Secure boot method, system and device for in-vehicle infotainment system, and medium and vehicle

Abstract

A secure boot method, system and device for an in-vehicle infotainment system, and a medium and a vehicle, which improve the security of a vehicle startup process. The method comprises: when a microcontroller unit detects an in-vehicle infotainment system power-on signal, using a first preset encryption algorithm to verify an application program; and if the verification of the application program is successful, outputting an enable signal to initiate the boot of a system on chip (S100); the system on chip using a second preset encryption algorithm to verify a digital signature of the system on chip; and if the verification of the digital signature is successful, loading a bootloader (S200); once the bootloader starts successfully, launching a hypervisor and a kernel to boot the system on chip (S300); and once the system on chip is successfully booted, loading a file system to boot an in-vehicle infotainment system (S400). The present invention can improve the security of the vehicle startup process and can be widely applied in the technical field of automotive control.

Description

Safe startup methods, systems, devices, media and vehicles for vehicle infotainment systems Technical Field

[0001] This invention relates to the field of automotive control technology, and in particular to a method, system, device, medium, and vehicle for safe startup of a vehicle infotainment system. Background Technology

[0002] Currently, the automotive industry is developing towards connectivity, automation, sharing, and electrification, with these "four new trends" all pointing towards intelligentization. Intelligentization revolutionized the mobile phone industry 15 years ago, and it's now playing out again in the automotive industry, making automobiles the world's most dynamic market. As automotive intelligence increases, to ensure the security and reliability of in-vehicle systems, these systems need certain protective measures to guarantee smooth startup every time power is supplied, preventing tampering or attacks on the vehicle and its services.

[0003] Summary of the Invention

[0004] In view of this, in order to solve one of the above problems, the purpose of the embodiments of the present invention is to provide a safe starting method, system, device, medium and vehicle for vehicle infotainment systems, which can improve the safety of the vehicle starting process.

[0005] On one hand, embodiments of the present invention provide a method for secure startup of a vehicle infotainment system, including:

[0006] When the microcontroller detects the power-on signal of the vehicle system, it uses the first preset encryption algorithm to verify the application; if the application is successfully verified, it outputs an enable signal to start the on-chip system.

[0007] The on-chip system uses a second preset encryption algorithm to verify the digital signature of the on-chip system; if the digital signature verification is successful, the boot program is loaded.

[0008] After the bootloader starts successfully, it starts the virtual machine and kernel to boot the on-chip system;

[0009] After the on-chip system starts successfully, the file system is loaded to start the vehicle infotainment system.

[0010] Optionally, the step of verifying the application using a first preset encryption algorithm specifically includes:

[0011] Cyclic redundancy check is used to verify the application, and the first check value is obtained;

[0012] The first verification value is encrypted using a first preset encryption algorithm to obtain a first verification authentication value; the first preset encryption algorithm includes a symmetric algorithm.

[0013] The first verification value is compared with a preset stored reference verification value. If the first verification value matches the reference verification value, the application verification is successful.

[0014] Optionally, the startup method further includes:

[0015] If the microcontroller unit is upgraded, the upgraded application is verified to obtain a second verification value.

[0016] The second verification value is encrypted using a first preset encryption algorithm to obtain a second verification authentication value, and the stored reference verification value is updated based on the second verification authentication value.

[0017] Optionally, the second preset encryption algorithm includes an asymmetric algorithm; the on-chip system uses the second preset encryption algorithm to verify the digital signature of the on-chip system, specifically including:

[0018] The first hash value is obtained by calculating the digital signature of the on-chip system using the private key;

[0019] The digital signature of the on-chip system is calculated using the public key to obtain the second hash value;

[0020] The first hash value and the second hash value are compared. If the first hash value and the second hash value are consistent, the digital signature verification of the on-chip system is successful.

[0021] Optionally, the startup method further includes: performing step-by-step verification of all digital signatures on the on-chip system.

[0022] Optionally, the public key includes a root public key and a content public key, and the step-by-step verification of all digital signatures on the on-chip system specifically includes:

[0023] When the system-on-chip is powered on, the root public key is used to verify the first-level digital signature; if the first-level digital signature verification is successful, the second-level digital signature verification is initiated.

[0024] The second-level digital signature is verified using the content public key; if the second-level digital signature verification is successful, the third-level digital signature verification is initiated.

[0025] The second-level digital signature is verified using the content public key; if the third-level digital signature verification is successful, the boot program starts successfully.

[0026] Optionally, the boot method further includes: disabling write operations to the partition of the bootloader from the driver layer.

[0027] Optionally, the kernel is loaded by the bootloader.

[0028] On the other hand, embodiments of the present invention provide a vehicle infotainment system safe startup system, including:

[0029] The first module is used to verify the application using a first preset encryption algorithm when the microcontroller detects the power-on signal of the vehicle system; if the application is successfully verified, an enable signal is output to start the on-chip system.

[0030] The second module is used to verify the digital signature of the on-chip system using a second preset encryption algorithm; if the digital signature verification is successful, the boot program is loaded.

[0031] The third module is used to start the virtual machine and kernel to start the on-chip system after the boot program has started successfully;

[0032] The fourth module is used to load the file system to start the vehicle infotainment system after the on-chip system has successfully started.

[0033] On the other hand, embodiments of the present invention provide a vehicle infotainment system safe start device, comprising:

[0034] At least one processor;

[0035] At least one memory for storing at least one program;

[0036] When the at least one program is executed by the at least one processor, the at least one processor implements the above-described secure boot method.

[0037] On the other hand, embodiments of the present invention provide a computer-readable storage medium storing a processor-executable program, which, when executed by a processor, is used to perform the above-described secure boot method.

[0038] On the other hand, embodiments of the present invention provide a vehicle that includes the above-described safety start system or the above-described safety start device.

[0039] Implementing the embodiments of the present invention has the following beneficial effects: When the microcontroller detects the power-on signal of the vehicle system, it verifies the application using a first preset encryption algorithm; if the application verification is successful, it outputs an enable signal to start the on-chip system. Before the on-chip system starts, the integrity and legality of the application are verified, improving the security of the microcontroller startup; the on-chip system uses a second preset encryption algorithm to verify the digital signature of the on-chip system; if the digital signature verification is successful, the bootloader is loaded. Before loading the bootloader, the integrity and legality of the digital signature of the on-chip system are verified again, improving the security of the on-chip system startup; after the bootloader starts successfully, the virtual machine and kernel are started to start the on-chip system; after the on-chip system starts successfully, the file system is loaded to start the vehicle system; thereby reducing the possibility of the vehicle system being maliciously tampered with or attacked, and improving the security of the vehicle startup process. Attached Figure Description

[0040] Figure 1 is a flowchart of power management for a vehicle infotainment system according to an embodiment of the present invention;

[0041] Figure 2 is a flowchart illustrating the steps of a vehicle infotainment system safe startup method provided in an embodiment of the present invention.

[0042] Figure 3 is a timing diagram of the startup process of an MCU provided in an embodiment of the present invention;

[0043] Figure 4 is a timing diagram of the startup process of a SOC provided in an embodiment of the present invention;

[0044] Figure 5 is a schematic flowchart of the steps for verifying an application provided by an embodiment of the present invention;

[0045] Figure 6 is a schematic flowchart of a step for updating a reference verification value according to an embodiment of the present invention;

[0046] Figure 7 is a schematic flowchart of a step for verifying the front of a number according to an embodiment of the present invention;

[0047] Figure 8 is a schematic flowchart of a step-by-step verification process for a digital signature provided in an embodiment of the present invention.

[0048] Figure 9 is a schematic diagram of another step-by-step verification process for digital signatures provided by an embodiment of the present invention;

[0049] Figure 10 is a structural block diagram of a vehicle infotainment system safe start system provided in an embodiment of the present invention;

[0050] Figure 11 is a structural block diagram of a vehicle infotainment system safety start device provided in an embodiment of the present invention. Detailed Implementation

[0051] The present invention will now be described in further detail with reference to the accompanying drawings and specific embodiments. The step numbers in the following embodiments are only for ease of explanation and do not limit the order of the steps. The execution order of each step in the embodiments can be adapted according to the understanding of those skilled in the art.

[0052] It should be noted that although functional modules are divided in the device schematic diagram and a logical order is shown in the flowchart, in some cases, the steps shown or described may be performed in a different order than the module division in the device or the order in the flowchart. The terms "first," "second," etc., used in the specification, claims, and the foregoing drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented, for example, in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatuses.

[0053] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used herein is for the purpose of describing embodiments of this application only and is not intended to limit this application.

[0054] The terminology used in this embodiment will be explained below.

[0055] JTAG (Joint Test Action Group) is an international standard test protocol (IEEE 1149.1 compliant) primarily used for internal chip testing. The basic principle of JTAG is to define a TAP (Test Access Port) within the device and use dedicated JTAG testing tools to test internal nodes. JTAG testing allows multiple devices to be chained together via the JTAG interface, forming a JTAG chain, enabling individual testing of each device. Today, the JTAG interface is also commonly used to implement ISP (In-System Programmer) for programming devices such as FLASH memory.

[0056] The bootloader (also known as the startup loader or boot program) resides on a computer or other computer application and is the program that boots the operating system. The boot method and the specific program used vary depending on the application and its device. Simply put, the bootloader is a small program that runs before the operating system kernel. Through this program, we can initialize hardware devices, establish a memory space mapping, and bring the system's hardware and software environment to a suitable state, thus preparing the correct environment for the final call to the operating system kernel.

[0057] Hypervisor (virtual machine): A middleware layer software that runs between a physical server and an operating system, allowing multiple operating systems and applications to share a single set of underlying physical hardware. A hypervisor can be viewed as the "meta" operating system in a virtual environment, coordinating access to all physical devices and virtual machines on the server; hence, it is also called a virtual machine monitor. The hypervisor is the core of all virtualization technologies, and non-disruptive support for migrating multiple workloads is a fundamental function of a hypervisor. When the server starts and executes the hypervisor, it allocates appropriate amounts of memory, CPU, network, and disk resources to each virtual machine and loads the guest operating system for all virtual machines.

[0058] Kernel: The most fundamental part of an operating system, it is the core of the operating system. It is the first layer of software extension based on the hardware, providing the most basic functions of the operating system. It is the foundation for the operation of the operating system, responsible for managing system processes, memory, kernel architecture, device drivers, file and network systems, and determining the system's performance and stability.

[0059] CMAC (Cipher Block Chaining-Message Authentication Code), also known as CBC_MAC, is a message authentication code based on a symmetric key block cipher algorithm. Because it is based on a "symmetric key block cipher algorithm," it can be considered an operating mode of a symmetric algorithm.

[0060] Secure Boot is a security feature designed to protect a computer's boot process from malware and unauthorized operating systems. Secure Boot works by requiring each component in the boot process to be digitally signed and verified to ensure it was released by a trusted publisher and has not been tampered with or replaced. If any component fails verification, Secure Boot prevents the computer from continuing to boot.

[0061] `mount` is a Linux command that can mount a partition to a Linux folder, thus linking the partition to that directory. Therefore, accessing the folder is equivalent to accessing the partition.

[0062] Figure 1 shows a flowchart of the power management process for the vehicle infotainment system. The IG-ON signal refers to the ignition switch signal; in this mode, the starter motor does not operate, but basic equipment and settings can still be started normally. The MCU (Microcontroller Unit), also known as a single-chip microcomputer or microcontroller, is primarily responsible for the vehicle infotainment system's CAN signal communication and power logic management in this embodiment. The SOC (System-on-Chip) is an integrated circuit that combines various elements of a computer system into a single chip, containing a complete system and embedded software. In this embodiment, it is mainly responsible for processing audio, video, and image signals for the vehicle infotainment system. The EMMC (Embedded Multimedia Controller) is an integrated chip that encapsulates memory, controller, and interface modules. DDR (Double Data Rate) refers to double data rate synchronous dynamic random access memory.

[0063] The power management process of the vehicle infotainment system is as follows: After the vehicle is powered on, when the infotainment system detects the IG-ON signal, the host generates a power supply voltage to power the MCU. When the MCU detects the IG-ON signal, it outputs an enable signal to power the system power management chip. After the output enable signal turns on the power management chip, the power management chip supplies power to components such as the SOC, eMMC, and DDR. Once the SOC is powered normally, the bootloader is loaded, the memory IC is initialized, the program is loaded from the eMMC (data storage chip) to the DDR (memory) for execution, and the Hypervisor (virtual machine) and Linux kernel are started, completing the startup of the vehicle infotainment system.

[0064] It should be noted that the hardware of the vehicle system needs to be protected to ensure the security of firmware information and prevent malicious extraction of information. The firmware code in the memory is stored in the internal flash memory of the MCU. During the mass production stage of the vehicle project, the JTAG interface is password protected to prevent attackers from accessing the vehicle system's memory through JTAG for firmware security protection.

[0065] Referring to Figure 2, an embodiment of the present invention provides a method for safe startup of a vehicle infotainment system, including steps S100 to S400.

[0066] S100. When the microcontroller detects the power-on signal of the vehicle system, it uses the first preset encryption algorithm to verify the application program; if the application program is successfully verified, it outputs an enable signal to start the on-chip system.

[0067] Referring to Figure 3, when the microcontroller unit (MCU) detects the power-on signal of the vehicle system, it first verifies the application program. If the application program is successfully verified, the MCU outputs an enable signal to turn on the power supply on the system side to power the system on-chip (SOC). After the system on-chip (SOC) detects the power supply, it starts up. If the application program is successfully verified, the MCU does not output an enable signal, the SOC has no power supply, and the SOC cannot start up.

[0068] It should be noted that the first preset encryption algorithm is determined based on the actual application, and this embodiment does not impose specific restrictions.

[0069] S200: The on-chip system uses a second preset encryption algorithm to verify the digital signature of the on-chip system; if the digital signature verification is successful, the boot program is loaded.

[0070] After the on-chip system starts up, the digital signature of the on-chip system is verified using the second preset encryption algorithm; if the digital signature verification is successful, the bootloader is loaded; if the digital signature verification fails, the bootloader cannot be loaded.

[0071] It should be noted that the second preset encryption algorithm is determined based on the actual application, and this embodiment does not impose specific restrictions.

[0072] Specifically, referring to Figure 4, loading and running the Bootloader includes initializing hardware devices, establishing a memory space mapping, etc. Loading the Bootloader mainly consists of two stages:

[0073] Phase 1:

[0074] 1.1 First, initialize the hardware code:

[0075] A. Mask all interrupts: The BootLoader does not need to respond to any interrupts during execution; providing interrupt services is usually the responsibility of the operating system driver. Interrupt masking can be accomplished by writing to the CPU's interrupt mask register or status register.

[0076] B. Set the CPU speed and clock frequency.

[0077] C. RAM Initialization: Correctly configure the function registers of the system memory controller.

[0078] D. Disable the CPU's internal instruction / data cache.

[0079] 1.2 After hardware initialization, reserve readable and writable RAM space for loading stage 2, and test the read and write RAM space address.

[0080] 1.3. Set the stack pointer and modify the PC register to point to the appropriate address to achieve stage 2 of the Bootloader.

[0081] Phase 2:

[0082] 2.1 In order to communicate I / O information with end users, it is also necessary to initialize hardware devices such as timers.

[0083] 2.2 Detect the memory mapping within the vehicle infotainment system and load the kernel hardware and root file system.

[0084] 2.3 Set the kernel boot parameters and make the call.

[0085] The SOC-based bootloader is embedded and loads the bootloader from the EMMC.

[0086] After the S300 bootloader successfully starts, it starts the virtual machine and kernel to launch the on-chip system.

[0087] Referring to Figure 4, after the bootloader starts successfully, it initializes the DDR and loads the program into the DDR; after the DDR is loaded successfully, it starts the Hypervisor virtual machine; it starts the Linux Kernel and mounts the system files; it loads the relevant processes for virtual machine interaction and informs the virtual machine interaction process to notify the Android system that the resource loading is complete.

[0088] After the S400 and on-chip system successfully boot, the file system is loaded to start the vehicle infotainment system.

[0089] Referring to Figure 4, after the SOC starts successfully, it starts the Android system kernel, loads the file system and applications, and reads and writes the system log; it loads the screen drivers for the central control unit and instrument panel, lights up the screen, and plays the welcome animation.

[0090] Optionally, the boot method also includes: disabling write operations to the partition of the bootloader from the driver layer.

[0091] To prevent unauthorized or maliciously modified software from affecting the security of the vehicle's infotainment system, the system needs to verify the integrity and legality of the executed code during system startup. To prevent unauthorized updates to the EMMC partition software, the vehicle's infotainment system prohibits write operations to the EMMC bootloader partition from the driver layer.

[0092] Optionally, referring to Figure 5, the application is verified using a first preset encryption algorithm, specifically including:

[0093] S101. Cyclic redundancy check is used to check the application to obtain the first check value;

[0094] S102. The first verification value is encrypted using a first preset encryption algorithm to obtain a first verification authentication value; the first preset encryption algorithm includes a symmetric algorithm;

[0095] S103. Compare the first verification authentication value with the preset stored reference verification value. If the first verification authentication value is consistent with the reference verification value, the application verification is successful.

[0096] It should be noted that the specific methods of Cyclic Redundancy Check (CRC), the first preset encryption algorithm, and the symmetric algorithm are determined according to the actual application, and this embodiment does not impose specific restrictions.

[0097] CRC is a fast algorithm that generates a short, fixed-length check code based on data such as network packets or computer files. It is primarily used to detect or verify errors that may occur during data transmission or storage. CRC utilizes the principles of division and remainders to achieve error detection, and has advantages such as clear principles and simple implementation.

[0098] Symmetric key encryption, also known as private key encryption or shared key encryption, requires both the sender and receiver to use the same key to encrypt and decrypt plaintext. Common symmetric key encryption algorithms include DES, 3DES, IDEA, RC5, AES, and RC6.

[0099] In one specific embodiment, the MCU's secure boot design is based on a symmetric algorithm, where a symmetric key is pre-installed in the firmware during the development phase. Upon software release, the symmetric key is used to calculate a CMAC checksum for the application software, and this CMAC checksum is stored in the MCU as a reference checksum for secure boot. The MCU's secure boot verification steps are as follows:

[0100] 1) When the system powers on, the MCU ROMCode is run to execute the Boot program (written once and cannot be modified);

[0101] 2) The Boot program first uses the CRC-32 algorithm to calculate the CRC value of the application area, and then uses the software AES-128CMAC algorithm to calculate the CMAC value corresponding to the CRC value;

[0102] 3) Compare the calculated CMAC with the preset CMAC stored in the APP image (digital signature). If they match, the verification passes and the application code is executed. If they do not match, the verification fails, indicating that the software has been maliciously tampered with and the application fails to start.

[0103] Optionally, referring to Figure 6, the startup method also includes:

[0104] S010. If the microcontroller unit is upgraded, the upgraded application is verified to obtain a second verification value.

[0105] S020. The second verification value is encrypted using the first preset encryption algorithm to obtain the second verification authentication value, and the stored reference verification value is updated according to the second verification authentication value.

[0106] Specifically, when creating the MCU upgrade file, the CRC and CMAC values ​​of the application area are calculated, and these values ​​are attached to the image (digital signature) file. After the upgrade, the CRC and CMAC values ​​will be added to the updated MCU's ROM as secure boot reference verification values.

[0107] Optionally, referring to Figure 7, the second preset encryption algorithm includes an asymmetric algorithm; the on-chip system uses the second preset encryption algorithm to verify the digital signature of the on-chip system, specifically including:

[0108] S201. Calculate the digital signature of the on-chip system using the private key to obtain the first hash value;

[0109] S202. Calculate the digital signature of the on-chip system using the public key to obtain the second hash value;

[0110] S203. Compare the first hash value and the second hash value. If the first hash value and the second hash value are consistent, the digital signature verification of the on-chip system is successful.

[0111] It should be noted that the second preset encryption algorithm and asymmetric algorithm are determined according to the actual application, and this embodiment does not impose specific restrictions.

[0112] Asymmetric encryption uses a key pair consisting of a public key and a private key. The private key is kept secret by the key owner and must not be disclosed, while the public key can be distributed to others in plaintext. Data encrypted with the private key can only be decrypted with the public key, and vice versa. Because encryption and decryption use different keys, it is called asymmetric encryption.

[0113] Asymmetric algorithms include RSA, DSA, ECC, and DH algorithms. RSA is a relatively influential public-key encryption algorithm. Multiplying two large prime numbers is easy, but factoring their product is extremely difficult. Therefore, the product is divided into its components and used as the encryption key, i.e., the public key, while the two prime numbers are combined to form the private key. The encryption and decryption process of the RSA algorithm includes: the decryptor first determines and saves a private key, then calculates the public key based on the private key, and sends the public key to the encryptor over the network; after receiving the public key, the encryptor uses it to encrypt the information and sends the ciphertext over the network to the decryptor; the decryptor uses the known private key to decrypt the ciphertext.

[0114] The DSA algorithm includes a public key, a private key, and a digital signature. The encryption and decryption process of the DSA algorithm involves the following steps: The sender first encrypts the data to be sent using a message digest algorithm to generate a digital digest. Then, the sender re-encrypts the digest using their private key to form a digital signature. The sender then sends both the original data and the encrypted digest to the receiver. The receiver first decrypts the digest using the sender's public key and simultaneously generates the same digest for the received data using the same message digest algorithm. The decrypted digest is then compared with the digest generated by the receiver after re-encrypting the received data. If they match, the message has not been corrupted or tampered with during transmission. Otherwise, the message has lost its security and confidentiality.

[0115] The secure boot design for SOC is based on the principle of asymmetric algorithm digital signature. The image file to be executed is signed, and the signature verification of the image file to be executed is loaded into the boot process when the system starts up, ensuring the integrity of the executed code and preventing any unauthorized or maliciously modified software from running.

[0116] In one specific embodiment, the digital signature for the SOC's secure boot primarily involves the vehicle's infotainment system generating a public-private key pair during the development phase and then using the private key to sign the hash value of the image file when the image is released. This hash encryption algorithm ensures the SOC's security, while the public key certificate serves as verification for the SOC's secure boot.

[0117] When the system starts and loads the image, it calculates the hash value of the image to be executed to obtain Hash1, and uses the public key to verify the signature carried by the image file to obtain Hash2. The consistency of Hash1 and Hash2 is compared. If they match, the integrity and legitimacy of the image are verified and the system starts. If they do not match, it means the image has been maliciously tampered with or is of illegitimate origin, and the system startup fails. The hash algorithm ensures the legitimacy of the SOC startup sequence.

[0118] Optionally, the startup method may also include: performing step-by-step verification of all digital signatures on the on-chip system.

[0119] All boot images in the SOC use a private key and are digitally signed using the RSA-PSS algorithm. The system startup adopts a step-by-step verification mechanism from ROMcode to images. Each image is verified by the previous image before it is executed.

[0120] The RSA-PSS algorithm is an algorithm that adds a padding algorithm to the RSA algorithm. The RSA-PSS algorithm process includes: first, hashing the information to be signed to obtain a hash value; then, padding the hash value using a preset padding algorithm to obtain the message encoding; and finally, encrypting the message encoding using an RSA private key to form a digital signature.

[0121] Optionally, referring to Figure 8, the public key includes a root public key and a content public key, which are used to verify all digital signatures on the on-chip system at each level, specifically including:

[0122] S211. When the on-chip system is powered on, the root public key is used to verify the first-level digital signature; if the first-level digital signature verification is successful, the second-level digital signature verification is initiated.

[0123] S212. Verify the second-level digital signature using the content public key; if the second-level digital signature verification is successful, initiate the third-level digital signature verification.

[0124] S213. Verify the second-level digital signature using the content public key; if the third-level digital signature verification is successful, the boot program starts successfully.

[0125] To further ensure security, the vehicle infotainment chip has a root public key and a content public key. The root public key is stored in the eFuse and read by the ROM code, serving as a trusted root for secure boot. The content public key is responsible for verifying the signature of the image to be executed, ensuring that the vehicle infotainment system cannot be maliciously tampered with or attacked.

[0126] Referring to Figure 9, in a specific embodiment, the verification steps for SOC Secure Boot are as follows:

[0127] 1) When the system is powered on, the main chip starts running from the ROM code. BL1 (Boot ROM) uses the root public key in the e-Fuse to verify and start BL2 (Trusted Boot);

[0128] 2) BL2 (Trusted Boot) uses the content public key to verify the signature and start BL3.1 (Secure Monitor), BL3.2 (OP-Tee), and BL3.3 (Uboot);

[0129] 3) BL3.3 (Uboot) loads and starts the Hypervisor, checks the kernel and device tree of the three guest systems through AVB, and checks the file system of the three guest systems through Dm-verity;

[0130] 4) If the check passes, mount the system; the system starts successfully. If the check fails, send a restart signal.

[0131] By verifying the encryption algorithms of the MCU and SOC, the vehicle infotainment system can be guaranteed to start securely and will not be maliciously attacked or tampered with, thus ensuring a certain level of security for the vehicle infotainment system to start securely.

[0132] Before loading the operating system, the legitimacy of the bootloader and the system should be verified. The integrity of the system should also be verified, meaning it has not been tampered with. All calculations and data should be based on securely stored keys and secure computation.

[0133] Optionally, the kernel is loaded by the bootloader.

[0134] The Linux kernel system boot process is as follows: When the system powers on, the main chip starts executing code from ROM, loads the bootloader into RAM, and then the bootloader loads the kernel. After a system upgrade or re-flash, the new system may be tampered with. The secure boot mechanism must verify the integrity of the bootloader to ensure that it is complete, secure, and has not been tampered with. If the verification fails, the execution of an unauthorized bootloader is prevented. If the bootloader verification passes, the kernel integrity will be verified next.

[0135] Implementing the embodiments of the present invention has the following beneficial effects: When the microcontroller detects the power-on signal of the vehicle system, it verifies the application using a first preset encryption algorithm; if the application verification is successful, it outputs an enable signal to start the on-chip system. Before the on-chip system starts, the integrity and legality of the application are verified, improving the security of the microcontroller startup; the on-chip system uses a second preset encryption algorithm to verify the digital signature of the on-chip system; if the digital signature verification is successful, the bootloader is loaded. Before loading the bootloader, the integrity and legality of the digital signature of the on-chip system are verified again, improving the security of the on-chip system startup; after the bootloader starts successfully, the virtual machine and kernel are started to start the on-chip system; after the on-chip system starts successfully, the file system is loaded to start the vehicle system; thereby reducing the possibility of the vehicle system being maliciously tampered with or attacked, and improving the security of the vehicle startup process.

[0136] Referring to Figure 10, an embodiment of the present invention provides a vehicle infotainment system safe start system, including:

[0137] The first module is used to verify the application using a first preset encryption algorithm when the microcontroller detects the power-on signal of the vehicle system; if the application verification is successful, it outputs an enable signal to start the on-chip system.

[0138] The second module is used by the on-chip system to verify the digital signature of the on-chip system using a second preset encryption algorithm; if the digital signature verification is successful, the boot program is loaded.

[0139] The third module is used to start the virtual machine and kernel to start the on-chip system after the boot program has started successfully;

[0140] The fourth module is used to load the file system to start the vehicle infotainment system after the on-chip system has successfully started.

[0141] It is evident that the content of the above method embodiments is applicable to this system embodiment. The specific functions implemented in this system embodiment are the same as those in the above method embodiments, and the beneficial effects achieved are also the same as those achieved in the above method embodiments.

[0142] Referring to Figure 11, an embodiment of the present invention provides a vehicle infotainment system safety start device, comprising:

[0143] At least one processor;

[0144] At least one memory for storing at least one program;

[0145] When at least one program is executed by at least one processor, the at least one processor implements the secure boot method described above.

[0146] The memory, as a non-transitory computer-readable storage medium, can be used to store non-transitory software programs and non-transitory computer-executable programs. The memory may include high-speed random access memory, and may also include non-transitory memory, such as at least one disk storage device, flash memory device, or other non-transitory solid-state storage device. In some embodiments, the memory may optionally include remote memory located remotely relative to the processor, which can be connected to the processor via a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.

[0147] It is evident that the content of the above method embodiments is applicable to this device embodiment. The specific functions implemented in this device embodiment are the same as those in the above method embodiments, and the beneficial effects achieved are also the same as those achieved in the above method embodiments.

[0148] Furthermore, this application also discloses a computer program product or computer program stored in a computer-readable storage medium. A processor of a computer device can read the computer program from the computer-readable storage medium, and the processor executes the computer program, causing the computer device to perform the described method. Similarly, the content of the above method embodiments is applicable to this storage medium embodiment. The specific functions implemented in this storage medium embodiment are the same as those in the above method embodiments, and the beneficial effects achieved are also the same as those achieved in the above method embodiments.

[0149] This invention also provides a computer-readable storage medium storing a processor-executable program that, when executed by a processor, implements the above-described method.

[0150] It is understood that all or some of the steps and systems in the methods disclosed above can be implemented as software, firmware, hardware, and suitable combinations thereof. Some or all of the physical components can be implemented as software executed by a processor, such as a central processing unit, digital signal processor, or microprocessor, or as hardware, or as an integrated circuit, such as an application-specific integrated circuit. Such software can be distributed on a computer-readable medium, which can include computer storage media (or non-transitory media) and communication media (or transient media). As is known to those skilled in the art, the term computer storage media includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, program modules, or other data). Computer storage media includes, but is not limited to, RAM, ROM, EEPROM, flash memory or other memory technologies, CD-ROM, digital versatile disc (DVD) or other optical disc storage, magnetic cartridges, magnetic tape, disk storage or other magnetic storage devices, or any other medium that can be used to store desired information and is accessible to a computer. Furthermore, as is known to those skilled in the art, communication media typically contain computer-readable instructions, data structures, program modules, or other data in modulated data signals such as carrier waves or other transmission mechanisms, and may include any information delivery medium.

[0151] This invention also provides a vehicle, which includes an electric drive assembly comprising the aforementioned safety start system or safety start device. Specifically, the vehicle can be a private car, such as a sedan, SUV, MPV, or pickup truck. The vehicle can also be a commercial vehicle, such as a van, bus, small truck, or large trailer. The vehicle can be a gasoline-powered vehicle or a new energy vehicle. When the vehicle is a new energy vehicle, it can be a hybrid vehicle or a pure electric vehicle.

[0152] The above is a detailed description of the preferred embodiments of the present invention. However, the present invention is not limited to the embodiments described. Those skilled in the art can make various equivalent modifications or substitutions without departing from the spirit of the present invention. All such equivalent modifications or substitutions are included within the scope defined by the claims of this application.

Claims

1. A method for safe startup of a vehicle infotainment system, characterized in that, include: When the microcontroller detects the power-on signal of the vehicle system, it uses the first preset encryption algorithm to verify the application. If the application verification is successful, an enable signal is output to start the on-chip system; The system-on-a-chip uses a second preset encryption algorithm to verify the digital signature of the system-on-a-chip; If the digital signature verification is successful, load the bootloader; After the bootloader starts successfully, it starts the virtual machine and kernel to boot the on-chip system; After the on-chip system starts successfully, the file system is loaded to start the vehicle infotainment system.

2. The startup method according to claim 1, characterized in that, The verification of the application using the first preset encryption algorithm specifically includes: Cyclic redundancy check is used to verify the application, and the first check value is obtained; The first verification value is encrypted using a first preset encryption algorithm to obtain a first verification authentication value; the first preset encryption algorithm includes a symmetric algorithm. The first verification value is compared with a preset stored reference verification value. If the first verification value matches the reference verification value, the application verification is successful.

3. The startup method according to claim 1, characterized in that, The startup method further includes: If the microcontroller unit is upgraded, the upgraded application is verified to obtain a second verification value. The second verification value is encrypted using a first preset encryption algorithm to obtain a second verification authentication value, and the stored reference verification value is updated based on the second verification authentication value.

4. The startup method according to claim 1, characterized in that, The second preset encryption algorithm includes an asymmetric algorithm; the on-chip system uses the second preset encryption algorithm to verify the digital signature of the on-chip system, specifically including: The first hash value is obtained by calculating the digital signature of the on-chip system using the private key; The digital signature of the on-chip system is calculated using the public key to obtain the second hash value; The first hash value and the second hash value are compared. If the first hash value and the second hash value are consistent, the digital signature verification of the on-chip system is successful.

5. The startup method according to claim 4, characterized in that, The startup method also includes: performing step-by-step verification of all digital signatures on the on-chip system.

6. The startup method according to claim 5, characterized in that, The public key includes a root public key and a content public key. The step-by-step verification of all digital signatures on the on-chip system specifically includes: When the system-on-chip is powered on, the root public key is used to verify the first-level digital signature; if the first-level digital signature verification is successful, the second-level digital signature verification is initiated. The second-level digital signature is verified using the content public key; if the second-level digital signature verification is successful, the third-level digital signature verification is initiated. The second-level digital signature is verified using the content public key; if the third-level digital signature verification is successful, the boot program starts successfully.

7. The startup method according to claim 1, characterized in that, The boot method further includes: disabling write operations to the partition of the bootloader from the driver layer.

8. The startup method according to claim 1, characterized in that, The kernel is loaded by the bootloader.

9. A vehicle infotainment system safety start system, characterized in that, include: The first module is used to verify the application using a first preset encryption algorithm when the microcontroller detects a power-on signal from the vehicle system. If the application verification is successful, an enable signal is output to start the on-chip system. The second module is used for the on-chip system to verify the digital signature of the on-chip system using a second preset encryption algorithm; If the digital signature verification is successful, load the bootloader; The third module is used to start the virtual machine and kernel to start the on-chip system after the boot program has started successfully; The fourth module is used to load the file system to start the vehicle infotainment system after the on-chip system has successfully started.

10. A vehicle infotainment system safety start device, characterized in that, include: At least one processor; At least one memory for storing at least one program; When the at least one program is executed by the at least one processor, the at least one processor implements the secure boot method as described in any one of claims 1-8.

11. A computer-readable storage medium storing a processor-executable program, characterized in that, The processor-executable program, when executed by the processor, is used to perform the secure boot method as described in any one of claims 1-8.

12. A vehicle, characterized in that, The vehicle includes the safety start system as described in claim 9 or the safety start device as described in claim 10.

Images