A method, device, equipment and product for updating automobile safety data

Abstract

The present invention discloses a method, device, equipment and product for updating automobile safety data, and relates to the field of automobile technology. The method comprises: a battery management system determines an information flashing instruction sent by a server, and generates an information update flag based on the determined information flashing instruction; a first code area determines an information update flag, generates and sends a request flashing flag to a server; a code flash memory of a hardware security module comprises a first code area, a second code area and a third code area; determines the flashing data returned by the server based on the request flashing flag, and writes the determined flashing data into the second code area based on the first code area; writes the flashing data written in the second code area into the third code area of ​​erased data. The present invention eliminates the process of dismantling and unpacking the car, saves manpower and material resources, meets the existing industrial structure and safety requirements of automobiles, and can also provide safety protection for the entire life cycle of automobile software updates.

Description

Technical Field

[0001] The present invention relates to the field of automobile technology, and in particular to a method, device, equipment and product for updating automobile safety data. Background Art

[0002] From the power source of electric vehicles, it can be known that one of the most important components of electric vehicles is the Battery Management System (BMS). Hardware Security Module (HSM) can be integrated into BMS. HSM is designed to improve the ability of the vehicle network and vehicle to X (V2X) application to defend against attacks. BMS communicates with the electric vehicle controller through CANbus. However, the running code of HSM cannot be updated through CANbus. The code can only be updated by directly connecting the debugger to the hardware debugging interface. This results in the electric vehicle after the standard operating procedure (SOP) can only be dismantled and unpacked to download the HSM code, which is time-consuming and laborious, and does not meet the existing industrial structure and safety requirements of automobiles. It cannot provide security protection for the entire life cycle of automobile software updates.

[0003] Therefore, how to update the HSM code to update the safety information without dismantling the vehicle after the BMS is installed is an important issue that needs to be solved urgently in the industry. Summary of the invention

[0004] In view of this, the embodiments of the present invention provide a method, device, equipment and product for updating automobile safety data to solve the problem that the HSM code can only be obtained by dismantling the vehicle and unpacking the BMS after it is installed on the vehicle.

[0005] According to a first aspect, an embodiment of the present invention provides a method for updating automobile safety data, the method being applied to a client, wherein a battery management system having an integrated hardware security module is installed in the client, and the hardware security module and the battery management system establish communication based on IPC, the method comprising:

[0006] The battery management system determines the information flashing instruction sent by the server, and generates an information update flag based on the determined information flashing instruction;

[0007] The first code area determines the information update flag, generates and sends a request to the server to flash the flag; the code flash memory of the hardware security module includes the first code area, the second code area and the third code area;

[0008] Determine the flash data returned by the server based on the flash flag bit requested, and write the determined flash data into the second code area based on the first code area;

[0009] The first code area writes the flash data written in the second code area into the third code area from which the data has been erased; the data in the third code area is erased through the first code area.

[0010] In combination with the first aspect, in a first implementation of the first aspect, the flash data includes signature information;

[0011] The step of determining the flash data returned by the server based on the flash flag bit requested, and writing the determined flash data into the second code area specifically includes:

[0012] The battery management system determines the flash data returned by the server based on the flash flag bit requested, and stores the flash data in the IPC;

[0013] Based on the first code area, determine the flash data, write the determined flash data into the second code area, and verify the data in the second code area based on the signature information in the flash data;

[0014] It is determined that the second code area has passed the verification, and the first code area is generated and the first success flag is sent to the server.

[0015] In combination with the first embodiment of the first aspect, in the second embodiment of the first aspect, the method further includes:

[0016] It is determined that the second code area fails the verification, the first code area generates and sends a first failure flag to the server, the first code area deletes the data of the second code area and resets the hardware security module.

[0017] In combination with the first implementation of the first aspect, in a third implementation of the first aspect, the first code area writes the flash data written in the second code area into the third code area from which the data has been erased; and the data in the third code area is erased through the first code area, specifically including:

[0018] Based on the first success flag, the first code area erases the data in the third code area;

[0019] The first code area writes the flash data written in the second code area into the third code area from which the data has been erased, and verifies the data in the third code area based on the signature information in the flash data;

[0020] It is determined that the third code area has passed the verification, and the first code area is generated and a second success flag is sent to the server.

[0021] In combination with the third implementation of the first aspect, in a fourth implementation of the first aspect, the method further includes:

[0022] It is determined that the third code area fails verification, the first code area generates and sends a second failure flag to the server, the first code area deletes the data in the third code area and resets the hardware security module.

[0023] According to a second aspect, an embodiment of the present invention further provides a method for updating automobile safety data, the method being applied to a server, and the method comprising:

[0024] Determine a data update request and a data flushing instruction based on the data update request;

[0025] Determine the request flash flag returned by the client based on the information flash instruction; the client is equipped with a battery management system with an integrated hardware security module, and the hardware security module and the battery management system establish communication based on IPC;

[0026] Sending flash data to the client; transmitting flag bits and flash data between the first code area in the hardware security module and the battery management system through IPC, the code flash memory of the hardware security module includes the first code area, the second code area and the third code area; the first code area is used to flash and delete data in the second code area, erase and delete data in the third code area, and write data in the second code area to the third code area.

[0027] According to a third aspect, an embodiment of the present invention further provides a device for updating automobile safety data, the device is applied to a client, a battery management system with an integrated hardware security module is installed in the client, the hardware security module and the battery management system establish communication based on IPC, and the device includes:

[0028] A first generating module, used to determine the information flashing instruction sent by the server through the battery management system, and generate an information update flag based on the determined information flashing instruction;

[0029] The second generating module is used to determine the information update flag bit through the first code area, generate and send a request to the server to flash the flag bit; the code flash memory of the hardware security module includes the first code area, the second code area and the third code area;

[0030] A first flashing module, used for determining the flashing data returned by the server based on the flashing request flag, and writing the determined flashing data into the second code area based on the first code area;

[0031] The second flashing module is used to write the flashing data written in the second code area into the third code area from which the data has been erased through the first code area; the data in the third code area is erased through the first code area.

[0032] According to a fourth aspect, an embodiment of the present invention further provides a method for updating automobile safety data, wherein the device is applied to a server, and the device comprises:

[0033] A first determination module is used to determine a data update request and a flash data, and determine an information flash instruction based on the data update request;

[0034] The second determination module is used to determine the request flash flag returned by the client based on the information flash instruction; the client is equipped with a battery management system with an integrated hardware security module, and the hardware security module and the battery management system establish communication based on IPC;

[0035] A data sending module is used to send flash data to the client; the first code area in the hardware security module and the battery management system transmit flag bits and flash data through IPC, and the code flash memory of the hardware security module includes a first code area, a second code area and a third code area; the first code area is used to flash and delete data in the second code area, erase and delete data in the third code area, and write data in the second code area into the third code area.

[0036] According to the fifth aspect, an embodiment of the present invention further provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the steps of the method for updating automobile safety data as described in any one of the above items are implemented.

[0037] According to the sixth aspect, an embodiment of the present invention further provides a non-transitory computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the steps of the method for updating automobile safety data as described in any one of the above items are implemented.

[0038] According to the seventh aspect, an embodiment of the present invention further provides a computer program product, including a computer program, and when the computer program is executed by a processor, it implements any of the above-mentioned methods for updating automobile safety data.

[0039] The method, device, equipment and product for updating automobile safety data provided by the present invention, when applied to the client, can perform data interaction between the client HSM and BMS through IPC. The server can update the operating code of the HSM based on IPC and existing CAN and other communication methods. For the whole vehicle that has passed the SOP, the process of dismantling the vehicle and unpacking is omitted, saving manpower and material resources. By dividing the code flash memory of the HSM into the first, second and third code areas, the orderly flashing of the flashing data is achieved, ensuring that the flashing data can be safely and effectively flashed to the HSM, and the update of the HSM operating code is completed as required. The present invention meets the existing industrial structure and safety requirements of automobiles, and can also provide security protection for the entire life cycle of automobile software updates;

[0040] When applied to the server, the server receives the request for the client to respond and write the flag bit. After that, the server transmits the writing data based on IPC and existing CAN and other communication methods to update the running code of the client's HSM. For the whole vehicle that has passed the SOP, the process of dismantling the vehicle and unpacking is omitted, which saves manpower and material resources, and completes the update of the HSM running code as required. The present invention meets the existing industrial structure and safety requirements of automobiles, and can also provide safety protection for the entire life cycle of automobile software updates. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] The features and advantages of the present invention will be more clearly understood by referring to the accompanying drawings, which are schematic and should not be construed as limiting the present invention in any way. In the accompanying drawings:

[0042] Figure 1 A schematic diagram showing a flow chart of the method for updating automobile safety data provided by an embodiment of the present invention when applied to a client;

[0043] Figure 2 A specific flow chart of step S20 in the method for updating automobile safety data provided by an embodiment of the present invention is shown;

[0044] Figure 3 The specific flow chart of step S40 in the method for updating automobile safety data provided by the embodiment of the present invention is shown.

[0045] Figure 4 A schematic diagram showing a flow chart of the method for updating automobile safety data provided by an embodiment of the present invention when applied to a server;

[0046] Figure 5 A schematic diagram showing the structure of the vehicle safety data updating device provided by an embodiment of the present invention when applied to a client;

[0047] Figure 6 A schematic diagram showing a flow chart of the vehicle safety data updating device provided by an embodiment of the present invention when applied to a server;

[0048] Figure 7 A schematic structural diagram of an electronic device provided by an embodiment of the present invention is shown. DETAILED DESCRIPTION

[0049] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0050] Taking energy conservation into consideration, the automotive industry has developed electric vehicles that use new energy sources in contrast to fuel vehicles. Unlike traditional fuel vehicles, electric vehicles are powered by batteries that supply power to the electric motor.

[0051] From the power source of electric vehicles, we can know that one of the most important components of electric vehicles is BMS. BMS is responsible for real-time collection, processing, and storage of important information during the operation of the battery pack, and is responsible for exchanging information with external devices such as the vehicle controller. It can solve key issues such as safety, availability, ease of use, and service life in the lithium battery system of electric vehicles.

[0052] For example, since the lithium battery of electric vehicles is an electrochemical carrier, various reactions will occur when the lithium battery is charged. In the case of many unsafe factors in the outside world, how to ensure the safety of the battery system is the core issue of battery management technology. BMS can formulate the battery charging and discharging power according to the battery voltage, temperature and the environment used, and feed back the information to the whole vehicle, so that the battery can be used in a more comfortable environment.

[0053] HSM is a computer device used to protect and manage keys and sensitive data used by strong authentication systems, and to provide related cryptographic operations. In the automotive field, in order to meet the requirements of automotive-grade robustness, HSM is generally an independent chip or a partition integrated on the chip, so HMS can currently be integrated on BMS.

[0054] HSM is essential for fully secure onboard communication (SecOC). HSM helps ensure the authenticity of all data received here and prevents attackers from gaining access to the central processor or even the onboard network by bypassing security-related ECU interfaces.

[0055] At present, BMS and lithium battery power battery pack together form the battery pack. At this time, the communication relationship with BMS is: vehicle controller and charger. Specifically, BMS communicates with the electric vehicle controller through CANbus, reports battery pack status parameters, receives vehicle controller instructions, and determines power output in accordance with vehicle needs. Alternatively, BMS monitors the operating status of the entire battery pack to protect the battery pack from abnormal operating conditions such as over-discharge and overheating. During the charging process, BMS interacts with the charger to manage charging parameters and monitor the charging process of the electric vehicle to ensure that charging can be completed normally.

[0056] However, the running code of HSM cannot be updated through CANbus, and can only be updated by directly connecting the debugger to the hardware debugging interface. This leads to a problem. After the standard operating procedure (SOP) of the electric vehicle, the running code of HSM can only be updated by dismantling the vehicle and unpacking it.

[0057] Combine the following Figure 1 Describe the method for updating automobile safety data of the present application, Figure 1 The method is applied to the client. It should be noted that the client is equipped with a BMS of HSM. The HSM and BMS establish communication based on IPC. The method includes:

[0058] S10. The BMS in the client determines the information refresh instruction sent by the server (eg, the host computer), and generates an information update flag based on the determined information refresh instruction.

[0059] At present, if the host computer wants to communicate with the HSM integrated in the BSM after installation, it must communicate through the IPC (InterProcessor Communication) channel. The host computer cannot directly communicate with the HSM integrated in the BSM after installation through CANbus. IPC communication technology uses hardware communication (mailbox), shared memory and arbitration circuit to achieve fast data exchange and access between heterogeneous cores.

[0060] In this embodiment, the communication between the BSM and the HSM is realized through two channels in the IPC, one channel (channel 1) is responsible for storing and transmitting the flag bit, and the other channel (channel 2) is responsible for storing and transmitting the flash data.

[0061] After confirming the information refresh instruction sent by the server, the BMS will generate an information update flag, which will be stored in the IPC.

[0062] S20. The first code area determines an information update flag, generates and sends a request to the server to refresh the flag.

[0063] In this embodiment, the code flash memory (Code Flash) responsible for storing program codes in the HSM is divided into a first code area, a second code area and a third code area. The first code area is the update area (HSM Updater area) of the HSM, the second code area is the new code area of ​​the HSM, and the third code area is the old code area of ​​the HSM.

[0064] For example, the storage size of the entire code flash segment is 192KB, the storage address of the code flash segment is 0x608000-0x637FFF, the storage address of the divided first code area is 0x6200000-0x620FFFF, the storage address of the divided second code area is 0x6300000-0x630FFFF, and the storage address of the divided third code area is 0x6100000-0x610FFFF.

[0065] Similarly, after the first code area determines the information update flag, it generates a request to flash flag, which is also stored in the IPC and transmitted to the BMS via the IPC. The BMS can communicate with the server directly via CANbus, for example, based on CAN FD, so the server can receive the request to flash flag from the BMS. After the server receives a positive response from the BMS, it sends the flash data to the BMS to update the safety data.

[0066] In this embodiment, the first code area determines whether there is an information update flag in the IPC after a preset detection time. That is to say, the first code area periodically detects whether there is an information update flag in the IPC. When the first code area detects the information update flag, it generates a request to refresh the flag.

[0067] In some possible embodiments of the present invention, no time interval is set between the preset detection durations, that is, the first code area will perform detection continuously; in other possible embodiments of the present invention, a preset time interval is set between the preset detection durations, that is, the first code area will be separated by a period of time after each flag detection before performing the next flag detection.

[0068] S30, determining the flash data returned by the server based on the flash flag bit requested, and writing the determined flash data into the second code area based on the first code area.

[0069] The server will first send the flash data returned by the request flash flag to the BMS. The BMS will store the flash data in the IPC and transmit the flash data to the HSM based on the IPC. After the HSM receives the flash data in the first code area, it will write the flash data into the second code area to update the security data.

[0070] In the method of the present invention, the flag bits and flash data required for security data update are transmitted through the IPC established between the BMS and the HSM. Therefore, the BMS can directly transmit the flag bits and flash data to the server through the CANbus, that is, through the IPC and the existing CAN communication method, the server can update the running code of the HSM. For the whole vehicle that has passed the SOP, the process of dismantling the vehicle and unpacking is omitted, which saves manpower and material resources, meets the existing industrial structure and safety requirements of the automobile, and can also provide safety protection for the entire life cycle of the automobile software update.

[0071] S40, writing the flash data written in the second code area into the third code area from which the data has been erased through the first code area. In this embodiment, the data in the third code area is erased through the first code area.

[0072] When the HSM receives the complete flash data, that is, when the new code is completely updated to the second code area, the first code area will erase the data in the third code area. After the erasure is completed, the first code area will directly copy the data in the second code area to the third code area.

[0073] In this embodiment, after the copying is completed, that is, after the new code is completely written into the third code area, the first code area will also delete the data in the second code area to prepare for the subsequent data update.

[0074] Therefore, in this embodiment, the first code area is used to refresh the data in the second code area, erase the data in the third code area, and write the data in the second code area into the third code area.

[0075] The method for updating automobile safety data of the present invention can perform data interaction between the client's HSM and BMS through IPC. The server can update the running code of the HSM based on IPC and existing CAN and other communication methods. For the whole vehicle that has passed the SOP, the process of dismantling the vehicle and unpacking is omitted, saving manpower and material resources; by dividing the code flash memory of the HSM into the first, second, and third code areas, the orderly flashing of the flashing data is realized, ensuring that the flashing data can be safely and effectively flashed to the HSM, and the update of the HSM running code is completed as required. The present invention meets the existing industrial structure and safety requirements of automobiles, and can also provide security protection for the entire life cycle of automobile software updates.

[0076] Since the quality of the flashing must be guaranteed by knowing where to flash (i.e., the starting address and the ending address), whether the flashing space is large enough, whether the flashing is completed correctly, etc., when the data is flashed, it should be noted that the flashing data of the present invention contains information such as the storage address, the data to be updated, the verification data, the flashing type and the flashing length, and the verification data is used to verify whether the flashing is correct. The above information contained in the flashing data can be parsed by a dedicated tool, and then the parsed information is flashed through the corresponding service.

[0077] In some possible embodiments of the present invention, the verification data is a checksum, that is, the checksum is used to verify whether the flashing is correct.

[0078] In this embodiment, the flash data also includes signature information issued by the server, and the verification of the signature information is used to confirm whether the flash data has been tampered with.

[0079] Based on the above content, the following Figure 2 The method for updating automobile safety data of the present application is described, step S30 specifically comprising:

[0080] S31. When the client receives a positive response from the server indicating that the download is possible, the client determines the flash data returned by the server based on the flash flag requested through the BMS, and then the BMS stores the flash data in the IPC.

[0081] S32. Based on the first code area, determine the flash data, write the determined flash data into the second code area, and verify the data in the second code area based on the signature information in the flash data.

[0082] In some possible embodiments of the present invention, in step 32, the data stored in the IPC is determined by the first code area, and when the first code area receives the flash data stored in the IPC, the flash data is updated and written into the second code area; in other possible embodiments of the present invention, in step S32, the server may also update and write the flash data into the second code area through the existing communication method and IPC in sequence.

[0083] S33: Determine that the second code area has passed verification, and the first code area is generated and the first success flag is sent to the server.

[0084] The first code area can be integrated with signature verification information for parsing signature information, or the server can transmit the signature verification information to the first code area through CAN and IPC in sequence, and then the second code area performs signature verification based on the existing signature verification method. When the signature information issued by the server can be verified, for example, the signature is consistent, the data verification of the second code area is passed. At this time, the first code area will generate a first success flag and store it in the IPC. The first success flag is transmitted to the BMS through the IPC, and the BMS transmits the first success flag to the server through the existing communication method, that is, the client will respond positively to the server.

[0085] S34: Determine that the second code area fails verification, the first code area generates and sends a first failure flag to the server, the first code area deletes the data in the second code area and resets the hardware security module.

[0086] If the data verification of the second code area fails. At this time, the first code area will generate a first failure flag and store it in the IPC. The first failure flag is transmitted to the BMS through the IPC, and the BMS transmits the first failure flag to the server through the existing communication method, that is, the client will respond negatively to the server. At the same time, the first code area will also delete the data of the second code area and reset the HSM to prepare for the subsequent data flashing. Based on the negative response, the server transmits new flashing data and repeats steps S10 to S30 until the client responds positively to the server, completing a security data update.

[0087] The data of the flash data will be flashed into the second code area block by block according to the one-to-one corresponding addresses. When the data is flashed, the verification data contained in the flash data, such as the verification of the checksum, will be verified. Taking the verification of the checksum as an example, the data of the second code area is obtained according to the starting address and the address size, and an actual checksum is calculated by a predetermined algorithm. The actual and expected checksums are compared. If the two are equal, it means that the flashed data is correct. If the actual and expected checksums are not equal, it means that the flashed data is not all correct.

[0088] In some possible embodiments of the present invention, when the verification data fails to pass the verification, a first failure flag may be generated and transmitted to the server based on IPC, CAN, etc., that is, when the verification data fails to pass the verification, the client may also give a negative response to the server.

[0089] Combine the following Figure 3 The method for updating automobile safety data of the present application is described, and step S40 specifically includes:

[0090] S41. Based on the first success flag, the first code area erases the data in the third code area.

[0091] S42, writing the flash data written in the second code area into the third code area from which the data has been erased through the first code area, and verifying the data in the third code area based on the signature information in the flash data.

[0092] The verification process of step S42 is similar to that of step S32 and will not be elaborated on here.

[0093] S43: Determine that the third code area has passed verification, and the first code area generates and sends a second success flag to the server.

[0094] Similar to step S33, when the data verification of the third code area passes, the first code area will generate a second success flag and store it in the IPC. The second success flag is transmitted to the BMS via the IPC, and the BMS then transmits the second success flag to the server via the existing communication method, that is, the client will respond positively to the server.

[0095] S44: Determine that the third code area fails verification, the first code area generates and sends a second failure flag to the server, the first code area deletes the data in the third code area and resets the hardware security module.

[0096] Similar to step S34, when the data verification of the third code area fails, the first code area will generate a second failure flag and store it in the IPC. The second failure flag is transmitted to the BMS via the IPC, and the BMS transmits the second failure flag to the server via the existing communication method, that is, the client will respond negatively to the server. Based on the negative response, the server transmits new flash data and repeats steps S10 to S40 until the client responds positively to the server, completing a security data update.

[0097] Through the two verification processes of step S30 and step S40, it is verified whether the flash data has been tampered with, so as to achieve orderly flashing of the flash data and ensure that the flash data can be safely and effectively flashed to the HSM.

[0098] At the same time, in this embodiment, the first code area is also used to verify whether the flashed data has been tampered with and delete the data in the second and third code areas.

[0099] Combine the following Figure 4 Describe the method for updating automobile safety data of the present application, Figure 4 The method is applied to the server, and the server is used to update the security data of the client. It should be noted that the client is installed with a BMS of the HSM, and the HSM and the BMS establish communication based on IPC. Updating the security data of the client is to update the running code of the HSM. The method includes:

[0100] S50, determining a data update request and a data flushing instruction based on the data update request.

[0101] After receiving the user's data update request, the server generates an information refresh instruction.

[0102] S60: Determine a request flash flag returned by the client based on the information flash instruction.

[0103] It should be noted that the user's data update request can also be for updating the data of other modules of the BMS. The client will return the request to refresh the flag bit to the server only after it determines that the data update request is an update request for the HSM or an update request containing the HSM.

[0104] At present, if the host computer wants to communicate with the HSM integrated in the BSM after installation, it must communicate through the IPC channel. The host computer cannot directly communicate with the HSM integrated in the BSM after installation through CANbus. IPC communication technology uses hardware communication (mailbox), shared memory and arbitration circuit to achieve fast data exchange and access between heterogeneous cores.

[0105] In this embodiment, the communication between the BSM and the HSM is realized through two channels in the IPC, one channel (channel 1) is responsible for storing and transmitting the flag bit, and the other channel (channel 2) is responsible for storing and transmitting the flash data.

[0106] In some possible embodiments of the present invention, after receiving the information flash instruction through the existing CANbus or other communication methods, the BSM generates an information update flag, which is stored in the IPC. After the HSM determines the information update flag stored in the IPC, the HSM generates a request flash flag. The request flash flag is also stored in the IPC and then transmitted to the BMS via the IPC. The BMS can communicate with the server directly through the CANbus, for example, based on CAN FD, so the server can receive the request flash flag from the BMS.

[0107] S70: Send the flash data to the client.

[0108] After the server receives a positive response from BMS, it will send the flash data to BMS. BMS will then store the flash data through IPC and transmit the flash data to HSM. After that, the flash data will be flashed to HSM to complete the update of security data. Since the quality of the flashing can only be guaranteed if you know where to flash (i.e., the starting address and the ending address), whether the flashing space is large enough, and whether the flashing is completed correctly, the flashing data of the present invention contains information such as storage address, data to be updated, verification data, flash type, and flash length. The verification data is used to verify whether the flashing is correct. The above information contained in the flash data can be parsed by a dedicated tool, and then the parsed information can be flashed through the corresponding service.

[0109] More specifically, the flag bit and flash data are transmitted between the first code area in the HSM and the BMS through IPC, and the code flash memory of the HSM includes the first code area, the second code area and the third code area; the first code area is used to flash and delete the data in the second code area, erase and delete the data in the third code area, and write the data in the second code area into the third code area.

[0110] In the method of the present invention, the flag bits and flash data required for security data update are transmitted through the IPC established between the BMS and the HSM. Therefore, the server can directly transmit the flag bits and flash data to the client's BMS through the CANbus, that is, through the IPC and the existing CAN communication method, the server can update the running code of the HSM. For the whole vehicle that has passed the SOP, the process of dismantling the vehicle and unpacking is omitted, which saves manpower and material resources, meets the existing industrial structure and safety requirements of automobiles, and can also provide safety protection for the entire life cycle of automobile software updates.

[0111] The method for updating automobile safety data of the present invention is that the server receives the request for positive response from the client and writes the flag bit, and then the server transmits the writing data based on IPC and existing CAN and other communication methods to update the running code of the HSM of the client. For the whole vehicle that has passed the SOP, the process of dismantling the vehicle and unpacking is omitted, which saves manpower and material resources, and completes the update of the HSM running code as required. The present invention meets the existing industrial structure and safety requirements of automobiles, and can also provide safety protection for the entire life cycle of automobile software updates.

[0112] The following is a description of the vehicle safety data updating device provided by the present invention. The vehicle safety data updating device described below and the vehicle safety data updating method described above can be referenced to each other.

[0113] Combine the following Figure 5 Describe the updating device of automobile safety data of the present application, Figure 5The device is applied to the client. It should be noted that the client is equipped with a BMS with HSM. The HSM and BMS establish communication based on IPC. The device includes:

[0114] The first generating module 10 is used to determine the information flashing instruction sent by the server (such as the host computer) through the BMS in the client, and generate an information update flag based on the determined information flashing instruction.

[0115] At present, if the host computer wants to communicate with the HSM integrated in the BSM after installation, it must communicate through the IPC channel. The host computer cannot directly communicate with the HSM integrated in the BSM after installation through CANbus. IPC communication technology uses hardware communication (mailbox), shared memory and arbitration circuit to achieve fast data exchange and access between heterogeneous cores.

[0116] In this embodiment, the communication between the BSM and the HSM is realized through two channels in the IPC, one channel (channel 1) is responsible for storing and transmitting the flag bit, and the other channel (channel 2) is responsible for storing and transmitting the flash data.

[0117] After confirming the information refresh instruction sent by the server, the BMS will generate an information update flag, which will be stored in the IPC.

[0118] The second generating module 20 is used to determine the information update flag through the first code area, generate and send a request to refresh the flag to the server.

[0119] In this embodiment, the code flash memory (Code Flash) responsible for storing program codes in the HSM is divided into a first code area, a second code area and a third code area. The first code area is the update area (HSM Updater area) of the HSM, the second code area is the new code area of ​​the HSM, and the third code area is the old code area of ​​the HSM.

[0120] For example, the storage size of the entire code flash segment is 192KB, the storage address of the code flash segment is 0x608000-0x637FFF, the storage address of the divided first code area is 0x6200000-0x620FFFF, the storage address of the divided second code area is 0x6300000-0x630FFFF, and the storage address of the divided third code area is 0x6100000-0x610FFFF.

[0121] Similarly, after the first code area determines the information update flag, it generates a request to flash flag, which is also stored in the IPC and transmitted to the BMS via the IPC. The BMS can communicate with the server directly via CANbus, for example, based on CAN FD, so the server can receive the request to flash flag from the BMS. After the server receives a positive response from the BMS, it sends the flash data to the BMS to update the safety data.

[0122] In this embodiment, the first code area determines whether there is an information update flag in the IPC after a preset detection time. That is to say, the first code area periodically detects whether there is an information update flag in the IPC. When the first code area detects the information update flag, it generates a request to refresh the flag.

[0123] In some possible embodiments of the present invention, no time interval is set between the preset detection durations, that is, the first code area will perform detection continuously; in other possible embodiments of the present invention, a preset time interval is set between the preset detection durations, that is, the first code area will be separated by a period of time after each flag detection before performing the next flag detection.

[0124] The first flashing module 30 is used to determine the flashing data returned by the server based on the flashing request flag, and write the determined flashing data into the second code area based on the first code area.

[0125] The server will first send the flash data returned by the request flash flag to the BMS. The BMS will store the flash data in the IPC and transmit the flash data to the HSM based on the IPC. After receiving the flash data, the first code area of ​​the HSM will write the flash data into the second code area to update the security data.

[0126] In the device of the present invention, the flag bits and flash data required for security data update are transmitted through the IPC established between the BMS and the HSM. Therefore, the BMS can directly transmit the flag bits and flash data to the server through the CANbus, that is, through the IPC and the existing CAN communication method, the server can update the running code of the HSM. For the whole vehicle that has passed the SOP, the process of dismantling the vehicle and unpacking is omitted, which saves manpower and material resources, meets the existing industrial structure and safety requirements of automobiles, and can also provide safety protection for the entire life cycle of automobile software updates.

[0127] The second flashing module 40 is used to write the flashing data written in the second code area into the third code area with erased data through the first code area. In this embodiment, the data in the third code area is erased through the first code area.

[0128] When the HSM receives the complete flash data, that is, when the new code is completely updated to the second code area, the first code area will erase the data in the third code area. After the erasure is completed, the first code area will directly copy the data in the second code area to the third code area.

[0129] In this embodiment, after the copying is completed, that is, after the new code is completely written into the third code area, the first code area will also delete the data in the second code area to prepare for the subsequent data update.

[0130] Therefore, in this embodiment, the first code area is used to refresh the data in the second code area, erase the data in the third code area, and write the data in the second code area into the third code area.

[0131] The updating device for automobile safety data of the present invention can perform data interaction between the client's HSM and BMS through IPC. The server can update the running code of HSM based on IPC and existing CAN and other communication methods. For the whole vehicle that has passed the SOP, the process of dismantling the vehicle and unpacking is omitted, saving manpower and material resources; by dividing the code flash memory of HSM into the first, second, and third code areas, the orderly flashing of the flashing data is realized, ensuring that the flashing data can be safely and effectively flashed to the HSM, and the update of the HSM running code is completed as required. The present invention meets the existing industrial structure and safety requirements of automobiles, and can also provide security protection for the entire life cycle of automobile software updates.

[0132] Combine the following Figure 6 Describe the updating device of automobile safety data of the present application, Figure 6 The device is applied to the server, and the server is used to update the security data of the client. It should be noted that the BMS of the HSM is installed in the client, and the HSM and BMS establish communication based on IPC. Updating the security data of the client is to update the running code of the HSM. The device includes:

[0133] The first determination module 50 is used to determine a data update request and a data flushing instruction, and based on the data update request, determine an information flushing instruction.

[0134] After receiving the user's data update request, the server generates an information refresh instruction.

[0135] The second determination module 60 is used to determine the request flush flag returned by the client based on the information flush instruction.

[0136] It should be noted that the user's data update request can also be for updating the data of other modules of the BMS. The client will return the request to refresh the flag bit to the server only after it determines that the data update request is an update request for the HSM or an update request containing the HSM.

[0137] At present, if the host computer wants to communicate with the HSM integrated in the BSM after installation, it must communicate through the IPC channel. The host computer cannot directly communicate with the HSM integrated in the BSM after installation through CANbus. IPC communication technology uses hardware communication (mailbox), shared memory and arbitration circuit to achieve fast data exchange and access between heterogeneous cores.

[0138] In this embodiment, the communication between the BSM and the HSM is realized through two channels in the IPC, one channel (channel 1) is responsible for storing and transmitting the flag bit, and the other channel (channel 2) is responsible for storing and transmitting the flash data.

[0139] In some possible embodiments of the present invention, after receiving the information flash instruction through the existing CANbus or other communication methods, the BSM generates an information update flag, which is stored in the IPC. After the HSM determines the information update flag stored in the IPC, the HSM generates a request flash flag. The request flash flag is also stored in the IPC and then transmitted to the BMS via the IPC. The BMS can communicate with the server directly through the CANbus, for example, based on CAN FD, so the server can receive the request flash flag from the BMS.

[0140] The data sending module 70 is used to send the flash data to the client.

[0141] After the server receives a positive response from BMS, it will send the flash data to BMS. BMS will then store the flash data through IPC and transmit the flash data to HSM. After that, the flash data will be flashed to HSM to complete the update of security data. Since the quality of the flashing can only be guaranteed if you know where to flash (i.e., the starting address and the ending address), whether the flashing space is large enough, and whether the flashing is completed correctly, the flashing data of the present invention contains information such as storage address, data to be updated, verification data, flash type, and flash length. The verification data is used to verify whether the flashing is correct. The above information contained in the flash data can be parsed by a dedicated tool, and then the parsed information can be flashed through the corresponding service.

[0142] More specifically, the flag bit and flash data are transmitted between the first code area in the HSM and the BMS through IPC, and the code flash memory of the HSM includes the first code area, the second code area and the third code area; the first code area is used to flash and delete the data in the second code area, erase and delete the data in the third code area, and write the data in the second code area into the third code area.

[0143] In the device of the present invention, the flag bits and flash data required for security data update are transmitted through the IPC established between the BMS and the HSM. Therefore, the server can directly transmit the flag bits and flash data to the client's BMS through the CANbus, that is, through the IPC and the existing CAN communication method, the server can update the running code of the HSM. For the whole vehicle that has passed the SOP, the process of dismantling the vehicle and unpacking is omitted, which saves manpower and material resources, meets the existing industrial structure and safety requirements of automobiles, and can also provide safety protection for the entire life cycle of automobile software updates.

[0144] The updating device for automobile safety data of the present invention receives a request for a positive response from the client and writes a flag bit, and then transmits the writing data based on IPC and existing CAN and other communication methods to update the running code of the HSM of the client. For the whole vehicle that has passed the SOP, the process of dismantling the vehicle and unpacking is omitted, which saves manpower and material resources, and completes the update of the HSM running code as required. The present invention meets the existing industrial structure and safety requirements of automobiles, and can also provide safety protection for the entire life cycle of automobile software updates.

[0145] Figure 7 An example of a physical structure diagram of an electronic device is shown in FIG. Figure 7 As shown, the electronic device may include: a processor 810, a communication interface 820, a memory 830 and a communication bus 840, wherein the processor 810, the communication interface 820 and the memory 830 communicate with each other through the communication bus 840. The processor 810 may call the logic command in the memory 830 to execute the method for updating the automobile safety data, and the method includes:

[0146] The battery management system determines the information flashing instruction sent by the server, and generates an information update flag based on the determined information flashing instruction;

[0147] The first code area determines the information update flag, generates and sends a request to the server to flash the flag; the code flash memory of the hardware security module includes the first code area, the second code area and the third code area;

[0148] Determine the flash data returned by the server based on the flash flag bit requested, and write the determined flash data into the second code area based on the first code area;

[0149] The first code area writes the flash data written in the second code area into the third code area where the data has been erased; the data in the third code area is erased through the first code area;

[0150] Alternatively, the method comprises:

[0151] Determine a data update request and a data flushing instruction based on the data update request;

[0152] Determine the request flash flag returned by the client based on the information flash instruction; the client is equipped with a battery management system with an integrated hardware security module, and the hardware security module and the battery management system establish communication based on IPC;

[0153] Sending flash data to the client; transmitting flag bits and flash data between the first code area in the hardware security module and the battery management system through IPC, the code flash memory of the hardware security module includes the first code area, the second code area and the third code area; the first code area is used to flash and delete data in the second code area, erase and delete data in the third code area, and write data in the second code area to the third code area.

[0154] In addition, the logic commands in the above-mentioned memory 830 can be implemented in the form of software functional units and can be stored in a computer-readable storage medium when sold or used as an independent product. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several commands to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a disk or an optical disk.

[0155] On the other hand, the present invention further provides a computer program product, the computer program product comprising a computer program, the computer program can be stored in a non-transitory computer-readable storage medium, when the computer program is executed by a processor, the computer can execute the vehicle safety data updating method provided by the above methods, the method comprising:

[0156] The battery management system determines the information flashing instruction sent by the server, and generates an information update flag based on the determined information flashing instruction;

[0157] The first code area determines the information update flag, generates and sends a request to the server to flash the flag; the code flash memory of the hardware security module includes the first code area, the second code area and the third code area;

[0158] Determine the flash data returned by the server based on the flash flag bit requested, and write the determined flash data into the second code area based on the first code area;

[0159] The first code area writes the flash data written in the second code area into the third code area where the data has been erased; the data in the third code area is erased through the first code area;

[0160] Alternatively, the method comprises:

[0161] Determine a data update request and a data flushing instruction based on the data update request;

[0162] Determine the request flash flag returned by the client based on the information flash instruction; the client is equipped with a battery management system with an integrated hardware security module, and the hardware security module and the battery management system establish communication based on IPC;

[0163] Sending flash data to the client; transmitting flag bits and flash data between the first code area in the hardware security module and the battery management system through IPC, the code flash memory of the hardware security module includes the first code area, the second code area and the third code area; the first code area is used to flash and delete data in the second code area, erase and delete data in the third code area, and write data in the second code area to the third code area.

[0164] In another aspect, the present invention further provides a non-transitory computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the method for updating the automobile safety data provided by the above methods is implemented, and the method comprises:

[0165] The battery management system determines the information flashing instruction sent by the server, and generates an information update flag based on the determined information flashing instruction;

[0166] The first code area determines the information update flag, generates and sends a request to the server to flash the flag; the code flash memory of the hardware security module includes the first code area, the second code area and the third code area;

[0167] Determine the flash data returned by the server based on the flash flag bit requested, and write the determined flash data into the second code area based on the first code area;

[0168] The first code area writes the flash data written in the second code area into the third code area where the data has been erased; the data in the third code area is erased through the first code area;

[0169] Alternatively, the method comprises:

[0170] Determine a data update request and a data flushing instruction based on the data update request;

[0171] Determine the request flash flag returned by the client based on the information flash instruction; the client is equipped with a battery management system with an integrated hardware security module, and the hardware security module and the battery management system establish communication based on IPC;

[0172] Sending flash data to the client; transmitting flag bits and flash data between the first code area in the hardware security module and the battery management system through IPC, the code flash memory of the hardware security module includes the first code area, the second code area and the third code area; the first code area is used to flash and delete data in the second code area, erase and delete data in the third code area, and write data in the second code area to the third code area.

[0173] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0174] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, which can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of commands to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0175] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for updating automobile safety data, characterized in that: The method is applied to a client, in which a battery management system with an integrated hardware security module is installed, and the hardware security module and the battery management system establish communication based on IPC. The method includes: The battery management system determines the information flashing instruction sent by the server, and generates an information update flag based on the determined information flashing instruction; The first code area determines the information update flag, generates and sends a request to the server to flash the flag; the code flash memory of the hardware security module includes the first code area, the second code area and the third code area; Determine the flash data returned by the server based on the flash flag bit requested, and write the determined flash data into the second code area based on the first code area; The first code area writes the flash data written in the second code area into the third code area from which the data has been erased; the data in the third code area is erased through the first code area.

2. The method for updating automobile safety data according to claim 1, characterized in that: The flash data contains signature information; The step of determining the flash data returned by the server based on the flash flag bit requested, and writing the determined flash data into the second code area based on the first code area, specifically includes: The battery management system determines the flash data returned by the server based on the flash flag bit requested, and stores the flash data in the IPC; Based on the first code area, determine the flash data, write the determined flash data into the second code area, and verify the data in the second code area based on the signature information in the flash data; It is determined that the second code area has passed the verification, the first code area generates a first success flag, and sends the first success flag to the server.

3. The method for updating automobile safety data according to claim 2, characterized in that: The method further comprises: It is determined that the second code area fails verification, the first code area generates a first failure flag, and sends the first failure flag to the service end, the first code area deletes the data of the second code area and resets the hardware security module.

4. The method for updating automobile safety data according to claim 2, characterized in that: The first code area writes the flash data written in the second code area into the third code area where the data has been erased, specifically including: Based on the first success flag, the first code area erases the data in the third code area; The first code area writes the flash data written in the second code area into the third code area from which the data has been erased, and verifies the data in the third code area based on the signature information in the flash data; It is determined that the third code area has passed the verification, the first code area generates a second success flag, and sends the second success flag to the server.

5. The method for updating automobile safety data according to claim 4, characterized in that: The method further comprises: It is determined that the third code area verification fails, the first code area generates a second failure flag bit, and sends the second failure flag bit to the service end, the first code area deletes the data of the third code area and resets the hardware security module.

6. A method for updating automobile safety data, characterized in that: The method is applied to the server, and the method includes: Determine a data update request and a data flushing instruction based on the data update request; Determine the request flash flag returned by the client based on the information flash instruction; the client is equipped with a battery management system with an integrated hardware security module, and the hardware security module and the battery management system establish communication based on IPC; Sending flash data to the client; transmitting flag bits and flash data between the first code area in the hardware security module and the battery management system through IPC, the code flash memory of the hardware security module includes the first code area, the second code area and the third code area; the first code area is used to flash and delete data in the second code area, erase and delete data in the third code area, and write data in the second code area to the third code area.

7. A device for updating automobile safety data, characterized in that: The device is applied to a client, in which a battery management system with an integrated hardware security module is installed, and the hardware security module and the battery management system establish communication based on IPC. The device includes: A first generating module, configured to determine, through a battery management system, an information flashing instruction sent by a server, and generate an information update flag based on the determined information flashing instruction; The second generating module is used to determine the information update flag bit through the first code area, generate and send a request to the server to flash the flag bit; the code flash memory of the hardware security module includes the first code area, the second code area and the third code area; A first flashing module, used for determining the flashing data returned by the server based on the flashing request flag, and writing the determined flashing data into the second code area based on the first code area; The second flashing module is used to write the flashing data written in the second code area into the third code area from which the data has been erased through the first code area; the data in the third code area is erased through the first code area.

8. A device for updating automobile safety data, characterized in that: The device is applied to a server, and includes: A first determination module is used to determine a data update request and a flash data, and determine an information flash instruction based on the data update request; The second determination module is used to determine the request flash flag returned by the client based on the information flash instruction; the client is equipped with a battery management system with an integrated hardware security module, and the hardware security module and the battery management system establish communication based on IPC; A data sending module is used to send flash data to the client; the first code area in the hardware security module and the battery management system transmit flag bits and flash data through IPC, and the code flash memory of the hardware security module includes a first code area, a second code area and a third code area; the first code area is used to flash and delete data in the second code area, erase and delete data in the third code area, and write data in the second code area into the third code area.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the steps of the method for updating automobile safety data according to any one of claims 1 to 6 are implemented.

10. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method for updating automobile safety data according to any one of claims 1 to 6 are implemented.

Images