Over-the-air upgrade methods, systems, computer devices, and vehicles

Abstract

The system generates a first software upgrade count to record the number of software upgrades, a software upgrade rollback flag indicating whether it is a lower version software upgrade task, upgrade information required by the vehicle, encrypted upgrade information, and a software upgrade package. After the vehicle decides to upgrade to a lower version software according to the software upgrade rollback flag, it decrypts the transmitted encrypted upgrade information to obtain new upgrade information. Based on the relationship between the first and second software upgrade counts and the correspondence between the new upgrade information and the upgrade information, it authorizes the upgrade and, after determining that the over-the-air upgrade is legitimate, it upgrades to the lower version software.

Description

Technical Field

[0001] This application claims the priority of a Chinese patent application filed with the China National Intellectual Property Administration on May 30, 2024, with an application number of 202410688373.6 and a title of "Over-the-Air Upgrade Method, System, Computer Device, and Vehicle", and the entire content thereof is incorporated herein by reference.

[0002] This application relates to the technical field of over-the-air upgrade, and specifically to an over-the-air upgrade method, system, computer device, and vehicle.

Background Art

[0003] With the rapid development of smart connected cars, in order to quickly occupy the market and achieve rapid iteration of functions, a common approach in the industry is to secure the reserved resources of hardware and then achieve iterative upgrades of smart functions and rapid correction of vulnerabilities through rapid over-the-air (OTA) upgrades. However, in the process of OTA upgrades, there are problems such as insufficient software quality, insufficient testing, instability of new versions, and incompatibility between the upgraded version and other parts of the vehicle. Therefore, while there is a business need to roll back to a lower version in OTA upgrade operations, according to the analysis of information security risks, hackers can illegally utilize the need for the system to permit upgrades to lower versions, maliciously and illegally upgrade to a version with vulnerabilities that has been officially released, and further use this vulnerability to attack the vehicle.

[0004] Currently, encryption during the OTA upgrade process often resolves the issues of protecting the legitimacy, integrity, and confidentiality of upgrade packages. However, regarding the security vulnerabilities that may arise when users upgrade to older versions of software, it is often impossible to satisfy the user's need to upgrade to older versions while simultaneously avoiding the security vulnerabilities that may result from such upgrades. [Overview of the project] [Problems that the invention aims to solve]

[0005] In view of the above circumstances, the present invention provides an over-the-air upgrade method, system, computer device, and vehicle to solve the problem that conventional methods cannot ensure system security when a user upgrades to a lower version of software. [Means for solving the problem]

[0006] In the first aspect, the present application applies to the network side. The steps include generating a software upgrade key and sending the software upgrade key to the vehicle, After receiving a software upgrade task sent from the vehicle, the first software upgrade count is updated, it is detected whether the software upgrade task is a lower version software upgrade task, and a software upgrade rollback flag is obtained. The steps include: encrypting upgrade information, including the first software upgrade count, using a software upgrade key, and generating encrypted upgrade information; The present invention provides an over-the-air upgrade method that includes the steps of: transmitting upgrade information, encrypted upgrade information, a software upgrade rollback flag, and a software upgrade package corresponding to a software upgrade task to the vehicle side so that the vehicle side decides to upgrade to a lower version of the software according to the software upgrade rollback flag; decrypting the encrypted upgrade information according to the software upgrade key to obtain new upgrade information and a first software upgrade count; determining that the over-the-air upgrade is valid according to the relationship between the first software upgrade count and a second software upgrade count stored therein, and the correspondence between the new upgrade information and the upgrade information; and then upgrading to a lower version of the software using the software upgrade package.

[0007] By utilizing the network side to generate a first software upgrade count to record the number of software upgrades, a software upgrade rollback flag indicating whether it is a lower version software upgrade task, upgrade information required on the vehicle side, encrypted upgrade information, and a software upgrade package, the vehicle side, after deciding to upgrade to a lower version software according to the software upgrade rollback flag, decrypts and authorizes the encrypted upgrade information sent from the network side, and after determining that the over-the-air upgrade is legitimate, upgrades to the lower version software using the software upgrade package, thereby guaranteeing the security and legitimacy of the upgrade when the user upgrades to a lower version software.

[0008] In one selectable embodiment, the software upgrade key includes a software upgrade master key, the upgrade information further includes software information and authentication information for upgrade authentication, the encrypted upgrade information includes encrypted authentication information, and the step of encrypting the upgrade information, including the first software upgrade count, by the software upgrade key and generating the encrypted upgrade information is: The first step is to generate authentication information based on the number of software upgrades, A step of performing symmetric encryption on software information using a software upgrade master key to obtain a rollback operation key, wherein the software information is generated according to the software upgrade version corresponding to the software upgrade task, the current software version, and the software upgrade rollback flag. This includes the step of performing symmetric encryption on the authentication information using a rollback business key to obtain encrypted authentication information.

[0009] This improves transmission security by encrypting the authentication information when generating and sending it to the vehicle for upgrade authentication.

[0010] In one selectable embodiment, the step of sending upgrade information, encrypted upgrade information, a software upgrade rollback flag, and a software upgrade package corresponding to a software upgrade task to the vehicle side is: The process includes sending software information, authentication information, encrypted authentication information, a software upgrade rollback flag, and a software upgrade package corresponding to the software upgrade task to the vehicle, after which the vehicle decides to upgrade to a lower version of the software according to the software upgrade rollback flag, decrypts the encrypted authentication information according to the software upgrade master key and software information, extracts the first software upgrade count based on the decrypted new authentication information, determines that the over-the-air upgrade is valid according to the relationship between the first software upgrade count and the second software upgrade count stored therein and the correspondence between the new authentication information and the authentication information, and then upgrades to the lower version of the software using the software upgrade package.

[0011] In one selectable embodiment, the steps of generating a software upgrade key and sending the software upgrade key to the vehicle are: After receiving the public key transmitted from the vehicle, the process involves generating a software upgrade master key and a transmission protection key. The steps include: performing asymmetric encryption on the transmission protection key using the public key to obtain the ciphertext transmission protection key; performing symmetric encryption on the software upgrade master key according to the ciphertext transmission protection key to obtain the ciphertext software upgrade master key; The process includes the steps of: transmitting a ciphertext software upgrade master key and a ciphertext transmission protection key to the vehicle, allowing the vehicle to decrypt the ciphertext transmission protection key using a private key corresponding to the public key to obtain a transmission protection key, and then decrypting the ciphertext software upgrade master key based on the transmission protection key to obtain a software upgrade master key.

[0012] This improves security by having the network generate a software upgrade master key, encrypt it, and send it to the vehicle, which then decrypts it to obtain the network's software upgrade master key.

[0013] In one selectable embodiment, the software upgrade key includes an asymmetric key pair consisting of a software upgrade public key and a software upgrade private key, the upgrade information further includes authentication information and digest authentication information for upgrade authentication, the encrypted upgrade information includes signature authentication information, and the step of generating encrypted upgrade information is to encrypt the upgrade information, including the first software upgrade count, using the software upgrade key. The first step is to generate authentication information based on the number of software upgrades, The process includes the steps of performing a digest operation on the authentication information to obtain digest authentication information, performing asymmetric encryption on the digest authentication information using a software upgrade secret key to obtain signed authentication information.

[0014] This improves transmission security by encrypting and digesting the authentication information when generating and sending the signature authentication information for upgrade authentication to the vehicle.

[0015] In one selectable embodiment, the step of sending upgrade information, encrypted upgrade information, a software upgrade rollback flag, and a software upgrade package corresponding to a software upgrade task to the vehicle side is: The process includes sending authentication information, signature authentication information, a software upgrade rollback flag, and a software upgrade package corresponding to the software upgrade task to the vehicle, after which the vehicle decides to upgrade to a lower version of the software according to the software upgrade rollback flag, decrypts the signature authentication information according to the software upgrade public key to obtain digest authentication information, performs a digest operation on the authentication information to obtain new digest authentication information, extracts the first software upgrade count from the authentication information, determines that the over-the-air upgrade is valid according to the relationship between the first software upgrade count and the second software upgrade count stored therein and the correspondence between the new digest authentication information and the digest authentication information, and then upgrades to the lower version of the software using the software upgrade package.

[0016] In one selectable embodiment, after receiving a software upgrade task transmitted from the vehicle, the steps include updating the first software upgrade count, detecting whether the software upgrade task is a lower version software upgrade task, and obtaining a software upgrade rollback flag. After receiving a software upgrade task, the process involves incrementing the first software upgrade count by one, and obtaining the software upgrade version and the current software version based on the software upgrade task. If it is detected that the software upgrade version is less than or equal to the current software version, the software upgrade task is determined to be a lower version software upgrade task, and the software upgrade rollback flag is set to 1. The process includes the step of determining that a software upgrade task is not a lower-version software upgrade task and setting the software upgrade rollback flag to 0 if it is detected that the software upgrade version is less than or equal to the current software version.

[0017] This allows the system to compare the software upgrade version with the current software version to determine whether the vehicle should attempt to upgrade to a lower version of the software, and then generate a software upgrade rollback flag to determine whether the vehicle should authorize the upgrade based on that flag.

[0018] In the second aspect, the present application applies to the vehicle side. The steps include receiving a software upgrade key sent from the network side, The steps include sending a software upgrade task to the network side and receiving upgrade information, encrypted upgrade information, a software upgrade rollback flag, and a software upgrade package corresponding to the software upgrade task from the network side, wherein the encrypted upgrade information is obtained by the network side encrypting upgrade information including the first software upgrade count using a software upgrade key, the first software upgrade count is obtained by the network side updating the current software upgrade count after receiving the software upgrade task, and the software upgrade rollback flag is obtained by the network side detecting whether the software upgrade task is an older version software upgrade task. After determining the upgrade to the lower version software according to the software upgrade rollback flag, decrypt the encrypted upgrade information according to the software upgrade key to obtain new upgrade information and the number of times of the first software upgrade stored on the network side, After determining that the over-the-air upgrade is legitimate according to the magnitude relationship between the number of times of the first software upgrade and the number of times of the second software upgrade stored in itself and the correspondence relationship between the new upgrade information and the upgrade information, upgrade the lower version software by the software upgrade package. The present invention provides an over-the-air upgrade method including the above steps.

[0019] By using the network side to record the number of times of software upgrade, the software upgrade rollback flag indicating whether it is a lower version software upgrade task, the upgrade information required on the vehicle side, generating the encrypted upgrade information and the software upgrade package, after determining the upgrade to the lower version software according to the software upgrade rollback flag, the vehicle side decrypts and authorizes the encrypted upgrade information sent from the network side, and after determining that the over-the-air upgrade is legitimate, upgrades the lower version software by the software upgrade package, thereby guaranteeing the security and legitimacy of the upgrade when the user upgrades to the lower version software.

[0020] In one selectable embodiment, the software upgrade key includes a software upgrade master key, the upgrade information further includes software information and authentication information for upgrade authentication, and the encrypted upgrade information includes encrypted authentication information. The step of receiving the upgrade information, encrypted upgrade information, software upgrade rollback flag, and software upgrade package corresponding to the software upgrade task fed back from the network side is including the step of receiving the software information, authentication information, encrypted authentication information, software upgrade rollback flag, and software upgrade package corresponding to the software upgrade task fed back from the network side, The step of decrypting the encrypted upgrade information according to the software upgrade key to obtain new upgrade information and the first software upgrade count stored on the network side is including the step of performing symmetric encryption on the software information according to the software upgrade master key to obtain a rollback service key, and the step of decrypting the encrypted authentication information with the rollback service key to obtain the new decrypted authentication information and extracting the first software upgrade count stored on the network side from the new authentication information.

[0021] By decrypting the encrypted information transmitted from the network side with the software upgrade master key, it is easy to determine the validity of subsequent over-the-air upgrades and improve the security of information transmission.

[0022] In one selectable embodiment, before upgrading the lower version software with the software upgrade package, the method includes the step of determining whether the new authentication information matches the authentication information when it is detected that the first software upgrade count is greater than the second software upgrade count. If it is detected that the new authentication information matches the existing authentication information, the over-the-air upgrade is deemed valid, the value of the first software upgrade count is assigned to the second software upgrade count, and the step of upgrading to the lower version software using the software upgrade package is performed. The process further includes a step of stopping the upgrade if it is detected that the new authentication information does not match the existing authentication information, or that the number of first software upgrades is less than or equal to the number of second software upgrades.

[0023] This allows for the determination of the relative number of first and second software upgrades, and the matching relationship between new authentication information and existing authentication information, thereby determining whether a lower-version upgrade is legitimate. This improves security during over-the-air upgrades and avoids security risks caused by security vulnerabilities in lower-version software.

[0024] In one selectable embodiment, after receiving a software upgrade key transmitted from the network side, the method, The steps include obtaining the software upgrade version and the current software version, comparing the software upgrade version and the current software version, and obtaining a software upgrade rollback flag to indicate whether or not it is a lower version software upgrade task. The steps include: determining an upgrade to a lower version based on the software upgrade rollback flag; performing symmetric encryption on the software upgrade version, the current software version, and the software upgrade rollback flag; obtaining a rollback operation key; and receiving authentication information for upgrade authentication, encrypted authentication information, and a software upgrade package entered offline by the user, wherein the authentication information, encrypted authentication information, and software upgrade package are obtained by the user from the network side. The process further includes the step of decrypting encrypted authentication information using a rollback business key to obtain new authentication information after decryption, and the step of performing subsequent steps.

[0025] In offline scenarios, this allows for legitimate upgrades to lower versions by receiving user-entered credentials, encrypted credentials, and software upgrade packages.

[0026] In one selectable embodiment, the software upgrade key includes an asymmetric key pair consisting of a software upgrade public key and a software upgrade private key, the upgrade information further includes authentication information and digest authentication information for upgrade authentication, and the encrypted upgrade information includes signature authentication information. The step of receiving upgrade information, encrypted upgrade information, a software upgrade rollback flag, and a software upgrade package corresponding to a software upgrade task, which are fed back from the network side, The step includes receiving authentication information, signature authentication information, a software upgrade rollback flag, and a software upgrade package corresponding to the software upgrade task, which are fed back from the network side. The step of decrypting encrypted upgrade information according to the software upgrade key to obtain new upgrade information and the first software upgrade count stored on the network side is: The process includes decrypting signature authentication information in accordance with the software upgrade public key transmitted from the network side to obtain digest authentication information, performing a digest operation on the authentication information to obtain new digest authentication information, and extracting the first software upgrade count from the authentication information.

[0027] This allows for the decryption of signature authentication information transmitted from the network side using the software upgrade public key, thereby facilitating the verification of the legitimacy of subsequent over-the-air upgrades and improving the security of information transmission.

[0028] In one selectable embodiment, before upgrading to a lower version of the software by a software upgrade package, the method If it is detected that the new digest authentication information matches the digest authentication information, the next step is to determine whether the number of first software upgrades is greater than the number of second software upgrades. If it is detected that the number of first software upgrades is greater than the number of second software upgrades, the over-the-air upgrade is deemed legitimate, the value of the first software upgrade count is assigned to the second software upgrade count, and the step of upgrading to a lower version of the software using a software upgrade package is performed. The procedure further includes a step of stopping the upgrade if it is detected that the number of first software upgrades is less than or equal to the number of second software upgrades, or if the new digest authentication information does not match the digest authentication information.

[0029] This allows for the determination of the relative magnitude of the number of first and second software upgrades, and the matching relationship between the new digest authentication information and the digest information. By determining whether a lower-version upgrade is legitimate, security during over-the-air upgrades is improved, and security risks due to security vulnerabilities in the lower-version software are avoided.

[0030] In one selectable embodiment, after receiving a software upgrade public key transmitted from the network side, the method, The steps include obtaining the software upgrade version and the current software version, comparing the software upgrade version and the current software version, and obtaining a software upgrade rollback flag to indicate whether or not it is a lower version software upgrade task. The following steps are performed: after deciding to upgrade to a lower version in accordance with the software upgrade rollback flag, receiving authentication information, signature authentication information, and a software upgrade package for upgrade authentication entered offline by the user, decrypting the signature authentication information in accordance with the software upgrade public key transmitted from the network side to obtain digest authentication information, and subsequent steps, wherein the authentication information, signature authentication information, and software upgrade package are obtained by the user from the network side.

[0031] In offline scenarios, this allows for legitimate upgrades to lower versions by receiving user-entered authentication information, signature credentials, and software upgrade packages.

[0032] In the third aspect, the present application includes the network side and the vehicle side, The network side generates a software upgrade key, transmits the software upgrade key to the vehicle, receives a software upgrade task transmitted from the vehicle, updates the first software upgrade count, detects whether the software upgrade task is a lower version software upgrade task, obtains a software upgrade rollback flag, encrypts the upgrade information including the first software upgrade count using the software upgrade key, generates encrypted upgrade information, and transmits the upgrade information, encrypted upgrade information, software upgrade rollback flag, and software upgrade package corresponding to the software upgrade task to the vehicle. The vehicle, after deciding to upgrade to a lower version of the software according to the software upgrade rollback flag, decrypts the encrypted upgrade information according to the software upgrade key to obtain new upgrade information and the first software upgrade count. After determining that the over-the-air upgrade is valid based on the relationship between the first software upgrade count and the second software upgrade count stored therein, and the correspondence between the new upgrade information and the upgrade information, it provides an over-the-air upgrade system used to upgrade to a lower version of the software using a software upgrade package.

[0033] By using the network to generate a first software upgrade count to record the number of software upgrades, a software upgrade rollback flag indicating whether it is a lower version software upgrade task, upgrade information required by the vehicle, encrypted upgrade information, and a software upgrade package, the vehicle decides to upgrade to a lower version of the software according to the software upgrade rollback flag, decrypts the encrypted upgrade information to obtain new upgrade information and the first software upgrade count, and determines that the over-the-air upgrade is legitimate according to the relationship between the first software upgrade count and the second software upgrade count stored therein, and the correspondence between the new upgrade information and the upgrade information, then upgrades to the lower version of the software using the software upgrade package, thereby guaranteeing the security and legitimacy of the upgrade when the user upgrades to a lower version of the software.

[0034] In a fourth aspect, the present invention provides a computer device comprising a first memory and a first processor, wherein the first memory and the first processor are communicated with each other, the first memory stores first computer instructions, and the first processor executes the first computer instructions to perform the over-the-air upgrade method in the first aspect or any one of the corresponding embodiments.

[0035] In a fifth aspect, the present invention provides a vehicle that includes a second memory and a second processor, the second memory and the second processor being communicated with each other, the second memory storing a second computer instruction, and the second processor executing a first computer instruction to perform the over-the-air upgrade method in the second aspect or any one of the corresponding embodiments. [Effects of the Invention]

[0036] The beneficial effects of this application are as follows: By using the network to generate a first software upgrade count to record the number of software upgrades, a software upgrade rollback flag indicating whether it is a lower version software upgrade task, upgrade information required by the vehicle, encrypted upgrade information, and a software upgrade package, the vehicle, after deciding to upgrade to a lower version software according to the software upgrade rollback flag, decrypts the encrypted upgrade information sent from the network to obtain new upgrade information, authorizes the upgrade based on the relationship between the first software upgrade count and the second software upgrade count stored within the vehicle, and the correspondence between the new upgrade information and the upgrade information, and after determining that the over-the-air upgrade is legitimate, it upgrades to the lower version software using the software upgrade package, thereby guaranteeing the security and legitimacy of the upgrade when the user upgrades to a lower version software.

[0037] To more clearly describe specific embodiments of the present application or technical solutions of the prior art, the drawings necessary for describing specific embodiments or the prior art will be briefly described below. As will be clear, the drawings described below are some embodiments of the present application, and those skilled in the art can obtain other drawings based on these without any creative work. [Brief explanation of the drawing]

[0038] [Figure 1] This is a structural block diagram of an over-the-air upgrade system according to an embodiment of the present invention. [Figure 2] This is a structural block diagram of another over-the-air upgrade system according to an embodiment of the present application. [Figure 3]This is a structural block diagram of yet another over-the-air upgrade system according to an embodiment of the present application. [Figure 4] This is a flowchart of an over-the-air upgrade method according to an embodiment of the present invention. [Figure 5] This is a flowchart of a symmetric authorization over-the-air online upgrade method according to an embodiment of the present application. [Figure 6] This is a flowchart of the symmetric authorization over-the-air offline upgrade method according to an embodiment of the present application. [Figure 7] This is a flowchart of an asymmetric authorization over-the-air online upgrade method according to an embodiment of the present application. [Figure 8] This is a flowchart of the asymmetric authorization over-the-air offline upgrade method according to an embodiment of the present application. [Figure 9] This is a schematic diagram of the hardware configuration of a computer device in an embodiment of the present invention. [Figure 10] This is a schematic diagram of the vehicle hardware configuration in the embodiment of the present invention. [Modes for carrying out the invention]

[0039] To further clarify the purpose, technical solutions, and advantages of the embodiments of this application, the technical solutions of the embodiments of this application will be described clearly and completely below with reference to the drawings of the embodiments of this application, and as will be obvious, the embodiments described are some embodiments of this application, not all embodiments. All other embodiments that a person skilled in the art can obtain without creative work based on the embodiments of this application are within the scope of protection of this application.

[0040] During the automotive software upgrade process, users have a need to upgrade to a lower version than their current software version. However, traditional methods of upgrading to a lower version can introduce security risks due to security vulnerabilities present in the lower version software. Therefore, permission management is necessary for legitimate upgrades to lower versions of software, thereby satisfying the need for users to voluntarily and legitimately upgrade to lower versions of software, while preventing other users from illegally upgrading to lower versions of software.

[0041] Accordingly, the embodiment of the present invention provides an over-the-air upgrade means that determines whether the over-the-air upgrade is legitimate based on dialogue information between the network side and the vehicle side, and the vehicle side upgrades to the lower version software after determining that the over-the-air upgrade is legitimate, thereby satisfying the user's need to upgrade to the lower version software while guaranteeing security and legitimacy.

[0042] According to embodiments of the present application, an over-the-air upgrade system is provided, as shown in Figure 1, which includes a network side 101 and a vehicle side 102. The network side 101 is a port that receives vehicle upgrade requests, such as a cloud server or an edge server, and the vehicle side 102 may be the vehicle, the vehicle's in-vehicle infotainment system, a controller, or client software installed in the vehicle, and embodiments of the present application are not limited thereto.

[0043] The network side 101 generates a software upgrade key, transmits the software upgrade key to the vehicle side 102, receives a software upgrade task transmitted from the vehicle side 102, updates the first software upgrade count, detects whether the software upgrade task is a lower version software upgrade task, obtains a software upgrade rollback flag, encrypts the upgrade information including the first software upgrade count using the software upgrade key, generates encrypted upgrade information, and transmits the upgrade information, encrypted upgrade information, software upgrade rollback flag, and software upgrade package corresponding to the software upgrade task to the vehicle side 102.

[0044] After the vehicle side 102 decides to upgrade to a lower version of the software according to the software upgrade rollback flag, it decrypts the encrypted upgrade information according to the software upgrade key to obtain new upgrade information and the first software upgrade count, and after determining that the over-the-air upgrade is valid according to the relationship between the first software upgrade count and the second software upgrade count stored therein and the correspondence between the new upgrade information and the upgrade information, it uses the software upgrade package to upgrade to the lower version of the software.

[0045] The over-the-air upgrade system according to the embodiment of the present invention utilizes the network side to generate a first software upgrade count that records the number of software upgrades, a software upgrade rollback flag indicating whether or not it is a lower version software upgrade task, upgrade information required on the vehicle side, encrypted upgrade information, and a software upgrade package. After the vehicle side decides to upgrade to a lower version of the software according to the software upgrade rollback flag, it decrypts the encrypted upgrade information to obtain new upgrade information and the first software upgrade count. After determining that the over-the-air upgrade is legitimate according to the relationship between the first software upgrade count and the second software upgrade count stored therein, and the correspondence between the new upgrade information and the upgrade information, it upgrades to the lower version of the software using the software upgrade package, thereby guaranteeing the security and legitimacy of the upgrade when the user upgrades to a lower version of the software.

[0046] In some selectable embodiments, as shown in Figure 2, the network side 101 includes an authentication unit 201 and an upgrade unit 202, and the vehicle side 102 includes a vehicle-side authorization unit 203 and a display and input unit 204.

[0047] Furthermore, upon receiving a software upgrade task, the upgrade unit 202 is required to perform a series of security operations on the software package, such as encryption and signing. Simultaneously, the vehicle-side authorization unit is required to protect the confidentiality and legitimacy of the upgrade package by employing operations such as decryption and signature verification. These processes are necessary for the security upgrade process, and details can be found in the descriptions of related technologies. Detailed explanations are omitted here, and the implementation steps of the embodiment of this application are carried out based on these processes.

[0048] As selectable, as shown in Figure 3, the authentication unit 201 mainly includes a key generation module 2011, a key storage module 2012, and an authentication module 2013. The key generation module 2011 is used to generate software upgrade keys such as a software upgrade master key and an asymmetric key pair consisting of a software upgrade public key and a software upgrade private key. The key storage module 2012 is used to store the software upgrade keys generated by the key generation module 2011. The authentication module 2013 is mainly used to encrypt the upgrade information and obtain encrypted upgrade information.

[0049] Referencing Figure 3 again, the vehicle-side authorization unit 203 mainly includes a vehicle-side key management module 2031, a vehicle-side key storage module 2032, and an authorization module 2033, which is used to determine the legitimacy of the lower version software during the software upgrade process. The vehicle-side key management module 2031 is used to receive information transmitted from the network side, the vehicle-side key storage module 2032 is used to store information transmitted from the network side, and the authorization module 2033 is used to decode the information transmitted from the network side and determine whether the over-the-air upgrade is legitimate based on the decoded information.

[0050] Referring again to Figure 3, the display and input unit 204 mainly includes a display module 2041 and a vehicle authorization input module 2042, the vehicle authorization input module 2042 is used to receive information entered by the user, and the display module 2041 is used to display the information.

[0051] Furthermore, the upgrade unit 202 manages the number of first software upgrades stored on the network side using OTA_COUNT, with an initial value of 0, and the vehicle-side authorization module 2033 manages the number of second software upgrades stored on the vehicle side using V_OTA_COUNT, with an initial value of 0.

[0052] Embodiments of the present invention provide an embodiment of an over-the-air upgrade method, wherein the steps shown in the flowchart of the drawings may be performed, for example, in a computer system of one set of computer executable instructions, and although the flowchart shows a logical order, in some cases the steps shown or described may be performed in an order different from the order herein.

[0053] This embodiment provides an over-the-air upgrade method which can be used on the network side 101 and vehicle side 102 shown in Figure 1. Figure 4 is a schematic diagram of the interaction process of the over-the-air upgrade system according to an embodiment of the present invention, where the network side 101 is used to execute steps S101 to S104, and the vehicle side 102 is used to execute steps S201 to S205. The specific interaction process between the network side 101 and the vehicle side 102 is as follows.

[0054] Step S101: Generate a software upgrade key and send it to the vehicle.

[0055] Specifically, the embodiments of this application can be broadly divided into two methods: symmetric authorization and asymmetric authorization. In the symmetric authorization method, the network generates a software upgrade master key, encrypts it, and transmits it to the vehicle. In the asymmetric authorization method, the network generates an asymmetric key pair consisting of a software upgrade public key and a software upgrade private key, and transmits the software upgrade public key to the vehicle.

[0056] Step S201: Receive the software upgrade key sent from the network side.

[0057] Specifically, in the case of a symmetric authorization system, the vehicle receives an encrypted message containing the software upgrade master key from the network side, decrypts the message, and obtains the software upgrade master key. In the case of an asymmetric authorization system, the vehicle receives a public software upgrade key transmitted from the network side, and this public software upgrade key corresponds to the network side's private software upgrade key.

[0058] Steps S101 and S201 are essentially processes for initializing the network side and the vehicle side. During the initialization process, the network side and the vehicle side maintain a communication connection. After initialization is complete, the vehicle may be upgraded online, or it may be upgraded by obtaining the necessary data offline. During the offline upgrade process, the vehicle side may disconnect from the network side.

[0059] Furthermore, during initialization, the network side manages the number of first software upgrades using OTA_COUNT, which has an initial value of 0, while the vehicle side manages the number of second software upgrades using V_OTA_COUNT, which also has an initial value of 0.

[0060] Step S202: Send the software upgrade task to the network side.

[0061] Specifically, the vehicle generates a software upgrade task based on information such as the current software version installed on the controller and the required software upgrade version, and sends an upgrade request to the network.

[0062] Step S102: After receiving the software upgrade task sent from the vehicle, update the first software upgrade count, detect whether the software upgrade task is a lower version software upgrade task, and obtain the software upgrade rollback flag.

[0063] Specifically, each time the network receives a software upgrade task, it records the first software upgrade count, determines whether the vehicle is attempting to upgrade to a lower version of the software, and generates a software upgrade rollback flag. The vehicle then uses this flag to determine whether authorization is required.

[0064] In some selectable embodiments, step S102 includes steps a1 to a3.

[0065] Step a1: After receiving a software upgrade task, increment the first software upgrade count by 1 and obtain the software upgrade version and current software version based on the software upgrade task.

[0066] Step a2: If it is detected that the software upgrade version is less than or equal to the current software version, determine that the software upgrade task is a lower version software upgrade task and set the software upgrade rollback flag to 1.

[0067] Step a3: If it is detected that the software upgrade version is less than or equal to the current software version, determine that the software upgrade task is not a lower version software upgrade task and set the software upgrade rollback flag to 0.

[0068] For example, referring again to Figure 2, when the upgrade unit receives a software upgrade task, it increments the counter OTA_COUNT, which indicates the first software upgrade count, by 1, then determines the software upgrade version number, and sets the software upgrade rollback flag RE_OTA_FLAG to 0 if the software upgrade version is higher than the current software version of the vehicle-side controller, and sets RE_OTA_FLAG to 1 if the software upgrade version is less than or equal to the current software version of the vehicle-side controller.

[0069] Step S103: Encrypt the upgrade information, including the first software upgrade count, using the software upgrade key, and generate encrypted upgrade information.

[0070] Specifically, in the case of a symmetric authorization scheme, upgrade information mainly includes the number of first software upgrades, software information, and authentication information for upgrade authentication, and encrypted upgrade information mainly includes encrypted authentication information obtained by encrypting the authentication information. In the case of an asymmetric authorization scheme, upgrade information mainly includes the number of first software upgrades, authentication information for upgrade authentication, and digest authentication information, the digest authentication information is obtained by encrypting the authentication information, and encrypted upgrade information mainly includes signed authentication information obtained by encrypting the digest authentication information.

[0071] Step S104: Send upgrade information, encrypted upgrade information, software upgrade rollback flag, and software upgrade package corresponding to the software upgrade task to the vehicle.

[0072] Specifically, in the case of a symmetric authorization method, the network side sends software information, authentication information, encrypted authentication information, a software upgrade rollback flag, and a software upgrade package corresponding to the software upgrade task to the vehicle side. In the case of an asymmetric authorization method, the network side sends authentication information, signature authentication information, a software upgrade rollback flag, and a software upgrade package corresponding to the software upgrade task to the vehicle side.

[0073] Step S203: Receive upgrade information, encrypted upgrade information, software upgrade rollback flags, and software upgrade packages corresponding to software upgrade tasks, which have been fed back from the network side.

[0074] Step S204: After deciding to upgrade to a lower version of the software according to the software upgrade rollback flag, the encrypted upgrade information is decrypted according to the software upgrade key to obtain new upgrade information and the first software upgrade count stored on the network side.

[0075] Specifically, the vehicle decrypts the encrypted upgrade information according to the software upgrade master key or software upgrade public key to obtain new upgrade information and the network-side first software upgrade count OTA_COUNT.

[0076] Step S205: After determining that an over-the-air upgrade is valid based on the relationship between the first software upgrade count and the second software upgrade count stored within the system, and the correspondence between new upgrade information and upgrade information, the system is upgraded to a lower version of the software using a software upgrade package.

[0077] Specifically, the vehicle determines whether an over-the-air upgrade is legitimate based on the relationship between the first software upgrade count OTA_COUNT and the second software upgrade count V_OTA_COUNT, and the correspondence between new upgrade information and upgrade information. Only if the over-the-air upgrade is deemed legitimate does the vehicle allow the upgrade to a lower version of the software via the software upgrade package.

[0078] The over-the-air upgrade method according to the embodiment of the present invention utilizes the network side to generate a first software upgrade count that records the number of software upgrades, a software upgrade rollback flag indicating whether it is a lower version software upgrade task, upgrade information required on the vehicle side, encrypted upgrade information, and a software upgrade package. After the vehicle side decides to upgrade to a lower version software according to the software upgrade rollback flag, it decrypts the encrypted upgrade information to obtain new upgrade information and the first software upgrade count. After determining that the over-the-air upgrade is legitimate according to the relationship between the first software upgrade count and the second software upgrade count stored therein, and the correspondence between the new upgrade information and the upgrade information, it upgrades to the lower version software using the software upgrade package, thereby guaranteeing the security and legitimacy of the upgrade when the user upgrades to a lower version software.

[0079] The embodiment of the present invention ensures that users can voluntarily and legitimately upgrade to lower versions of software by managing permissions for legitimate upgrades to lower versions of software when a user upgrades to a software version lower than the current software version. This prevents other unauthorized users from illegally upgrading to legitimate lower versions of software and avoids security risks due to security vulnerabilities in the lower version of software itself.

[0080] This embodiment provides an over-the-air upgrade method which can be used on the network side 101 and vehicle side 102 shown in Figure 1. Figure 5 is a schematic diagram of the interaction process of the over-the-air upgrade system according to an embodiment of the present invention, where the network side 101 is used to execute steps S301 to S306, and the vehicle side 102 is used to execute steps S401 to S406. The specific interaction process between the network side 101 and the vehicle side 102 is as follows.

[0081] Step S301: Generate a software upgrade master key and send it to the vehicle.

[0082] In some selectable embodiments, step S301 includes steps b1 to b3.

[0083] Step b1: After receiving the public key transmitted from the vehicle, generate the software upgrade master key and transmission protection key.

[0084] Step b2: Asymmetric encryption is performed on the transmission protection key using the public key to obtain the ciphertext transmission protection key. Then, symmetric encryption is performed on the software upgrade master key according to the ciphertext transmission protection key to obtain the ciphertext software upgrade master key.

[0085] Step b3: Send the ciphertext software upgrade master key and ciphertext transmission protection key to the vehicle.

[0086] For illustrative purposes, referring again to Figure 3, the vehicle-side key management module generates an asymmetric key, the private key SK is securely stored in the vehicle-side key management module, the public key PK is sent to the authentication unit offline or online, and the requesting authentication unit provides the OTA_MASTER_KEY.

[0087] Referring again to Figure 3, the authentication unit calls the key generation module to randomly generate a 128-bit or 256-bit random number as the software upgrade master key OTA_MASTER_KEY, which is securely stored in the key storage module and cannot be exported in plain text. Generally, the key generation module can be implemented using a hardware security module (HSM) device. Subsequently, the authentication unit calls the key generation module again to randomly generate a 128-bit or 256-bit random number as the transmission protection key TRANS_KEY, which is used to encrypt and protect the OTA_MASTER_KEY.

[0088] Selectively, after receiving the public key PK, the authentication unit performs asymmetric encryption on the transmission protection key TRANS_KEY using the PK to obtain the ciphertext transmission protection key ENC_TRANS_KEY. The asymmetric encryption algorithm may be any secure general-purpose algorithm such as RSA (Rivest-Shamir-Adleman Algorithm) or Elliptic Curve Cryptography (ECC), and the embodiments of this application are not limited thereto.

[0089] Next, the ciphertext software upgrade master key ENC_OTA_MASTER_KEY is obtained by performing symmetric encryption on the software upgrade master key OTA_MASTER_KEY using the ciphertext transmission protection key ENC_TRANS_KEY. Exemplarily, the symmetric encryption algorithm may be a secure, general-purpose algorithm such as the Advanced Encryption Standard (AES) or the SM4 Block Cipher Algorithm (SM4), and the embodiments of this application are not limited thereto. Finally, ENC_TRANS_KEY and ENC_OTA_MASTER_KEY are transmitted to the vehicle-side key management module.

[0090] Step S401: Receive the software upgrade master key sent from the network side.

[0091] In some selectable embodiments, the vehicle side decrypts the ciphertext transmission protection key using the private key corresponding to the public key to obtain the transmission protection key, and then decrypts the ciphertext software upgrade master key based on the transmission protection key to obtain the software upgrade master key.

[0092] For example, the vehicle-side key management module calls the secret key SK to decrypt the ciphertext transmission protection key ENC_TRANS_KEY to obtain the transmission protection key TRANS_KEY, then uses the obtained transmission protection key TRANS_KEY to decrypt the ciphertext software upgrade master key ENC_OTA_MASTER_KEY to obtain the software upgrade master key OTA_MASTER_KEY, and securely stores the obtained software upgrade master key OTA_MASTER_KEY in the vehicle-side key storage module.

[0093] This improves security by having the network generate a software upgrade master key, encrypt it, and send it to the vehicle, which then decrypts it to obtain the network's software upgrade master key.

[0094] Step S402: Send the software upgrade task to the network side. For details, refer to step S202 in the embodiment shown in Figure 4, and a redundant explanation will be omitted here.

[0095] Step S302: After receiving the software upgrade task sent from the vehicle, the first software upgrade count is updated, it is detected whether the software upgrade task is a lower version software upgrade task, and a software upgrade rollback flag is obtained. For details, please refer to step S102 of the embodiment shown in Figure 4, and a redundant explanation is omitted here.

[0096] Step S303: Generate authentication information based on the first software upgrade count.

[0097] Specifically, the authentication information CERT_INFO is information used by the vehicle authorization module to determine whether the execution of the over-the-air upgrade process is a legitimate action, and its contents mainly consist of a random number RNG and the first software upgrade count OTA_COUNT.

[0098] Step S304: Perform symmetric encryption on the software information using the software upgrade master key to obtain the rollback operation key.

[0099] In some selectable embodiments, referring again to Figure 3, the upgrade unit generates software information SOFT_INFO and authentication information CERT_INFO, and then sends the software information SOFT_INFO and authentication information CERT_INFO for authentication to the authentication module of the authentication unit. The authentication module calls OTA_MASTER_KEY to perform a security calculation on SOFT_INFO based on a symmetric encryption algorithm to obtain the rollback operation key OTA_RE_KEY for the current software version.

[0100] The software information SOFT_INFO is a derived factor for generating the OTA_RE_KEY, a one-time password related to upgrade operations, and consists of information such as the software version number SOFT_VN (including the current software version and software upgrade version) and the software upgrade rollback flag RE_OTA_FLAG.

[0101] Step S305: Perform symmetric encryption on the authentication information using the rollback business key to obtain encrypted authentication information.

[0102] In some optional embodiments, referring again to Figure 3, the authentication unit calls the rollback operation key OTA_RE_KEY to perform a security calculation based on a symmetric encryption algorithm on the authentication information CERT_INFO to obtain the encrypted authentication information ENC_CERT_INFO, and then feeds ENC_CERT_INFO back to the upgrade unit.

[0103] This improves transmission security by encrypting the authentication information when generating and sending it to the vehicle for upgrade authentication.

[0104] Step S306: Send software information, authentication information, encrypted authentication information, software upgrade rollback flag, and the software upgrade package corresponding to the software upgrade task to the vehicle.

[0105] For example, referring again to Figure 3, after the upgrade unit receives the encrypted authentication information ENC_CERT_INFO, it sends the encrypted authentication information ENC_CERT_INFO, the authentication information CERT_INFO, the software information SOFT_INFO, the software upgrade package, and the software upgrade rollback flag RE_OTA_FLAG to the vehicle-side authorization unit via the OTA channel.

[0106] Step S403: Receive software information, authentication information, encrypted authentication information, software upgrade rollback flag, and software upgrade package corresponding to the software upgrade task, which have been fed back from the network side.

[0107] Step S404: After deciding to upgrade to a lower version of the software according to the software upgrade rollback flag, symmetric encryption is performed on the software information according to the software upgrade master key to obtain the rollback operation key.

[0108] Specifically, the software upgrade rollback flag is used to indicate the software upgrade status. A value of 0 indicates that the upgrade version is higher than the vehicle's current software version and that it is a normal software upgrade process. A value of 1 indicates that the upgrade version is lower than the vehicle's current software version and that it is a special upgrade process. The vehicle must then authorize the upgrade process to determine whether the lower-version over-the-air upgrade is legitimate.

[0109] For example, referring again to Figure 3, if the vehicle-side authorization unit determines that RE_OTA_FLAG=0, it indicates a normal upgrade process and proceeds; if RE_OTA_FLAG=1, it indicates a special upgrade process and requires authorization. If the authorization module determines that the vehicle-side authorization unit requires authorization, it first calls the software upgrade master key OTA_MASTER_KEY and performs a security calculation based on a symmetric encryption algorithm on the software information SOFT_INFO, using the same calculation method as the authentication module to calculate OTA_RE_KEY. The rollback operation key OTA_RE_KEY is then obtained.

[0110] Step S405: The encrypted authentication information is decrypted using the rollback operation key to obtain new authentication information after decryption, and the number of first software upgrades stored on the network side is extracted from the new authentication information.

[0111] For example, referring again to Figure 3, the authorization module calls the rollback operation key OTA_RE_KEY to decrypt the encrypted authentication information ENC_CERT_INFO to obtain a new CERT_INFO', and extracts the first software upgrade count OTA_COUNT from the new CERT_INFO'.

[0112] This allows encrypted information transmitted from the network side to be decrypted using a software upgrade master key, facilitating the verification of the legitimacy of subsequent over-the-air upgrades and improving the security of information transmission.

[0113] Step S406: After determining that the over-the-air upgrade is legitimate based on the relationship between the first software upgrade count and the second software upgrade count stored therein, and the correspondence between the new authentication information and the authentication information, the software is upgraded to a lower version using the software upgrade package.

[0114] In some selectable embodiments, step S406 includes steps c1 to c3.

[0115] Step c1: If it is detected that the number of first software upgrades is greater than the number of second software upgrades, determine whether the new credentials match the existing credentials.

[0116] Step c2: If it is detected that the new credentials match the existing credentials, the over-the-air upgrade is deemed valid, the value of the first software upgrade count is assigned to the second software upgrade count, and the step of upgrading to the lower version of the software using the software upgrade package is executed.

[0117] Step c3: If it is detected that the new credentials do not match the existing credentials, or that the number of first software upgrades is less than or equal to the number of second software upgrades, the upgrade will be stopped.

[0118] For example, referring again to Figure 3, the authorization module extracts the first software upgrade count OTA_COUNT from the new CERT_INFO', compares it to the second software upgrade count V_OTA_COUNT securely stored in the authorization module, and if OTA_COUNT > V_OTA_COUNT, compares CERT_INFO' with the sent CERT_INFO. If they are the same, it determines that the upgrade to the lower version is legitimate and assigns the value of OTA_COUNT to V_OTA_COUNT. If CERT_INFO' is different from the sent CERT_INFO, it determines it is abnormal and interrupts the upgrade. If OTA_COUNT ≤ V_OTA_COUNT, it determines it is an invalid upgrade and terminates the upgrade.

[0119] This allows for the determination of the relative number of first and second software upgrades, and the matching relationship between new authentication information and existing authentication information, thereby determining whether a lower-version upgrade is legitimate. This improves security during over-the-air upgrades and avoids security risks caused by security vulnerabilities in lower-version software.

[0120] The over-the-air upgrade method according to the embodiment of the present invention utilizes the network side to generate a first software upgrade count that records the number of software upgrades, a software upgrade rollback flag indicating whether or not it is a lower version software upgrade task, necessary software information for the vehicle side, authentication information, encrypted authentication information, and a software upgrade package. After the vehicle side decides to upgrade to a lower version of the software according to the software upgrade rollback flag, it decrypts the encrypted authentication information to obtain new authentication information and the first software upgrade count. After determining that the over-the-air upgrade is legitimate according to the relationship between the first software upgrade count and the second software upgrade count stored therein, and the correspondence between the new authentication information and the authentication information, it upgrades to the lower version of the software using the software upgrade package, thereby guaranteeing the security and legitimacy of the upgrade when the user upgrades to a lower version of the software.

[0121] This embodiment provides an over-the-air upgrade method which can be used on the network side 101 and vehicle side 102 shown in Figure 1. Figure 6 is a schematic diagram of the interaction process of the over-the-air upgrade system according to an embodiment of the present invention, where the network side 101 is used to execute step S501, and the vehicle side 102 is used to execute steps S601 to S605. The specific interaction process between the network side 101 and the vehicle side 102 is as follows.

[0122] Step S501: Generate a software upgrade master key and send the software upgrade master key to the vehicle. For details, refer to step S301 of the embodiment shown in Figure 5, and a redundant explanation will be omitted here.

[0123] Step S601: Receive the software upgrade master key transmitted from the network side. For details, refer to step S401 in the embodiment shown in Figure 5, and a redundant explanation will be omitted here.

[0124] Step S602: Obtain the software upgrade version and the current software version, compare the software upgrade version and the current software version, and obtain a software upgrade rollback flag to indicate whether or not it is a lower version software upgrade task.

[0125] Specifically, when performing a software upgrade process, the vehicle's authorization unit must determine the software version number. If the software upgrade version is higher than the vehicle's current software version, it indicates a normal upgrade process and proceeds. If the software upgrade version is lower than or equal to the vehicle's current software version, it must indicate a special upgrade process and authorize it. This determines whether an over-the-air upgrade to a lower version is legitimate and obtains the software upgrade rollback flag RE_OTA_FLAG to indicate whether it is a lower-version software upgrade task.

[0126] Step S603: After deciding to upgrade to a lower version according to the software upgrade rollback flag, symmetric encryption is performed on the software upgrade version, the current software version, and the software upgrade rollback flag to obtain the rollback operation key, and the authentication information for the upgrade authentication entered by the user offline, encrypted authentication information, and the software upgrade package are received.

[0127] For example, referring again to Figure 3, if the vehicle-side authorization unit determines that authorization is necessary, the authorization module calls OTA_MASTER_KEY and performs a security calculation based on a symmetric encryption algorithm on the software version number SOFT_VN, which includes the software upgrade version and the current software version, and the software upgrade rollback flag RE_OTA_FLAG, to obtain the rollback operation key OTA_RE_KEY. Subsequently, the display interface presents the user with the authentication information CERT_INFO, encrypted authentication information ENC_CERT_INFO, and the software upgrade package to input. The method of the symmetric encryption calculation is the same as the method of OTA_RE_KEY in the authentication module.

[0128] Furthermore, authentication information, encrypted authentication information, and software upgrade packages are obtained by the user from the network side. The user may also input the vehicle-side software upgrade task to the network side, and the network-side upgrade unit, after obtaining data such as encrypted authentication information ENC_CERT_INFO, transmits the encrypted authentication information ENC_CERT_INFO, authentication information CERT_INFO, and software upgrade package to the user offline.

[0129] In offline scenarios, this allows for legitimate upgrades to lower versions by receiving user-entered credentials, encrypted credentials, and software upgrade packages.

[0130] Step S604: The encrypted authentication information is decrypted using the rollback business key to obtain new authentication information after decryption, and the number of first software upgrades stored on the network side is extracted from the new authentication information. For details, please refer to step S405 of the embodiment shown in Figure 5, and a redundant explanation is omitted here.

[0131] Step S605: After determining that the over-the-air upgrade is valid based on the relationship between the first software upgrade count and the second software upgrade count stored therein, and the correspondence between the new authentication information and the authentication information, the software is upgraded to the lower version using the software upgrade package. For details, please refer to step S406 of the embodiment shown in Figure 5, and a redundant explanation is omitted here.

[0132] The over-the-air upgrade method according to the embodiment of the present invention generates a software upgrade master key using the network side, and the vehicle side receives software information, authentication information, encrypted authentication information, and a software upgrade package entered offline by the user. After the vehicle side decides to upgrade to a lower version of the software according to the software upgrade rollback flag, it decrypts the encrypted authentication information using the software upgrade master key to obtain new authentication information and the first software upgrade count. After determining that the over-the-air upgrade is legitimate according to the relationship between the first software upgrade count and the second software upgrade count stored therein, and the correspondence between the new authentication information and the authentication information, it upgrades to the lower version of the software using the software upgrade package, thereby guaranteeing the security and legitimacy of the upgrade when the user upgrades to a lower version of the software.

[0133] This embodiment provides an over-the-air upgrade method which can be used on the network side 101 and vehicle side 102 shown in Figure 1. Figure 7 is a schematic diagram of the interaction process of the over-the-air upgrade system according to an embodiment of the present invention, where the network side 101 is used to execute steps S701 to S705, and the vehicle side 102 is used to execute steps S801 to S805. The specific interaction process between the network side 101 and the vehicle side 102 is as follows.

[0134] Step S701: Generate an asymmetric key pair consisting of a software upgrade public key and a software upgrade private key, and send the software upgrade public key to the vehicle.

[0135] In some optional embodiments, referring again to Figure 3, the authentication unit invokes a key generation module to randomly generate an asymmetric key pair consisting of a software upgrade public key OTA_MASTER_KEY_P and a software upgrade private key OTA_MASTER_KEY_S. OTA_MASTER_KEY_S is securely stored in a key storage module and cannot be exported in plaintext, while OTA_MASTER_KEY_P is sent to the vehicle. Exemplarily, the key generation module is implemented using a hardware security module (HSM) device.

[0136] Step S801: Receive the software upgrade public key sent from the network side.

[0137] Specifically, the network-side authentication unit sends the public key OTA_MASTER_KEY_P offline to the vehicle-side authorization unit, and the vehicle-side authorization unit securely stores OTA_MASTER_KEY_P in the vehicle-side key management module.

[0138] Step S802: Send the software upgrade task to the network side. For details, refer to step S402 in the embodiment shown in Figure 5, and a redundant explanation will be omitted here.

[0139] Step S702: After receiving the software upgrade task sent from the vehicle, the first software upgrade count is updated, it is detected whether the software upgrade task is a lower version software upgrade task, and a software upgrade rollback flag is obtained. For details, please refer to step S302 of the embodiment shown in Figure 5, and a redundant explanation is omitted here.

[0140] Step S703: Generate authentication information based on the first software upgrade count. For details, refer to step S303 of the embodiment shown in Figure 5, and a redundant explanation will be omitted here.

[0141] Step S704: Perform a digest operation on the authentication information to obtain digest authentication information, then perform asymmetric encryption on the digest authentication information using the software upgrade secret key to obtain signature authentication information.

[0142] In some selectable embodiments, referring again to Figure 3, the upgrade unit sends authentication information CERT_INFO for authentication to the authentication module of the authentication unit. The authentication module performs a digest operation on CERT_INFO to obtain digest authentication information DIG_CERT_INFO, and the digest operation algorithm can employ any secure general-purpose digest algorithm such as SHA256 or SM3, and the embodiments of this application are not limited thereto. Subsequently, the software upgrade secret key OTA_MASTER_KEY_S is called to perform a security operation on the digest authentication information DIG_CERT_INFO based on an asymmetric encryption algorithm to obtain signed authentication information SIG_CERT_INFO, and then SIG_CERT_INFO is fed back to the upgrade unit.

[0143] This improves transmission security by encrypting and digesting the authentication information when generating and sending the signature authentication information for upgrade authentication to the vehicle.

[0144] Step S705: Send authentication information, signature authentication information, software upgrade rollback flag, and the software upgrade package corresponding to the software upgrade task to the vehicle.

[0145] For example, referring again to Figure 3, after the upgrade unit receives the signature authentication information SIG_CERT_INFO, it sends the signature authentication information SIG_CERT_INFO, the authentication information CERT_INFO, the software upgrade rollback flag, and the software upgrade package to the vehicle-side authorization unit via the OTA channel.

[0146] Step S803: Receive authentication information, signature authentication information, software upgrade rollback flag, and software upgrade package corresponding to the software upgrade task, which have been fed back from the network side.

[0147] Step S804: After deciding to upgrade to a lower version of the software according to the software upgrade rollback flag, the signature authentication information is decrypted according to the software upgrade public key to obtain digest authentication information, a digest operation is performed on the authentication information to obtain new digest authentication information, and the number of first software upgrades is extracted from the authentication information.

[0148] Specifically, the software upgrade rollback flag is used to indicate the software upgrade status. A value of 0 indicates that the upgrade version is higher than the vehicle's current software version and that it is a normal software upgrade process. A value of 1 indicates that the upgrade version is lower than the vehicle's current software version and that it is a special upgrade process. The vehicle must then authorize the upgrade process to determine whether the lower-version over-the-air upgrade is legitimate.

[0149] For example, referring again to Figure 3, if the vehicle-side authorization unit determines that RE_OTA_FLAG=0, it indicates a normal upgrade process and proceeds; if RE_OTA_FLAG=1, it indicates a special upgrade process and requires authorization. If the vehicle-side authorization unit determines that authorization is required, the authorization module calls the software upgrade public key OTA_MASTER_KEY_P to decrypt the signature authentication information SIG_CERT_INFO to obtain digest authentication information DIG_CERT_INFO, then performs a digest operation on the received authentication information CERT_INFO to obtain new digest authentication information DIG_CERT_INFO', the digest operation method is the same as the algorithm used by the authentication module. Furthermore, the first software upgrade count is extracted from the authentication information CERT_INFO.

[0150] This allows for the decryption of signature authentication information transmitted from the network side using the software upgrade public key, thereby facilitating the verification of the legitimacy of subsequent over-the-air upgrades and improving the security of information transmission.

[0151] Step S805: After determining that the over-the-air upgrade is legitimate based on the relationship between the first software upgrade count and the second software upgrade count stored therein, and the correspondence between the new digest authentication information and the digest authentication information, the software upgrade package is used to upgrade to the lower version of the software.

[0152] In some selectable embodiments, step S805 includes steps d1 to d3.

[0153] Step d1: If it is detected that the new digest authentication information matches the digest authentication information, determine whether the number of first software upgrades is greater than the number of second software upgrades.

[0154] Step d2: If it is detected that the number of first software upgrades is greater than the number of second software upgrades, the over-the-air upgrade is deemed valid, the value of the first software upgrade count is assigned to the second software upgrade count, and the step of upgrading to the lower version software by software upgrade package is performed.

[0155] Step d3: Stop the upgrade if the number of first software upgrades is less than or equal to the number of second software upgrades, or if it is detected that the new digest authentication information does not match the digest authentication information.

[0156] For example, the authorization module compares the new digest authentication information DIG_CERT_INFO' with the existing digest authentication information DIG_CERT_INFO to determine if they are the same. If they are different, it terminates the upgrade. If they are the same, it compares the first software upgrade count OTA_COUNT with the second software upgrade count V_OTA_COUNT, which is securely stored in the authorization module. If OTA_COUNT > V_OTA_COUNT, it determines that the upgrade to the lower version is legitimate and assigns the value of OTA_COUNT to V_OTA_COUNT. If OTA_COUNT ≤ V_OTA_COUNT, it determines that the upgrade is invalid and terminates the upgrade.

[0157] This allows for the determination of the relative magnitude of the number of first and second software upgrades, and the matching relationship between the new digest authentication information and the digest information. By determining whether a lower-version upgrade is legitimate, security during over-the-air upgrades is improved, and security risks due to security vulnerabilities in the lower-version software are avoided.

[0158] This embodiment provides an over-the-air upgrade method which can be used on the network side 101 and vehicle side 102 shown in Figure 1. Figure 8 is a schematic diagram of the interaction process of the over-the-air upgrade system according to an embodiment of the present invention, where the network side 101 is used to execute step S901, and the vehicle side 102 is used to execute steps S1001 to S1005. The specific interaction process between the network side 101 and the vehicle side 102 is as follows.

[0159] Step S901: An asymmetric key pair consisting of a software upgrade public key and a software upgrade private key is generated, and the software upgrade public key is sent to the vehicle. For details, please refer to step S701 of the embodiment shown in Figure 7, and a redundant explanation is omitted here.

[0160] Step S1001: Receive the software upgrade public key sent from the network side. For details, refer to step S801 in the embodiment shown in Figure 7, and a redundant explanation will be omitted here.

[0161] Step S1002: Obtain the software upgrade version and the current software version, compare the software upgrade version and the current software version, and obtain a software upgrade rollback flag to indicate whether or not it is a lower version software upgrade task. For details, refer to step S602 of the embodiment shown in Figure 6, and redundant explanation will be omitted here.

[0162] Step S1003: After deciding to upgrade to a lower version of the software according to the software upgrade rollback flag, the system receives authentication information, signature authentication information, and a software upgrade package for upgrade authentication, which are entered offline by the user.

[0163] For example, referring again to Figure 3, if the vehicle-side authorization unit determines that authorization is necessary, the authorization unit will present the user with the authentication information CERT_INFO, the signature authentication information SIG_CERT_INFO, and the software upgrade package via the display module.

[0164] The authentication information CERT_INFO, signature authentication information SIG_CERT_INFO, and software upgrade package are obtained by the user from the network side. The user may also input the vehicle-side software upgrade task to the network side, and the network-side upgrade unit, after obtaining data such as the signature authentication information SIG_CERT_INFO, transmits the encrypted authentication information ENC_CERT_INFO, authentication information CERT_INFO, and software upgrade package to the user offline.

[0165] In offline scenarios, this allows for legitimate upgrades to lower versions by receiving user-entered authentication information, signature credentials, and software upgrade packages.

[0166] Step S1004: The signature authentication information is decrypted according to the software upgrade public key to obtain digest authentication information, a digest operation is performed on the authentication information to obtain new digest authentication information, and the number of first software upgrades is extracted from the authentication information. For details, please refer to step S804 of the embodiment shown in Figure 7, and a redundant explanation is omitted here.

[0167] Step S1005: After determining that the over-the-air upgrade is valid based on the relationship between the first software upgrade count and the second software upgrade count stored therein, and the correspondence between the new digest authentication information and the digest authentication information, the software is upgraded to the lower version using the software upgrade package. For details, please refer to step S805 of the embodiment shown in Figure 7, and a redundant explanation is omitted here.

[0168] The over-the-air upgrade method in the embodiment of the present invention will be described in more detail below with reference to several application scenarios, and the over-the-air upgrade method can be applied to the over-the-air upgrade system shown in Figure 3.

[0169] 1) When adopting a symmetric key algorithm The authentication unit generates a software upgrade master key, which is used to perform security calculations based on an encryption algorithm on the software information SOFT_INFO entered by the upgrade unit to obtain the rollback operation key OTA_RE_KEY for the current software version. The rollback operation key OTA_RE_KEY is used to provide legitimacy and upgrade authority protection for the upgraded version.

[0170] The upgrade unit is used to manage and send upgrade software versions, and if it determines that the software upgrade version is lower than the current vehicle software version, it generates the software upgrade rollback flag RE_OTA_FLAG.

[0171] Optionally, the upgrade unit generates authentication information CERT_INFO, encrypts CERT_INFO with OTA_RE_KEY to obtain encrypted authentication information ENC_CERT_INFO, and then sends the software upgrade package, encrypted authentication information ENC_CERT_INFO, authentication information CERT_INFO, and software upgrade rollback flag RE_OTA_FLAG to the vehicle-side authorization unit.

[0172] Scenario 1: When performing an online software upgrade process, this scenario typically occurs after user vehicles have been distributed, when the new software version becomes unstable during the upgrade process, requiring a large-scale upgrade to a lower version for mass-produced vehicles. The vehicle-side authorization unit determines the software upgrade version. If the target software upgrade version is higher than the current software version, it proceeds. If it is lower than the current software version, it extracts the software information SOFT_INFO and performs a security calculation on the software information SOFT_INFO using the pre-configured software upgrade master key OTA_MASTER_KEY, based on a symmetric encryption algorithm. The calculation method is the same as the method used by the authentication unit to generate the rollback operation key OTA_RE_KEY. With the rollback operation key OTA_RE_KEY obtained, the encrypted authentication information ENC_CERT_INFO is decrypted using OTA_RE_KEY to obtain CERT_INFO, which is compared with the transmitted CERT_INFO. If they are the same, it is determined that the upgrade to the lower version is a legitimate action; if they are different, it is determined to be abnormal, and the upgrade is interrupted.

[0173] Scenario 2: When performing an offline software upgrade process, this scenario is mainly used to authorize the offline upgrade of a single vehicle to a lower version via, for example, a USB interface, when identifying problems during the testing or mass production phase. The vehicle-side authorization unit determines the software upgrade version, and if the software upgrade version is less than or equal to the vehicle's software version number, it indicates that it is a special upgrade process and requires authorization. The authorization module calls OTA_MASTER_KEY and performs security calculations based on a symmetric encryption algorithm on SOFT_VN and RE_OTA_FLAG, using the same calculation method as the authentication module's OTA_RE_KEY. After obtaining OTA_RE_KEY, the display interface then prompts the user to input information such as CERT_INFO and ENC_CERT_INFO.

[0174] The authorization module calls OTA_RE_KEY to decrypt the encrypted authentication information ENC_CERT_INFO to obtain CERT_INFO', extracts the first software upgrade count OTA_COUNT from CERT_INFO', compares it to the second software upgrade count V_OTA_COUNT securely stored in the authorization module, and if OTA_COUNT > V_OTA_COUNT, compares CERT_INFO' with the sent CERT_INFO. If they are the same, it determines that this upgrade to the lower version is legitimate and assigns the value of OTA_COUNT to V_OTA_COUNT. If they are different, it determines that it is abnormal and interrupts the upgrade. If OTA_COUNT ≤ V_OTA_COUNT, it determines that it is an invalid upgrade and terminates the upgrade.

[0175] 2) When an asymmetric key algorithm is adopted When the upgrade unit receives a software upgrade task, it increments the OTA_COUNT counter, which indicates the number of software upgrades, by 1. Then it determines the software upgrade version number. If the software upgrade version number is higher than the current software version, it sets the software upgrade rollback flag RE_OTA_FLAG to 0. If the software upgrade version number is less than or equal to the current software version, it sets RE_OTA_FLAG to 1. Finally, it sends the authentication information CERT_INFO for authentication to the authentication module of the authentication unit.

[0176] The authentication module performs a digest operation on the authentication information CERT_INFO to obtain digest authentication information DIG_CERT_INFO, and the digest operation algorithm may be any secure general-purpose digest algorithm such as SHA256 or SM3. Subsequently, the software upgrade secret key OTA_MASTER_KEY_S is called to perform a security operation based on an asymmetric encryption algorithm on the digest authentication information DIG_CERT_INFO to obtain signed authentication information SIG_CERT_INFO, and then SIG_CERT_INFO is fed back to the upgrade unit.

[0177] Scenario 3: When performing an online software upgrade, this scenario typically occurs after user vehicles have been distributed, during the upgrade process to the new version of the software, if the new version is unstable and a large-scale upgrade to an older version is required for mass-produced vehicles. In this scenario, the upgrade unit, after receiving SIG_CERT_INFO, sends SIG_CERT_INFO, CERT_INFO, the software upgrade package, and the software upgrade rollback flag RE_OTA_FLAG, etc., to the vehicle-side authorization unit via the OTA channel.

[0178] If the vehicle-side authorization unit determines that RE_OTA_FLAG=0, it indicates a normal upgrade process and proceeds. If RE_OTA_FLAG=1, it indicates a special upgrade process and requires authorization. If the vehicle-side authorization unit determines that authorization is required, the authorization module calls OTA_MASTER_KEY_P to decode SIG_CERT_INFO to obtain DIG_CERT_INFO. Then, it performs a digest operation on the received CERT_INFO to obtain DIG_CERT_INFO', and the digest operation method is the same as the algorithm used by the authentication module. Next, the system compares whether DIG_CERT_INFO' and DIG_CERT_INFO are the same. If they are different, the upgrade is terminated. If they are the same, the OTA_COUNT in CERT_INFO is extracted and compared with V_OTA_COUNT, which is securely stored in the authorization module. If OTA_COUNT > V_OTA_COUNT, the system determines that this upgrade to the lower version is legitimate and assigns the value of OTA_COUNT to V_OTA_COUNT. If OTA_COUNT ≤ V_OTA_COUNT, the system determines that the upgrade is invalid and terminates the upgrade.

[0179] Scenario 4: When performing an offline software upgrade, this scenario is primarily used to authorize the offline upgrade of a single vehicle model to a lower version via, for example, a USB interface, when identifying problems during the testing or mass production phase. The upgrade unit receives SIG_CERT_INFO and then transmits information such as SIG_CERT_INFO to the user offline.

[0180] The vehicle-side authorization unit determines the software upgrade version. If the software upgrade version is higher than the current software version, it indicates a normal upgrade process and proceeds. If the software upgrade version is lower than or equal to the current software version, it indicates a special upgrade process and requires authorization. If the vehicle-side authorization unit determines that authorization is required, the authorization unit prompts the user to input information such as CERT_INFO and SIG_CERT_INFO via the display module.

[0181] The authorization module calls OTA_MASTER_KEY_P to decrypt SIG_CERT_INFO and obtain DIG_CERT_INFO. Then, it performs a digest operation on the received CERT_INFO to obtain DIG_CERT_INFO', using the same digest operation algorithm as the authentication module. Next, it compares whether DIG_CERT_INFO' and DIG_CERT_INFO are the same. If they are different, the upgrade is terminated. If they are the same, the OTA_COUNT in CERT_INFO is extracted and compared with V_OTA_COUNT, which is securely stored in the authorization module. If OTA_COUNT > V_OTA_COUNT, it is determined that this upgrade to the lower version is legitimate and the value of OTA_COUNT is assigned to V_OTA_COUNT. If OTA_COUNT ≤ V_OTA_COUNT, it is determined that the upgrade is invalid and the upgrade is terminated.

[0182] The secure over-the-air upgrade system for upgrading to a lower version of software according to the embodiment of the present application solves the problem of unauthorized users exploiting known vulnerabilities in the lower version of software to illegally upgrade to a lower version of software when there are quality issues in the new version of software that necessitate an upgrade to the lower version of software, and is used to provide security protection against unauthorized upgrades to lower version software in two upgrade scenarios: online upgrade and offline upgrade.

[0183] Embodiments of the present invention further provide computer devices applicable to the network side.

[0184] Referring to Figure 9, which is a schematic diagram of the structure of a computer device according to an optional embodiment of the present invention, the computer device includes one or more first processors 10, a first memory 20, and interfaces for connecting each component, including a high-speed interface and a low-speed interface. Each component communicates with one another via different buses and may be mounted on a common motherboard or otherwise mounted as needed. The processors can process instructions executed within the computer device, including instructions stored in or on memory for displaying GUI graphic information on an external input / output device (e.g., a display device coupled to the interface). In some optional embodiments, multiple processors and / or multiple buses may be used together with multiple memories and multiple storage devices as needed. Similarly, multiple computer devices may be connected, each providing a portion of the required operations (e.g., functioning as a server array, a set of blade servers, or a multiprocessor system). In Figure 9, one first processor 10 is used as an example.

[0185] The first processor 10 may be a central processing unit, a network processor, or a combination thereof. The first processor 10 may further include a hardware chip. The hardware chip may be an application-specific integrated circuit, a programmable logic device, or a combination thereof. The programmable logic device may be a complex programmable logic device, a field programmable logic gate array, a generic array logic, or any combination thereof.

[0186] The first memory 20 stores instructions that can be executed by at least one first processor 10, thereby enabling at least one first processor 10 to execute and implement the method shown in the above embodiment.

[0187] The first memory 20 may include an operating system, a program storage area capable of storing application programs required for at least one function, and a data storage area capable of storing data created in accordance with the use of the computer device. The first memory 20 may also include high-speed random-access memory and may further include non-temporary memory such as at least one disk storage device, a flash memory device, or other non-temporary solid-state storage device. In some selectable embodiments, the first memory 20 may include memory that is optionally remotely installed relative to the first processor 10, and these remote memories may be connected to the computer device via a network. Examples of such networks include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0188] The first memory 20 may include volatile memory such as random access memory, the memory may include non-volatile memory such as flash memory, hard disk, or solid-state drive, and the first memory 20 may include a combination of the above types of memory.

[0189] The computer device further includes an input device 30 and an output device 40. The first processor 10, the first memory 20, the input device 30, and the output device 40 may be connected by a bus or by other means, with Figure 9 showing a bus connection as an example.

[0190] The input device 30 can receive input numerical or character information and generate input key signals relating to user settings and function control of the computer device, such as a touchscreen, keypad, mouse, trackpad, pointing stick, one or more mouse buttons, trackball, and joystick. The output device 40 may include a display device, auxiliary lighting device (e.g., LEDs), and haptic feedback device (e.g., vibration motor). The display device includes, but is not limited to, liquid crystal displays, light-emitting diodes, displays, and plasma displays. In some optional embodiments, the display device may be a touchscreen.

[0191] Embodiments of the present application further provide a vehicle. Referring to Figure 10, which is a schematic diagram of the structure of a vehicle according to an optional embodiment of the present application, the vehicle includes one or more second processors 50, a second memory 60, and interfaces for connecting each component, including a high-speed interface and a low-speed interface. The vehicle further includes a second input device 70 and a second output device 80. The second processors 50, second memory 60, second input device 70 and second output device 80 may be connected by bus or by other means, with bus connection being an example in Figure 10. For the communication process of the second processors 50, second memory 60, second input device 70 and second output device 80 of the vehicle, refer to the above-mentioned description of computer devices, and a redundant explanation is omitted here.

[0192] Embodiments of the present application further provide a computer-readable storage medium, and the methods according to the embodiments of the present application may be implemented in hardware and firmware, or may be implemented in a recordable manner on a storage medium, or may be implemented as computer code downloaded over a network, originally stored on a remote storage medium or a non-temporary machine-readable storage medium but stored on a local storage medium, thereby the methods described herein may be processed by a general-purpose computer, a dedicated processor, or software stored on a storage medium using programmable or dedicated hardware. The storage medium may be a magnetic disk, an optical disk, read-only memory, random access memory, flash memory, a hard disk, or a solid-state drive, and optionally the storage medium may include a combination of the above types of memory. To understand that a computer, processor, microprocessor controller, or programmable hardware includes a storage component capable of storing or receiving software or computer code, and when the software or computer code is accessed and executed by the computer, processor, or hardware, the methods described in the embodiments are implemented.

[0193] Parts of this application may be applied as computer program products, such as computer program instructions, which, when executed by a computer, can be invoked or provided by the operation of the computer. As those skilled in the art will understand, the forms in which computer program instructions exist on a computer-readable medium include, but are not limited to, source files, executable files, and installation package files, and correspondingly, the forms in which computer program instructions are executed by a computer include, but are not limited to, the computer directly executing the instructions, the computer compiling the instructions and then executing the corresponding compiled program, the computer reading and executing the instructions, or the computer reading and installing the instructions and then executing the corresponding installed program. Here, the computer-readable medium may be any available computer-readable storage or communication medium accessible by a computer.

[0194] While embodiments of the present application have been described with reference to the drawings, those skilled in the art can make various changes and modifications without departing from the spirit and scope of the present application, and such changes and modifications all fall within the scope defined in the attached claims.

Claims

1. This is an over-the-air upgrade method, applied to the network side. The steps include generating a software upgrade key and transmitting the software upgrade key to the vehicle, After receiving a software upgrade task transmitted from the vehicle, the first software upgrade count is updated, the software upgrade task is detected as an older version software upgrade task, and a software upgrade rollback flag is obtained. The steps include: encrypting upgrade information including the first software upgrade count using a software upgrade key and generating encrypted upgrade information; An over-the-air upgrade method characterized by the step of: transmitting upgrade information, encrypted upgrade information, a software upgrade rollback flag, and a software upgrade package corresponding to the software upgrade task to the vehicle side, so that the vehicle side decides to upgrade to a lower version of the software according to the software upgrade rollback flag; decrypting the encrypted upgrade information according to the software upgrade key to obtain new upgrade information and a first software upgrade count; determining that the over-the-air upgrade is valid according to the relationship between the first software upgrade count and a second software upgrade count stored therein and the correspondence between the new upgrade information and the upgrade information; and then upgrading to a lower version of the software using the software upgrade package.

2. The software upgrade key includes a software upgrade master key, the upgrade information further includes software information and authentication information for upgrade authentication, the encrypted upgrade information includes encrypted authentication information, and the step of encrypting the upgrade information, including the first software upgrade count, using the software upgrade key to generate the encrypted upgrade information is: A step of generating authentication information based on the number of software upgrades, A step of performing symmetric encryption on software information using the aforementioned software upgrade master key to obtain a rollback operation key, wherein the software information is generated according to the software upgrade version corresponding to the software upgrade task, the current software version, and a software upgrade rollback flag. The method according to claim 1, characterized by comprising the step of performing symmetric encryption on the authentication information using the rollback business key to obtain encrypted authentication information.

3. The step of sending upgrade information, encrypted upgrade information, a software upgrade rollback flag, and a software upgrade package corresponding to the software upgrade task to the vehicle side is: The method according to claim 2, characterized in that it includes the steps of: transmitting software information, authentication information, encrypted authentication information, a software upgrade rollback flag, and a software upgrade package corresponding to the software upgrade task to the vehicle side, allowing the vehicle side to decide to upgrade to a lower version of the software in accordance with the software upgrade rollback flag; decrypting the encrypted authentication information in accordance with the software upgrade master key and the software information; extracting a first software upgrade count based on the decrypted new authentication information; determining that the over-the-air upgrade is valid in accordance with the relationship between the first software upgrade count and a second software upgrade count stored therein, and the correspondence between the new authentication information and the authentication information; and then upgrading to a lower version of the software using the software upgrade package.

4. The step of generating a software upgrade key and transmitting the software upgrade key to the vehicle side is: After receiving the public key transmitted from the vehicle, the process involves generating a software upgrade master key and a transmission protection key. The steps include: performing asymmetric encryption on the transmission protection key using the public key to obtain a ciphertext transmission protection key; performing symmetric encryption on the software upgrade master key according to the ciphertext transmission protection key to obtain a ciphertext software upgrade master key; The method according to the second invention, comprising the steps of: transmitting the ciphertext software upgrade master key and the ciphertext transmission protection key to the vehicle side, the vehicle side using the secret key corresponding to the public key to decrypt the ciphertext transmission protection key to obtain a transmission protection key, and decrypting the ciphertext software upgrade master key based on the transmission protection key to obtain the software upgrade master key.

5. The software upgrade key includes an asymmetric key pair consisting of a software upgrade public key and a software upgrade private key, the upgrade information further includes authentication information and digest authentication information for upgrade authentication, the encrypted upgrade information includes signature authentication information, and the step of encrypting the upgrade information, including the first software upgrade count, using the software upgrade key to generate the encrypted upgrade information is as follows: A step of generating authentication information based on the number of software upgrades, The method according to claim 1, characterized by comprising the steps of performing a digest operation on the authentication information to obtain digest authentication information, performing asymmetric encryption on the digest authentication information using the software upgrade secret key to obtain signature authentication information.

6. The step of sending upgrade information, encrypted upgrade information, a software upgrade rollback flag, and a software upgrade package corresponding to the software upgrade task to the vehicle side is: The method according to claim 5, characterized in that it includes the steps of: transmitting authentication information, signature authentication information, a software upgrade rollback flag, and a software upgrade package corresponding to the software upgrade task to the vehicle, allowing the vehicle to decide to upgrade to a lower version of the software according to the software upgrade rollback flag; decrypting the signature authentication information according to the software upgrade public key to obtain the digest authentication information; performing a digest operation on the authentication information to obtain new digest authentication information; extracting the first software upgrade count from the authentication information; determining that the over-the-air upgrade is valid according to the relationship between the first software upgrade count and the second software upgrade count stored therein, and the correspondence between the new digest authentication information and the digest authentication information; and then upgrading to a lower version of the software using the software upgrade package.

7. The steps described above include: receiving a software upgrade task transmitted from the vehicle, updating the first software upgrade count, detecting whether the software upgrade task is a lower version software upgrade task, and obtaining a software upgrade rollback flag; After receiving a software upgrade task, the first software upgrade count is incremented by 1, and the software upgrade version and the current software version are obtained based on the software upgrade task. If it is detected that the software upgrade version is less than or equal to the current software version, the software upgrade task is determined to be a lower version software upgrade task, and the software upgrade rollback flag is set to 1. The method according to claim 1, comprising the step of determining that the software upgrade task is not a lower version software upgrade task if it is detected that the software upgrade version is less than or equal to the current software version, and setting the software upgrade rollback flag to 0.

8. This is an over-the-air upgrade method, applied to the vehicle side. The steps include receiving a software upgrade key sent from the network side, The steps include sending a software upgrade task to the network side and receiving upgrade information, encrypted upgrade information, a software upgrade rollback flag, and a software upgrade package corresponding to the software upgrade task from the network side, wherein the encrypted upgrade information is obtained by the network side encrypting upgrade information including a first software upgrade count using the software upgrade key, the first software upgrade count is obtained by the network side updating the current software upgrade count after receiving the software upgrade task, and the software upgrade rollback flag is obtained by the network side detecting whether the software upgrade task is a lower version software upgrade task. The steps include: determining to upgrade to a lower version of the software according to the software upgrade rollback flag, then decrypting the encrypted upgrade information according to the software upgrade key to obtain new upgrade information and a first software upgrade count stored on the network side; An over-the-air upgrade method characterized by comprising the step of determining that an over-the-air upgrade is valid in accordance with the relationship between the number of first software upgrades and the number of second software upgrades stored therein, and the correspondence between new upgrade information and the upgrade information, and then upgrading to a lower version of the software using the software upgrade package.

9. The software upgrade key includes a software upgrade master key, the upgrade information further includes software information and authentication information for upgrade authentication, and the encrypted upgrade information includes encrypted authentication information. The step of receiving upgrade information, encrypted upgrade information, a software upgrade rollback flag, and a software upgrade package corresponding to the software upgrade task, which are fed back from the network side, The step includes receiving software information, authentication information, encrypted authentication information, a software upgrade rollback flag, and a software upgrade package corresponding to the software upgrade task, which are fed back from the network side. The step of decrypting the encrypted upgrade information according to the software upgrade key to obtain new upgrade information and the first software upgrade count stored on the network side is: The steps include: performing symmetric encryption on the software information according to the aforementioned software upgrade master key to obtain a rollback operation key; The method according to the 8th, characterized by comprising the steps of: decrypting encrypted authentication information using the rollback business key to obtain new authentication information after decryption; and extracting the number of first software upgrades stored on the network side from the new authentication information.

10. Before upgrading to a lower version of the software using the aforementioned software upgrade package, If it is detected that the number of first software upgrades is greater than the number of second software upgrades, the step is to determine whether the new authentication information matches the aforementioned authentication information. If it is detected that the new authentication information matches the aforementioned authentication information, the over-the-air upgrade is determined to be valid, the value of the first software upgrade count is assigned to the second software upgrade count, and the step of upgrading to the lower version software using the software upgrade package is performed. The method according to 9, further comprising the step of stopping the upgrade if it is detected that the new authentication information does not match the aforementioned authentication information, or that the number of first software upgrades is less than or equal to the number of second software upgrades.

11. After receiving the software upgrade key sent from the network, The steps include obtaining the software upgrade version and the current software version, comparing the software upgrade version and the current software version, and obtaining a software upgrade rollback flag to indicate whether or not it is a lower version software upgrade task. The steps include: determining an upgrade to a lower version based on the software upgrade rollback flag; performing symmetric encryption on the software upgrade version, the current software version, and the software upgrade rollback flag; obtaining a rollback operation key; and receiving authentication information for upgrade authentication, encrypted authentication information, and a software upgrade package entered offline by the user, wherein the authentication information, encrypted authentication information, and software upgrade package are obtained by the user from the network side. The method according to 10, further comprising the steps of decrypting encrypted authentication information using the rollback business key to obtain new authentication information after decryption, and performing subsequent steps.

12. The software upgrade key includes an asymmetric key pair consisting of a software upgrade public key and a software upgrade private key, the upgrade information further includes authentication information and digest authentication information for upgrade authentication, and the encrypted upgrade information includes signature authentication information. The step of receiving upgrade information, encrypted upgrade information, a software upgrade rollback flag, and a software upgrade package corresponding to the software upgrade task, which are fed back from the network side, The step includes receiving authentication information, signature authentication information, a software upgrade rollback flag, and a software upgrade package corresponding to the software upgrade task, which are fed back from the network side. The step of decrypting the encrypted upgrade information according to the software upgrade key to obtain new upgrade information and the first software upgrade count stored on the network side is: The method according to the 8th, characterized in that it includes the steps of: decrypting signature authentication information in accordance with a software upgrade public key transmitted from the network side to obtain digest authentication information; performing a digest operation on the authentication information to obtain new digest authentication information; and extracting the number of first software upgrades from the authentication information.

13. Before upgrading to a lower version of the software using the aforementioned software upgrade package, If it is detected that the new digest authentication information matches the digest authentication information, the steps include determining whether the number of first software upgrades is greater than the number of second software upgrades, If it is detected that the number of first software upgrades is greater than the number of second software upgrades, the over-the-air upgrade is determined to be valid, the value of the number of first software upgrades is assigned to the number of second software upgrades, and the step of upgrading to a lower version of the software using the software upgrade package is performed. The method according to 12, further comprising the step of stopping the upgrade if it is detected that the number of first software upgrades is less than or equal to the number of second software upgrades, or if new digest authentication information does not match the digest authentication information.

14. After receiving the software upgrade public key sent from the network side, The steps include obtaining the software upgrade version and the current software version, comparing the software upgrade version and the current software version, and obtaining a software upgrade rollback flag to indicate whether or not it is a lower version software upgrade task. The method according to 13, further comprising the steps of: determining to upgrade to a lower version in accordance with the software upgrade rollback flag; receiving authentication information, signature authentication information, and a software upgrade package for upgrade authentication entered offline by the user; decrypting the signature authentication information in accordance with the software upgrade public key transmitted from the network side to obtain digest authentication information; and performing subsequent steps, wherein the authentication information, signature authentication information, and software upgrade package are obtained by the user from the network side.

15. An over-the-air upgrade system, including the network side and the vehicle side, The network side generates a software upgrade key, transmits the software upgrade key to the vehicle side, receives a software upgrade task transmitted from the vehicle side, updates the first software upgrade count, detects whether the software upgrade task is a lower version software upgrade task, obtains a software upgrade rollback flag, encrypts the upgrade information including the first software upgrade count using the software upgrade key, generates encrypted upgrade information, and transmits the upgrade information, encrypted upgrade information, software upgrade rollback flag, and a software upgrade package corresponding to the software upgrade task to the vehicle side. The over-the-air upgrade system is characterized in that, after the vehicle decides to upgrade to a lower version of the software according to the software upgrade rollback flag, it decrypts the encrypted upgrade information according to the software upgrade key to obtain new upgrade information and a first software upgrade count, and after determining that the over-the-air upgrade is valid according to the relationship between the first software upgrade count and a second software upgrade count stored therein and the correspondence between the new upgrade information and the upgrade information, it is used to upgrade to a lower version of the software using the software upgrade package.

16. A computer device, A computer device comprising a first memory and a first processor, wherein the first memory and the first processor are connected to each other in communication, the first memory stores a first computer instruction, and the first processor executes the over-the-air upgrade method according to any one of claims 1 to 7 by executing the first computer instruction.

17. It is a vehicle, A vehicle comprising a second memory and a second processor, wherein the second memory and the second processor are connected to each other in communication, the second memory stores a second computer instruction, and the second processor executes the over-the-air upgrade method according to any one of claims 8 to 14 by executing the second computer instruction.

Images