Update systems and methods that prevent unauthorized modification of information

Abstract

A method for preventing unauthorized modification of information is implemented by a server device and an update device. The server device stores an update file, an encrypted update file after encrypting the update file, a hash value before encryption corresponding to the update file, and a hash value after encryption corresponding to the encrypted update file. The method includes: (S1) The update device decrypts the received encrypted update file to obtain the update file; (S2) The update device sends a hash value after encryption to be verified corresponding to the received encrypted update file to the server device; (S3) The update device sends a hash value before encryption to be verified corresponding to the decrypted update file to the server device; (S4) When the server device successfully verifies the hash value before encryption and the hash value before encryption to be verified, the update device performs an update.

Description

[Technical Field]

[0001] This invention relates to a system update system and method thereof, and more particularly to an update system and method thereof that can prevent unauthorized modification of information. [Previous Technology]

[0002] Existing update technologies have many problems, such as: (1) requiring simultaneous download and update at a set time; (2) the downloaded update file cannot be verified as modified; and (3) the source of the downloaded update file cannot be verified as correct. In response, US Patent US9464905B2 discloses a method for updating a vehicle electronic control unit (ECU). This method includes the following steps: establishing communication between the vehicle ECU and an update server in advance, enabling the two parties to exchange keys via communication, and the update server transmitting the update file to the vehicle ECU via communication. The vehicle ECU then verifies the update file based on the obtained key and updates the vehicle ECU after verification.

[0003] The above-mentioned technology can effectively verify downloaded update files, ensuring that they have not been modified without authorization. However, this technology is limited to verifying file integrity. When the key is intercepted or stolen by a third party, the legitimacy of the update information cannot be verified, and therefore cannot be protected, posing a potential security risk. In other words, once an attacker obtains the key, they may disguise malicious files as legitimate update files, leading to attacks during vehicle ECU updates.

[0004] In view of this, the prior art needs an improved solution to enhance the security of the update process. [Summary of the Invention]

[0005] Therefore, the object of the present invention is to provide an update system that can prevent unauthorized modification of information.

[0006] Thus, the present invention provides an update system that prevents unauthorized modification of information, comprising a server device and an update device that is signal-connected to the server device.

[0007] The server device stores an update file for updating the update device, an encrypted update file after the update file is encrypted using an encryption and decryption algorithm, a hash value before encryption obtained based on the update file and using a hash algorithm, and a hash value after encryption obtained based on the encrypted update file and using the hash algorithm.

[0008] Wherein, the server device transmits the encrypted update file to the update device. After receiving the encrypted update file, the update device uses the encryption / decryption algorithm to decrypt the encrypted update file to obtain the update file. Based on the encrypted update file, the update device uses the hash algorithm to obtain and transmit a hash value corresponding to the received encrypted update file that needs to be verified after encryption to the server device. Based on the update file, the update device uses the hash algorithm to obtain and transmit a hash value corresponding to the decrypted update file that needs to be verified before encryption to the server device. The device, the server device, determines whether the encrypted hash value is the same as the encrypted hash value to be verified, and determines whether the unencrypted hash value is the same as the unencrypted hash value to be verified. When the server device determines that the encrypted hash value is the same as the encrypted hash value to be verified, and determines that the unencrypted hash value is the same as the unencrypted hash value to be verified, the server device generates and transmits an update command to the update device to instruct the update device to continue updating. After receiving the update command, the update device updates according to the update file.

[0009] Another object of the present invention is to provide an update method that prevents unauthorized modification of information, implemented by a server device that is signal-connected to an update device. The server device stores an update file for updating the update device, an encrypted update file after the update file is encrypted using an encryption and decryption algorithm, a hash value before encryption obtained based on the update file and using a hash algorithm, and a hash value after encryption obtained based on the encrypted update file and using the hash algorithm. The update method that prevents unauthorized modification of information includes a step (A), a step (B), a step (C), a step (D), and a step (E).

[0010] Step (A) is to transmit the encrypted update file to the update terminal device through the server device, so that the update terminal device can obtain and transmit a corresponding encrypted hash value to be verified to the server device based on the encrypted update file and the hash algorithm.

[0011] Step (B) is to determine whether the encrypted hash value is the same as the encrypted hash value to be verified after receiving the encrypted hash value to be verified by the server device.

[0012] Step (C) is that when it is determined that the encrypted hash value is the same as the encrypted hash value to be verified, the server device generates and transmits a first update instruction to the update device to instruct the update device to continue updating, so that after receiving the first update instruction, the update device uses the encryption and decryption algorithm to decrypt the encrypted update file to obtain the update file, and according to the update file, uses the hash algorithm to obtain and transmit a hash value before encryption to be verified corresponding to the decrypted update file to the server device.

[0013] Step (D) is to determine whether the pre-encryption hash value is the same as the pre-encryption hash value to be verified by the server device after receiving the pre-encryption hash value to be verified.

[0014] Step (E) is to generate and transmit a second update instruction to the update terminal device by the server device when it is determined that the hash value before encryption is the same as the hash value before encryption to be verified, so that the update terminal device can update according to the update file after receiving the second update instruction.

[0015] Another object of the present invention is to provide an update method that can prevent unauthorized modification of information, implemented by an update terminal device, the update terminal device being signal-connected to a server terminal device, the server terminal device storing an update file for updating the update terminal device, an encrypted update file after the update file is encrypted using an encryption and decryption algorithm, a hash value before encryption obtained based on the update file and using a hash algorithm, and a hash value after encryption obtained based on the encrypted update file and using the hash algorithm. The update method that can prevent unauthorized modification of information includes a step (A), a step (B), a step (C), and a step (D).

[0016] Step (A) is that after receiving the encrypted update file from the server device, the update terminal device obtains and transmits a corresponding encrypted hash value to be verified to the server device using the hash algorithm based on the encrypted update file, so that when the server device determines that the encrypted hash value is the same as the encrypted hash value to be verified, it generates and transmits a first update instruction to the update terminal device to instruct the update terminal device to continue updating.

[0017] Step (B) is to use the encryption and decryption algorithm to decrypt the encrypted update file after receiving the first update instruction by the update terminal device, so as to obtain the update file.

[0018] Step (C) is to use the update terminal device to obtain and transmit a hash value before encryption corresponding to the decrypted update file to the server terminal device according to the update file and the hash algorithm, so that when the server terminal device determines that the hash value before encryption is the same as the hash value before encryption to be verified, it generates and transmits a second update instruction to the update terminal device to instruct the update terminal device to continue updating.

[0019] Step (D) is to update the file according to the update terminal device after receiving the second update instruction.

[0020] The advantage of the present invention is that by using the server device 1 to confirm the correctness of the encrypted hash value to be verified and the unencrypted hash value to be verified, the update file is double-verified to ensure the legality of the source of the update file and that it has not been modified without authorization, thereby achieving more comprehensive security protection.

Implementation Method

[0022] Before the present invention is described in detail, it should be noted that similar elements are represented by the same numbers in the following description.

[0023] Referring to FIG1, one embodiment of the update method for preventing unauthorized modification of information according to the present invention is implemented by an update system 100 for preventing unauthorized modification of information. The update system 100 for preventing unauthorized modification of information includes a server device 1 and an update terminal device 2 connected to the server device 1 via a communication network 900.

[0024] The server device 1 includes a server communication module 11, a server storage module 12, and a server processing module 13 electrically connected to the server communication module 11 and the server storage module 12.

[0025] The server-side storage module 12 stores an update file for updating the update terminal device, an encrypted update file after the update file is encrypted using an encryption and decryption algorithm, a hash value before encryption obtained based on the update file and using a hash algorithm, and a hash value after encryption obtained based on the encrypted update file and using the hash algorithm.

[0026] It is worth noting that, in this embodiment, the encryption / decryption algorithm includes a symmetric-key algorithm, such as Advanced Encryption Standard 128, but is not limited thereto. Furthermore, the hash algorithm includes a hash algorithm, but is not limited thereto.

[0027] The update end device 2 includes an update end communication module 21, an update end storage module 22, and an update end processing module 23 electrically connected to the update end communication module 21 and the update end storage module 22.

[0028] The server device 1 may be a server or a human computer, but is not limited thereto.

[0029] The update device 2 may be an on-board device installed in a vehicle, but is not limited thereto.

[0030] Referring to Figures 2 and 3, the following will describe the operation details of the server device 1 and the update device 2 in conjunction with this embodiment of the update method for preventing unauthorized modification of information. This embodiment of the update method for preventing unauthorized modification of information includes steps S301 to S315.

[0031] In step S301, the server-side processing module 13 obtains the pre-encryption hash value corresponding to the update file using the hash algorithm, and stores the pre-encryption hash value in the server-side storage module 12.

[0032] In step S302, the server processing module 13 uses the encryption and decryption algorithm to encrypt the update file, obtain the encrypted update file, and stores the encrypted update file in the server storage module 12, and transmits the encrypted update file to the update device 2 through the server communication module 11.

[0033] In step S303, the server-side processing module 13 obtains the encrypted hash value corresponding to the encrypted update file using the hash algorithm, and stores the encrypted hash value in the server-side storage module 12.

[0034] In step S304, after receiving the encrypted update file through the update end communication module 21, the update end processing module 23 stores the encrypted update file in the update end storage module 22. Based on the encrypted update file, the update end processing module 23 uses the hash algorithm to obtain a hash value to be verified corresponding to the received encrypted update file, and transmits the hash value to be verified to the server device 1 through the update end communication module 21.

[0035] In step S305, after receiving the encrypted hash value to be verified through the server communication module 11, the server processing module 13 determines whether the encrypted hash value is the same as the encrypted hash value to be verified. When the server processing module 13 determines that the encrypted hash value is not the same as the encrypted hash value to be verified, the process step S306 is performed; when the server processing module 13 determines that the encrypted hash value is the same as the encrypted hash value to be verified, the process step S308 is performed.

[0036] In step S306, the server processing module 13 generates a first stop update command to instruct the update terminal device 2 to stop updating, and transmits the first stop update command to the update terminal device 2 through the server communication module 11.

[0037] In step S307, after receiving the first stop update command through the update terminal communication module 21, the update terminal processing module 23 stops the update method that can prevent unauthorized modification of information.

[0038] In step S308, the server processing module 13 generates a first update instruction to instruct the update terminal device to continue updating, and transmits the first update instruction to the update terminal device 2 through the server communication module 11.

[0039] In step S309, after receiving the first update instruction through the update end communication module 21, the update end processing module 23 uses the encryption and decryption algorithm to decrypt the encrypted update file to obtain the update file.

[0040] In step S310, the update processing module 23 obtains a hash value before encryption to be verified corresponding to the decrypted update file by using the hash algorithm according to the update file, and transmits the hash value before encryption to be verified to the server device 1 through the update communication module 21.

[0041] In step S311, after receiving the pre-encryption hash value to be verified through the server communication module 11, the server processing module 13 determines whether the pre-encryption hash value is the same as the pre-encryption hash value to be verified. When the server processing module 13 determines that the pre-encryption hash value is not the same as the pre-encryption hash value to be verified, the process step S312 is performed; when the server processing module 13 determines that the pre-encryption hash value is the same as the pre-encryption hash value to be verified, the process step S314 is performed.

[0042] In step S312, the server processing module 13 generates a second stop update command to instruct the update terminal device 2 to stop updating, and transmits the second stop update command to the update terminal device 2 through the server communication module 11.

[0043] In step S313, after receiving the second stop update command through the update terminal communication module 21, the update terminal processing module 23 stops the update method that can prevent unauthorized modification of information.

[0044] In step S314, the server-side processing module 13 generates a second update instruction to instruct the update terminal device to continue updating, and the server-side communication module 11 transmits the second update instruction to the update terminal device 2.

[0045] In step S315, after receiving the second update instruction through the update terminal communication module 21, the update terminal processing module 23 updates according to the update file.

[0046] Referring to Figure 4, step S315 also includes steps S315A and S315B.

[0047] In step S315A, after receiving the second update command through the update terminal communication module 21, the update terminal processing module 23 determines whether the vehicle is in an updateable state. When the update terminal processing module 23 determines that the vehicle is not in the updateable state, it stops the update method that prevents unauthorized modification of information; when the update terminal processing module 23 determines that the vehicle is in the updateable state, it proceeds to process step S315B.

[0048] In detail, the update terminal device 2 is based on UNECE R 156 "Software updates and software update management systems" and ISO 24089 "Road vehicles - Software update engineering", and is designed to determine whether the vehicle is in the update-ready state by determining at least one of the following: whether the vehicle's battery level is greater than a preset battery level, whether the vehicle is stopped, whether there are obstacles around the vehicle, whether the driver has confirmed the update, and whether the vehicle is locked. Specifically, when the update terminal device determines that the battery level is greater than the preset battery level, the vehicle is stopped, there are no obstacles around the vehicle, the driver has confirmed the update, and the vehicle is locked, the vehicle is determined to be in the update-ready state; when the update terminal device determines that the battery level is not greater than the preset battery level, or the vehicle is not stopped, or there are obstacles around the vehicle, or the driver has not confirmed the update, or the vehicle is not locked, the vehicle is determined not to be in the update-ready state. It is worth noting that the driver of the vehicle can freely decide when to perform the update by confirming whether to perform the update.

[0049] In step S315B, the update terminal processing module 23 updates according to the update file.

[0050] Referring to Figure 5, another embodiment of the update method of the present invention that can prevent unauthorized modification of information includes steps S401 to S411.

[0051] In step S401, the server-side processing module 13 obtains the pre-encryption hash value corresponding to the update file using the hash algorithm, and stores the pre-encryption hash value in the server-side storage module 12.

[0052] In step S402, the server processing module 13 uses the encryption and decryption algorithm to encrypt the update file, obtain the encrypted update file, and stores the encrypted update file in the server storage module 12, and transmits the encrypted update file to the update device 2 through the server communication module 11.

[0053] In step S403, the server-side processing module 13 obtains the encrypted hash value corresponding to the encrypted update file using the hash algorithm, and stores the encrypted hash value in the server-side storage module 12.

[0054] In step S404, after receiving the encrypted update file through the update end communication module 21, the update end processing module 23 uses the encryption and decryption algorithm to decrypt the encrypted update file to obtain the update file.

[0055] In step S405, the update end processing module 23 obtains the encrypted hash value to be verified corresponding to the received encrypted update file by using the hash algorithm, and transmits the encrypted hash value to be verified to the server device 1 through the update end communication module 21.

[0056] In step S406, the update processing module 23 obtains the unencrypted hash value of the update file to be verified by using the hash algorithm according to the update file, and transmits the unencrypted hash value to be verified to the server device 1 through the update communication module 21.

[0057] In step S407, after receiving the encrypted hash value to be verified and the unencrypted hash value to be verified through the server communication module 11, the server processing module 13 determines whether the encrypted hash value is the same as the encrypted hash value to be verified, and also determines whether the unencrypted hash value is the same as the unencrypted hash value to be verified. When the server processing module 13 determines that the encrypted hash value is not the same as the encrypted hash value to be verified, or determines that the unencrypted hash value is not the same as the unencrypted hash value to be verified, the process step S408 is performed; when the server processing module 13 determines that the encrypted hash value is the same as the encrypted hash value to be verified, and determines that the unencrypted hash value is the same as the unencrypted hash value to be verified, the process step S410 is performed.

[0058] In step S408, the server processing module 13 generates a stop update command to instruct the update terminal device 2 to stop updating, and transmits the stop update command to the update terminal device 2 through the server communication module 11.

[0059] In step S409, after receiving the stop update command through the update terminal communication module 21, the update terminal processing module 23 stops the update method that can prevent unauthorized modification of information.

[0060] In step S410, the server-side processing module 13 generates an update command to instruct the update terminal device to continue updating, and the server-side communication module 11 transmits the update command to the update terminal device 2.

[0061] In step S411, after receiving the update instruction through the update terminal communication module 21, the update terminal processing module 23 updates according to the update file.

[0062] In summary, the update method of the present invention, which prevents unauthorized modification of information, not only confirms the correctness of the encrypted hash value to be verified and the unencrypted hash value to be verified through the server device 1, performing double verification on the update file to ensure the legitimacy of the update file source and that it has not been modified without authorization, thereby achieving more comprehensive security protection, but also confirms that the vehicle is in a safe state where it can be updated before performing the update operation through the update terminal device 2, effectively avoiding the occurrence of potential risks. Therefore, the present invention can comprehensively improve the security and reliability of the update process, and truly achieves the intended purpose of the invention.

[0063] However, the above description is only an embodiment of the present invention and should not be construed as limiting the scope of the present invention. Any simple equivalent changes and modifications made in accordance with the scope of the patent application and the contents of the patent specification of the present invention shall still fall within the scope of the patent of the present invention. [Simplified Explanation of the Diagram]

[0021] Other features and effects of the present invention will be clearly presented in the embodiments with reference to the drawings, wherein: FIG1 is a block diagram illustrating an update system for preventing unauthorized modification of information for performing one embodiment of the update method for preventing unauthorized modification of information of the present invention; FIG2 is a flowchart illustrating steps S301 to S309 of this embodiment of the update method for preventing unauthorized modification of information of the present invention; FIG3 is a flowchart illustrating steps S310 to S315 of this embodiment; FIG4 is a flowchart illustrating the sub-steps of step S315 of this embodiment; and FIG5 is a flowchart illustrating another embodiment of the update method for preventing unauthorized modification of information of the present invention.

Claims

1. An update system for preventing unauthorized modification of information, comprising: an update terminal device including an in-vehicle device installed in a vehicle; and a server terminal device signal-connected to the update terminal device, the server terminal device storing an update file for updating the update terminal device, an encrypted update file obtained by encrypting the update file using an encryption / decryption algorithm, a pre-encryption hash value obtained based on the update file using a hash algorithm, and a post-encryption hash value obtained based on the encrypted update file using the hash algorithm; wherein, The server device transmits the encrypted update file to the update device. Upon receiving the encrypted update file, the update device uses the encryption / decryption algorithm to decrypt the file, obtaining the update file. Based on the encrypted update file, the update device uses the hash algorithm to obtain and transmit a corresponding encrypted hash value to be verified for the received encrypted update file to the server device. Based on the update file, the update device uses the hash algorithm to obtain and transmit a corresponding unencrypted hash value to be verified for the decrypted update file to the server device. The server device then compares the encrypted hash value with the unencrypted hash value to be verified. The server determines whether the encrypted hash value is the same as the encrypted hash value to be verified. When the server determines that the encrypted hash value is the same as the encrypted hash value to be verified, and the encrypted hash value is the same as the encrypted hash value to be verified, the server generates and transmits an update command to the update device to instruct the update device to continue updating. After receiving the update command, the update device determines whether the vehicle is in an updateable state. When the update device determines that the vehicle is in an updateable state, the update device updates according to the update file.

2. An update system as described in claim 1 that prevents unauthorized modification of information, wherein, The update device determines whether the vehicle is in an updateable state by judging whether the vehicle's battery level is greater than a preset battery level, whether the vehicle is stopped, and whether the driver of the vehicle has confirmed the update. When the update device determines that the battery level is greater than the preset battery level, the vehicle is stopped, and the driver of the vehicle has confirmed the update, the vehicle is in an updateable state.

3. An update method for preventing unauthorized modification of information, implemented by a server device, the server device being signal-connected to an update device, the server device storing an update file for updating the update device, an encrypted update file after encrypting the update file using an encryption / decryption algorithm, a pre-encryption hash value obtained based on the update file and using a hash algorithm, and a post-encryption hash value obtained based on the encrypted update file and using the hash algorithm, the update device including an in-vehicle device installed in a vehicle, the update method for preventing unauthorized modification of information comprising the following steps: (A) transmitting the encrypted update file to the update device via the server device, so that the update device obtains and transmits a post-encryption hash value to be verified corresponding to the received encrypted update file to the server device based on the encrypted update file and using the hash algorithm; (B) determining, upon receiving the post-encryption hash value to be verified, whether the post-encryption hash value is the same as the post-encryption hash value to be verified. (C) When it is determined that the encrypted hash value is the same as the encrypted hash value to be verified, the server device generates and transmits a first update command to the update device to instruct the update device to continue updating. Upon receiving the first update command, the update device uses the encryption / decryption algorithm to decrypt the encrypted update file to obtain the update file, and based on the update file, uses the hash algorithm to obtain and transmit a pre-encryption hash value corresponding to the decrypted update file to be verified to the server device; (D) Upon receiving the pre-encryption hash value to be verified, the server device determines whether the pre-encryption hash value is the same as the pre-encryption hash value to be verified; and (E) When it is determined that the hash value before encryption is the same as the hash value before encryption to be verified, the server device generates and transmits a second update command to the update device to instruct the update device to continue updating. After receiving the second update command, the update device determines whether the vehicle is in an updateable state. When the update device determines that the vehicle is in the updateable state, it updates according to the update file.

4. The update method for preventing unauthorized modification of information as described in claim 3, wherein, In step (E), the update device determines whether the vehicle is in the updateable state by determining whether the vehicle's battery level is greater than a preset battery level, whether the vehicle is stopped, and whether the driver of the vehicle has confirmed the execution of the update. When the update device determines that the battery level is greater than the preset battery level, the vehicle is stopped, and the driver of the vehicle has confirmed the execution of the update, the vehicle is determined to be in the updateable state.

5. An update method for preventing unauthorized modification of information, implemented by an update terminal device signal-connected to a server terminal device, the server terminal device storing an update file for updating the update terminal device, an encrypted update file obtained by encrypting the update file using an encryption / decryption algorithm, a pre-encryption hash value obtained based on the update file and using a hash algorithm, and a post-encryption hash value obtained based on the encrypted update file and using the hash algorithm, the update terminal device including an in-vehicle device installed in a vehicle, the update method for preventing unauthorized modification of information comprising the following steps: (A) (A) Upon receiving the encrypted update file from the server device, the update terminal device, based on the encrypted update file, uses the hash algorithm to obtain and transmit a corresponding encrypted hash value to be verified for the received encrypted update file to the server device. When the server device determines that the encrypted hash value matches the encrypted hash value to be verified, it generates and transmits a first update command to instruct the update terminal device to continue the update. (B) Upon receiving the first update command, the update terminal device uses the encryption / decryption algorithm to decrypt the encrypted update file to obtain the update file. (C) Based on the update file, the update terminal device uses the hash algorithm to obtain and transmit a corresponding unencrypted hash value to be verified for the decrypted update file to the server device. When the server device determines that the unencrypted hash value matches the unencrypted hash value to be verified, it generates and transmits a second update command to instruct the update terminal device to continue the update. (D) Upon receiving the second update command, the update terminal device determines whether the vehicle is in an updateable state; and (E) when the vehicle is determined to be in the updateable state, the update terminal device performs an update based on the update file.

6. The update method for preventing unauthorized modification of information as described in claim 5, wherein, In step (D), the update device determines whether the vehicle is in the updateable state by determining whether the vehicle's battery level is greater than a preset battery level, whether the vehicle is stopped, and whether the driver of the vehicle has confirmed the execution of the update. When the update device determines that the battery level is greater than the preset battery level, the vehicle is stopped, and the driver of the vehicle has confirmed the execution of the update, the vehicle is determined to be in the updateable state.

Images