Vehicle-mounted applet offline update method and vehicle-mounted applet offline update system

Abstract

The present invention discloses a vehicle-mounted applet offline update method and a vehicle-mounted applet offline update system. The vehicle-mounted applet offline update method comprises the following steps: after establishing a secure communication channel with a host computer, performing two-way authentication with the host computer based on the secure communication channel, and receiving an encrypted data packet sent by the host computer after the two-way authentication is successful; decrypting and formatting the encrypted data packet to generate a TLV format data packet, and encrypting the TLV format data packet and sending it to a security module, so that the applet stored in the security module is updated according to the decrypted TLV format data packet. Thus, through the vehicle-mounted applet offline update method of the present application, the vehicle-mounted applet can be quickly and conveniently updated offline, and the vehicle-mounted applet update failure and the vehicle-mounted applet function loss will not be caused, thereby avoiding the function loss of the vehicle, and at the same time, the transmission security during the data transmission process can be guaranteed.

Description

Technical Field

[0001] The present invention relates to the field of vehicles, and in particular to a vehicle-mounted applet offline updating method and a vehicle-mounted applet offline updating system. Background Art

[0002] In the related art, the update of vehicle-side module software and the resolution of faults are based on the operation of external devices. After connecting to the external device, the software update of the relevant module can be completed online or offline. However, based on the existing diagnostic burning specifications, the software update of the relevant module has the problem of long update time and the relevant module does not contain double backup, which will lead to the failure of application update and the loss of software functions, thereby causing the loss of vehicle functions.

[0003] In addition, the update of existing vehicle module software is mainly carried out through the CAN network, and the security mechanism of transmission is determined based on the diagnostic burning specification. However, the data transmission parties do not clearly define the security level of the encryption and authentication mechanism of the data transmission process.

[0004] In addition, the software functions of existing vehicle modules are mainly concentrated on the main control MCU side, and the processing function logic and implementation algorithms are all in the MCU, which poses certain risks for secure storage with high encryption level requirements. Summary of the invention

[0005] The present invention aims to solve at least one of the technical problems existing in the prior art. To this end, one object of the present invention is to provide a vehicle-mounted applet offline update method, which can quickly and conveniently update the vehicle-mounted applet offline without causing the vehicle-mounted applet update failure and the vehicle-mounted applet function loss, thereby avoiding the function loss of the vehicle, and at the same time, ensuring the transmission security during the data transmission process.

[0006] The present invention further proposes a vehicle-mounted applet offline updating method.

[0007] The present invention further provides a computer-readable storage medium.

[0008] The present invention further proposes a main control MCU.

[0009] The present invention further proposes a host computer.

[0010] The present invention further proposes an in-vehicle applet offline updating system.

[0011] The vehicle-mounted applet offline update method according to the present invention comprises the following steps: after establishing a secure communication channel with a host computer, performing two-way authentication with the host computer based on the secure communication channel, and receiving an encrypted data packet sent by the host computer after the two-way authentication is successful; decrypting and formatting the encrypted data packet to generate a TLV format data packet, and encrypting the TLV format data packet and sending it to a security module, so that the applet stored in the security module is updated according to the decrypted TLV format data packet.

[0012] According to the vehicle-mounted applet offline update method of the present invention, the vehicle-mounted applet can be updated offline quickly and conveniently without causing the vehicle-mounted applet update failure and the loss of vehicle-mounted applet functions, thereby avoiding the loss of vehicle functions and ensuring the transmission security during the data transmission process.

[0013] In some examples of the present invention, establishing a secure communication channel with a host computer includes: receiving a security operation execution command issued by the host computer, responding to the security operation execution command according to preset security channel specification requirements to generate a response command, and sending the response command to the host computer to complete the establishment of the secure communication channel.

[0014] In some examples of the present invention, performing two-way authentication with the host computer based on the secure communication channel includes: receiving a static key sent by the host computer, calculating a shared negotiated key pair based on the static key, and completing two-way authentication based on the shared negotiated key pair.

[0015] In some examples of the present invention, after completing the two-way authentication, the session key is generated according to the shared negotiated key pair by interacting with the host computer, and the encrypted data packet is decrypted according to the session key.

[0016] In some examples of the present invention, before receiving the encrypted data packet, the received host computer request message is converted into an APDU encryption instruction and sent to the security module, and a response message fed back by the security module is received, and the response message is format-converted and uploaded to the host computer.

[0017] The vehicle-mounted applet offline update method according to the present invention comprises the following steps: after establishing a secure communication channel with a main control MCU, performing two-way authentication with the main control MCU based on the secure communication channel; after the two-way authentication succeeds, encrypting a data packet to be updated to generate an encrypted data packet, and sending the encrypted data packet to the main control MCU so that the main control MCU decrypts and converts the format of the encrypted data packet to generate a TLV format data packet; encrypting the TLV format data packet by the main control MCU and sending it to a security module so that the applet stored in the security module is updated according to the decrypted TLV format data packet.

[0018] In some examples of the present invention, establishing a secure communication channel with the master MCU includes: sending an execute security operation command to the master MCU so that the master MCU responds to the execute security operation command according to preset security channel specification requirements to generate a response command; after receiving the response command, completing the establishment of the secure communication channel.

[0019] In some examples of the present invention, two-way authentication is performed with the master MCU based on the secure communication channel, including: sending a static key to the master MCU, and interacting with the master MCU to calculate a shared negotiated key pair based on the static key, and completing the two-way authentication based on the shared negotiated key pair.

[0020] In some examples of the present invention, after completing the two-way authentication, the session key is generated according to the shared negotiated key pair by interacting with the master MCU, and the data packet to be updated is encrypted according to the session key.

[0021] In some examples of the present invention, before sending the encrypted data packet to the main control MCU, a host computer request message is also sent to the main control MCU so that the main control MCU converts the host computer request message into an APDU encryption instruction and sends it to the security module, and receives the converted message uploaded by the main control MCU, wherein the converted message is obtained by the main control MCU performing format conversion on the response message fed back by the security module.

[0022] In some examples of the present invention, before establishing a secure communication channel with the main control MCU, the data packet to be updated is also obtained from the server side.

[0023] The computer-readable storage medium according to the present invention stores an in-vehicle applet-based offline update program, which implements the in-vehicle applet offline update method when executed by a processor.

[0024] According to the computer-readable storage medium of the present invention, the vehicle-mounted applet can be updated offline quickly and conveniently without causing the failure of the vehicle-mounted applet update and the loss of vehicle-mounted applet functions, thereby avoiding the loss of vehicle functions and ensuring the transmission security during the data transmission process.

[0025] The main control MCU according to the present invention comprises a memory, a processor and a vehicle-mounted applet offline update program stored in the memory and executable on the processor. When the processor executes the vehicle-mounted applet offline update program, the above-mentioned vehicle-mounted applet offline update method is implemented.

[0026] The host computer according to the present invention includes a memory, a processor, and a vehicle-mounted applet offline update program stored in the memory and executable on the processor. When the processor executes the vehicle-mounted applet offline update program, the above-mentioned vehicle-mounted applet offline update method is implemented.

[0027] According to the in-vehicle applet offline update system of the present invention, it includes a host computer, a main control MCU and a security module, wherein the applet is arranged in the security module, wherein the host computer is used to establish a secure communication channel with the main control MCU, and after the secure communication channel is established, perform two-way authentication with the main control MCU according to the secure communication channel, and after the two-way authentication is successful, encrypt the data packet to be updated to generate an encrypted data packet, and send the encrypted data packet to the main control MCU; the main control MCU is used to decrypt and format the encrypted data packet to generate a TLV format data packet, and encrypt the TLV format data packet and send it to the security module; the security module receives and decrypts the encrypted TLV format data packet, and updates the applet according to the decrypted TLV format data packet.

[0028] According to the vehicle-mounted applet offline update system of the present invention, the vehicle-mounted applet can be updated offline quickly and conveniently without causing the vehicle-mounted applet update failure and the loss of vehicle-mounted applet functions, thereby avoiding the loss of vehicle functions and ensuring the transmission security during the data transmission process.

[0029] Additional aspects and advantages of the present invention will be given in part in the following description and in part will be obvious from the following description, or will be learned through practice of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] The above and / or additional aspects and advantages of the present invention will become apparent and easily understood from the description of the embodiments in conjunction with the following drawings, in which:

[0031] Figure 1 is a flow chart of a vehicle-mounted applet offline updating method according to an embodiment of the present invention;

[0032] Figure 2 is a flow chart of another embodiment of the vehicle-mounted applet offline update method according to an embodiment of the present invention;

[0033] Figure 3 is a block diagram of an in-vehicle applet offline update system according to an embodiment of the present invention;

[0034] Figure 4 It is a block diagram of a processor, a memory, a communication interface, and a communication bus according to an embodiment of the present invention.

[0035] Reference numerals:

[0036] In-vehicle applet offline update system 100;

[0037] Host computer 10; vehicle-side PAD 11; diagnostic equipment 12;

[0038] Main control MCU 20;

[0039] Security module 30;

[0040] Server end 40; cloud server 41; diagnostic server 42;

[0041] Processor 1201; communication interface 1202; memory 1203; communication bus 1204. DETAILED DESCRIPTION

[0042] Embodiments of the present invention are described in detail below, examples of which are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present invention, and cannot be understood as limiting the present invention.

[0043] Reference below Figure 1-Figure 4 The in-vehicle applet offline updating system 100 and the in-vehicle applet offline updating method according to the embodiments of the present invention are described.

[0044] like Figure 3As shown, the vehicle-mounted applet offline update system 100 according to an embodiment of the present invention includes: a host computer 10, a main control MCU (Microcontroller unit-micro control unit) 20 and a security module (SE-Secure Element) 30. The applet is set in the security module 30. Among them, the host computer 10 is used to establish a secure communication channel with the main control MCU 20, and after the secure communication channel is established, it performs two-way authentication with the main control MCU 20 according to the secure communication channel, and after the two-way authentication is successful, the host computer 10 encrypts the update data packet to generate an encrypted data packet, and sends the encrypted data packet to the main control MCU 20. It should be noted that the host computer 10 can establish a secure communication channel with the main control MCU 20, after the secure communication channel is established, the host computer 10 can perform two-way authentication with the main control MCU 20 according to the secure communication channel, after the host computer 10 and the main control MCU 20 perform two-way authentication successfully, the host computer 10 can encrypt the update data packet to generate an encrypted data packet, and the host computer 10 can send the encrypted data packet to the main control MCU 20.

[0045] The main control MCU 20 is used to decrypt and convert the encrypted data packet to generate a TLV (Tag Length Value-data format transmitted between the card and the terminal) format data packet, and encrypt the TLV format data packet and send it to the security module 30. It should be explained that the main control MCU 20 can decrypt the encrypted data packet sent by the host computer 10, and the main control MCU 20 can convert the format of the decrypted encrypted data packet to convert the format of the decrypted encrypted data packet into a TLV format data packet. After that, the main control MCU 20 can encrypt the TLV format data packet, and the main control MCU 20 can send the encrypted TLV format data packet to the security module 30.

[0046] The security module 30 receives and decrypts the encrypted TLV format data packet, and updates the applet according to the decrypted TLV format data packet. It should be noted that the security module 30 can receive the encrypted TLV format data packet sent by the main control MCU 20. After the security module 30 receives the encrypted TLV format data packet sent by the main control MCU 20, the security module 30 can decrypt the TLV format data packet, and the security module 30 can update the applet set in the security module 30 according to the decrypted TLV format data packet to complete the offline update of the applet.

[0047] Specifically, the host computer 10 may include but is not limited to the vehicle-side PAD 11 and the diagnostic equipment 12. The host computer 10 and the main control MCU 20 may be connected via a CAN (Controller Area Networker) bus or a CANFD (CAN With Flexible Data Rate-a serial communication protocol based on the CAN 2.0 physical layer) bus. The security module 30 may also include a cos system. The security module 30 needs to meet the normal functions of the cos system and the applet to ensure that the data packet can be completely transmitted during the communication process. The main control MCU 20 and the security module 30 can be connected via an SPI bus (serial peripheral interface-synchronous serial interface) communication connection, thereby ensuring normal communication between the main control MCU 20 and the security module 30.

[0048] Among them, the vehicle-mounted applet offline update system 100 may also include a server side 40, and the server side 40 may include but is not limited to a cloud server 41 and a diagnostic server 42. Preferably, the server side 40 and the host computer 10 can transmit the data packet to be updated through a TCP or IP network channel. Further, the cloud server 41 and the vehicle-side PAD11 can transmit the data packet to be updated through a TCP or IP network channel, and the diagnostic server 42 and the diagnostic device 12 can also transmit the data packet to be updated through a TCP or IP network channel. The host computer 10 can obtain the data packet to be updated from the server side 40 and load the data packet to be updated into the local memory. The host computer 10 can establish a secure communication channel with the main control MCU20. After the secure communication channel is established, the host computer 10 can perform two-way authentication with the main control MCU20 according to the secure communication channel. After the two-way authentication between the host computer 10 and the main control MCU20 is successful, the host computer 10 can perform authentication on the data packet to be updated. The main control MCU 20 can decrypt the encrypted data packet sent by the upper computer 10 and perform format conversion to convert the format of the decrypted encrypted data packet into a TLV format data packet. After that, the main control MCU 20 can encrypt the TLV format data packet, and the main control MCU 20 can send the encrypted TLV format data packet to the security module 30 through the SPI bus. After receiving the encrypted TLV format data packet sent by the main control MCU 20, the security module 30 can decrypt the TLV format data packet, and the security module 30 can update the applet set in the security module 30 according to the decrypted TLV format data packet to complete the offline update of the applet. Further, after MCU20 receives the encrypted data packet sent by the upper computer 10, MCU20 can store the encrypted data packet and perform software version detection of the applet of the security module 30.

[0049] Therefore, the upper computer 10, the main control MCU 20 and the security module 30 work together to quickly and conveniently update the vehicle-mounted applet offline without causing the failure of the vehicle-mounted applet update and the loss of vehicle-mounted applet functions, thereby avoiding the loss of vehicle functions and ensuring the transmission security during data transmission.

[0050] As some embodiments of the present invention, establishing a secure communication channel with the host computer 10 may include: receiving an execution security operation command issued by the host computer 10, and responding to the execution security operation command according to a preset security channel specification requirement to generate a response command, and sending the response command to the host computer 10 to complete the establishment of the secure communication channel. It should be explained that the host computer 10 can send an execution security operation command to the main control MCU 20, the main control MCU 20 can receive the execution security operation command issued by the host computer 10, and after the main control MCU 20 receives the execution security operation command issued by the host computer 10, it can respond to the execution security operation command according to the preset security channel specification requirement to generate a response command, and after MCU20 generates the response command, MCU20 can send the response command to the host computer 10 to establish a secure communication channel with the host computer 10, wherein the preset security channel specification requirement can be a security channel SCP11c (GlobalPlatform Card Technology Security Channel Protocol "11") specification requirement.

[0051] As some embodiments of the present invention, performing two-way authentication with the host computer 10 based on a secure communication channel may include: receiving a static key sent by the host computer 10, calculating a shared negotiated key pair based on the static key, and completing two-way authentication based on the shared negotiated key pair. It should be explained that after the secure communication channel is established, MCU20 can receive the static key sent by the host computer 10, and MCU20 can calculate a shared negotiated key pair (ECKA) based on the static key sent by the host computer 10, and then MCU20 can complete two-way authentication with the host computer 10 based on the shared negotiated key pair. Specifically, MCU20 can derive a channel session key (AES) based on the shared negotiated key pair, MCU20 can generate a response command based on the channel session key, and send the response command receipt to the host computer 10 to complete two-way authentication with the host computer 10, thereby ensuring transmission security during data transmission.

[0052] As some embodiments of the present invention, after completing the two-way authentication, the session key can be generated according to the shared negotiation key pair by interacting with the host computer 10, and the encrypted data packet can be decrypted according to the session key. It should be noted that after the MCU20 and the host computer 10 complete the two-way authentication, the MCU20 can interact with the host computer 10 to generate a session key according to the shared negotiation key pair, and the MCU20 can decrypt the encrypted data packet transmitted by the host computer 10 according to the session key, and then the MCU20 can convert the format of the data packet to generate a TLV format data packet, and encrypt the TLV format data packet, and after encryption, send it to the security module 30 through the SPI bus, thereby further ensuring the transmission security during the data transmission process.

[0053] It should be noted that the exchanged information between MCU20 and the security module 30 can be protected by SCP03 (Global Platform Card Technology Security Channel Protocol "03") secure message transmission. According to the encrypted data packet sent to MCU20 according to the diagnostic specification, in the SCP03 secure communication mechanism, the transmitted data is packaged into APDU (Application Protocol Data Unit) commands for encryption processing and transmission. The plaintext command data transmitted by SCP03 is first encrypted with a session key to generate an encrypted command, and then encrypted to generate a CMAC value, and finally filled in a fixed format to form an encrypted command + CMAC value. During the channel transmission process, in accordance with data security requirements, the fixed format transmission data is encrypted and then transmitted with the channel session key, which can ensure the confidentiality and integrity of the data.

[0054] Among them, after the data packet is loaded, the software version of the applet of the security module 30 can be detected. In addition, according to the diagnostic specification requirements, the burning and upgrading of the main control MCU 20 needs to go through the stages of version reading, vehicle silence, security access, entering the programming diagnostic session mode, data downloading and transmission. For the upgrade of the security module 30, since it is necessary to consider the data packet forwarding of the main control MCU 20, only some stages need to be adopted.

[0055] As some embodiments of the present invention, before receiving the encrypted data packet, the received host computer request message is converted into an APDU encryption instruction and sent to the security module 30, and the response message fed back by the security module 30 is received, and the response message is format-converted and uploaded to the host computer 10.

[0056] It needs to be explained that for each request from the host computer 10, that is, each time the host computer 10 sends a host computer request message (encrypted data packet) to the main control MCU 20, the main control MCU 20 needs to convert the host computer request message into a corresponding APDU encryption instruction in the TLV format and send it to the security module 30. The security module 30 needs to set the silent state of the non-burning node. When entering the programming diagnostic session mode, it first passes through the security access service, and then directly enters the data download, data transmission, and request transmission exit. Among them, for the data download stage, a 256-byte data cache area can be set to store the downloaded content, that is, the encrypted data packet transmitted by the upper computer 10 through the CAN or CANFD bus is stored first, and then the main control MCU20 responds successfully. In the subsequent data transmission stage, the main control MCU20 adds a header and a trailer to the downloaded encrypted data packet to package it, and forms an APDU encryption instruction in TLV format and sends it to the security module 30. After the security module 30 receives the APDU encryption instruction in TLV format sent by the main control MCU20, the security module 30 will complete the transmission of the response message to the main control MCU20. The main control MCU20 can convert the completion response message into a CAN message and pass it to the upper computer 10. For the execution instruction of the transmission exit, it can be normally completed and issued according to the specification. This cycle is repeated to complete the sending of the encrypted data packet.

[0057] As some embodiments of the present invention, sequence counters can be set on both the host computer 10 side and the main control MCU 20 side to perform counting operations during data transmission. When the count reaches a certain number of times, a memory check is performed to complete the self-update of the applet of the security module 30. After that, the security module 30 queries the update status of the applet. After the query passes, the status of the security module 30 is reset to release the silent state of the non-burned node. Then, the security module 30 packages the diagnostic response and completes the response transmission to the main control MCU 20. The main control MCU 20 converts the response into CAN data and returns it to the host computer 10.

[0058] As some embodiments of the present invention, establishing a secure communication channel with the main control MCU 20 may include: sending a security operation execution command to the main control MCU 20, so that the main control MCU 20 responds to the security operation execution command according to the preset security channel specification requirements to generate a response command, and after receiving the response command, the secure communication channel is established. It should be noted that the host computer 10 can send a security operation execution command to the main control MCU 20, and after receiving the security operation execution command issued by the host computer 10, the main control MCU 20 can respond to the security operation execution command issued by the host computer 10 according to the preset security channel specification requirements to generate a response command, and then MCU20 can send the response command to the host computer 10, and after receiving the response command, the host computer 10 can complete the establishment of a secure communication channel with MCU20, wherein the preset security channel specification requirements can be security channel SCP11c (GlobalPlatform Card Technology Security Channel Protocol "11") specification requirements.

[0059] As some embodiments of the present invention, bidirectional authentication with the main control MCU 20 based on a secure communication channel may include: sending a static key to the main control MCU 20, and calculating a shared negotiation key pair based on the static key by interacting with the main control MCU, and completing bidirectional authentication based on the shared negotiation key pair. It should be explained that after the secure communication channel is established, the host computer 10 can send a static key to the main control MCU 20, and the host computer 10 can calculate a shared negotiation key pair based on the static key by interacting with the main control MCU, and then the host computer 10 can complete bidirectional authentication with the MCU 20 based on the shared negotiation key pair. Specifically, the MCU 20 can derive a channel session key based on the shared negotiation key pair, and the MCU 20 can generate a response command based on the channel session key, and send the response command receipt to the host computer 10 to complete bidirectional authentication with the host computer 10, thereby ensuring the transmission security during data transmission.

[0060] As some embodiments of the present invention, after completing the two-way authentication, the host computer 10 can also interact with the main control MCU 20 to generate a session key according to the shared negotiation key pair, and encrypt the data packet to be updated according to the session key. It should be noted that after the host computer 10 and MCU20 complete the two-way authentication, the host computer 10 can interact with the main control MCU 20 to generate a session key according to the shared negotiation key pair, and the host computer 10 can encrypt the data packet to be updated according to the session key to generate an encrypted data packet, and the host computer 10 can send the encrypted data packet to the main control MCU 20, thereby further ensuring the transmission security during the data transmission process.

[0061] It should be noted that the exchanged information between MCU20 and the security module 30 is protected by SCP03 (GlobalPlatform Card Technology Security Channel Protocol "03") secure messaging. According to the encrypted data packet sent to MCU20 according to the diagnostic specification, in the SCP03 secure communication mechanism, the transmitted data is packaged into APDU commands for encryption processing and transmission. The plaintext command data transmitted by SCP03 is first encrypted with a session key to generate an encrypted command, and then encrypted to generate a CMAC value, and finally filled in a fixed format to form an encrypted command + CMAC value. During the channel transmission process, in accordance with data security requirements, the fixed format transmission data is encrypted and then transmitted with the channel session key, which can ensure the confidentiality and integrity of the data.

[0062] Among them, after the data packet is loaded, the software version of the applet of the security module 30 can be detected. In addition, according to the diagnostic specification requirements, the upgrade of the main control MCU 20 needs to go through the stages of version reading, vehicle silence, security access, entering the programming diagnostic session mode, data downloading and transmission. For the upgrade of the security module 30, since it is necessary to consider the data packet forwarding of the main control MCU 20, only some stages need to be adopted.

[0063] As some embodiments of the present invention, before sending an encrypted data packet to the main control MCU20, a host computer request message is also sent to the main control MCU20, so that the main control MCU20 converts the host computer request message into an APDU encryption instruction and sends it to the security module 30, and receives the converted message uploaded by the main control MCU20, wherein the converted message is obtained by the main control MCU20 converting the format of the response message fed back by the security module 30.

[0064] It needs to be explained that for each request from the host computer 10, that is, each time the host computer 10 sends a host computer request message (encrypted data packet) to the main control MCU 20, the main control MCU 20 needs to convert the host computer request message into a corresponding APDU encryption instruction in the TLV format and send it to the security module 30. The security module 30 needs to set the silent state of the non-burning node. When entering the programming diagnostic session mode, it first passes through the security access service, and then directly enters the data download, data transmission, and request transmission exit. Among them, for the data download stage, a 256-byte data cache area can be set to store the downloaded content, that is, the encrypted data packet transmitted by the upper computer 10 through the CAN or CANFD bus is stored first, and then the main control MCU20 responds successfully. In the subsequent data transmission stage, the main control MCU20 adds a header and a trailer to the downloaded encrypted data packet to package it, and forms an APDU encryption instruction in TLV format and sends it to the security module 30. After the security module 30 receives the APDU encryption instruction in TLV format sent by the main control MCU20, the security module 30 will complete the transmission of the response message to the main control MCU20. The main control MCU20 can convert the completion response message into a CAN message and pass it to the upper computer 10. For the execution instruction of the transmission exit, it can be normally completed and issued according to the specification. This cycle is repeated to complete the sending of the encrypted data packet.

[0065] As some embodiments of the present invention, sequence counters can be set on both the host computer 10 side and the main control MCU 20 side to perform counting operations during data transmission. When the count reaches a certain number of times, a memory check is performed to complete the self-update of the applet of the security module 30. After that, the security module 30 queries the update status of the applet. After the query passes, the status of the security module 30 is reset to release the silent state of the non-burned node. Then, the security module 30 packages the diagnostic response and completes the response transmission to the main control MCU 20. The main control MCU 20 converts the response into CAN data and returns it to the host computer 10.

[0066] As some embodiments of the present invention, before establishing a secure communication channel with the main control MCU 20, the data packet to be updated is also obtained from the server side 40. It should be explained that before establishing a secure communication channel with the main control MCU 20, the upper computer 10 can obtain the data packet to be updated from the server side 40 and load the data packet to be updated into the local memory. Thus, the upper computer 10 can obtain the data packet to be updated and store the data packet to be updated.

[0067] Figure 1 : is a flow chart of the vehicle-mounted applet offline update method according to an embodiment of the present invention. The vehicle-mounted applet offline update system of the above embodiment can implement the vehicle-mounted applet offline update method, such as Figure 1As shown, the vehicle-mounted applet offline update method includes the following steps:

[0068] S1, after establishing a secure communication channel with the host computer, perform two-way authentication with the host computer based on the secure communication channel, and receive the encrypted data packet sent by the host computer after the two-way authentication is successful. It should be explained that the vehicle applet offline update system includes: a host computer, a main control MCU (Microcontroller unit-microcontroller unit) and a security module (SE-Secure Element), wherein the host computer is used to establish a secure communication channel with the main control MCU, and after the secure communication channel is established, the host computer performs two-way authentication with the main control MCU according to the secure communication channel, and after the two-way authentication is successful, the host computer encrypts the data packet to be updated to generate an encrypted data packet, and sends the encrypted data packet to the main control MCU. It should be noted that the host computer can establish a secure communication channel with the main control MCU, after the secure communication channel is established, the host computer can perform two-way authentication with the main control MCU according to the secure communication channel, after the host computer and the main control MCU perform two-way authentication successfully, the host computer can encrypt the data packet to be updated to generate an encrypted data packet, and the host computer can send the encrypted data packet to the main control MCU.

[0069] S2, decrypt and convert the format of the encrypted data packet to generate a TLV format data packet, and encrypt the TLV format data packet and send it to the security module, so that the applet stored in the security module is updated according to the decrypted TLV format data packet. It should be noted that the main control MCU can decrypt the encrypted data packet sent by the host computer, and the main control MCU can convert the format of the decrypted encrypted data packet to convert the format of the decrypted encrypted data packet into a TLV format data packet, and then the main control MCU can encrypt the TLV format data packet, and the main control MCU can send the encrypted TLV format data packet to the security module, and the security module can receive the encrypted TLV format data packet sent by the main control MCU. After the security module receives the encrypted TLV format data packet sent by the main control MCU, the security module can decrypt the TLV format data packet, and the security module can update the applet set in the security module according to the decrypted TLV format data packet to complete the offline update of the applet.

[0070] Specifically, the host computer may include but is not limited to a vehicle-side PAD and diagnostic equipment. The host computer and the main control MCU may be connected via a CAN (Controller Area Networker) bus or a CANFD (CAN With Flexible Data Rate-a serial communication protocol based on the CAN 2.0 physical layer) bus. The security module may also include a cos system. The security module needs to meet the normal functions of the cos system and the applet to ensure that the data packet can be transmitted completely during the communication process. The main control MCU and the security module may be connected via an SPI bus (serial peripheral interface-synchronous serial interface), thereby ensuring normal communication between the main control MCU and the security module.

[0071] Among them, the vehicle-mounted applet offline update system may also include a server side, and the server side may include but is not limited to a cloud server and a diagnostic server. Preferably, the server side and the host computer can transmit the data packet to be updated through a TCP or IP network channel. Further, the cloud server and the vehicle-side PAD can transmit the data packet to be updated through a TCP or IP network channel, and the diagnostic server and the diagnostic device can also transmit the data packet to be updated through a TCP or IP network channel. The host computer can obtain the data packet to be updated from the server side and load the data packet to be updated into the local memory. The host computer can establish a secure communication channel with the main control MCU. After the secure communication channel is established, the host computer can perform two-way authentication with the main control MCU according to the secure communication channel. After the two-way authentication between the host computer and the main control MCU is successful, the host computer can encrypt the data packet to be updated to generate an encrypted The main control MCU can decrypt the encrypted data packet sent by the host computer and perform format conversion to convert the format of the decrypted encrypted data packet into a TLV format data packet. After that, the main control MCU can encrypt the TLV format data packet, and the main control MCU can send the encrypted TLV format data packet to the security module through the SPI bus. After receiving the encrypted TLV format data packet sent by the main control MCU, the security module can decrypt the TLV format data packet, and the security module can update the applet set in the security module according to the decrypted TLV format data packet to complete the offline update of the applet. Furthermore, after the MCU receives the encrypted data packet sent by the host computer, the MCU can store the encrypted data packet and perform software version detection of the applet of the security module.

[0072] Therefore, through the offline update method of the vehicle-mounted applet of the present application, the vehicle-mounted applet can be updated offline quickly and conveniently without causing the failure of the vehicle-mounted applet update and the loss of vehicle-mounted applet functions, thereby avoiding the loss of vehicle functions and ensuring the transmission security during the data transmission process.

[0073] In some embodiments of the present invention, establishing a secure communication channel with a host computer may include: receiving an execution security operation command issued by the host computer, and responding to the execution security operation command according to a preset security channel specification requirement to generate a response command, and sending the response command to the host computer to complete the establishment of the secure communication channel. It should be explained that the host computer may send an execution security operation command to the master MCU, and the master MCU may receive the execution security operation command issued by the host computer. After receiving the execution security operation command issued by the host computer, the master MCU may respond to the execution security operation command according to a preset security channel specification requirement to generate a response command. After the MCU generates the response command, the MCU may send the response command to the host computer to establish a secure communication channel with the host computer, wherein the preset security channel specification requirement may be a security channel SCP11c (GlobalPlatform Card Technology Security Channel Protocol "11") specification requirement.

[0074] In some embodiments of the present invention, bidirectional authentication with a host computer based on a secure communication channel may include: receiving a static key sent by the host computer, calculating a shared negotiated key pair based on the static key, and completing bidirectional authentication based on the shared negotiated key pair. It should be explained that after the secure communication channel is established, the MCU can receive the static key sent by the host computer, and the MCU can calculate a shared negotiated key pair (ECKA) based on the static key sent by the host computer, and then the MCU can complete bidirectional authentication with the host computer based on the shared negotiated key pair. Specifically, the MCU can derive a channel session key (AES) based on the shared negotiated key pair, and the MCU can generate a response command based on the channel session key, and send the response command receipt to the host computer to complete bidirectional authentication with the host computer, thereby ensuring transmission security during data transmission.

[0075] In some embodiments of the present invention, after completing the two-way authentication, the MCU can also interact with the host computer to generate a session key according to the shared negotiation key pair, and decrypt the encrypted data packet according to the session key. It should be noted that after the MCU and the host computer complete the two-way authentication, the MCU can interact with the host computer to generate a session key according to the shared negotiation key pair, and the MCU can decrypt the encrypted data packet transmitted by the host computer according to the session key, and then the MCU can convert the format of the data packet to generate a TLV format data packet, and encrypt the TLV format data packet, and after encryption, send it to the security module through the SPI bus, thereby further ensuring the transmission security during the data transmission process.

[0076] It should be noted that the exchanged information between the MCU and the security module can be protected by SCP03 (GlobalPlatform Card Technology Security Channel Protocol "03") secure messaging. According to the encrypted data packet sent to the MCU according to the diagnostic specification, in the SCP03 secure communication mechanism, the transmitted data is packaged into APDU (Application Protocol Data Unit) commands for encryption and transmission. The plaintext command data transmitted by SCP03 is first encrypted with a session key to generate an encrypted command, and then encrypted to generate a CMAC value, and finally filled in a fixed format to form an encrypted command + CMAC value. During the channel transmission process, in accordance with data security requirements, the fixed format transmission data is encrypted and then transmitted with the channel session key, which can ensure the confidentiality and integrity of the data.

[0077] Among them, after the data packet is loaded, the software version of the applet of the security module can be detected. In addition, according to the diagnostic specification requirements, the burning and upgrading of the main control MCU needs to go through the stages of version reading, vehicle silence, security access, entering the programming diagnostic session mode, data downloading and transmission. For the upgrade of the security module, since it is necessary to consider the data packet forwarding of the main control MCU, only some stages need to be adopted.

[0078] In some embodiments of the present invention, before receiving the encrypted data packet, the received host computer request message is converted into an APDU encryption instruction and sent to the security module, and the response message fed back by the security module is received, and the response message is format-converted and uploaded to the host computer.

[0079] It needs to be explained that for each request from the host computer, that is, each time the host computer sends a host computer request message (encrypted data packet) to the main control MCU, the main control MCU needs to convert the host computer request message into the corresponding TLV format APDU encryption instruction and send it to the security module. The security module needs to set the silent state of the non-burning node. When entering the programming diagnostic session mode, it first passes through the security access service, and then directly enters the data download, data transmission, and request transmission exit. Among them, for the data download stage, a 256-byte data buffer area can be set to store the downloaded content, that is, the encrypted data packet transmitted by the host computer through the CAN or CANFD bus is stored first, and then the main control MCU responds successfully. In the subsequent data transmission stage, the main control MCU adds a header and a trailer to the downloaded encrypted data packet to package it, and forms an APDU encryption instruction in the TLV format and sends it to the security module. After the security module receives the APDU encryption instruction in the TLV format sent by the main control MCU, the security module will complete the response message transmission to the main control MCU. The main control MCU can convert the completion response message into a CAN message and pass it to the host computer. For the execution instruction of the transmission exit, it can be sent normally according to the specification. This cycle completes the sending of the encrypted data packet.

[0080] As some embodiments of the present invention, sequence counters can be set on both the host computer side and the main control MCU side to perform counting operations during data transmission. When the count reaches a certain number of times, a memory check is performed to complete the self-update of the applet of the security module. After that, the security module queries the update status of the applet. After the query passes, the status of the security module is reset to release the silent state of the non-burned node. Then, the security module packages the diagnostic response and completes the response transmission to the main control MCU. The main control MCU converts the response into CAN data and returns it to the host computer.

[0081] Figure 2 FIG. 1 is a flow chart of an in-vehicle applet offline update method according to another specific embodiment of the present invention. The in-vehicle applet offline update system of the above embodiment can implement the in-vehicle applet offline update method, such as Figure 2 As shown, the vehicle-mounted applet offline update method includes the following steps:

[0082] S201, after establishing a secure communication channel with the main control MCU, perform two-way authentication with the main control MCU based on the secure communication channel. It should be explained that the vehicle applet offline update system includes: a host computer, a main control MCU (Microcontroller unit-microcontroller unit) and a security module (SE-Secure Element), and the applet is set in the security module. Among them, the host computer is used to establish a secure communication channel with the main control MCU, and after the secure communication channel is established, perform two-way authentication with the main control MCU based on the secure communication channel. It should be explained that the host computer can establish a secure communication channel with the main control MCU, and after the secure communication channel is established, the host computer can perform two-way authentication with the main control MCU based on the secure communication channel.

[0083] S202, after the two-way authentication is successful, encrypt the data packet to be updated to generate an encrypted data packet, and send the encrypted data packet to the main control MCU so that the main control MCU decrypts and converts the format of the encrypted data packet to generate a TLV format data packet. It should be noted that after the host computer and the main control MCU successfully perform two-way authentication, the host computer can encrypt the data packet to be updated to generate an encrypted data packet, and the host computer can send the encrypted data packet to the main control MCU, the main control MCU can decrypt the encrypted data packet sent by the host computer, and the main control MCU can convert the format of the decrypted encrypted data packet to convert the format of the decrypted encrypted data packet into a TLV format data packet.

[0084] S203, encrypting the TLV format data packet through the main control MCU and sending it to the security module, so that the applet stored in the security module is updated according to the decrypted TLV format data packet. It should be noted that the main control MCU can encrypt the TLV format data packet, and the main control MCU can send the encrypted TLV format data packet to the security module, the security module can receive the encrypted TLV format data packet sent by the main control MCU, after the security module receives the encrypted TLV format data packet sent by the main control MCU, the security module can decrypt the TLV format data packet, and the security module can update the applet set in the security module according to the decrypted TLV format data packet to complete the offline update of the applet.

[0085] Specifically, the host computer may include but is not limited to a vehicle-side PAD and diagnostic equipment. The host computer and the main control MCU may be connected via a CAN (Controller Area Networker) bus or a CANFD (CAN With Flexible Data Rate-a serial communication protocol based on the CAN 2.0 physical layer) bus. The security module may also include a cos system. The security module needs to meet the normal functions of the cos system and the applet to ensure that the data packet can be transmitted completely during the communication process. The main control MCU and the security module may be connected via an SPI bus (serial peripheral interface-synchronous serial interface), thereby ensuring normal communication between the main control MCU and the security module.

[0086] Among them, the vehicle-mounted applet offline update system may also include a server side, and the server side may include but is not limited to a cloud server and a diagnostic server. Preferably, the server side and the host computer can transmit the data packet to be updated through a TCP or IP network channel. Further, the cloud server and the vehicle-side PAD can transmit the data packet to be updated through a TCP or IP network channel, and the diagnostic server and the diagnostic device can also transmit the data packet to be updated through a TCP or IP network channel. The host computer can obtain the data packet to be updated from the server side and load the data packet to be updated into the local memory. The host computer can establish a secure communication channel with the main control MCU. After the secure communication channel is established, the host computer can perform two-way authentication with the main control MCU according to the secure communication channel. After the two-way authentication between the host computer and the main control MCU is successful, the host computer can encrypt the data packet to be updated to generate an encrypted The main control MCU can decrypt the encrypted data packet sent by the host computer and perform format conversion to convert the format of the decrypted encrypted data packet into a TLV format data packet. After that, the main control MCU can encrypt the TLV format data packet, and the main control MCU can send the encrypted TLV format data packet to the security module through the SPI bus. After receiving the encrypted TLV format data packet sent by the main control MCU, the security module can decrypt the TLV format data packet, and the security module can update the applet set in the security module according to the decrypted TLV format data packet to complete the offline update of the applet. Furthermore, after the MCU receives the encrypted data packet sent by the host computer, the MCU can store the encrypted data packet and perform software version detection of the applet of the security module.

[0087] Therefore, through the vehicle-mounted applet offline update method of this embodiment, the vehicle-mounted applet can be updated offline quickly and conveniently without causing the failure of the vehicle-mounted applet update and the loss of vehicle-mounted applet functions, thereby avoiding the loss of vehicle functions and ensuring the transmission security during data transmission.

[0088] In some embodiments of the present invention, establishing a secure communication channel with a master MCU may include: sending a security operation execution command to the master MCU so that the master MCU responds to the security operation execution command according to a preset security channel specification to generate a response command, and after receiving the response command, the secure communication channel is established. It should be noted that the host computer may send a security operation execution command to the master MCU, and after receiving the security operation execution command issued by the host computer, the master MCU may respond to the security operation execution command issued by the host computer according to a preset security channel specification to generate a response command, and then the MCU may send the response command to the host computer, and after receiving the response command, the host computer may complete the establishment of a secure communication channel with the MCU, wherein the preset security channel specification requirement may be a security channel SCP11c (GlobalPlatform Card Technology Security Channel Protocol "11") specification requirement.

[0089] In some embodiments of the present invention, bidirectional authentication with the master MCU based on a secure communication channel may include: sending a static key to the master MCU, and calculating a shared negotiated key pair based on the static key by interacting with the master MCU, and completing bidirectional authentication based on the shared negotiated key pair. It should be explained that after the secure communication channel is established, the host computer can send a static key to the master MCU, and the host computer can calculate a shared negotiated key pair based on the static key by interacting with the master MCU, and then the host computer can complete bidirectional authentication with the MCU based on the shared negotiated key pair. Specifically, the MCU can derive a channel session key based on the shared negotiated key pair, and the MCU can generate a response command based on the channel session key, and send the response command receipt to the host computer to complete bidirectional authentication with the host computer, thereby ensuring transmission security during data transmission.

[0090] In some embodiments of the present invention, after completing the two-way authentication, the host computer can also interact with the master MCU to generate a session key according to the shared negotiation key pair, and encrypt the data packet to be updated according to the session key. It should be noted that after the host computer and the MCU complete the two-way authentication, the host computer can interact with the master MCU to generate a session key according to the shared negotiation key pair, and the host computer can encrypt the data packet to be updated according to the session key to generate an encrypted data packet, and the host computer can send the encrypted data packet to the master MCU, thereby further ensuring the transmission security during the data transmission process.

[0091] It should be noted that the exchanged information between the MCU and the security module is protected by SCP03 (GlobalPlatform Card Technology Security Channel Protocol "03") secure messaging. According to the encrypted data packet sent to the MCU according to the diagnostic specification, in the SCP03 secure communication mechanism, the transmitted data is packaged into APDU commands for encryption and transmission. The plaintext command data transmitted by SCP03 is first encrypted with the session key to generate an encrypted command, and then encrypted to generate a CMAC value, and finally filled in a fixed format to form an encrypted command + CMAC value. During the channel transmission process, in accordance with data security requirements, the fixed format transmission data is encrypted and then transmitted with the channel session key to ensure the confidentiality and integrity of the data.

[0092] Among them, after the data packet is loaded, the software version of the applet of the security module can be detected. In addition, according to the diagnostic specification requirements, the upgrade of the main control MCU needs to go through the stages of version reading, vehicle silence, security access, entering the programming diagnostic session mode, data download and transmission. For the upgrade of the security module, since it is necessary to consider the data packet forwarding of the main control MCU, only some stages need to be used.

[0093] In some embodiments of the present invention, before sending an encrypted data packet to the main control MCU, a host computer request message is also sent to the main control MCU so that the main control MCU converts the host computer request message into an APDU encryption instruction and sends it to the security module, and receives the converted message uploaded by the main control MCU, wherein the converted message is obtained by the main control MCU converting the format of the response message fed back by the security module.

[0094] It needs to be explained that for each request from the host computer, that is, each time the host computer sends a host computer request message (encrypted data packet) to the main control MCU, the main control MCU needs to convert the host computer request message into the corresponding TLV format APDU encryption instruction and send it to the security module. The security module needs to set the silent state of the non-burning node. When entering the programming diagnostic session mode, it first passes through the security access service, and then directly enters the data download, data transmission, and request transmission exit. Among them, for the data download stage, a 256-byte data buffer area can be set to store the downloaded content, that is, the encrypted data packet transmitted by the host computer through the CAN or CANFD bus is stored first, and then the main control MCU responds successfully. In the subsequent data transmission stage, the main control MCU adds a header and a trailer to the downloaded encrypted data packet to package it, and forms an APDU encryption instruction in the TLV format and sends it to the security module. After the security module receives the APDU encryption instruction in the TLV format sent by the main control MCU, the security module will complete the response message transmission to the main control MCU. The main control MCU can convert the completion response message into a CAN message and pass it to the host computer. For the execution instruction of the transmission exit, it can be sent normally according to the specification. This cycle completes the sending of the encrypted data packet.

[0095] As some embodiments of the present invention, sequence counters can be set on both the host computer side and the main control MCU side to perform counting operations during data transmission. When the count reaches a certain number of times, a memory check is performed to complete the self-update of the applet of the security module. After that, the security module queries the update status of the applet. After the query passes, the status of the security module is reset to release the silent state of the non-burned node. Then, the security module packages the diagnostic response and completes the response transmission to the main control MCU. The main control MCU converts the response into CAN data and returns it to the host computer.

[0096] In some embodiments of the present invention, before establishing a secure communication channel with the main control MCU, the data packet to be updated is also obtained from the server side. It should be explained that before the upper computer establishes a secure communication channel with the main control MCU, the upper computer can obtain the data packet to be updated from the server side and load the data packet to be updated into the local memory. Thus, the upper computer can obtain the data packet to be updated and store the data packet to be updated.

[0097] The computer-readable storage medium according to the embodiment of the present invention stores an in-vehicle applet-based offline update program, and when the in-vehicle applet-based offline update program is executed by a processor, the in-vehicle applet offline update method of the above embodiment can be implemented.

[0098] According to the computer-readable storage medium of the embodiment of the present invention, the vehicle-mounted applet can be updated offline quickly and conveniently without causing the failure of the vehicle-mounted applet update and the loss of vehicle-mounted applet functions, thereby avoiding the loss of vehicle functions and ensuring the transmission security during the data transmission process.

[0099] In order to implement the above embodiment, the present invention further proposes a main control MCU20, which includes a memory, a processor, and a vehicle-mounted applet offline update program stored in the memory and executable on the processor. When the processor executes the vehicle-mounted applet offline update program, the vehicle-mounted applet offline update method of the above embodiment can be implemented.

[0100] According to the main control MCU20 of the embodiment of the present invention, the on-board applet can be updated offline quickly and conveniently by executing the on-board applet offline update program stored in the memory through the processor, and the on-board applet will not be caused to fail in updating the on-board applet and lack of on-board applet functions, thereby avoiding the lack of vehicle functions and ensuring the transmission security during the data transmission process.

[0101] In order to implement the above embodiment, the present invention further proposes a host computer 10, which includes a memory, a processor, and a vehicle-mounted applet offline update program stored in the memory and executable on the processor. When the processor executes the vehicle-mounted applet offline update program, the vehicle-mounted applet offline update method of the above embodiment can be implemented.

[0102] According to the upper computer of the embodiment of the present invention, the vehicle-mounted applet can be updated offline quickly and conveniently by executing the vehicle-mounted applet offline update program stored in the memory through the processor, and the vehicle-mounted applet will not be updated. Failure and loss of vehicle-mounted applet functions will not occur, thereby avoiding the loss of vehicle functions. At the same time, the transmission security during the data transmission process can be guaranteed.

[0103] like Figure 4 As shown, the host computer 10 and the main control MCU 20 may include at least one processor 1201, at least one communication interface 1202, at least one memory 1203 and at least one communication bus 1204. In an embodiment of the present invention, the number of the processor 1201, the communication interface 1202, the memory 1203 and the communication bus 1204 is at least one, and the processor 1201, the communication interface 1202 and the memory 1203 communicate with each other through the communication bus 1204.

[0104] The memory 1203 may be, but is not limited to, a random access memory (RAM), a read only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electric erasable programmable read-only memory (EEPROM), etc. The memory 1203 is used to store programs, and the processor 1201 executes the program after receiving the execution instruction to implement the steps of the vehicle-mounted applet offline update method described in the above embodiment.

[0105] The processor 1201 may be an integrated circuit chip with signal processing capabilities. The above-mentioned processor may be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it may also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The disclosed methods, steps and logic block diagrams in the embodiments of the present invention may be implemented or executed. The general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc.

[0106] It should be noted that the logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing logical functions, and can be specifically implemented in any computer-readable medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute instructions), or in combination with these instruction execution systems, devices or apparatuses. For the purposes of this specification, "computer-readable medium" can be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution system, device or apparatus, or in combination with these instruction execution systems, devices or apparatuses. More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection portion with one or more wirings (electronic device), a portable computer disk box (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium and then editing, interpreting or processing in other suitable ways if necessary, and then stored in a computer memory.

[0107] It should be understood that the various parts of the present invention can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, a plurality of steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0108] In the description of the present invention, it should be understood that the terms "center", "longitudinal", "lateral", "length", "width", "thickness", "up", "down", "front", "back", "left", "right", "vertical", "horizontal", "top", "bottom", "inside", "outside", "clockwise", "counterclockwise", "axial", "radial", "circumferential" and the like indicate orientations or positional relationships based on the orientations or positional relationships shown in the accompanying drawings, and are only for the convenience of describing the present invention and simplifying the description, and do not indicate or imply that the referred device or element must have a specific orientation, be constructed and operated in a specific orientation, and therefore should not be understood as limiting the present invention.

[0109] In the description of the present invention, "first feature" or "second feature" may include one or more of the features.

[0110] In the description of the present invention, "plurality" means two or more.

[0111] In the description of the present invention, a first feature being “on” or “under” a second feature may include that the first and second features are directly in contact with each other, or may include that the first and second features are not in direct contact with each other but are in contact with each other via another feature therebetween.

[0112] In the description of the present invention, “on”, “over” and “above” a first feature from a second feature includes the first feature being directly above and obliquely above the second feature, or simply means that the first feature is horizontally higher than the second feature.

[0113] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "illustrative embodiments", "examples", "specific examples", or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner.

[0114] Although the embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the claims and their equivalents.

Claims

1. A vehicle-mounted applet offline update method, characterized in that: include: After establishing a secure communication channel with the host computer, performing two-way authentication with the host computer based on the secure communication channel, and receiving an encrypted data packet sent by the host computer after the two-way authentication is successful; The encrypted data packet is decrypted and format-converted to generate a TLV format data packet, and the TLV format data packet is encrypted and sent to the security module, so that the applet stored in the security module is updated according to the decrypted TLV format data packet.

2. The vehicle-mounted applet offline update method according to claim 1, characterized in that: Establish a secure communication channel with the host computer, including: Receive the security operation execution command issued by the host computer, respond to the security operation execution command according to the preset security channel specification requirements to generate a response command, and send the response command to the host computer to complete the establishment of the security communication channel.

3. The vehicle-mounted applet offline updating method according to claim 1 or 2, characterized in that: Performing two-way authentication with the host computer based on the secure communication channel includes: The static key sent by the host computer is received, and a shared negotiated key pair is calculated according to the static key, and two-way authentication is completed according to the shared negotiated key pair.

4. The vehicle-mounted applet offline updating method according to claim 3, characterized in that: After completing the two-way authentication, the system also interacts with the host computer to generate a session key according to the shared negotiated key pair, and decrypts the encrypted data packet according to the session key.

5. The vehicle-mounted applet offline updating method according to claim 1, characterized in that: Before receiving the encrypted data packet, the received host computer request message is converted into an APDU encryption instruction and sent to the security module, and the response message fed back by the security module is received, and the response message is format-converted and uploaded to the host computer.

6. A vehicle-mounted applet offline update method, characterized in that: include: After establishing a secure communication channel with the master MCU, performing two-way authentication with the master MCU based on the secure communication channel; After the two-way authentication is successful, the data packet to be updated is encrypted to generate an encrypted data packet, and the encrypted data packet is sent to the master control MCU, so that the master control MCU decrypts and converts the format of the encrypted data packet to generate a TLV format data packet; The TLV format data packet is encrypted by the main control MCU and sent to the security module, so that the applet stored in the security module is updated according to the decrypted TLV format data packet.

7. The vehicle-mounted applet offline updating method according to claim 6, characterized in that: Establishing a secure communication channel with the master MCU, including: Sending a security operation execution command to the master control MCU so that the master control MCU responds to the security operation execution command according to a preset security channel specification requirement to generate a response command; After receiving the response command, the establishment of the secure communication channel is completed.

8. The vehicle-mounted applet offline updating method according to claim 6 or 7, characterized in that: Performing two-way authentication with the master MCU based on the secure communication channel includes: The static key is sent to the master MCU, and a shared negotiated key pair is calculated according to the static key by interacting with the master MCU, and two-way authentication is completed according to the shared negotiated key pair.

9. The vehicle-mounted applet offline updating method according to claim 8, characterized in that: After completing the two-way authentication, the system also interacts with the master MCU to generate a session key according to the shared negotiated key pair, and encrypts the data packet to be updated according to the session key.

10. The vehicle-mounted applet offline updating method according to claim 6, characterized in that: Before sending the encrypted data packet to the main control MCU, a host computer request message is also sent to the main control MCU so that the main control MCU converts the host computer request message into an APDU encryption instruction and sends it to the security module, and receives the converted message uploaded by the main control MCU, wherein the converted message is obtained by the main control MCU performing format conversion on the response message fed back by the security module.

11. The vehicle-mounted applet offline updating method according to claim 6, characterized in that: Before establishing a secure communication channel with the main control MCU, the data packet to be updated is also obtained from the server side.

12. A computer-readable storage medium, characterized in that: An in-vehicle applet offline update program is stored thereon, and when the in-vehicle applet offline update program is executed by the processor, the in-vehicle applet offline update method according to any one of claims 1 to 5 or the in-vehicle applet offline update method according to any one of claims 6 to 11 is implemented.

13. A master control MCU, characterized in that: The invention comprises a memory, a processor and a vehicle-mounted applet offline update program stored in the memory and executable on the processor. When the processor executes the vehicle-mounted applet offline update program, the vehicle-mounted applet offline update method according to any one of claims 1 to 5 is implemented.

14. A host computer, characterized in that: The invention comprises a memory, a processor and a vehicle-mounted applet offline update program stored in the memory and executable on the processor. When the processor executes the vehicle-mounted applet offline update program, the vehicle-mounted applet offline update method as described in any one of claims 6 to 11 is implemented.

15. An in-vehicle applet offline update system, characterized in that: It includes a host computer, a main control MCU and a security module, wherein the applet is arranged in the security module, wherein: The host computer is used to establish a secure communication channel with the main control MCU, and after the secure communication channel is established, perform two-way authentication with the main control MCU according to the secure communication channel, and after the two-way authentication is successful, encrypt the data packet to be updated to generate an encrypted data packet, and send the encrypted data packet to the main control MCU; The main control MCU is used to decrypt and convert the format of the encrypted data packet to generate a TLV format data packet, and encrypt the TLV format data packet and send it to the security module; The security module receives and decrypts the encrypted TLV format data packet, and updates the applet according to the decrypted TLV format data packet.

Images