CN117978454A - Vehicle SOA service authentication mechanism - Google Patents

Abstract

The invention discloses a vehicle SOA service authentication mechanism, which relates to the technical field of vehicle SOA service and comprises a generation mechanism authentication system, wherein an authentication application adding module, a white list construction module, a cache backup module and a double-end control module are arranged to provide selectable authority control for all service publishers and subscribers by using a white list mode.

Description

A vehicle SOA service authentication mechanism

Technical Field

The present invention relates to the technical field of vehicle SOA services, and in particular to a vehicle SOA service authentication mechanism.

Background technique

With the development of software-defined cars, the current EEA of vehicles adopts the SOA architecture. There are usually thousands of SOA service matrices defined on a car, including the processing of some sensitive operations. However, the current SOA architecture lacks an authentication mechanism for service provision and subscription, which makes it easy to encounter malicious attacks, data sniffing and other crises.

In the prior art, it is easy for illegal applications to subscribe and receive important data, or send malicious instructions, leading to crises. How to achieve SOA service publishing and subscription authority control, ensure that sensitive operations are not maliciously obtained, ensure that sensitive services resist DOS attacks, ensure that malicious SOA signals are not sent to endanger vehicle driving, improve vehicle network security protection capabilities, and reduce exposure points have become the focus of attention of automobile companies. Therefore, based on the above problems, the present invention needs to design a vehicle SOA service authentication mechanism to solve the above problems.

Therefore, the present application provides a vehicle SOA service authentication mechanism to solve one of the above technical problems.

Summary of the invention

The purpose of this application is to provide a vehicle SOA service authentication mechanism that can solve at least one of the above-mentioned technical problems. The specific solution is as follows:

According to the specific implementation mode of the present application, the purpose of the present application is to provide a vehicle SOA service authentication mechanism in order to solve the above-mentioned problem, which solves the problem mentioned in the background technology that it is easy for illegal applications to subscribe and receive important data, or send malicious instructions, leading to crises, and how to achieve SOA service publishing and subscription permission control, ensure that sensitive operations are not maliciously obtained, ensure that sensitive services resist DOS attacks, ensure that malicious SOA signals are not sent to endanger vehicle driving, improve vehicle network security protection capabilities, and reduce exposure points.

In order to solve the above problems, the present invention provides a technical solution:

A vehicle SOA service authentication mechanism includes the following specific steps:

S1. Generate a mechanism authentication system that provides optional permission control for all service publishers and subscribers by using a whitelist approach;

S2. Add a separate application device to be responsible for authentication operations, modify the static library that originally uses someip communication, and embed the authentication process in its subscription and publication;

S3. Both configuring SOA services and subscribing to SOA services based on the someip protocol need to be applied for in advance. A whitelist will be constructed with the application identifier and the published and subscribed service information. After power-on, the newly added authentication application module will be started first and the whitelist will be initialized to perform a process execution operation.

As a preferred technical solution, after the whitelist policy is preferentially started and initialized in step S3, other SOA service users need to obtain permission through the authentication application before publishing or subscribing to services. If they pass, they will be allowed. If they fail, a specific service error code information will be returned.

As a preferred technical solution, the static library of someip communication in step S2 includes:

libsomeip;

libsomeip-xtf;

libsomeip-rtp.

As a preferred technical solution, the permissions in step S1 include access permissions, service permissions, security permissions, management permissions and audit permissions.

As a preferred technical solution, the access permission is used to read and submit vehicle data provided by related services, the service permission is used to authorize specific services, including positioning services, navigation services, and driving assistance services, the security permission is used to verify and tamper-proof data using digital signature technology, the management permission is used to manage and configure access policies and security policies, and the audit permission is used to view audit logs, including its own access logs and access logs of other vehicles or services.

As a preferred technical solution, the mechanism authentication system includes an authentication application adding module, a whitelist building module, a cache backup module and a dual-end control module, the output end of the authentication application adding module is communicatively connected to the input end of the whitelist building module, the output end of the whitelist building module is communicatively connected to the input end of the cache backup module, and the output end of the cache backup module is communicatively connected to the input end of the dual-end control module.

As a preferred technical solution, the authentication application adding module includes an application adding unit, an authentication application unit and an embedding management unit, the output end of the application adding unit is communicatively connected to the input end of the authentication application unit, the authentication application unit and the embedding management unit are bidirectionally communicatively connected, and the output end of the authentication application unit is communicatively connected to the input end of the whitelist building module;

The application adding unit is used to provide optional permission control for all service publishers and subscribers, formulate detailed access policies, ensure that vehicles can only access authorized services, and the content of optional permissions can be set and edited in advance;

The authentication application unit is used to modify the static library that originally used someip communication, and perform application authentication in its subscription and publication;

The embedded management unit is integrated inside the authentication application unit, and is used to embed the authentication process in its subscription and publication, and perform real-time supervision and processing on the entire process.

As a preferred technical solution, the whitelist construction module includes a whitelist update unit, a whitelist management model and a whitelist encryption unit, the output end of the whitelist management model is communicatively connected to the input end of the whitelist update unit, the whitelist update unit and the whitelist management model are bidirectionally communicatively connected to the whitelist encryption unit, and the output end of the whitelist update unit is communicatively connected to the input end of the cache backup module;

The whitelist update unit is used to synchronize and update the data of the real-time updated whitelist model, build a whitelist with the application identifier and the published and subscribed service information, and preferentially start and initialize the whitelist to perform a process execution operation;

The whitelist management model is used to generate a model for each authentication mechanism, and to continuously update and manage it;

The whitelist encryption unit is used to ensure that service requests and responses are encrypted during transmission by using the HTTPS protocol to prevent whitelist information leakage.

As a preferred technical solution, the cache backup module includes an internal cache unit and a data backup unit, the output end of the internal cache unit is communicatively connected to the input end of the data backup unit, and the output end of the internal cache unit is communicatively connected to the input end of the double-end control module;

The internal cache unit is used to reduce the interaction with the authentication application device within the cycle, thereby reducing frequent applications and the authentication static library has a cache mechanism;

The data backup unit is used to perform backup processing on all received data.

As a preferred technical solution, the double-end control module includes a publisher operation port and a subscriber operation port, and the publisher operation port and the subscriber operation port are bidirectionally connected;

The publisher operation port is used for the publisher to log in and access the internal authentication system of the mechanism, allowing adjustment and update according to real-time conditions, and formulating fine-grained access policies to ensure that only authorized vehicles can perform specific operations;

The subscriber operation port is used for the subscriber to log in and access the internal authentication system of the mechanism, and record the detailed information of each service access, including vehicle identification, access time, access results, etc., for easy tracking and review.

Compared with the prior art, the above solution of the embodiment of the present application has at least the following beneficial effects:

The present invention generates a complete mechanism authentication system by setting an authentication application adding module, a whitelist building module, a cache backup module and a double-end control module. When in use, optional permission control is provided for all service publishers and subscribers by using a whitelist method. An application device is added separately to be responsible for the authentication operation, and the original static library using someip communication is modified, and the authentication process is embedded in its subscription and publication. A whitelist is constructed together with the application identifier and the published and subscribed service information. When powered on, the newly added authentication application module will be started first and the whitelist will be initialized, and a process execution operation will be performed to manage, visualize and store the vehicle SOA service and the corresponding analysis results, which is helpful to realize the mechanism authentication operation of the vehicle SOA service through the Internet cloud management and control, improve the intelligent level of the mechanism authentication management, shorten the overall cumbersome process, facilitate the real-time management of the whole situation, ensure that no malicious SOA signal is sent to endanger the vehicle driving, improve the vehicle network security protection capability, and reduce the exposure points.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG1 shows a use case diagram of a vehicle SOA service authentication mechanism;

FIG2 shows a flow chart of a vehicle SOA service authentication mechanism.

Detailed ways

In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present application.

The terms used in the embodiments of the present application are only for the purpose of describing specific embodiments, and are not intended to limit the present application. The singular forms "a", "said" and "the" used in the embodiments of the present application and the appended claims are also intended to include plural forms, unless the context clearly indicates other meanings, and "multiple" generally includes at least two.

It should be understood that the term "and/or" used in this article is only a description of the association relationship of associated objects, indicating that there can be three relationships. For example, A and/or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character "/" in this article generally indicates that the associated objects before and after are in an "or" relationship.

It should be understood that, although the terms first, second, third, etc. may be used to describe in the embodiments of the present application, these descriptions should not be limited to these terms. These terms are only used to distinguish the descriptions. For example, without departing from the scope of the embodiments of the present application, the first may also be referred to as the second, and similarly, the second may also be referred to as the first.

As used herein, the words "if" and "if" may be interpreted as "at the time of" or "when" or "in response to determining" or "in response to detecting", depending on the context. Similarly, the phrases "if it is determined" or "if (stated condition or event) is detected" may be interpreted as "when it is determined" or "in response to determining" or "when detecting (stated condition or event)" or "in response to detecting (stated condition or event)", depending on the context.

It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a product or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such product or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the presence of other identical elements in the product or device including the elements.

It should be particularly noted that any symbols and/or numbers in the specification that are not marked in the accompanying drawings are not drawing marks.

The optional embodiments of the present application are described in detail below with reference to the accompanying drawings.

The embodiment provided in this application is an embodiment of a vehicle SOA service authentication mechanism.

As shown in Figures 1 and 2, this specific implementation adopts the following technical solutions:

A vehicle SOA service authentication mechanism includes the following specific steps:

S1. Generate a mechanism authentication system that provides optional permission control for all service publishers and subscribers by using a whitelist approach;

S2. Add a separate application device to be responsible for authentication operations, modify the static library that originally uses someip communication, and embed the authentication process in its subscription and publication;

S3. Both configuring SOA services and subscribing to SOA services based on the someip protocol need to be applied for in advance. A whitelist will be constructed with the application identifier and the published and subscribed service information. After power-on, the newly added authentication application module will be started first and the whitelist will be initialized to perform a process execution operation.

In this embodiment, after the whitelist policy is preferentially started and initialized in step S3, other SOA service users need to obtain permission through the authentication application before publishing or subscribing to services. If they pass, they will be allowed. If they fail, a specific service error code will be returned.

In this embodiment, the static library of someip communication in step S2 includes:

libsomeip;

libsomeip-xtf;

libsomeip-rtp.

In this embodiment, the permissions in step S1 include access permissions, service permissions, security permissions, management permissions, and audit permissions.

In this embodiment, the access rights are used to read and submit vehicle data provided by related services, the service rights are used to authorize specific services, including positioning services, navigation services, and driving assistance services, the security rights are used to verify and prevent tampering of data using digital signature technology, the management rights are used to manage and configure access policies and security policies, and the audit rights are used to view audit logs, including their own access logs and access logs of other vehicles or services.

In this embodiment, the mechanism authentication system includes an authentication application adding module, a whitelist building module, a cache backup module and a dual-end control module, the output end of the authentication application adding module is communicatively connected to the input end of the whitelist building module, the output end of the whitelist building module is communicatively connected to the input end of the cache backup module, and the output end of the cache backup module is communicatively connected to the input end of the dual-end control module.

In this embodiment, the authentication application adding module includes an application adding unit, an authentication application unit and an embedded management unit. The output end of the application adding unit is communicatively connected to the input end of the authentication application unit, the authentication application unit and the embedded management unit are bidirectionally communicatively connected, and the output end of the authentication application unit is communicatively connected to the input end of the whitelist construction module; the application adding unit is used to provide optional permission control for all service publishers and subscribers, formulate detailed access policies, ensure that vehicles can only access their authorized services, and the content of optional permissions can be set and edited in advance; the authentication application unit is used to modify the static library that originally used someip communication, and perform application authentication in its subscription and publication; the embedded management unit is integrated inside the authentication application unit, and the embedded management unit is used to embed the authentication process in its subscription and publication, and perform real-time supervision and processing of the entire process.

In this embodiment, the whitelist construction module includes a whitelist update unit, a whitelist management model and a whitelist encryption unit. The output end of the whitelist management model is communicatively connected to the input end of the whitelist update unit. The whitelist update unit and the whitelist management model are both bidirectionally communicatively connected to the whitelist encryption unit. The output end of the whitelist update unit is communicatively connected to the input end of the cache backup module. The whitelist update unit is used to synchronize and update the data of the real-time updated whitelist model, build a whitelist with the application identifier and the published and subscribed service information, and preferentially start and initialize the whitelist to perform a process execution operation. The whitelist management model is used to generate a model for the mechanism at each authentication, and continuously update and manage it. The whitelist encryption unit is used to ensure that service requests and responses are encrypted during the transmission process by using the HTTPS protocol to prevent leakage of whitelist information.

In this embodiment, the cache backup module includes an internal cache unit and a data backup unit, and the publisher operation port and the subscriber operation port are bidirectionally connected; the output end of the internal cache unit is communicatively connected to the input end of the data backup unit, and the output end of the internal cache unit is communicatively connected to the input end of the double-end control module; the internal cache unit is used to reduce the interaction with the authentication application device within the cycle, thereby reducing frequent applications and the authentication static library has a cache mechanism; the data backup unit is used to back up all received data.

In this embodiment, the dual-end control module includes a publisher operation port and a subscriber operation port. The publisher operation port is used for the publisher to log in and access the internal part of the mechanism authentication system, allowing adjustment and update according to real-time conditions, and formulating fine-grained access policies to ensure that only authorized vehicles can perform specific operations; the subscriber operation port is used for the subscriber to log in and access the internal part of the mechanism authentication system, recording detailed information of each service access, including vehicle identification, access time, access results, etc., for easy tracking and review.

Example 1

When the mechanism authentication system is connected to the vehicle SOA service management:

S1. Vehicle publishers and vehicle subscribers check the required equipment one by one, start the mechanism authentication system, and the application adding unit provides optional permission control for all service publishers and subscribers by using a whitelist. The permissions include access rights, service rights, security rights, management rights, and audit rights. Access rights read and submit vehicle data provided by related services. Service rights are authorized for specific services, including positioning services, navigation services, and driving assistance services. Security rights use digital signature technology to verify and prevent tampering of data. Management rights manage and configure access policies and security policies. The audit rights are used to view audit logs, including their own access logs and access logs of other vehicles or services.

S2. Add an application device to be responsible for the authentication operation. The authentication application unit modifies the static library that originally uses someip communication, performs application authentication in its subscription and publication, and embeds the authentication process in its subscription and publication by the embedded management unit. The entire process is supervised in real time, and the authentication process is embedded in its subscription and publication.

S3. Both SOA service configuration and SOA service subscription based on someip protocol need to be applied in advance. The whitelist management model generates a model for each authentication mechanism, and continuously updates and manages it. The whitelist update unit synchronizes and updates the real-time updated whitelist model, and builds a whitelist with the application identifier and the published and subscribed service information. When powered on, the newly added authentication application module will be started first and initialize the whitelist. When other SOA service users publish or subscribe to services, they need to obtain permissions through the authentication application first. Only if they pass will they be allowed. If they fail, the specific service error code information will be returned to perform a process execution operation. The whitelist encryption unit uses the HTTPS protocol to ensure that service requests and responses are encrypted during transmission to prevent whitelist information leakage. The cache unit reduces the interaction with the authentication application device within the cycle to reduce frequent applications and the authentication static library has a cache mechanism. The data backup unit backs up all received data.

The table of optional permissions is as follows:

The static library content table of someip communication is as follows:

Example 2

When the mechanism authentication system is connected to the facial identity data management:

S1. The person who publishes the facial identity data detects the required devices one by one and starts the mechanism authentication system. The application adding unit provides optional permission control for all service publishers and subscribers by using the whitelist method. The permissions include access permission, service permission, security permission, management permission and audit permission. The access permission reads and submits the vehicle data provided by the relevant services. The service permission is authorized for specific services, including positioning services, navigation services, and driving assistance services. The security permission uses digital signature technology to verify and prevent tampering of the data. The management permission manages and configures the access policy and security policy. The audit permission is used to view the audit log, including its own access log and the access log of other vehicles or services.

S2. The person who publishes facial identity data adds an application device to be responsible for the authentication operation. The authentication application unit modifies the static library that originally uses someip communication, performs application authentication in its subscription and publication, and the embedded management unit embeds the authentication process in its subscription and publication, performs real-time supervision and processing on the entire process of facial identity data authentication, and embeds the authentication process in its subscription and publication;

S3. The whitelist management model generates a model for each authentication mechanism, and continuously updates and manages it. The whitelist update unit synchronizes and updates the real-time updated whitelist model, and builds a whitelist with the application identifier and the published and subscribed service information. When powered on, the newly added authentication application module will be started first and the whitelist will be initialized. When other users publish or subscribe to facial identity data authentication, they need to obtain permission through the authentication application first. If they pass, they will be allowed. If they fail, the specific service error code information will be returned to perform a process execution operation. The whitelist encryption unit uses the HTTPS protocol to ensure that service requests and responses are encrypted during transmission to prevent whitelist information leakage. The cache unit reduces the interaction with the authentication application device within the cycle to reduce frequent applications and the authentication static library has a cache mechanism. The data backup unit backs up all received data.

specific:

In actual applications, there are multiple double-end control modules, which are used in conjunction with the authentication application adding module, the whitelist building module, and the cache backup module. The multiple double-end control modules are located in different geographical locations. The vehicle publisher and the vehicle subscriber detect the required equipment one by one and start the mechanism authentication system. The application adding unit provides optional permission control for all service publishers and subscribers by using the whitelist method. The permissions include access permissions, service permissions, security permissions, management permissions, and audit permissions. Access permissions read and submit vehicle data provided by related services. Service permissions are authorized for specific services, including positioning services, navigation services, and driving assistance services. Security permissions use digital signature technology to verify and tamper-proof data. Management permissions manage and configure access policies and security policies. The audit authority is used to view audit logs, including its own access logs and the access logs of other vehicles or services; a separate application device is added to be responsible for authentication operations, the authentication application unit modifies the static library that originally used someip communication, and performs application authentication in its subscription and publication, and the embedded management unit embeds the authentication process in its subscription and publication, and performs real-time supervision and processing on the entire process, and embeds the authentication process in its subscription and publication; both the configuration of SOA services and the subscription of SOA services based on the someip protocol need to be applied in advance, the whitelist management model generates a model for each authentication mechanism, and continuously updates and manages it, the whitelist update unit synchronizes and updates the real-time updated whitelist model, and will build a whitelist with the application identifier and the published and subscribed service information. When powered on, the new The authentication application module will be started first and the whitelist will be initialized. When other SOA service users publish or subscribe to services, they need to obtain permissions through the authentication application first. Only if they pass will they be allowed. If they fail, an error code will be returned to the specific service to perform a process execution operation. The whitelist encryption unit uses the HTTPS protocol to ensure that service requests and responses are encrypted during the transmission process to prevent whitelist information leakage. The cache unit reduces the interaction with the authentication application device within the cycle to reduce frequent applications and the authentication static library has a cache mechanism. The data backup unit backs up all received data. The present invention generates a complete mechanism authentication system by setting an authentication application adding module, a whitelist building module, a cache backup module and a dual-end control module. When in use, all services are backed up by using the whitelist method. Both publishers and subscribers provide optional permission control. By adding a separate application device to be responsible for authentication operations, modifying the original static library that uses someip communication, embedding the authentication process in its subscription and publication, and building a whitelist with application identification and published and subscribed service information, when powered on, the newly added authentication application module will be started first and initialize the whitelist, perform a process execution operation, manage, visualize and store the vehicle SOA service and the corresponding analysis results, which helps to realize the mechanism authentication operation of the vehicle SOA service through Internet cloud management and control, improve the intelligence level of mechanism authentication management, shorten the overall cumbersome process, facilitate real-time management of the global situation, ensure that malicious SOA signals are not sent to endanger vehicle driving, improve vehicle network security protection capabilities, and reduce exposure points.

Those of ordinary skill in the art will appreciate that the modules and method steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the above-described devices, equipment and modules can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

In several embodiments provided in this application, it should be understood that the disclosed devices, systems and methods may be implemented in other ways.

For example, the system embodiments described above are merely illustrative;

For example, the division of the modules is only a logical function division, and there may be other division methods in actual implementation, such as multiple modules or units can be combined or integrated into another device, or some features can be ignored or not executed.

Another point is that the mutual coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interface, device or equipment, which may be electrical, mechanical or other forms.

The modules for adding authentication applications, building a whitelist, backing up cache, and controlling both ends may or may not be physically separated, and the components displayed as modules may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

In addition, each functional module in each embodiment of the present invention may be integrated into one processing module, or each module may exist physically separately, or two or more modules may be integrated into one module.

If the functions are implemented in the form of software function modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only storage server, random access storage server, disk or optical disk, and other media that can store program instructions.

In addition, it should be noted that the combination of the various technical features in this case is not limited to the combination described in the claims of this case or the combination described in the specific embodiments. All technical features recorded in this case can be freely combined or combined in any way unless there is a contradiction between them.

It should be noted that the above examples are only specific embodiments of the present invention. Obviously, the present invention is not limited to the above examples, and there are many similar variations. All variations that can be directly derived or associated with the contents disclosed by those skilled in the art should fall within the protection scope of the present invention.

The above are only preferred embodiments of the present invention and are not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention. The above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, a person of ordinary skill in the art should understand that the technical solutions described in the aforementioned embodiments can still be modified, or some of the technical features can be equivalently replaced. These modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims (10)

1. The vehicle SOA service authentication mechanism is characterized by comprising the following specific steps:

s1, a generation mechanism authentication system provides selectable rights control for all service publishers and subscribers by using a white list mode;

S2, an application device is added separately to take charge of authentication operation, a static library which is originally communicated by someip is modified, and an authentication flow is embedded in subscription and release of the static library;

S3, configuring the SOA service and subscribing the SOA service based on someip protocols, applying in advance, constructing a white list together with the application identifier and the published and subscribed service information, and after powering on, preferentially starting and initializing the white list by the newly added authentication application module to perform one-time flow execution operation.

2. The vehicle SOA service authentication mechanism as claimed in claim 1, wherein: in step S3, after the white list policy is preferentially started and initialized, when other SOA service users perform service publishing or subscribing, the authority needs to be acquired through the authentication application, and the authority is allowed only after the authority passes, and the authority does not pass and returns to the specific service error code information.

3. The vehicle SOA service authentication mechanism as claimed in claim 1, wherein: the static library for someip communications in step S2 includes: libsomeip; libsomeip-xtf; libsomeip-rtp.

4. The vehicle SOA service authentication mechanism as claimed in claim 1, wherein: the rights in step S1 include access rights, service rights, security rights, management rights, and audit rights.

5. The vehicle SOA service authentication mechanism as claimed in claim 4, wherein: the access rights are used for reading vehicle data provided by related service, the service rights are used for authorizing specific service, including positioning service, navigation service and driving auxiliary service, the safety rights are used for verifying and tamper-proofing the data by using digital signature technology, the management rights are used for managing and configuring access strategies and safety strategies, and the audit rights are used for checking audit logs, including access logs of the vehicle and access logs of other vehicles or services.

6. The vehicle SOA service authentication mechanism as claimed in claim 1, wherein: the mechanism authentication system comprises an authentication application adding module, a white list constructing module, a cache backup module and a double-end control module, wherein the output end of the authentication application adding module is in communication connection with the input end of the white list constructing module, the output end of the white list constructing module is in communication connection with the input end of the cache backup module, and the output end of the cache backup module is in communication connection with the input end of the double-end control module.

7. The vehicle SOA service authentication mechanism as claimed in claim 6, wherein:

The authentication application adding module comprises an application adding unit, an authentication application unit and an embedded management unit;

The application adding unit is used for providing optional rights control for all service publishers and subscribers, and making detailed access strategies to ensure that the vehicle can only access the authorized services;

The authentication application unit is used for modifying the static library which is originally communicated by someip, and carrying out application authentication in subscription and release;

The embedded management unit is integrated inside the authentication application unit and is used for embedding an authentication process in subscription and release of the authentication process and performing real-time supervision processing on the whole process.

8. The vehicle SOA service authentication mechanism as claimed in claim 6, wherein:

The white list construction module comprises a white list updating unit, a white list management model and a white list encryption unit;

The white list updating unit is used for carrying out data synchronization and updating on the white list model updated in real time, constructing a white list together with the application identifier and the published and subscribed service information, and preferentially starting and initializing the white list to carry out one-time flow execution operation;

the white list management model is used for generating a model for each authentication mechanism and continuously updating and managing the model;

the white list encryption unit is used for ensuring that service requests and responses are encrypted in the transmission process by using an HTTPS protocol, and preventing white list information from being leaked.

9. The vehicle SOA service authentication mechanism as claimed in claim 6, wherein:

The cache backup module comprises an internal cache unit and a data backup unit;

The internal caching unit is used for reducing frequent application and caching mechanism of the authentication static library by reducing interaction between the internal caching unit and the authentication application equipment in a period;

The data backup unit is used for carrying out backup processing on all received data.

10. The vehicle SOA service authentication mechanism as claimed in claim 6, wherein:

the double-end control module comprises a publisher operation port and a subscriber operation port;

The publisher operation port is used for a publisher to log in and access the inside of the mechanism authentication system, and allows adjustment and update according to real-time conditions;

the subscriber operation port is used for logging in and accessing the inside of the mechanism authentication system by the subscriber and recording the detailed information of each service access.