# US 12,603,866 B2 · Security architecture and system for central gateway, and storage medium

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,603,866 B2
- Document ID: US12603866B2
- Status: Granted
- Kind: B2
- Application number: 18/706,110
- Filed: 2022-08-11
- Published: 2024-12-19
- Granted: 2026-04-14
- Earliest claimed: 2021-12-29
- Assignees: Beijing National New Energy Vehicle Technology Innovation Co. Ltd
- Applicants: Beijing National New Energy Vehicle Technology Innovation Center Co., Ltd.
- Inventors: Qiuxia Li; Chengyin Yuan
- Web page: https://patentgrep.com/patent/US12603866B2

## CPC

- G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database}
- H04L 63/029: {Firewall traversal, e.g. tunnelling or, creating pinholes}
- H04L 9/40: Network security protocols
- H04L 12/66: Arrangements for connecting between networks having differing types of switching systems, e.g. gateways
- H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload}
- H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)}
- H04L 67/12: specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

The present disclosure relates to the technical field of intelligent gateway security, in particular to a security architecture and system for a central gateway, and a storage medium. The security architecture includes an application security layer, a data security layer, a network security layer, a node security layer, an identity and authentication management layer, and a security operation and maintenance layer; wherein the application security layer is used to ensure the security of application software; the data security layer is used to ensure the security of data passing through a central gateway; the security of in-vehicle and out-vehicle network communication of the central gateway is ensured by the network security layer; the node security layer is a support carrier for the application security layer, the data security layer, and the network security layer; and the identity and authentication management layer and the security operation and maintenance layer are both applied to the application security layer, the data security layer, the network security layer, and the node security layer. The central gateway is not only a simple data exchange center, but also has data and computing power, and provides common functions of a sharing service, central management, central control, and the like for a complete vehicle; and the central gateway in the present disclosure has double-layer protection of local data security and data transmission security.

## Claims

### Claim 1

A security system for a central gateway, comprising an application security layer, a data security layer, a network security layer, a node security layer, an identity and authentication management layer, and a security operation and maintenance layer;
wherein the application security layer is configured to ensure security of application software; after the security of the application software is determined, the data security layer is used to ensure security of data passing through the central gateway; after it is confirmed that the data is secure, security of in-vehicle and out-vehicle network communication of the central gateway is ensured by the network security layer; the node security layer is a support carrier for the application security layer, the data security layer, and the network security layer; and the identity and authentication management layer and the security operation and maintenance layer are both applied to the application security layer, the data security layer, the network security layer, and the node security layer,
wherein the application security layer comprises software embodied on a non-transitory computer-readable storage medium for implementing the following steps:
managing, via an access control module, application and access permissions of the application software;
encrypting, via an application encryption module, the application software;
detecting, via an intrusion detection module, intrusion data information of the application software;
diagnosing, via a security diagnosis module, the security of the application software;
auditing, via an application security audit module, the security of the application software;
hardening and patching, via a software hardening and patching module, the application software;
managing, via a security configuration management module, a security configuration of the application software; and
providing, via a WEB application firewall module, a firewall for a WEB application.

### Claim 2 (depends on 1)

The security system for a central gateway according to claim 1, wherein the data security layer comprises software embodied on the non-transitory computer-readable storage medium for implementing the following steps:
isolating, via a data isolation module, the data;
preventing, via a data tampering prevention module, tampering of the data;
backing up, via a data backup module, the data;
encrypting, via a data encryption module, the data and a data transmission process;
protecting, via a privacy protection module, privacy of the data;
controlling, via a data access control module, a permission to access the data; and
preventing, via a data leakage prevention module, leakage of the data.

### Claim 3 (depends on 1)

The security system for a central gateway according to claim 1, wherein the network security layer comprises software embodied on the non-transitory computer-readable storage medium for implementing the following steps:
encrypting, via a transmission encryption module, transmission of the data;
auditing, via a traffic audit module, traffic;
authenticating, via a security onboard communication (SecOC) module in-vehicle sensitive information;
detecting, via a message detection module, network message;
providing, via a firewall module, a firewall for a network;
detecting, via an intrusion prevention system/intrusion detection system (IPS/IDS) module, network intrusion and/or prevent intrusion;
protecting, via a distributed denial of service (DDoS) attack protection module, a DDoS attack of the network; and
establishing, via a virtual private network (VPN) module, a private network on the network for encrypted communication.

### Claim 4 (depends on 1)

The security system for a central gateway according to claim 1, wherein the node security layer comprises software embodied on the non-transitory computer-readable storage medium for implementing the following steps:
remotely upgrading, via a remote upgrade module, the software of the central gateway and fix vulnerabilities and patches;
establishing, via a lightweight trusted computing module, a lightweight trusted computing platform of the central gateway;
protecting, via an external port protection module, security of an external port of the central gateway;
encrypting, via a hardware encryption module, hardware of the central gateway;
securely booting, via a secure boot module, the central gateway;
protecting, via a side channel attack protection module, a side channel attack of the central gateway;
hardening, via a software hardening and security configuration module, the software of the central gateway and performing security configuration; and
ensuring, via a secure storage module, security of stored data in the central gateway.

### Claim 5 (depends on 1)

The security system for a central gateway according to claim 1, wherein the identity and authentication management layer comprises software embodied on the non-transitory computer-readable storage medium for implementing the following steps:
ensuring, via a centralized certificate management module and a key management module, the security of the application security layer, the data security layer, the network security layer, and the node security layer.

### Claim 6 (depends on 1)

The security system for a central gateway according to claim 1, wherein the security operation and maintenance layer comprises software embodied on the non-transitory computer-readable storage medium for implementing the following steps:
ensuring, via an operation and maintenance monitoring module, an emergency response module, and a security log module, monitoring and security of the application security layer, the data security layer, the network security layer, and the node security layer.

### Claim 7 (depends on 1)

A security system for a central gateway of an intelligent vehicle, comprising:
a memory configured to store an executable instruction; and
a processor configured to run the executable instruction stored in the memory to implement the security architecture for a central gateway according to claim 1.

### Claim 8 (depends on 1)

A non-transitory computer-readable storage medium storing an executable instruction, wherein the executable instruction, when executed by a processor, implements the security system for a central gateway according to claim 1.

### Claim 9

A method for ensuring security of application software running on a central gateway, comprising an application security layer, a data security layer, a network security layer, a node security layer, an identity and authentication management layer, and a security operation and maintenance layer, the method comprising:
after the security of the application software is determined, ensuring, via the data security layer, security of data passing through the central gateway;
after the data security layer confirms that the data is secure, ensuring, via the network security layer, security of in-vehicle and out-vehicle network communication of the central gateway, wherein the node security layer is a support carrier for the application security layer, the data security layer, and the network security layer, and the identity and authentication management layer and the security operation and maintenance layer are both applied to the application security layer, the data security layer, the network security layer, and the node security layer;
managing, via an access control module, application and access permissions of the application software;
encrypting, via an application encryption module, the application software;
detecting, via an intrusion detection module, intrusion data information of the application software;
diagnosing, via a security diagnosis module, the security of the application software;
auditing, via an application security audit module, the security of the application software;
hardening and patching, via a software hardening and patching module, the application software;
managing, via a security configuration management module, a security configuration of the application software; and
providing, via a WEB application firewall module, a firewall for a WEB application.

### Claim 10 (depends on 9)

The method according to claim 9, further comprising:
isolating, via a data isolation module, the data;
preventing, via a data tampering prevention module, tampering of the data;
backing up, via a data backup module, the data;
encrypting, via a data encryption module, the data and a data transmission process;
protecting, via a privacy protection module, privacy of the data;
controlling, via a data access control module, a permission to access the data; and
preventing, via a data leakage prevention module, leakage of the data.

### Claim 11 (depends on 9)

The method according to claim 9, further comprising:
encrypting, via a transmission encryption module, transmission of the data;
auditing, via a traffic audit module, traffic;
authenticating, via a security onboard communication (SecOC) module in-vehicle sensitive information;
detecting, via a message detection module, a network message;
providing, via a firewall module, a firewall for a network;
detecting, via an intrusion prevention system/intrusion detection system (IPS/IDS) module, network intrusion and/or prevent intrusion;
protecting, via a distributed denial of service (DDoS) attack protection module, a DDoS attack of the network; and
establishing, via a virtual private network (VPN) module, a private network on the network for encrypted communication.

### Claim 12 (depends on 9)

The method according to claim 9, further comprising:
remotely upgrading, via a remote upgrade module, the software of the central gateway and fix vulnerabilities and patches;
establishing, via a lightweight trusted computing module, a lightweight trusted computing platform of the central gateway;
protecting, via an external port protection module, security of an external port of the central gateway;
encrypting, via a hardware encryption module, hardware of the central gateway;
securely booting, via a secure boot module, the central gateway;
protecting, via a side channel attack protection module, a side channel attack of the central gateway;
hardening, via a software hardening and security configuration module, the software of the central gateway and performing security configuration; and
ensuring, via a secure storage module, security of stored data in the central gateway.

### Claim 13 (depends on 9)

The method according to claim 9, further comprising:
ensuring, via a centralized certificate management module and a key management module, the security of the application security layer, the data security layer, the network security layer, and the node security layer.

### Claim 14 (depends on 9)

The method according to claim 9, further comprising:
ensuring, via an operation and maintenance monitoring module, an emergency response module, and a security log module, monitoring and security of the application security layer, the data security layer, the network security layer, and the node security layer.

### Claim 15 (depends on 9)

A security system for a central gateway of an intelligent vehicle, comprising:
a memory configured to store an executable instruction; and
a processor configured to run the executable instruction stored in the memory to implement the security architecture for a central gateway according to claim 9.

### Claim 16 (depends on 9)

A non-transitory computer-readable storage medium storing an executable instruction, wherein the executable instruction, when executed by a processor, implements the security system for a central gateway according to claim 9.