Vehicle firmware upgrade task issuing method and device, server and storage medium

Abstract

The application relates to the technical field of vehicles, in particular to a vehicle firmware upgrade task publishing method and device, a server and a storage medium, wherein the method comprises the following steps: obtaining a vehicle firmware upgrade request; matching a target upgrade descriptive metafile and a password book metafile of the vehicle according to the firmware upgrade request; signing the password book through at least one online private key and at least one offline private key; signing data blocks in the target upgrade descriptive metafile by using corresponding passwords in the password book; and sending the signed target upgrade task publishing file to the vehicle, so that the vehicle successively verifies the password book file and verifies the hash of the target upgrade task publishing file and the downloaded firmware file by using the password book file, to perform firmware upgrade. Therefore, the problems of easy password leakage and poor security caused by the fixed password during the vehicle firmware upgrade task are solved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of vehicles, and particularly relates to a vehicle firmware upgrade task publishing method and device, a server and a storage medium. BACKGROUND

[0002] With the rapid development of the Internet of Vehicles, the OTA (Over The Air, online upgrade) function gradually becomes one of the necessary functions of vehicles, so that the Internet-connected vehicles can use the OTA function to update the vehicle firmware, vehicle application programs and vehicle system configurations, etc., to improve the convenience of updating. The process of updating is as follows: the Internet-connected vehicle sends an upgrade request to the server, and the cloud transmits the upgrade package to the Internet-connected vehicle through an Internet interface or a USB interface.

[0003] However, when the vehicle firmware is upgraded, the cloud usually uses a fixed public and private key password to sign and issue the OTA task to the OTA client of the vehicle. Since the password cannot be updated at any time or periodically, and there is only one set of password, the password is easy to be leaked, and the online password is easy to be attacked, which greatly reduces the security of the vehicle firmware upgrade. Since most of the automobile ECU firmware is provided by OEM suppliers, some OEM suppliers protect privacy data and need to use their own OTA firmware publishing system. Therefore, it is necessary to design a safe OTA upgrade strategy to meet the needs of different suppliers. SUMMARY

[0004] The present application provides a vehicle firmware upgrade task publishing method and device, a server and a storage medium, to solve the problem that the password for the vehicle firmware upgrade task in the related art is a fixed password, which leads to easy password leakage, a single task publishing method and poor security, and reduces the convenience and security of vehicle firmware upgrade.

[0005] The first aspect embodiment of the application provides a vehicle firmware upgrade task publishing method, comprising the following steps: obtaining a vehicle firmware upgrade request; constructing an upgrade version metadata file of the vehicle according to the password library version number matching in the firmware upgrade request and the firmware version number in the firmware upgrade request; signing the upgrade version file through at least one online private key in the password library metadata file, writing the signature data into the password metadata file, and signing the password metadata file with at least one offline private key and writing the signature data into the password metadata file, generating a target upgrade metadata file according to the firmware version number in the upgrade request, and signing the description file with the signature password in at least one of the above-mentioned password metadata files; and linking the signature-encrypted target upgrade metadata file and the new version of the password library metadata file to the vehicle, so that the vehicle downloads the password library metadata file, checks the upgrade target task, downloads the upgrade firmware package after the check is successful, and performs signature verification on the target upgrade file and the firmware package, and performs firmware upgrade after the verification is successful.

[0006] Further, the target upgrade version file is signed in an online manner by at least one key pair in the password library, and the metadata description data of the upgraded ECU firmware file is signed, and the signature data is written into the target upgrade file; comprising: calculating the hash value of the upgrade version file, and writing the hash value of the upgrade version file into the target task node of the target upgrade task publishing file; the hash data of the ECU firmware version described in the upgrade target metadata file is also signed by the online key pair.

[0007] Further, the keys are distributed in a manner of verifying the higher version password library by the lower version password library; comprising: one or a group of password pairs of a ROOT role verify the higher version password library through one ROOT role; wherein, the zero version in the password library version is the basic version and has a self-verification function.

[0008] Further, before sending the signature target upgrade task publishing file to the vehicle, it further comprises: signing the description metadata of the target upgrade task with at least one online private key in the password library, wherein the signature threshold is determined by the password attribute of the password library; the hash value of the descriptive metadata, the algorithm name of the signature, the signature value and the signature password identifier used are all written into the signature element of the descriptive metadata in the target upgrade description metadata file.

[0009] Further, before sending the signed target upgrade task release file to the vehicle, the method further comprises: when the target upgrade version file contains upgrade description metadata provided by an original equipment manufacturer (OEM), obtaining a key pair of the OEM from the password book cloud data, signing the OEM data block, and writing the identification of the OEM data block into the identification area of the OEM data block.

[0010] Further, if the vehicle password book metadata version is upgraded to a new version, the vehicle needs to authenticate the new version using the password metadata of the previous version.

[0011] The second aspect embodiment of the application provides a vehicle firmware upgrade task release device, comprising: an obtaining module configured to obtain a vehicle firmware upgrade request; a matching module configured to match a target upgrade description metadata file and a password book metadata file of the vehicle according to the firmware upgrade request; a release module configured to sign the password book metadata file through at least one online private key and at least one offline private key, sign data blocks in the target upgrade description metadata file using corresponding passwords in the password book metadata file, and send the signed target upgrade task release file to the vehicle, so that the vehicle successively verifies the password book metadata file and uses the password book metadata file to sign and verify the hash of the target upgrade task release file and a downloaded firmware file to perform firmware upgrade.

[0012] Further, the release module is further configured to verify a higher version of the password book through one or a group of passwords of a ROOT role; wherein a zero version in the password book version is used as a base version and has a self-verification function.

[0013] Further, the device further comprises a signing module configured to sign description metadata of the target upgrade task using at least one online private key in the password book before sending the signed target upgrade task release file to the vehicle, wherein a signature threshold is determined by a password book password attribute; a hash value of the description metadata, a signature algorithm name, a signature value, and a signature password identifier used are all written into a signature element of the description metadata in the target upgrade description metadata file.

[0014] Further, before sending the signed target upgrade task release file to the vehicle, when the target upgrade description metadata file includes upgrade description metadata provided by an original equipment manufacturer (OEM), the verification password identifier of the description metadata comes from the password book, and the verification password is provided by the OEM.

[0015] Further, the target release task contains multiple data areas, an ECU firmware metadata description area, an OEM release metadata description area, and a target release task signature area. Each area has corresponding password metadata online for signature.

[0016] The third aspect of the present application provides a server, comprising a memory, a processor and a computer program stored in the memory and executable on the processor, and the processor executes the program to implement the vehicle firmware upgrade task publishing method according to the above-mentioned embodiments.

[0017] The fourth aspect of the present application provides a computer readable storage medium, which stores a computer program executable by a processor to implement the vehicle firmware upgrade task publishing method according to the above-mentioned embodiments.

[0018] Therefore, the present application has at least the following beneficial effects:

[0019] The offline key and the online key are used to sign the mixed signature, the offline key is less likely to be leaked, the signed OTA task is safer, a multi-level trust system is used to sign the OTA task, the security of the multi-person signature is higher than that of the single-person signature, and thus the password leakage can be effectively avoided, the online signature can help improve the convenience of task publishing and the efficiency of task publishing, the online and offline task publishing modes are used to improve the security and the security of vehicle firmware upgrade, the OEM upgrade description area is given in the task publishing, and the OEM password is used for signature, so that the OEM can independently control the ECU unit upgrade. Therefore, the technical problems of fixed password for vehicle firmware upgrade task, easy password leakage, poor security and scalability of task publishing, and reduced security of vehicle firmware upgrade are solved.

[0020] The additional aspects and advantages of the present application will be partially given in the following description, partially will become obvious from the following description, or will be understood by practicing the present application. BRIEF DESCRIPTION OF DRAWINGS

[0021] The above-mentioned and / or additional aspects and advantages of the present application will become apparent and easy to understand from the following description of the embodiments in conjunction with the accompanying drawings, in which:

[0022] Figure 1 A flowchart of a vehicle firmware upgrade task publishing method according to an embodiment of the present application is shown;

[0023] Figure 2 A password-based signature flowchart according to an embodiment of the present application is shown;

[0024] Figure 3 A flowchart of generating a target upgrade descriptive metadata file according to an embodiment of the present application is shown;

[0025] Figure 4A flowchart of a process in which an OTA client parses a target file is provided according to an embodiment of the present application.

[0026] Figure 5 An example diagram of an apparatus for publishing an upgrade task of vehicle firmware is provided according to an embodiment of the present application.

[0027] Figure 6 A structural diagram of a server is provided according to an embodiment of the present application. DETAILED DESCRIPTION

[0028] Embodiments of the present application are described in detail below with reference to the accompanying drawings, in which examples of the embodiments are shown, wherein the same or similar notations are used to denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below by reference to the accompanying drawings are exemplary and are intended to explain the present application, and cannot be understood as limiting the present application.

[0029] Currently, FOTA (vehicle firmware upgrade) usually adopts fixed symmetric or asymmetric certificates for authentication between a vehicle and a cloud. Since the certificates usually have a time limit, the security of the OTA task cannot be effectively guaranteed when the certificates expire or are lost. In addition, when an OEM (Original Equipment Manufacturer) maintains its own OTA upgrade package, it often needs to obtain a private key from the host manufacturer, and the private key is used to sign the upgrade package. This not only makes the upgrade maintenance very inconvenient, but also easily leads to the leakage of the private key, reducing the security of the upgrade. Therefore, there is currently no convenient way for OEM suppliers to publish their own versions, reducing the convenience of publishing.

[0030] Therefore, in order to solve the problems of how to guarantee the security and integrity of the published OTA task, and the integrity and security of the task published by multiple levels of suppliers, etc. when upgrading the vehicle firmware, embodiments of the present application provide a flexible and expandable multi-level OTA task publishing solution. The host manufacturer can update the signature encryption key at any time, and the OEM can use its own key to sign and publish its own upgrade package. At the same time, in order to guarantee the security of the key, the host manufacturer has multiple keys to sign the task, and the core key is saved in an offline manner, effectively guaranteeing the security of the key library.

[0031] The vehicle firmware upgrade task publishing method, apparatus, server and storage medium of embodiments of the present application will be described below with reference to the accompanying drawings. Specifically, Figure 1 A flowchart of a vehicle firmware upgrade task publishing method provided by an embodiment of the present application is shown.

[0032] As Figure 1 shown, the vehicle firmware upgrade task publishing method includes the following steps:

[0033] In step S101, a firmware upgrade request of a vehicle is acquired.

[0034] It should be noted that the execution subject of the vehicle firmware upgrade task publishing method in the embodiments of the present application is a server, wherein the server can be an OTA cloud and the like, and no specific limitation is made thereto. In the following embodiments, the server is taken as an example of the OTA cloud.

[0035] It can be understood that when the vehicle needs to be upgraded, for example, the vehicle firmware needs to be upgraded, the OTA client of the vehicle can send an upgrade request to the OTA cloud, so that the OTA cloud can issue an upgrade task to the vehicle according to the upgrade request.

[0036] In step S102, the target upgrade descriptive metafile and the password book metafile of the vehicle are matched according to the firmware upgrade request.

[0037] It can be understood that the OTA cloud can match the corresponding target upgrade descriptive metafile and password book metafile from the database according to the firmware upgrade request.

[0038] In step S103, the password book metafile is signed by at least one online private key and at least one offline private key, the data blocks in the target upgrade descriptive metafile are signed by the corresponding password in the password book metafile, and the signed target upgrade task publishing file is sent to the vehicle, so that the vehicle verifies the signature of the password book metafile and uses the password book metafile to sign and verify the hash of the target upgrade task publishing file and the downloaded firmware file, to perform firmware upgrade.

[0039] The online key is generated by the OTA cloud for one vehicle or a group of vehicles in an online manner, and the online key can be one or more groups, which can be specifically set according to actual conditions, and no specific limitation is made thereto. The offline key can be generated by the OTA host in an offline manner, and can be used as a core key. Since the offline key has a low possibility of being leaked, the security of the OTA task publishing can be improved.

[0040] It should be noted that the private key signature and the public key verification can be used in the embodiments of the present application, wherein the public key and the private key appear in pairs, the private key is used to generate a fixed-length signature for a piece of text, and the public key is used to decrypt and verify the text signed by the private key.

[0041] It can be understood that the embodiments of the application can produce an offline key through an offline host, produce a group of keys through an online or offline mode at the same time, and authorize several administrator roles to sign the task package respectively, and distribute the signed task package to the OTA client of the vehicle, so as to sign the upgrade task by using the several keys generated above, effectively guarantee the data integrity and security of the OTA client of the vehicle distributed through the network, and further guarantee the security of the OTA distribution by using the online and offline multiple keys, and effectively improve the security and scalability of the OTA upgrade.

[0042] Specifically, the embodiments of the application can sign the upgrade task password book meta file by using at least one online private key, write the signature data into the upgrade task password book meta file, and sign the upgrade task password book meta file by using at least one offline private key, and write the signature data into the upgrade task password book meta file; at the same time, the OTA cloud end signs the description data of the vehicle to be upgraded firmware according to the published password book meta data to generate a target task file, and the target task file contains the password book meta data download link and the target task meta data; the vehicle obtains the task file, downloads the password book file and the upgradeable firmware data in the target task in sequence, and checks the target task by using the password book data, and checks the downloaded ECU upgrade package and the ECU description data in the target task, and the vehicle end performs ECU firmware upgrade after complete matching.

[0043] In the embodiments of the application, before the signed upgrade task distribution file is sent to the vehicle, the method further comprises: signing the password book file by using at least one online private key, and writing the signature into the file header of the key book file, wherein the password book file header comprises at least one online public key and at least one offline public key; the target upgrade task distribution file corresponds to the required password book file version.

[0044] It can be understood that the OTA cloud end generates a series of key pairs, and the public keys are assigned to different roles for different signature verification tasks; the public key of the ROOT role is used to verify and decrypt the key book of other roles; the password of the Target role is used to verify the signature of the target upgrade file; the OEM role is used to sign the OEM metadata in the target upgrade file; the ECU role is used to sign the elements in the ECU segment in the target upgrade file; the TIME role is used to verify the time elements in the time server. Each password metadata is numbered by HASH, the publication time of the password, the expiration time, the minimum number of signatures required when signing by using the password, and the like, wherein the OTA server must provide accurate time for the vehicle end, and the time server publishes the time by signing by using the private key of the TIME role, and the vehicle end OTA Client verifies the legality of the time published by the time server by using the signature verification public key of the TIME role.

[0045] The OTA server stores a zero version of the password book, which is used to verify the one version of the password book; the OTA server

[0046] The minimum dependent password version in the target task release version of the server starts from one; the vehicle-side OTA Client must download the corresponding password book according to the specification and verify the new password book;

[0047] In the embodiment of the application, the password book file needs to be signed by at least one offline private key; the target upgrade file is signed by the role in the password book; one password book version corresponds to multiple target upgrade files; when it is necessary to replace the password book, a new password book is generated and signed by the offline and online public keys; meanwhile, the new version of the password book must be verified by the password of the ROOT role of the previous version;

[0048] It can be understood that the OTA cloud can find the image file that can be updated from the OTA warehouse according to the version already installed by the vehicle, the hash data of the image signed by the key in the password book, the signature method and the survival period of the image, and the target ECU version information, and write these image attributes into the ECUS data area in the target task file. The attributes of ECUS include user-defined data and general attributes, and the general attributes include a target download address, a target file HASH, a target file belonging device number, etc. Among them, ECUS refers to a target upgrade task area, and ECU refers to a task node in the target task EUCS area.

[0049] In the embodiment of the application, before sending the signed upgrade task release file to the vehicle, the following is further included: when the target upgrade version includes upgrade version description information provided by the original equipment manufacturer (OEM), the OEM upgrade section is signed by the signature password of the OEM role from the OEM supplier in the password book, so that the OEM upgrade description task has no denial.

[0050] It can be understood that the security policy of the embodiment of the application can be nested to publish the vehicle upgrade, so that the OEM itself safely publishes its own upgrade package. Specifically, if there is an OEM supplier firmware that needs to be upgraded, the OEM section is included in the target upgrade file, the OEM section has the address to be updated by the OEM supplier, the signature of the OEM target file, and the identification code of the signature public key used.

[0051] In the embodiment of the application, the OTA client takes the public key in the password book from the task issued by the OTA cloud to verify the OTA upgrade task, and each OTA task issued by the OTA cloud has a version number. The OTA client compares the version of the OTA task issued by the cloud with the local version to determine whether the upgrade content is the latest version, thereby preventing the upgrade task from being rolled back.

[0052] The OTA cloud needs to provide accurate date service and sign with the password of one or several TIME roles in the password book; the vehicle end obtains the clock through the precise time server and verifies with the password book password, and the precise time can effectively prevent the expiration of the upgrade element in the target upgrade;

[0053] It should be noted that the vehicle and vehicle upgrade can use 4G, 5G and other wireless communication, and the firmware package data is sent to the corresponding ECU on the vehicle through the UDS protocol or DOIP writing protocol, and the ECU writes the firmware data to the corresponding storage area.

[0054] The following will describe the vehicle firmware upgrade task publishing method through a specific implementation, and the specific process of generating the password book and the target upgrade file in the following embodiment, as shown in Figure 2 、 Figure 3 and Figure 4 , specifically including the following steps:

[0055] 1) The OTA cloud generates a series of key pairs, numbers the public keys of these keys according to their own hash data; at the same time, obtains the public key from the OEM supplier and puts it into the password book; distributes these key pairs to different signature verification tasks; divides the private key of the above password pair into two parts: one part is offline storage, and the other part is online storage; signs the password book file with the above online private key and offline key, and writes the signature data into the password book.

[0056] 2) The password has its own attributes, expiration date and production date, password type, signature threshold

[0057] 3) The one or more public keys taken from the OEM supplier are only used for the OEM color in the password book, and only sign the metadata of the OEM publishing task;

[0058] 4) The OTA cloud generates a target task upgrade file according to the version number reported by the vehicle, if the OEM supplier needs to upgrade the version, writes the OEM label attribute and the description data of the OEM upgrade in the target file.

[0059] 5) The OEM supplier generates its own password book and target upgrade file in the same way.

[0060] 6) The vehicle's OTA client reports its installed version information to the OTA cloud and attaches an incremental reporting serial number to prevent rollback attacks.

[0061] 7) The vehicle's OTA client receives the password book download description file and the target upgrade task file from the OTA cloud;

[0062] 8) The OTA client of the vehicle downloads the password book file if necessary, and signs the new password book with the last password book;

[0063] 9) The OTA client of the vehicle signs the current upgrade file with the password in the password book, and downloads the corresponding firmware from the download address, calculates the hash data of the firmware according to the hash algorithm, and compares the data with the hash in the description file; the ECU upgrade description metadata has the expiration time of the task, and the OTA vehicle end needs to obtain the accurate time to check whether it is expired;

[0064] 10) The ECU upgrade description metadata has user-defined data, and the vehicle OTA client checks these user-defined data, such as upgrade preconditions and upgrade protocols.

[0065] 11) The vehicle OTA client performs ECU upgrade according to the upgrade preconditions;

[0066] 12) The vehicle OTA client needs to parse the OEM attribute of the target file, so as to nest the download and installation

[0067] 13) The vehicle OTA client reports the upgrade report to the OTA service cloud.

[0068] In summary, the keys for signing the ECU upgrade description metadata and the target upgrade file in the embodiment of the application are not limited to two, and are determined by a signature threshold; if the number of signatures does not meet the threshold requirement during signature verification, the signature verification fails.

[0069] According to the vehicle firmware upgrade task publishing method provided in the embodiment of the application, the offline key and the online key are used to sign in combination, the possibility of leakage of the offline key is lower, the signed OTA task is safer, a multi-level trust system is used to sign the task issued by the OTA, and the security of multi-person signature is higher than that of single-person signature, so that the password leakage can be effectively avoided, the security of task publishing is improved, and the security of vehicle firmware upgrade is improved.

[0070] Next, the vehicle firmware upgrade task publishing device provided in the embodiment of the application is described with reference to the accompanying drawings.

[0071] Figure 5 is a block schematic diagram of the vehicle firmware upgrade task publishing device in the embodiment of the application.

[0072] As shown in Figure 5 , the vehicle firmware upgrade task publishing device 10 includes an acquisition module 100, a matching module 200, and a publishing module 300.

[0073] The obtaining module 100 is configured to obtain a firmware upgrade request of the vehicle; the matching module 200 is configured to match a target upgrade description metafile and a password book metafile of the vehicle according to the firmware upgrade request; the publishing module 300 is configured to sign the password book metafile through at least one online private key and at least one offline private key, sign data blocks in the target upgrade description metafile through corresponding passwords in the password book metafile, and send the signed target upgrade task publishing file to the vehicle, so that the vehicle successively verifies the password book metafile and uses the password book metafile to sign and verify the hash of the target upgrade task publishing file and the downloaded firmware file, to perform the firmware upgrade.

[0074] In the embodiment of the application, the publishing module 300 is further configured to verify the password book of the higher version through one or a group of passwords of a role of a ROOT; wherein the zero version in the password book version is taken as a basic version and has a self-verification function.

[0075] In the embodiment of the application, the device 10 of the embodiment of the application further comprises a signing module. The signing module is configured to sign the description metadata of the target upgrade task through at least one online private key in the password book before the signed target upgrade task publishing file is sent to the vehicle, wherein a signature threshold is determined by a password attribute of the password book; a hash value of the description metadata, a signature algorithm name, a signature value and a signature password identifier used are all written into a signature element of the description metadata in the target upgrade description metafile.

[0076] In the embodiment of the application, before the signed target upgrade task publishing file is sent to the vehicle, when the target upgrade description metafile comprises upgrade description metadata provided by an original equipment manufacturer (OEM), the verification password identifier of the description metadata comes from the password book, and the verification password is provided by the OEM.

[0077] In the embodiment of the application, the target publishing task comprises a plurality of data areas, an ECU firmware meta data description area, an OEM publishing meta data description area and a target publishing task signature area. The respective areas are all signed by corresponding password metadata online.

[0078] It should be noted that the above explanation and description of the embodiment of the vehicle firmware upgrade task publishing method are also applicable to the vehicle firmware upgrade task publishing device of the embodiment, and thus will not be described herein again.

[0079] The vehicle firmware upgrade task publishing device provided by the embodiment of the present application uses a signature of mixed use of an offline key and an online key, the offline key has a lower possibility of leakage, so that the signed OTA task is safer, and a multi-level trust system is adopted to sign the task issued by the OTA, the security of multi-person signature is higher than that of single-person signature, so that the password leakage can be effectively avoided, the security of task publishing is improved, and the security of vehicle firmware upgrade is improved.

[0080] Figure 6 The server structure schematic diagram provided by the embodiment of the present application. The vehicle can include:

[0081] The memory 601, the processor 602 and the computer program stored in the memory 601 and executable on the processor 602.

[0082] The processor 602 implements the vehicle firmware upgrade task publishing method provided in the above embodiment when executing the program.

[0083] Further, the server further includes:

[0084] The communication interface 603 is used for communication between the memory 601 and the processor 602.

[0085] The memory 601 is used to store the computer program executable on the processor 602.

[0086] The memory 601 can include a high-speed RAM (Random Access Memory, Random Access Memory) memory, and can also include a non-volatile memory, for example, at least one disk memory.

[0087] If the memory 601, the processor 602 and the communication interface 603 are independently implemented, the communication interface 603, the memory 601 and the processor 602 can be connected to each other through a bus and complete the communication between each other. The bus can be an ISA (Industry Standard Architecture, Industry Standard Architecture) bus, a PCI (Peripheral Component, Peripheral Component Interconnect) bus or an EISA (Extended Industry Standard Architecture, Extended Industry Standard Architecture) bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. For the convenience of representation, Figure 6 Only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus.

[0088] Optionally, if the memory 601, the processor 602 and the communication interface 603 are integrated on a chip, the memory 601, the processor 602 and the communication interface 603 can complete the communication among each other through an internal interface.

[0089] The processor 602 can be a CPU (Central Processing Unit), or an ASIC (Application Specific Integrated Circuit), or one or more integrated circuits configured to perform the embodiments of the present application.

[0090] The embodiments of the present application further provide a computer readable storage medium, which has stored a computer program, and the program is executed by a processor to implement the method for publishing the upgrading task of the vehicle firmware as described above.

[0091] In the description of the present specification, the description of the terms "one embodiment", "some embodiments", "an example", "a specific example", or "some examples" means that the specific features, structures, materials or characteristics described in connection with the embodiment or example are included in at least one embodiment or example of the present application. In the present specification, the illustrative description of the above terms is not necessarily directed to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any one or N embodiments or examples in a suitable manner. In addition, the person skilled in the art can combine and combine the different embodiments or examples described in the present specification and the features of the different embodiments or examples without contradiction.

[0092] In addition, the terms "first", "second" are only for the purpose of description, and cannot be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined with "first", "second" can explicitly or implicitly include at least one of the features. In the description of the present application, the meaning of "N" is at least two, such as two, three, etc., unless otherwise specifically limited.

[0093] Any process or method descriptions in flow charts or described elsewhere herein can be understood as representing code modules, segments, or portions of code that include one or more executable instructions for implementing the specified logic functions (or steps) and / or can be implemented as computer-executable instructions. The various embodiments of the preferred implementation of the present application can include additional or fewer steps or processes, and the order of those that are included can be different from that shown or discussed. It is understood that these processes or steps can be combined or separated into different processes or steps, and can be performed in an order other than that shown or discussed, and / or can be performed concurrently, substantially concurrently or at different times, without departing from the scope of the present application.

[0094] It should be understood that portions of the application can be implemented in hardware, software, firmware, or combinations thereof. In the above embodiments, the N steps or methods can be implemented in software or firmware stored in a memory and executed by a suitable instruction execution system. As such, if implemented in hardware, and in another embodiment, any of the following technologies, known in the art, or their combinations, can be used to implement: discrete logic circuitry having logic gates for implementing logic functions on data signals, application specific integrated circuits having appropriate combinational logic gates, programmable gate arrays, field programmable gate arrays, and the like.

[0095] Those skilled in the art can understand that all or part of the steps carried out by the above-mentioned embodiment methods can be completed by programs instructing related hardware, and the programs can be stored in a computer readable storage medium. When the program is executed, it includes one of the steps of the method embodiment or a combination thereof.

Claims

1. A method for issuing an upgrade task of vehicle firmware, characterized in that, The method comprises the following steps: obtaining a firmware upgrade request of a vehicle; matching a target upgrade description metafile and a password book metafile of the vehicle according to the firmware upgrade request; and signing the password book metafile by using at least one online private key and at least one offline private key, and signing data blocks in the target upgrade description metafile by using corresponding passwords in the password book metafile; sending the signed target upgrade task release file to the vehicle, so that the vehicle successively verifies the password book metafile and verifies the hash of the target upgrade task release file and the downloaded firmware file by using the password book metafile, to perform firmware upgrade, wherein the key is distributed in a manner that a higher version of the password book is verified by a lower version of the password book, including that one or a group of passwords of a role of a ROOT verifies a higher version of the password book; wherein a zero version in the password book version is a basic version and has a self-verification function.

2. The method of claim 1, wherein, Before the signed target upgrade task release file is sent to the vehicle, the method further comprises: signing description metadata of the target upgrade task by using at least one online private key in the password book, wherein a signature threshold is determined by a password attribute of the password book; calculating a hash value of the description metadata, an algorithm name used for signing, a signature value, and a signature password identifier used for signing, and writing them into a signature element of the description metadata in the target upgrade description metafile.

3. The method of claim 1, wherein, Before the signed target upgrade task release file is sent to the vehicle, the method further comprises: when the target upgrade description metafile comprises upgrade description metadata provided by an original equipment manufacturer (OEM), a verification password identifier of the description metadata comes from the password book, and the verification password is provided by the OEM.

4. An apparatus for issuing an upgrade task of vehicle firmware, characterized by, The method comprises: an obtaining module configured to obtain a firmware upgrade request of a vehicle; a matching module configured to match a target upgrade description metafile and a password book metafile of the vehicle according to the firmware upgrade request; and a release module configured to sign the password book metafile by using at least one online private key and at least one offline private key, and sign data blocks in the target upgrade description metafile by using corresponding passwords in the password book metafile; send the signed target upgrade task release file to the vehicle, so that the vehicle successively verifies the password book metafile and verifies the hash of the target upgrade task release file and the downloaded firmware file by using the password book metafile, to perform firmware upgrade, wherein the key is distributed in a manner that a higher version of the password book is verified by a lower version of the password book, including that one or a group of passwords of a role of a ROOT verifies a higher version of the password book; wherein a zero version in the password book version is a basic version and has a self-verification function.

5. The apparatus of claim 4, wherein, The method further comprises: a signing module configured to, before the signed target upgrade task release file is sent to the vehicle, sign description metadata of the target upgrade task by using at least one online private key in the password book, wherein a signature threshold is determined by a password attribute of the password book; The hash value of the descriptive metadata, the algorithm name of the signature, the signature value, and the signature cipher identification used are all written into a signature element of the descriptive metadata in the target upgrade descriptive metadata file.

6. The apparatus of claim 4, wherein, Before sending the signed target upgrade task release file to the vehicle, when the target upgrade descriptive metadata file includes upgrade descriptive metadata provided by an original equipment manufacturer (OEM), the signature verification cipher identification of the descriptive metadata is from a cipher book, and the signature verification cipher is provided by the OEM.

7. A vehicle characterized by comprising: The program is executed by the processor to implement the vehicle firmware upgrade task release method according to any one of claims 1-3. The program is executed by the processor to implement the vehicle firmware upgrade task release method according to any one of claims 1-3.

8. A computer-readable storage medium having stored thereon a computer program, characterized in that, ​

Images