A controller security management method and device, a vehicle and a storage medium

Abstract

This invention discloses a controller security management method, device, vehicle, and storage medium. The method is applied to a control system, which includes a controller and a hardware encryption management module. The controller's memory includes a first partition and a second partition. The method includes: when the controller is detected to be powered on for the first time, calling a secure startup function to store the first and second partition verification keys in the hardware encryption management module; determining the startup function signature based on the secure startup function and the first partition verification key, and storing it in the hardware encryption management module; calling the application function based on the secure startup function, the second partition verification key, and the application function signature to achieve secure controller startup. This solves the problem of function security not being guaranteed during controller startup. The first partition is set as a one-time programmable area to prevent data tampering, prevent functions from being intruded, tampered with, or illegally injected by malicious software, and ensure device security.

Description

Technical Field

[0001] This invention relates to the field of vehicle management technology, and in particular to a controller safety management method, device, vehicle, and storage medium. Background Technology

[0002] With the development of technology and living standards, intelligent devices are increasingly appearing in people's lives, such as vehicles and mobile phones. These devices typically rely on microcontroller units (MCUs) for operation. To ensure the normal operation of the MCU, the security of its code must be guaranteed. However, with technological advancements, malicious intrusion into device code frequently occurs. Once maliciously intruded, device code will execute incorrect instructions, affecting the normal operation of the device system and causing significant harm. Summary of the Invention

[0003] This invention provides a controller safety management method, device, vehicle, and storage medium to achieve safe management of the controller.

[0004] According to one aspect of the present invention, a controller security management method is provided, applied to a control system, the control system including a controller and a hardware encryption management module, the controller's memory including a first partition and a second partition, the first partition storing a secure boot function, a first area verification key, and a second area verification key, the second partition storing an application function and an application function signature, the first partition being configured as a one-time programmable area, the method comprising:

[0005] When the controller is detected to be powered on for the first time, the secure startup function is called to store the first area verification key and the second area verification key in the hardware encryption management module.

[0006] The startup function signature is determined based on the secure startup function and the first area verification key, and then stored in the hardware encryption management module;

[0007] The secure startup function, combined with the second area verification key and the application function signature, controls the startup of the application function to achieve secure startup of the controller.

[0008] According to another aspect of the present invention, a controller security management device is provided, applied to a controller, wherein the controller's memory includes a first partition and a second partition, the first partition storing a secure boot function, a first area verification key, and a second area verification key, and the second partition storing an application function and an application function signature, wherein the first partition is configured as a one-time programmable area, including:

[0009] The key storage module is used to call the secure startup function to store the first area verification key and the second area verification key to the hardware encryption management module when the controller is detected to be powered on for the first time.

[0010] The signature storage module is used to determine the signature of the startup function based on the secure startup function and the first area verification key, and store it in the hardware encryption management module;

[0011] The startup module is used to control the startup of the application function based on the secure startup function, the second area verification key, and the application function signature, so as to achieve secure startup of the controller.

[0012] According to another aspect of the present invention, a vehicle is provided, the vehicle comprising: a control system, the control system comprising a controller and a hardware encryption management module;

[0013] The memory is used to store one or more programs;

[0014] When the controller executes one or more programs, the controller implements the controller security management method according to any embodiment of the present invention.

[0015] According to another aspect of the present invention, a computer-readable storage medium is provided, the computer-readable storage medium storing computer instructions for causing a processor to execute and implement the controller security management method according to any embodiment of the present invention.

[0016] This invention provides a controller security management method applied to a control system. The control system includes a controller and a hardware encryption management module. The controller's memory includes a first partition and a second partition. The first partition stores a secure startup function, a first area verification key, and a second area verification key. The second partition stores an application function and its signature. The first partition is set as a one-time programmable area. The method includes: when the controller is detected to be powered on for the first time, calling the secure startup function to store the first area verification key and the second area verification key in the hardware encryption management module; determining the startup function signature based on the secure startup function and the first area verification key, and storing it in the hardware encryption management module; calling the application function based on the secure startup function, the second area verification key, and the application function signature to achieve secure controller startup. This solves the problem of function security not being guaranteed during controller startup. By setting the first and second partitions of the memory to store different data, and setting the first partition as a one-time programmable area to prevent data tampering, and storing the first and second area verification keys in the hardware encryption management module to prevent key loss and tampering, the startup function signature is determined by the secure startup function and the first area verification key and stored in the hardware encryption management module for subsequent security verification of the secure startup function. The application function is verified by combining the secure startup function with the second-zone verification key and the application function signature. The application function is then called based on the verification result, thereby achieving secure startup of the controller and preventing functions from being intruded, tampered with, or illegally injected by malicious software, ensuring normal operation of the device and guaranteeing device security.

[0017] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of the present invention, nor is it intended to limit the scope of the invention. Other features of the invention will become readily apparent from the following description. Attached Figure Description

[0018] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0019] Figure 1 This is a flowchart of a controller security management method provided in Embodiment 1 of the present invention;

[0020] Figure 2 This is a flowchart of a controller security management method provided according to Embodiment 2 of the present invention;

[0021] Figure 3This is a schematic diagram of the structure of a controller safety management device according to Embodiment 3 of the present invention;

[0022] Figure 4 This is a structural schematic diagram of a vehicle implementing the controller safety management method of this invention. Detailed Implementation

[0023] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0024] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0025] Example 1

[0026] Figure 1 This invention provides a flowchart of a controller security management method according to Embodiment 1. This embodiment is applicable to situations involving controller security management. The method can be executed by a controller security management device, which can be implemented in hardware and / or software and configured within the controller. The method is applied to a control system, which includes a controller and a hardware encryption management module. The controller's memory includes a first partition and a second partition. The first partition stores a secure startup function, a first area verification key, and a second area verification key. The second partition stores application functions and application function signatures. The first partition is set as a one-time programmable area.

[0027] This application partitions the controller's memory into a first partition and a second partition, storing different types of data respectively. The secure boot function, the first area verification key, and the second area verification key are stored in the first partition. Simultaneously, the first partition is set as a one-time programmable area (i.e., an OTP area) to prevent data tampering and further ensure data security.

[0028] like Figure 1 As shown, the method includes:

[0029] S101. When the controller is detected to be powered on for the first time, the secure startup function is called to store the first area verification key and the second area verification key to the hardware encryption management module.

[0030] In this embodiment, the secure boot function can be understood as a function that initializes and starts the system. The first area verification key can be specifically understood as a key used to verify the boot function. The second area verification key is also a key used to verify the application function. The hardware encryption management module can be specifically understood as a module that manages the keys; in this application, the hardware encryption management module is an HSM (Hardware Security Module) module. The controller in this application can be a microcontroller unit (MCU).

[0031] Specifically, the system detects whether the controller is powered on and started. When the controller is powered on for the first time, it calls the secure startup function to obtain the first area verification key and the second area verification key from the first partition, loads the first area verification key and the second area verification key into the hardware encryption management module, and stores them.

[0032] It should be noted that the first power-on boot in this application refers to the first power-on boot after data has been written to the first and second partitions during the MCU development process. At this time, the device used by the controller may not have officially shipped or been put into use. The second partition in this application can also store other types of data.

[0033] S102. Determine the startup function signature based on the secure startup function and the first area verification key, and store it in the hardware encryption management module.

[0034] In this embodiment, the startup function signature can be specifically understood as signature information used to verify the security and legitimacy of the secure startup function. The first region verification key is used as the algorithm key to generate the startup function signature corresponding to the secure startup function, and the startup function signature is stored in the hardware encryption management module. The startup function signature in this application can employ a Cipher Block Chaining-message authentication code (CMAC).

[0035] S103. The application function is called based on the secure startup function, the second area verification key, and the application function signature to achieve secure startup of the controller.

[0036] In this embodiment, the application function signature can be specifically understood as signature information used for secure verification of the application function; the application function can be specifically understood as a function that performs or implements a certain function. A signature is generated based on the secure startup function and the second-region verification key, and the generated signature is verified using the application function signature to determine the verification result. Once the verification is successful, the application function is invoked normally, executing the corresponding function and achieving secure startup of the controller.

[0037] This invention provides a controller security management method applied to a control system. The control system includes a controller and a hardware encryption management module. The controller's memory includes a first partition and a second partition. The first partition stores a secure startup function, a first area verification key, and a second area verification key. The second partition stores an application function and its signature. The first partition is set as a one-time programmable area, solving the problem of unreliable function security during controller startup. By setting the first and second partitions of the memory to store different data, and making the first partition a one-time programmable area, data tampering is prevented. The first and second area verification keys are stored in the hardware encryption management module to prevent key loss and tampering. The startup function signature is determined by the secure startup function and the first area verification key and stored in the hardware encryption management module for subsequent security verification during startup. The application function is verified by combining the secure startup function with the second area verification key and the application function signature. The application function is called based on the verification result, thereby achieving secure controller startup, preventing functions from being intruded, tampered with, or illegally injected by malicious software, ensuring normal device operation and guaranteeing device security.

[0038] Example 2

[0039] Figure 2 This is a flowchart of a controller safety management method provided in Embodiment 2 of the present invention. This embodiment is a refinement based on the above embodiments. Figure 2 As shown, the method includes:

[0040] S201. When the controller is detected to be powered on for the first time, the secure startup function is called to store the first area verification key and the second area verification key to the hardware encryption management module.

[0041] S202. Process the secure startup function and the first area verification key according to the predetermined first preset algorithm, determine the startup function signature, and store it in the hardware encryption management module.

[0042] In this embodiment, the first preset algorithm can be understood as an encryption algorithm, such as Hash, AES128, AES-192, AE-256, etc. The first preset algorithm is predetermined, and the secure startup function and the first area verification key are encrypted according to the first preset algorithm to generate a startup function signature, which is then stored in the hardware encryption management module. The secure startup function in this application can be implemented through code; therefore, when generating the startup function signature, the secure startup code corresponding to the secure startup function can be combined with the first area verification key and encrypted using the first preset algorithm to generate the startup function signature.

[0043] S203. Process the secure startup function and the second area verification key according to the predetermined second preset algorithm to determine the signature of the application function to be verified.

[0044] In this embodiment, the second preset algorithm can be understood as an encryption algorithm. The second preset algorithm can be the same as or different from the first preset algorithm. The signature of the application function to be verified can be understood as a signature with verification requirements, used to verify the legality of the application function.

[0045] Specifically, a second preset algorithm is predetermined, and the secure startup function and the second area verification key are encrypted using this algorithm to obtain the signature of the application function to be verified. Similarly, when determining the signature of the application function to be verified based on the secure startup function, the signature can also be generated based on the secure startup code corresponding to the secure startup function.

[0046] S204. If the signature of the application function to be verified matches the signature of the application function, call the application function.

[0047] Determine whether the signature of the application function to be verified is consistent with the signature of the application function stored in the second partition. If they are consistent, the application function is verified and the application function is called to implement the corresponding function.

[0048] S205. When it is detected that the controller is not powered on for the first time, the signature of the startup function to be verified is determined according to the secure startup function and the first area verification key, and the startup function signature stored in the hardware encryption management module is obtained.

[0049] In this embodiment, the startup function signature to be verified can be specifically understood as a signature with verification requirements, used to determine whether the secure startup function is legitimate. When it is detected that the controller is not powered on for the first time, the secure startup function and the first area verification key are obtained from the first partition. The secure startup function and the first area verification key are encrypted according to the first preset algorithm to generate the startup function signature to be verified. At the same time, the startup function signature stored in the hardware encryption management module is obtained.

[0050] S206. If the signature of the startup function to be verified matches the signature of the startup function, the application function is called according to the secure startup function combined with the second area verification key and the application function signature to achieve secure startup of the controller.

[0051] The system checks if the signature of the startup function to be verified matches the actual startup function signature. If they match, the secure startup function verification is successful. The application function is then verified using the secure startup function, the second-area verification key, and the application function signature. If the verification passes, the application function is valid, and it is invoked to perform the corresponding function, thus achieving secure startup of the controller. The method of verifying and invoking the application function using the secure startup function, the second-area verification key, and the application function signature is the same as in S203-S204.

[0052] In this embodiment, after the controller has been running for a period of time, the application functions will be upgraded due to functional updates or other reasons. When the application functions are upgraded, the controller can be upgraded either after the first power-on and before the second power-on, or after the nth power-on. Therefore, the execution order of S205-S206 and S207-S210 can be either upgrade first or upgrade later. Figure 2 The following example illustrates the controller safety management method.

[0053] S207. When an application function upgrade is detected, obtain the signature, random number, and second-region verification key verification data information of the application function to be upgraded.

[0054] In this embodiment, the signature of the application function to be upgraded can be specifically understood as the signature information used for application function upgrade verification. The verification key verification data information of the second region can be specifically understood as the information used for security verification during the upgrade process.

[0055] Specifically, when upgrading an application function, the system can determine whether an application function needs to be upgraded by receiving upgrade commands from the cloud, host computer, etc.; or, it can detect application functions stored in the cloud, host computer, file management system, etc., and determine whether an application function needs to be upgraded based on its version or date. If a new version of the application function exists, the system will determine whether to upgrade the application function; alternatively, the user can manually upgrade the application function. This manual upgrade can be initiated by the user when a new version of the application function is discovered, through methods such as clicking, double-clicking, or swiping; or, if the user is unsure whether a new version of the application function exists, they can initiate the upgrade through methods such as clicking, double-clicking, or swiping. The controller establishes a connection with the cloud, host computer, etc., to determine whether a new version of the application function exists, and if a new version exists, it will determine whether to upgrade the application function.

[0056] If an application function is detected to require an upgrade, the system retrieves the signature, random number, and second-region verification key verification data of the application function to be upgraded. This data can be stored in the cloud, on a host computer, or in the same location as the new application function.

[0057] The signature, random number, and second-region verification key verification data of the application function to be upgraded can also be stored in the second partition after the application function upgrade is completed, thereby updating the random number and second-region verification key verification data originally stored in the second partition. The length information of the application function can also be obtained when retrieving the signature, random number, and second-region verification key verification data of the application function to be upgraded.

[0058] S208. Perform key verification based on the random number and the second area verification key verification data information.

[0059] The key is parsed based on the random number required for the upgrade and the verification data of the second area verification key. The parsed key is then determined. The validity of the parsed key is judged based on the second area verification key. If the key is valid, the key verification result is determined to be verified successfully, and the upgrade of the application function can continue. If the key is invalid, the key verification result is determined to be verified as verified failed, the upgrade of the application function ends, and the application function upgrade fails.

[0060] As an optional embodiment of this example, this optional embodiment further optimizes the key verification based on the random number and the second region verification key verification data information as follows:

[0061] A1. Determine the real key by combining the data information of the random number and the second area verification key with the predetermined third preset algorithm.

[0062] In this embodiment, the third preset algorithm is a decryption algorithm, such as the AES algorithm or the Hash algorithm. Both AES and Hash algorithms can perform both encryption and decryption operations. The third preset algorithm in this application can be the same as or different from the first and second preset algorithms. When the same algorithm is used, the first and second preset algorithms encrypt the data, while the third preset algorithm decrypts the data. The real key can be specifically understood as the key corresponding to the data information verified by the second area verification key obtained through decryption. The real key is obtained by decrypting the random number and the data information verified by the second area verification key according to the third preset algorithm.

[0063] A2. Obtain the second area verification key stored in the hardware encryption management module.

[0064] Obtain the second area verification key from the corresponding storage space of the hardware encryption management module.

[0065] A3. If the real key matches the second area verification key, the key verification result is determined to be successful.

[0066] Determine whether the real key and the second area verification key are consistent. If they are consistent, the key verification result is determined to be successful; if they are inconsistent, the key verification result is determined to be unsuccessful.

[0067] S209. If the verification passes, obtain the new application function.

[0068] If the verification passes, a new application function is obtained. This new application function is an upgraded function, typically offering more comprehensive functionality and representing an optimization of the original. The new application function can be stored in the cloud, on a host computer, etc. If the verification fails, the application function upgrade ends, and the upgrade fails.

[0069] S210. The upgrade of the application function is controlled based on the new application function, the second area verification key, and the signature of the application function to be upgraded.

[0070] Obtain the second-zone verification key stored in the hardware encryption management module. Encrypt the new application function and the second-zone verification key to determine the signature. Use this signature to perform security verification on the signature of the application function to be upgraded. If the verification is successful, the new application function is deemed legitimate. Then, use the new application function to upgrade and update the application function.

[0071] As an optional embodiment of this example, this optional embodiment further controls the upgrade of the application function based on the new application function, the second area verification key, and the signature of the application function to be upgraded, including:

[0072] B1 processes the new application function and the second region verification key according to the predetermined fourth preset algorithm to determine the signature of the upgrade function to be verified.

[0073] In this embodiment, the fourth preset algorithm is a pre-defined algorithm, which may be the same as or different from the first, second, and third preset algorithms. The upgrade function signature to be verified can be understood as a signature information used to verify the legitimacy of the new application function. The fourth preset algorithm is predetermined, and the new application function and the second area verification key are encrypted using the fourth preset algorithm to generate the upgrade function signature to be verified. The new application function can also be implemented through code; therefore, when determining the upgrade function signature to be verified, encryption operations can be performed on the code corresponding to the new application function to determine the upgrade function signature.

[0074] B2. If the signature of the function to be upgraded is consistent with the signature of the application function to be upgraded, the application function is replaced by the new application function to achieve the upgrade of the application function.

[0075] The system checks if the signature of the function to be verified for upgrade matches the signature of the application function to be upgraded. If they match, the new application function is verified as valid and updated. During controller startup, the new application function replaces the original application function and executes to implement the corresponding functionality. The replacement can be achieved by directly deleting the original application function and overwriting it with the new one, or by not deleting the original application function but calling the new application function directly after the security startup function verifies its validity during controller startup.

[0076] This application stores application functions in a second partition. Since the second partition is not a one-time programmable area, the data in it can be modified, allowing for application function upgrades. By setting an immutable first partition and a modifiable second partition, secure boot is ensured without affecting device upgrades. Furthermore, in case of upgrade failure, bootloader or APP runtime errors, a rollback function can be used to switch to the previous version of the application function, thus resolving the issue of machine boot failure and improving product stability and reliability. This application includes setting area verification keys for the first and second areas to ensure area security, and multiple area verification keys can also be used for encryption and decryption.

[0077] This invention provides a controller security management method applied to a control system. The control system includes a controller and a hardware encryption management module. The controller's memory includes a first partition and a second partition. The first partition is a one-time programmable area to ensure the security of the secure startup function and prevent its tampering. This solves the problem of unreliable function security during controller startup by storing different data in the first and second partitions of the memory. The first and second partition verification keys are stored in the hardware encryption management module to prevent key loss and tampering. The startup function signature is determined by the secure startup function and the first partition verification key and stored in the hardware encryption management module for subsequent security verification during startup. The application function is verified by combining the secure startup function with the second partition verification key and the application function signature. The application function is called based on the verification result, thereby achieving secure controller startup and preventing malicious software intrusion, tampering, and illegal injection, ensuring normal device operation and security. The data in the second partition is modifiable, ensuring secure startup without affecting device upgrades. Both device startup and upgrade processes require multiple verifications to ensure data security.

[0078] Example 3

[0079] Figure 3 This is a schematic diagram of a controller security management device provided in Embodiment 3 of the present invention. The device is applied to a controller, and the controller's memory includes a first partition and a second partition. The first partition stores a secure startup function, a first area verification key, and a second area verification key. The second partition stores application functions and application function signatures. The first partition is configured as a one-time programmable area. Figure 3 As shown, the device includes: a key storage module 31, a signature storage module 32, and a startup module 33.

[0080] Among them, the key storage module 31 is used to call the secure startup function to store the first area verification key and the second area verification key to the hardware encryption management module when the controller is detected to be powered on for the first time.

[0081] The signature storage module 32 is used to determine the signature of the startup function based on the secure startup function and the first area verification key, and store it in the hardware encryption management module;

[0082] The startup module 33 is used to control the startup of the application function based on the secure startup function combined with the second area verification key and the application function signature, so as to realize the secure startup of the controller.

[0083] This invention provides a controller security management device that solves the problem of unreliable function security during controller startup. It determines the startup function signature using a secure startup function and a first-region verification key, and stores this signature in a hardware encryption management module for subsequent security verification during startup. The secure startup function, combined with a second-region verification key and the application function signature, verifies the application function. Based on the verification result, the application function is invoked, thereby achieving secure controller startup, preventing functions from being intruded upon, tampered with, or illegally injected by malicious software, ensuring normal device operation and guaranteeing device security.

[0084] Optionally, the signature storage module 32 is specifically used to process the secure startup function and the first area verification key according to a predetermined first preset algorithm to determine the startup function signature.

[0085] Optionally, the device may also include:

[0086] The startup signature verification module is used to determine the startup function signature to be verified based on the secure startup function and the first area verification key when it is detected that the controller is not starting up for the first time, and to obtain the startup function signature stored in the hardware encryption management module.

[0087] The application function call module is used to call the application function based on the secure startup function combined with the second area verification key and the application function signature if the signature of the startup function to be verified and the startup function signature are consistent, so as to achieve secure startup of the controller.

[0088] Optionally, the step of calling the application function based on the secure startup function in combination with the second area verification key and the application function signature includes: processing the secure startup function and the second area verification key according to a predetermined second preset algorithm to determine the application function signature to be verified; if the application function signature to be verified and the application function signature are consistent, calling the application function.

[0089] Optionally, the device may also include:

[0090] The upgrade information acquisition module is used to acquire the signature, random number, and second-region verification key verification data information of the application function to be upgraded when the application function upgrade is detected.

[0091] The random number verification module is used to perform key verification based on the random number and the second area verification key verification data information;

[0092] The application function retrieval module is used to retrieve new application functions if the verification passes.

[0093] The application function upgrade module is used to control the upgrade of the application function based on the new application function, the second area verification key, and the signature of the application function to be upgraded.

[0094] Optional, the random number verification module includes:

[0095] The real key determination unit is used to determine the real key based on the random number and the second area verification key verification data information combined with a predetermined third preset algorithm.

[0096] A key acquisition unit is used to acquire the second area verification key stored in the hardware encryption management module;

[0097] A key verification unit is used to determine that the key verification result is successful if the real key is consistent with the second area verification key.

[0098] Optionally, the application function upgrade module includes:

[0099] The upgrade signature determination unit is used to process the new application function and the second area verification key according to a predetermined fourth preset algorithm to determine the signature of the upgrade function to be verified.

[0100] An upgrade verification unit is used to replace the application function with the new application function if the signature of the upgrade function to be verified is consistent with the signature of the application function to be upgraded, so as to upgrade the application function.

[0101] The controller security management device provided in the embodiments of the present invention can execute the controller security management method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0102] Example 4

[0103] Figure 4 A schematic diagram of a vehicle structure that can be used to implement embodiments of the present invention is shown. The vehicle includes a control system 41, which includes a controller 411 and a hardware encryption management module 412. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the invention described and / or claimed herein.

[0104] like Figure 4 As shown, the vehicle includes at least one controller 411 and a memory, such as a read-only memory (ROM) 42 and a random access memory (RAM) 43, communicatively connected to the controller 411. The memory stores computer programs executable by the controller. The controller 411 can perform various appropriate actions and processes based on the computer program stored in the ROM 42 or loaded from storage unit 48 into the RAM 43. The RAM 43 can also store various programs and data required for vehicle operation. The controller 411, ROM 42, and RAM 43 are interconnected via a bus 44. An input / output (I / O) interface 45 is also connected to the bus 44.

[0105] Multiple components in the vehicle are connected to the I / O interface 45, including: input units 46, such as a keyboard, mouse, etc.; output units 47, such as various types of displays, speakers, etc.; storage units 48, such as disks, optical discs, etc.; and communication units 49, such as network cards, modems, wireless transceivers, etc. The communication unit 49 allows the vehicle to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0106] Controller 411 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of controller 411 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, digital signal processors (DSPs), and any suitable processor, controller, microcontroller, etc. Controller 411 performs the various methods and processes described above, such as controller security management methods.

[0107] In some embodiments, the controller security management method may be implemented as a computer program tangibly contained in a computer-readable storage medium, such as storage unit 48. In some embodiments, part or all of the computer program may be loaded and / or installed on the vehicle via ROM 42 and / or communication unit 49. When the computer program is loaded into RAM 43 and executed by controller 411, one or more steps of the controller security management method described above may be performed. Alternatively, in other embodiments, controller 411 may be configured to perform the controller security management method by any other suitable means (e.g., by means of firmware).

[0108] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), payload-programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0109] Computer programs used to implement the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when executed by the processor, the computer programs cause the functions / operations specified in the flowcharts and / or block diagrams to be performed. The computer programs may be executed entirely on a machine, partially on a machine, or as a standalone software package, partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0110] In the context of this invention, a computer-readable storage medium can be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination thereof. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0111] To provide interaction with the user, the systems and technologies described herein can be implemented in a vehicle having: a display device for displaying information to the user (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor); and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the vehicle. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0112] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or computing systems that include middleware components (e.g., application servers), or computing systems that include frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include local area networks (LANs), wide area networks (WANs), blockchain networks, and the Internet.

[0113] A computing system can include clients and servers. Clients and servers are generally located far apart and typically interact through communication networks. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a hosting product within the cloud computing service system to address the shortcomings of traditional physical hosts and VPS services, such as high management difficulty and weak business scalability.

[0114] It should be understood that the various forms of processes shown above can be used, with steps reordered, added, or deleted. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this invention can be achieved, and this is not limited herein.

[0115] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. A controller security management method characterized by, The application is applied to a control system, the control system comprises a controller and a hardware encryption management module, a memory of the controller comprises a first partition and a second partition, the first partition stores a secure start function, a first area check key and a second area check key, the second partition stores an application function and an application function signature, the first partition is set as a one-time programmable area, and the method comprises the following steps: when it is detected that the controller is started for the first time, the secure start function is called to store the first area check key and the second area check key to the hardware encryption management module; a start function signature is determined according to the secure start function and the first area check key, and is stored to the hardware encryption management module, the start function signature is used for security and legality verification of the secure start function; the application function is called according to the secure start function, the second area check key and the application function signature, so as to realize controller secure start, and the second area check key is used for checking the application function.

2. The method of claim 1, wherein, the start function signature is determined according to the secure start function and the first area check key, and comprises the following steps: the secure start function and the first area check key are processed according to a predetermined first preset algorithm, and the start function signature is determined.

3. The method of claim 1, wherein, further comprising: when it is detected that the controller is started for the first time, the secure start function and the first area check key are determined according to the secure start function and the first area check key, and the start function signature is determined. if the to-be-verified start function signature and the start function signature are consistent, the application function is called according to the secure start function, the second area check key and the application function signature, so as to realize controller secure start.

4. The method according to any one of claims 1-3, characterized in that, the application function is called according to the secure start function, the second area check key and the application function signature, and comprises the following steps: the secure start function and the second area check key are processed according to a predetermined second preset algorithm, and a to-be-verified application function signature is determined; if the to-be-verified application function signature and the application function signature are consistent, the application function is called.

5. The method of claim 1, wherein, further comprising: when it is detected that the application function is upgraded, a to-be-upgraded application function signature, a random number and second area verification key verification data information are obtained; key verification is performed according to the random number and the second area verification key verification data information; if the verification is passed, a new application function is obtained; the application function is controlled to be upgraded according to the new application function, the second area verification key and the to-be-upgraded application function signature.

6. The method of claim 5, wherein, the key verification is performed according to the random number and the second area verification key verification data information, and comprises the following steps: a real key is determined according to the random number and the second area verification key verification data information in combination with a predetermined third preset algorithm; the second area check key stored in the hardware encryption management module is obtained; if the real key is consistent with the second area check key, it is determined that the key verification result is that the verification is passed.

7. The method of claim 5, wherein, The application function is controlled to upgrade according to the new application function, the second area verification key and the application function signature to be upgraded, and the method comprises the following steps of: The new application function and the second area verification key are processed according to a fourth preset algorithm to determine a function signature to be verified; If the function signature to be verified is consistent with the application function signature to be upgraded, the application function is replaced by the new application function to realize the upgrade of the application function.

8. A controller security management apparatus characterized by comprising: The controller comprises a memory, a key storage module, a signature storage module and a starting module. The key storage module is used for storing the first area verification key and the second area verification key to the hardware encryption management module when the controller is started for the first time. The signature storage module is used for determining a starting function signature according to the security starting function and the first area verification key and storing the starting function signature to the hardware encryption management module. The starting module is used for controlling the application function to start according to the security starting function, the second area verification key and the application function signature to realize the safe starting of the controller.

9. A vehicle characterized by comprising: The vehicle comprises a control system, the control system comprising a controller and a hardware encryption management module. The memory is used for storing one or more programs. When the one or more programs are executed by the controller, the controller realizes the controller security management method in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, The computer readable storage medium stores computer instructions, and the computer instructions are used for making the processor to realize the controller security management method in any one of claims 1-7 when executed.

Images