform the method provided in any one of the embodiments corresponding to fig. 2 to fig. 7 of the present application.

In the several embodiments provided in the present application, it should be understood that the disclosed apparatus and method may be implemented in other ways. For example, the above-described apparatus embodiments are merely illustrative, and for example, a division of modules is merely a division of logical functions, and an actual implementation may have another division, for example, a plurality of modules or components may be combined or integrated into another system, or some features may be omitted, or not executed. In addition, the shown or discussed mutual coupling or direct coupling or communication connection may be an indirect coupling or communication connection through some interfaces, devices or modules, and may be in an electrical, mechanical or other form.

Other embodiments of the present application will be apparent to those skilled in the art from consideration of the specification and practice of the application disclosed herein. This application is intended to cover any variations, uses, or adaptations of the invention following, in general, the principles of the application and including such departures from the present disclosure as come within known or customary practice within the art to which the invention pertains. It is intended that the specification and examples be considered as exemplary only, with a true scope and spirit of the application being indicated by the following claims.

It will be understood that the present application is not limited to the precise arrangements described above and shown in the drawings and that various modifications and changes may be made without departing from the scope thereof. The scope of the application is limited only by the appended claims.

Claims

1. A data security calling method is characterized by comprising the following steps:

receiving target data and acquiring storage information of the target data, wherein the storage information represents the data use of the target data;

storing the target data to a corresponding target storage position based on the storage information, and generating formatted data;

and acquiring the formatted data, and executing the corresponding target application based on the formatted data.

2. The method of claim 1, wherein the stored information comprises a data type of the target data; the storing the target data to a corresponding target storage location based on the storage information, and generating formatted data, including:

determining a corresponding target storage position according to the data type of the target data;

and storing the target data to the target storage position to generate the formatted data.

3. The method of claim 2, wherein the target data comprises sensor data, and determining a corresponding target storage location based on a data type of the target data comprises:

determining storage demand information according to the data type of the sensor data, wherein the storage demand information represents the unit time storage amount for storing the sensor data;

and determining a corresponding target storage position according to the storage demand information, wherein the target storage position is a cloud storage medium or a local storage medium.

4. The method of claim 1, further comprising:

encrypting the target data based on the storage information to generate encrypted data;

the storing the target data to a corresponding target storage location based on the storage information, and generating formatted data, including:

and storing the encrypted data to a corresponding target storage position based on the storage information to generate the formatted data.

5. The method of claim 4, wherein encrypting the target data based on the storage information to generate encrypted data comprises:

determining a corresponding target encryption algorithm according to the storage information, wherein the storage information and the complexity of the encryption algorithm have a preset mapping relation;

and encrypting the target data based on the target encryption algorithm to generate encrypted data.

6. The method of claim 1, further comprising:

acquiring running environment information of the target application, wherein the running environment information represents the security level of a communication network used by the target application during running;

and storing the target data to a corresponding target storage position according to the running environment information and the storage information of the target application to generate the formatted data.

7. The method of claim 6, wherein the storing the target data to a corresponding target storage location according to the running environment information and the storage information of the target application, and generating the formatted data comprises:

if the operating environment information represents a high safety level, storing target data to a target storage position of a vehicle end according to the storage information;

and if the operating environment information represents a low security level, storing and uploading target data to a target storage position of a cloud according to the storage information.

8. The method according to any one of claims 1-7, wherein said obtaining said formatted data and executing a corresponding target application based on said formatted data comprises:

determining a target data type required for running the target application;

requesting the formatted data based on the target data type to obtain target formatted data belonging to the target data type;

executing the target application based on the target formatted data.

9. A data security call apparatus, comprising:

10. An electronic device, comprising: a processor, and a memory communicatively coupled to the processor;

the memory stores computer-executable instructions;

the processor executes the memory-stored computer-executable instructions to implement the data security call method of any of claims 1 to 8.

11. A computer-readable storage medium having computer-executable instructions stored thereon, which when executed by a processor, implement the data security call method of any one of claims 1 to 8.