A method and system for realizing vehicle over-the-air downloading

Abstract

An embodiment of the present application discloses a method, system, electronic device and storage medium for implementing vehicle over-the-air downloading; the method includes a controller randomly selecting a first symmetric key from a symmetric key table to obtain a symmetric key identifier; the controller encrypts a first random number from the cloud based on the first symmetric key to obtain a first message; the controller sends the symmetric key identifier and the first message to the cloud, so that the cloud obtains a second symmetric key based on the symmetric key identifier, the cloud decrypts the first message based on the second symmetric key to obtain a second random number, the cloud compares the first random number and the second random number, and when the comparison results are the same, determines that the cloud identity is legitimate; the controller receives the second message sent by the cloud, the second message is generated and issued by the cloud after determining that the identity is legitimate, and the determining that the identity is legitimate at least includes determining that the cloud identity is legitimate; the controller decrypts the second message to obtain the software package, so as to improve the security of vehicle over-the-air downloading.

Description

Technical Field

[0001] The present invention relates to the field of vehicles, and in particular to a method and system for implementing over-the-air downloading of vehicles. Background Art

[0002] With the development of technology, cars have become an integral part of people's lives, and controllers are a crucial component of vehicles. To reduce the cost of upgrading and managing vehicle controllers, over-the-air (OTA) technology is often used to remotely upgrade and manage controllers through external remote communication methods.

[0003] To improve the security of the OTA process, software-based symmetric encryption algorithms are often used to encrypt and protect the software being flashed. However, protecting the software being flashed solely through symmetric encryption can be less secure when the OTA link is attacked. For example, an unsecured cloud server could attack the OTA function of a specific vehicle controller, issue unsecured keys, or inject unsafe software. Therefore, a vehicle OTA method and system for improving vehicle OTA security is urgently needed. Summary of the Invention

[0004] In view of this, embodiments of the present application provide a method and system for implementing vehicle over-the-air downloading, so as to improve the security of vehicle over-the-air downloading.

[0005] In a first aspect, the present application provides a method for implementing vehicle over-the-air downloading, the method comprising:

[0006] The controller randomly selects a first symmetric key from the symmetric key table and obtains a symmetric key identifier;

[0007] The controller encrypts a first random number from the cloud based on the first symmetric key to obtain a first message;

[0008] The controller sends the symmetric key identifier and the first message to the cloud, so that the cloud obtains a second symmetric key based on the symmetric key identifier. The cloud decrypts the first message based on the second symmetric key to obtain a second random number. The cloud compares the first random number and the second random number. When the comparison results are the same, it is determined that the cloud identity is legitimate.

[0009] The controller receives a second message sent by the cloud, where the second message is generated and sent by the cloud by performing an encryption operation on the software package after determining that the identity is legitimate, wherein determining that the identity is legitimate includes at least determining that the cloud identity is legitimate;

[0010] The controller decrypts the second message to obtain the software package.

[0011] In one possible implementation, the controller includes a first controller and a second controller, and the method includes:

[0012] The first controller randomly selects a first symmetric key from the symmetric key table to obtain a symmetric key identifier;

[0013] The first controller sends the symmetric key identifier to the second controller, so that the second controller obtains the first symmetric key from the symmetric key table based on the symmetric key identifier;

[0014] The first controller encrypts a first random number from the cloud based on the first symmetric key to obtain a first message;

[0015] The first controller sends the symmetric key identifier and the first message to the cloud, so that the cloud obtains a second symmetric key based on the symmetric key identifier, decrypts the first message based on the second symmetric key to obtain a second random number, and compares the first random number with the second random number. When the comparison results are the same, it is determined that the cloud identity is legitimate;

[0016] The second controller receives a second message sent by the cloud through the first controller, where the second message is generated by the cloud performing an encryption operation on the software package and sent to the first controller after determining that the identity is legitimate, wherein determining that the identity is legitimate includes at least determining that the cloud identity is legitimate;

[0017] The second controller decrypts the second message to obtain the software package.

[0018] In a possible implementation, after determining that the cloud identity is legitimate, the following steps are further included:

[0019] The second controller generates a seed and randomly selects a first public key from the asymmetric key table to obtain an asymmetric key identifier;

[0020] The second controller sends the asymmetric key identifier and the seed to the first controller;

[0021] The first controller sends the asymmetric key identifier to the cloud, so that the cloud obtains the first private key from the asymmetric key table based on the asymmetric key identifier;

[0022] The first controller generates a second public key based on the seed;

[0023] The first controller sends the second public key to the cloud and the second controller respectively, so that the cloud digitally signs the second public key based on the first private key, obtains a third message and sends it to the first controller;

[0024] The first controller sends a third message to the second controller;

[0025] The second controller receives a fourth message from the third controller;

[0026] The second controller performs digital signature verification on the fourth message from the third controller based on the first public key;

[0027] When the verification is successful, the third controller is confirmed to be legitimate;

[0028] After confirming the legitimacy of the identity, the cloud encrypts the software package and sends a second message to the first controller, including:

[0029] After determining that the cloud identity is legitimate and that the third controller identity is legitimate, the cloud encrypts the software package and then sends a second message to the first controller.

[0030] In one possible implementation, the cloud performs an encryption operation on the software package to generate the second message, including:

[0031] The cloud symmetrically encrypts the software package based on the second symmetric key to generate a second message;

[0032] The second controller decrypts the second message to obtain a software package, including:

[0033] The second controller decrypts the second message based on the first symmetric key to obtain the software package.

[0034] In one possible implementation, the cloud performs an encryption operation on the software package to generate the second message, including:

[0035] The cloud symmetrically encrypts the software package based on the second symmetric key to generate an encrypted software package;

[0036] The cloud uses a hash function to obtain a first summary of the encrypted software package;

[0037] The cloud signs the summary based on the first private key to generate a digital signature;

[0038] The cloud determines the encrypted software package, the hash value, and the digital signature to form a second message;

[0039] The second controller decrypts the second message to obtain a software package, including:

[0040] The second controller decrypts the second message based on the first public key to obtain a first digest;

[0041] The second controller uses a hash function to obtain a second digest of the encrypted software package in the second message;

[0042] The second controller compares the first digest and the second digest;

[0043] When the comparison results are consistent, the second controller decrypts the second message based on the first symmetric key to obtain the software package.

[0044] In a possible implementation manner, after determining that the identity of the third controller is legitimate, the method further includes:

[0045] The second controller randomly generates a third public key, a third private key, and a third random number;

[0046] The second controller sends a third public key and a third random number to the first controller;

[0047] The first controller encrypts the third random number based on the third public key, generates a first encrypted random number, and sends the first encrypted random number to the second controller;

[0048] The second controller encrypts the third random number based on the third private key to generate a second encrypted random number;

[0049] The second controller compares the first encrypted random number with the second encrypted random number to obtain a comparison result.

[0050] In a possible implementation manner, after the second controller decrypts the second message to obtain the software package, the method further includes:

[0051] Get the version information of the software package;

[0052] Verify the version information of the software package;

[0053] If the verification is successful, the software flash operation is performed based on the software package.

[0054] In a second aspect, the present application provides a system for implementing over-the-air downloading of vehicles, the system comprising a vehicle controller and a cloud, wherein:

[0055] The controller is configured to: randomly select a first symmetric key from a symmetric key table to obtain a symmetric key identifier; encrypt a first random number from the cloud based on the first symmetric key to obtain a first message; and send the symmetric key identifier and the first message to the cloud;

[0056] The cloud is configured to: obtain a second symmetric key based on the symmetric key identifier; decrypt the first message based on the second symmetric key to obtain a second random number; compare the first random number and the second random number; and determine that the cloud identity is legitimate when the comparison results are the same; after determining that the identity is legitimate, encrypt the software package to generate a second message, and send the second message to the controller, wherein determining that the identity is legitimate includes at least determining that the cloud identity is legitimate;

[0057] The controller is further configured to receive a second message sent from the cloud; and decrypt the second message to obtain a software package.

[0058] In a third aspect, the present application provides an electronic device for implementing over-the-air downloading in a vehicle, the electronic device comprising a processor and a memory, wherein the memory stores code, and the processor is configured to call the code stored in the memory to implement the following functions:

[0059] The controller randomly selects a first symmetric key from the symmetric key table and obtains a symmetric key identifier;

[0060] The controller encrypts a first random number from the cloud based on the first symmetric key to obtain a first message;

[0061] The controller sends the symmetric key identifier and the first message to the cloud, so that the cloud obtains a second symmetric key based on the symmetric key identifier. The cloud decrypts the first message based on the second symmetric key to obtain a second random number. The cloud compares the first random number and the second random number. When the comparison results are the same, it is determined that the cloud identity is legitimate.

[0062] The controller receives a second message sent by the cloud, where the second message is generated and sent by the cloud by performing an encryption operation on the software package after determining that the identity is legitimate, wherein determining that the identity is legitimate includes at least determining that the cloud identity is legitimate;

[0063] The controller decrypts the second message to obtain the software package.

[0064] In a fourth aspect, the present application provides a computer-readable storage medium, wherein the computer-readable storage medium is used to store a computer program, and the computer program is used to execute any of the above methods.

[0065] In an embodiment of the present application, the controller randomly selects a first symmetric key from a symmetric key table, encrypts a first random number from the cloud based on the first symmetric key, obtains a first message, and sends the symmetric key identifier and the first message to the cloud; the cloud obtains a second symmetric key based on the symmetric key identifier, decrypts the first message based on the second symmetric key to obtain a second random number, compares the first random number and the second random number, and determines that the cloud identity is legitimate when the comparison results are the same; the controller receives a second message sent by the cloud, the second message is generated and issued by the cloud after determining the legitimacy of the identity, and the determination of the legitimacy of the identity at least includes determining the legitimacy of the cloud identity; the controller decrypts the second message to obtain the software package.

[0066] It can be seen that the embodiments of the present application have the beneficial effect of improving the security of vehicle over-the-air downloading.

[0067] By encrypting the first random number with the first symmetric key, the cloud is authenticated. Only when the cloud identity is legitimate will the controller receive and decrypt the message sent from the cloud, reducing the occurrence of unsafe cloud servers sending unsafe keys and injecting unsafe software, thereby improving the security of vehicle over-the-air downloads. The first symmetric key is randomly selected by the controller from the symmetric key table. The randomness of the first symmetric key and the first random number can further improve the security of vehicle over-the-air downloads. BRIEF DESCRIPTION OF THE DRAWINGS

[0068] Figure 1 A flowchart of a method for implementing vehicle over-the-air downloading provided in an embodiment of the present application;

[0069] Figure 2 A flowchart of a method for implementing vehicle over-the-air downloading provided in another embodiment of the present application;

[0070] Figure 3 A schematic diagram of the structure of a system for implementing vehicle over-the-air downloading provided in an embodiment of the present application;

[0071] Figure 4 A schematic structural diagram of an electronic device for implementing vehicle over-the-air downloading provided in an embodiment of the present application. DETAILED DESCRIPTION

[0072] In order to facilitate understanding and explanation of the technical solutions provided by the embodiments of the present application, the technical terms in the embodiments of the present application will be explained below.

[0073] Over-the-Air Technology (OTA): A technology that enables remote management of mobile terminal devices and SIM card data through the air interface of mobile communications. Applied to vehicle control download technology, OCT remotely upgrades and manages the software of the vehicle's controller through external remote communication methods, such as 4G / 5G mobile communication interfaces. OCT is generally divided into FOTA (Firmware OTA) and SOTA (Software OTA). FOTA manages and upgrades the underlying firmware of the vehicle controller; SOTA manages and upgrades the application software of the vehicle controller.

[0074] To facilitate understanding of the technical solution provided by the embodiment of the present application, a method and system for implementing vehicle over-the-air downloading provided by the embodiment of the present application are described below with reference to the accompanying drawings.

[0075] Although the accompanying drawings show exemplary embodiments of the present application, it should be understood that the present application can be implemented in various forms and should not be limited by the embodiments described herein. Based on the embodiments of the present application, other embodiments obtained by those skilled in the art without making any creative contribution shall fall within the scope of protection of the present application.

[0076] In the claims and specification of this application and the drawings, the terms "comprises" and "having" and any variations thereof are intended to cover non-exclusive inclusion. It should also be noted that, in this document, relational terms such as first and second, etc. are merely used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply the existence of any such actual relationship or order between these entities or operations. Moreover, the terms "comprises", "comprising" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or apparatus comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or apparatus. In the absence of further restrictions, an element defined by the sentence "comprising a ..." does not exclude the presence of other identical elements in the process, method, article or apparatus comprising the element.

[0077] To improve the security of the OTA process, existing technologies typically employ software-based symmetric encryption algorithms to protect the software being flashed. However, protecting the software being flashed solely through symmetric encryption can be less secure when the OTA link is attacked. For example, an unsecured cloud server could attack the OTA function of a specific vehicle controller, issue unsecured keys, or inject unsafe software.

[0078] Based on this, in an embodiment of the present application provided by the inventor, the controller randomly selects a first symmetric key from a symmetric key table, and encrypts a first random number from the cloud based on the first symmetric key to obtain a first message, and sends the symmetric key identifier and the first message to the cloud; the cloud obtains a second symmetric key based on the symmetric key identifier, decrypts the first message based on the second symmetric key to obtain a second random number, compares the first random number and the second random number, and determines that the cloud identity is legitimate when the comparison results are the same; the controller receives the second message sent by the cloud, and the second message is generated and issued by the cloud after determining that the identity is legitimate, and the determination of the legitimacy of the identity at least includes determining that the cloud identity is legitimate; the controller decrypts the second message to obtain the software package.

[0079] By encrypting the first random number with the first symmetric key, the cloud is authenticated. Only when the cloud identity is legitimate will the controller receive and decrypt messages sent from the cloud, reducing the possibility of unsafe cloud servers sending unsafe keys or injecting unsafe software, thereby improving the security of vehicle over-the-air downloads. The first symmetric key is randomly selected by the controller from the symmetric key table. The randomness of the first symmetric key and the first random number can further improve the security of vehicle over-the-air downloads. Therefore, the embodiments of the present application have the beneficial effect of improving the security of vehicle over-the-air downloads.

[0080] See also Figure 1 , Figure 1 This is a flow chart of a method for implementing vehicle over-the-air downloading provided in an embodiment of the present application. Figure 1 As shown, the method for implementing vehicle over-the-air downloading in the embodiment of the present application includes the following steps:

[0081] S101. The controller randomly selects a first symmetric key from a symmetric key table and obtains a symmetric key identifier.

[0082] In S101, the controller refers to the vehicle controller, that is, the object to be upgraded or managed via over-the-air download technology; the symmetric key table contains the symmetric key; the key identifier can be used to obtain the corresponding symmetric key in the symmetric key table; there is a correspondence between the randomly selected first symmetric key and the symmetric key identifier, for example, the symmetric key identifier indicates the position of the first symmetric key in the symmetric key table. It can be understood that the above correspondence is only an example and is not a limitation of the embodiments of the present application. By obtaining the first symmetric key by random selection, compared with the prior art, the embodiments of the present application can increase the security of the first symmetric key, thereby increasing the security of the vehicle OTA process.

[0083] Furthermore, the key table can be preset on the controller and the cloud before the vehicle leaves the factory. In order to achieve the above functions, there is a certain correspondence between the legal vehicle controller and the legal cloud key table.

[0084] S102. The controller encrypts a first random number from the cloud using a first symmetric key to obtain a first message.

[0085] In S102 , the first random number comes from the cloud, and the randomness of the random number further increases security.

[0086] S103. The controller sends the symmetric key identifier and the first message to the cloud, so that the cloud obtains a second symmetric key based on the symmetric key identifier. The cloud decrypts the first message based on the second symmetric key to obtain a second random number. The cloud compares the first random number with the second random number. When the comparison results are the same, it determines that the cloud identity is legitimate.

[0087] In S103, if the cloud is legitimate, the symmetric key tables of the cloud and the vehicle-side controller are consistent. Therefore, the cloud can obtain a first symmetric key based on the symmetric key identifier, which is consistent with the symmetric key randomly generated by the controller. At this time, the second random number generated by the cloud using the obtained first symmetric key is the same as the first random number sent by the cloud to the vehicle-side controller. Therefore, when the comparison result of the second random number and the first random number is the same, the cloud identity is determined to be legitimate.

[0088] Furthermore, the cloud may decrypt the first message based on the symmetric key identifier to obtain the second symmetric key by querying a symmetric key table based on the symmetric key identifier to obtain the second symmetric key corresponding to the symmetric key identifier. It is understood that the cloud may also obtain the second symmetric key through other means.

[0089] S104. The controller receives a second message sent by the cloud. The second message is generated and sent by the cloud by performing an encryption operation on the software package after determining the legitimacy of the identity. The determining the legitimacy of the identity at least includes determining the legitimacy of the cloud identity.

[0090] In S104, determining the legitimacy of the identity at least includes determining the legitimacy of the cloud identity. After S101-S104, after determining the legitimacy of the identity, the cloud encrypts the software package to generate a second message, and sends the second message to the controller.

[0091] S105: The controller decrypts the second message to obtain a software package, which is a software package waiting to be upgraded, for example, by completing the upgrade of the controller through software flashing.

[0092] In S105 , since the cloud encrypted the software package in S104 , the controller needs to decrypt it to obtain the software package.

[0093] Through S101-S105, identity recognition is performed on the cloud, and the key unification mechanism between the cloud and the vehicle improves the identity legitimacy of each link in the controller OTA process, and has higher security when facing penetration attacks in the field of automotive network security.

[0094] In the embodiment of the present application, identity authentication for the cloud can be completed through S101-S105. Therefore, the cloud can be set to send an identity authentication request to the controller as a trigger condition for S101. That is, after the controller receives the identity authentication request sent by the cloud, the controller randomly selects a first symmetric key from the symmetric key table to obtain a symmetric key identifier. Furthermore, since the first random number is sent by the cloud in S102, the controller encrypts the first random number based on the first symmetric key and then performs subsequent steps. Therefore, the cloud can be set to send the first random number to the controller when sending the identity authentication request to reduce the number of data transmissions. It can be understood that whether the cloud sends the identity authentication request to the controller and whether the cloud sends the first random number to the controller when sending the identity authentication request do not affect the implementation of the embodiment of the present application.

[0095] See also Figure 2 , Figure 2 This is a flow chart of a method for implementing vehicle over-the-air downloading provided in another embodiment of the present application. Figure 2As shown, in the embodiment of the present application, the controller includes a first controller and a second controller. The method for implementing vehicle over-the-air downloading in the embodiment of the present application includes the following steps:

[0096] S201. The first controller randomly selects a first symmetric key from a symmetric key table and obtains a symmetric key identifier.

[0097] S202: The first controller sends a symmetric key identifier to the second controller, so that the second controller obtains a first symmetric key from a symmetric key table based on the symmetric key identifier.

[0098] S203. The first controller encrypts a first random number from the cloud using a first symmetric key to obtain a first message.

[0099] S204. The first controller sends the symmetric key identifier and the first message to the cloud, so that the cloud obtains a second symmetric key based on the symmetric key identifier. The cloud decrypts the first message based on the second symmetric key to obtain a second random number, and compares the first random number with the second random number. When the comparison results are the same, it is determined that the cloud identity is legitimate.

[0100] S205. The second controller receives a second message sent by the cloud through the first controller. The second message is generated by the cloud performing an encryption operation on the software package and sent to the first controller after determining the legitimacy of the identity. The determining the legitimacy of the identity at least includes determining the legitimacy of the cloud identity.

[0101] S206: The second controller decrypts the second message to obtain a software package.

[0102] Compared to Figure 1 The corresponding embodiment, in Figure 2 In the corresponding embodiment of the present application, the vehicle controller includes a first controller and a second controller. The first controller and the second controller belong to the vehicle side, and the second controller realizes communication between the vehicle side and the cloud through the first controller.

[0103] After S201 - S206 , the cloud identity is legal, the identity verification between the cloud and the first controller is completed, and the cloud, the first controller and the second controller have a unified symmetric key.

[0104] The vehicle controller is divided into a first controller and a second controller because, generally speaking, the OTA function of some vehicle controllers does not communicate directly with the external cloud, and there is usually no relevant hardware to support direct communication between the controller and the cloud. Therefore, due to the electronic and electrical architecture of the entire vehicle, there is usually a type of OTA management controller OTAMG (OTAManager ECU) and an intermediate link controller (Middle Transition ECU) in the OTA process to realize data interaction between the vehicle and the cloud during the OTA process, such as forwarding the OTA upgrade package from the cloud. OTAMG is responsible for establishing a secure communication transport layer channel such as TLS1.3 (Transport Layer Security) with the remote cloud server through 4G / 5G and other means for remote interactive communication, such as the IAM module; the Middle Transition ECU is responsible for filtering and transparently transmitting the information sent by OTAMG, such as the ICC module. It can be understood that the embodiment of the present application can also be used for vehicle controllers that communicate directly with the cloud to realize OTA, such as a controller with integrated vehicle network (TBOX) function. In the embodiment of the present application, the first controller is the above-mentioned intermediate controller; the second controller is the object of the OTA upgrade, and the second controller can also be called the target controller.

[0105] The second controller can be understood as the target controller, which is a controller that is upgraded and managed through download technology and is the object of OTA upgrade. For example, the second controller can be a domain controller for intelligent driving. MPD (Master Pilot Device) is an intelligent driving domain controller and is an important controller for realizing automatic driving and assisted driving. Since MPD can directly issue the vehicle's lateral and longitudinal control instructions and body control instructions, it is highly sensitive to network security attacks and information security; in addition, after the standard operating procedure (SOP) of the whole vehicle project, more frequent OTA may be required to enrich, optimize and repair intelligent driving related functions, making MPD's OTA more likely to be attacked. Therefore, in an embodiment of the present application, the second controller can be an MPD controller, and the embodiment of the present application can be used in scenarios where the vehicle MPD controller is remotely upgraded and managed after the vehicle SOP.

[0106] The various steps in the embodiments of the present application and the connections between the steps can achieve the same Figure 1 The corresponding method for realizing vehicle over-the-air downloading has the same technical effect, and will not be described here to avoid repetition.

[0107] In the prior art, there are multiple interactive transparent transmission links of vehicle controllers during the OTA process, which may lead to more penetration attack vulnerabilities. Furthermore, in the embodiment of the present application, after determining that the cloud identity is legitimate, the legitimacy of the identity of the first controller can also be verified. Figure 2 In a corresponding embodiment, after determining that the cloud identity is legitimate, the method for implementing vehicle over-the-air downloading may further include the following steps:

[0108] S301: The second controller generates a seed and randomly selects a first public key from an asymmetric key table to obtain an asymmetric key identifier;

[0109] In S301, the seed generated by the second controller is used to generate an asymmetric key in an asymmetric encryption algorithm; the asymmetric key table includes asymmetric keys, which refer to public keys and private keys that appear in pairs; the first public key is randomly selected, and the randomness enhances the security of the first public key; the asymmetric key identifier is used to obtain the first public key from the asymmetric key table.

[0110] Furthermore, the key table can be preset on the controller and the cloud before the vehicle leaves the factory. In order to achieve the above functions, there is a certain correspondence between the legal vehicle controller and the legal cloud key table.

[0111] Furthermore, in the above embodiments, the key tables in the controllers (including the first controller and the second controller) can be pre-stored before the vehicle leaves the factory, and the key tables in the cloud can also be pre-stored. There is a corresponding relationship between the legitimate controllers and the legitimate key tables in the cloud.

[0112] The controller pre-stores the symmetric key table and the asymmetric key table, and the cloud pre-stores the symmetric key table and the asymmetric key table.

[0113] S302: The second controller sends an asymmetric key identifier and a seed to the first controller;

[0114] S303: The first controller sends the asymmetric key identifier to the cloud, so that the cloud obtains the first private key from the asymmetric key table based on the asymmetric key identifier;

[0115] S304: The first controller generates a second public key based on the seed;

[0116] S305: The first controller sends the second public key to the cloud and the second controller respectively, so that the cloud digitally signs the second public key based on the first private key, obtains a third message, and sends it to the first controller;

[0117] In S305 , the cloud digitally signs the second public key based on the first private key to obtain a third message, and the cloud sends the third message to the first controller.

[0118] S306: The first controller sends a third message to the second controller;

[0119] S307: The second controller receives a fourth message from the third controller;

[0120] S308. The second controller performs digital signature verification on the fourth message from the third controller based on the first public key;

[0121] In S308 , the first public key and the first private key in S305 form a pair of asymmetric keys.

[0122] S309: When the verification is successful, the third controller is determined to be legitimate;

[0123] S306-S309 verify the legitimacy of the third controller sending the message to the first controller. Because the first public key and the first private key form an asymmetric key pair, successful digital signature verification indicates the legitimacy of the third controller. Therefore, the third controller and the first controller are the same legitimate controller, and the third message and the fourth message are the same legitimate message.

[0124] Since the cloud is trustworthy and is the trust root for the handshake between the second controller and the first controller, the digital signature obtained from the cloud is considered safe and trustworthy. Therefore, passing the signature verification means that the key pair of the first controller is legal.

[0125] go through Figure 2 In S201-205 of the corresponding embodiment, and S301-309 of the embodiment of the present application, the identities of the cloud, the first controller, and the second controller have all been verified to be legitimate.

[0126] After confirming that the identity is legitimate, the cloud encrypts the software package and then sends a second message to the first controller, which may include step S310:

[0127] S310: After determining that the cloud identity is legitimate and that the third controller identity is legitimate, the cloud encrypts the software package and then sends a second message to the first controller;

[0128] S311. The second controller receives a second message sent by the cloud through the first controller;

[0129] S312: The second controller decrypts the second message to obtain a software package.

[0130] By verifying the legitimacy of the identity of controllers in each link, the security of automobile network can be improved.

[0131] Furthermore, in order to further improve OTA security, the upgraded software package may be encrypted, and the encryption operation may be symmetric encryption.

[0132] The cloud performs an encryption operation on the software package to generate a second message, which may include:

[0133] The cloud symmetrically encrypts the software package based on the second symmetric key to generate a second message;

[0134] The second controller decrypting the second message to obtain the software package may include:

[0135] The second controller decrypts the second message based on the first symmetric key to obtain the software package.

[0136] exist Figure 2 In the corresponding embodiment, the symmetric keys of the cloud, the first controller, and the second controller are unified. Therefore, the software package can be encrypted using the unified symmetric key to improve OTA security.

[0137] Furthermore, in addition to symmetrically encrypting the software package, digital signatures can also be used to further enhance the security of OTA.

[0138] The cloud performs encryption operation on the software package to generate a second message, which may include steps S401-S404:

[0139] S401: The cloud symmetrically encrypts the software package based on the second symmetric key to generate an encrypted software package.

[0140] S402, the cloud obtains a first summary of the encrypted software package using a hash function;

[0141] In S401 , the first digest refers to a hash value obtained by using a hash function, and generally refers to a hash value used to verify data integrity and uniqueness.

[0142] S403: The cloud signs the digest based on the first private key to generate a digital signature;

[0143] S404: The cloud determines that the encrypted software package, the hash value, and the digital signature constitute a second message;

[0144] The second controller decrypts the second message to obtain the software package, which may include steps S501-S504:

[0145] S501: The second controller decrypts the second message based on the first public key to obtain a first digest;

[0146] S502: The second controller uses a hash function to obtain a second digest of the encrypted software package in the second message;

[0147] S503: The second controller compares the first digest with the second digest;

[0148] S504: When the comparison results are consistent, the second controller decrypts the second message based on the first symmetric key to obtain the software package.

[0149] S401 and S504 are the processes of encrypting the software package using a symmetric encryption algorithm. S402-S404 and S501-S504 are the processes of digitally signing and verifying the software package. The combination of the two can further enhance the security of OTA.

[0150] The OTA verification and flashing process uses an asymmetric encryption signature mechanism. Based on a secure identity-based OTA environment, it can reduce the risk of unintended software being flashed into the target controller.

[0151] Furthermore, the cloud can send a request message to the first controller before S301, and the first controller filters and transmits the authentication message to the second controller, that is, the second controller receiving the authentication message sent by the cloud can be used as a condition for triggering S301.

[0152] Furthermore, after determining that the identity of the third controller is legitimate, the following steps may be further included:

[0153] The second controller randomly generates a third public key, a third private key, and a third random number;

[0154] The second controller sends a third public key and a third random number to the first controller;

[0155] The first controller encrypts the third random number based on the third public key, generates a first encrypted random number, and sends the first encrypted random number to the second controller;

[0156] The second controller encrypts the third random number based on the third private key to generate a second encrypted random number;

[0157] The second controller compares the first encrypted random number with the second encrypted random number to obtain a comparison result.

[0158] The purpose of the above steps is to verify the validity of the second public key generated by the first controller through the comparison process of random numbers, and further realize the unification of keys in the OTA process.

[0159] Furthermore, after the second controller decrypts the second message to obtain the software package, the method may further include:

[0160] Get the version information of the software package;

[0161] Verify the version information of the software package;

[0162] If the verification is successful, the software flash operation is performed based on the software package.

[0163] A successful verification usually indicates that the software package is successfully decrypted. At this time, the software flashing operation is performed to reduce the possibility of flashing the wrong version of the software.

[0164] Furthermore, in the above embodiments, the key tables in the controllers (including the first controller and the second controller) can be pre-stored before the vehicle leaves the factory, and the key tables in the cloud can also be pre-stored. There is a corresponding relationship between the legitimate controllers and the legitimate key tables in the cloud.

[0165] Furthermore, the key table can be stored encrypted. The controller can include a firewall to process the received data during data transmission and reception.

[0166] Furthermore, the symmetric encryption algorithm used in the above method may be at least the AES128 algorithm, and the asymmetric encryption algorithm may use the ECC256 algorithm.

[0167] Furthermore, the random selection process in the above method can use a random number generator. Furthermore, the random number generator can use TRNG (True random number generator), can use the chip's HSM module (Hardware Security Module) resources, and can use the Evita Full-level HSM module to manage and hardware-accelerate the asymmetric encryption, symmetric encryption, and random number generation processes in the above method, and encrypt and manage the key table. The above-mentioned Secure OTA mechanism can make full use of the chip's advanced HSM module resources, has higher security features, and can reduce the increase in CPU load caused by the encryption algorithm. It has good application prospects in automotive network security.

[0168] See also Figure 3 , Figure 3 This is a schematic diagram of the structure of a system for implementing vehicle over-the-air downloading provided in an embodiment of the present application. Figure 3 As shown, the system 300 for implementing vehicle over-the-air downloading in the embodiment of the present application includes a vehicle controller 301 and a cloud 302, wherein:

[0169] The controller 301 is configured to: randomly select a first symmetric key from the symmetric key table to obtain a symmetric key identifier; encrypt a first random number from the cloud using the first symmetric key to obtain a first message; and send the symmetric key identifier and the first message to the cloud.

[0170] The cloud 302 is configured to: obtain a second symmetric key based on the symmetric key identifier; decrypt the first message based on the second symmetric key to obtain a second random number; compare the first random number with the second random number; and determine that the cloud identity is legitimate when the comparison results are the same; after determining that the identity is legitimate, encrypt the software package to generate a second message, and send the second message to the controller, wherein determining that the identity is legitimate includes at least determining that the cloud identity is legitimate;

[0171] The controller 301 is further configured to receive a second message sent from the cloud; and decrypt the second message to obtain a software package.

[0172] The devices included in the system for implementing vehicle over-the-air downloads and the connections between the devices can achieve the same technical effects as the above-mentioned method for implementing vehicle over-the-air downloads. To avoid repetition, they are not described here. In addition, since the system for implementing vehicle over-the-air downloads in the application embodiment can improve the security of the OTA process, it can also be called a SecureOTA system.

[0173] See also Figure 4 , Figure 4 This is a schematic diagram of the structure of an electronic device for implementing vehicle over-the-air downloading provided in an embodiment of the present application. Figure 4 As shown, the electronic device 400 for implementing vehicle over-the-air downloading in the embodiment of the present application includes a processor 401 and a memory 402, wherein the memory stores code, and the processor is used to call the code stored in the memory to implement the following functions:

[0174] The controller randomly selects a first symmetric key from the symmetric key table and obtains a symmetric key identifier;

[0175] The controller encrypts a first random number from the cloud based on the first symmetric key to obtain a first message;

[0176] The controller sends the symmetric key identifier and the first message to the cloud, so that the cloud obtains a second symmetric key based on the symmetric key identifier. The cloud decrypts the first message based on the second symmetric key to obtain a second random number. The cloud compares the first random number and the second random number. When the comparison results are the same, it is determined that the cloud identity is legitimate.

[0177] The controller receives a second message sent by the cloud, where the second message is generated and sent by the cloud by performing an encryption operation on the software package after determining that the identity is legitimate, wherein determining that the identity is legitimate includes at least determining that the cloud identity is legitimate;

[0178] The controller decrypts the second message to obtain the software package.

[0179] The units included in the electronic device for implementing vehicle over-the-air downloading and the connection relationship between the units can achieve the same technical effect as the above-mentioned method for implementing vehicle over-the-air downloading. To avoid repetition, they will not be described here.

[0180] In an embodiment of the present application, a computer-readable storage medium is further provided, wherein the computer-readable storage medium is used to store a computer program, and the computer program is used to execute the above-mentioned method for realizing vehicle over-the-air downloading, and can achieve the same technical effect. To avoid repetition, it will not be repeated here. Among them, the computer-readable storage medium is such as a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc. The above description of the disclosed embodiments enables professionals and technicians in this field to implement or use the present application. Various modifications to these embodiments will be obvious to professionals and technicians in this field, and the general principles defined in this article can be implemented in other embodiments without departing from the spirit or scope of this application. Therefore, the present application will not be limited to the embodiments shown in this article, but will comply with the widest scope consistent with the principles and novel features disclosed in this article.

Claims

1. A method for implementing vehicle over-the-air downloading, characterized in that: A controller applied to a vehicle includes a first controller and a second controller, wherein the first controller is used to implement data exchange between the vehicle and the cloud during over-the-air downloading, and the second controller is an intelligent driving domain controller and is the object of upgrade via over-the-air downloading. The method includes: The first controller randomly selects a first symmetric key from the symmetric key table to obtain a symmetric key identifier; The first controller sends the symmetric key identifier to the second controller, so that the second controller obtains the first symmetric key from the symmetric key table based on the symmetric key identifier; The first controller encrypts a first random number from the cloud based on the first symmetric key to obtain a first message; The first controller sends the symmetric key identifier and the first message to the cloud, so that the cloud obtains a second symmetric key from the symmetric key table based on the symmetric key identifier, decrypts the first message based on the second symmetric key to obtain a second random number, and compares the first random number with the second random number. When the comparison results are the same, it is determined that the cloud identity is legitimate; The second controller receives, through the first controller, a second message sent by the cloud, where the second message is generated by the cloud performing a symmetric encryption operation on the software package based on the second symmetric key after determining that the cloud identity and the first controller identity are legitimate, and then sent to the first controller; The second controller decrypts the second message based on the first symmetric key to obtain a software package; The determining whether the identity of the first controller is legitimate includes: The second controller generates a seed and randomly selects a first public key from the asymmetric key table to obtain an asymmetric key identifier; The second controller sends the asymmetric key identifier and the seed to the first controller; The first controller sends the asymmetric key identifier to the cloud, so that the cloud obtains a first private key from an asymmetric key table based on the asymmetric key identifier, where the first private key and the first public key form a pair of asymmetric keys; the first controller generating a second public key based on a seed received from the second controller; The first controller sends the second public key to the cloud and the second controller respectively, so that the cloud digitally signs the second public key based on the first private key, obtains a third message and sends it to the first controller; The first controller sends a third message to the second controller; The second controller receives a third message from the first controller; The second controller performs digital signature verification on the third message from the first controller based on the first public key; When the verification is successful, it is determined that the identity of the first controller is legitimate; The first controller and the second controller both pre-store the symmetric key table and the asymmetric key table, and the cloud pre-stores the symmetric key table and the asymmetric key table.

2. The method according to claim 1, characterized in that The cloud performs a symmetric encryption operation on the software package based on the second symmetric key, including: The cloud symmetrically encrypts the software package based on the second symmetric key to generate an encrypted software package; The cloud uses a hash function to obtain a first summary of the encrypted software package; The cloud signs the summary based on the first private key to generate a digital signature; The cloud determines the encrypted software package, the hash value, and the digital signature to form a second message; The second controller decrypts the second message based on the first symmetric key to obtain a software package, including: The second controller decrypts the second message based on the first public key to obtain a first digest; The second controller uses a hash function to obtain a second digest of the encrypted software package in the second message; The second controller compares the first digest and the second digest; When the comparison results are consistent, the second controller decrypts the second message based on the first symmetric key to obtain the software package.

3. The method according to claim 1, characterized in that After the second controller decrypts the second message to obtain the software package, the method further includes: Get the version information of the software package; Verify the version information of the software package; If the verification is successful, the software flash operation is performed based on the software package.

4. A system for realizing vehicle over-the-air downloading, characterized in that: The system includes a controller and a cloud. The controller is a vehicle controller and includes a first controller and a second controller. The first controller is used to implement data interaction between the vehicle and the cloud during over-the-air download. The second controller is an intelligent driving domain controller and is the object to be upgraded through over-the-air download. The first controller is configured to: randomly select a first symmetric key from the symmetric key table to obtain a symmetric key identifier; and send the symmetric key identifier to the second controller; The second controller is configured to obtain the first symmetric key from the symmetric key table based on the symmetric key identifier received from the first controller; encrypt a first random number from the cloud based on the first symmetric key to obtain a first message; and send the symmetric key identifier and the first message to the cloud; The cloud is configured to: obtain a second symmetric key from the symmetric key table based on the symmetric key identifier; decrypt the first message based on the second symmetric key to obtain a second random number; compare the first random number and the second random number; determine that the cloud identity is legitimate when the comparison results are the same; after determining that the cloud identity is legitimate and that the first controller identity is legitimate, perform a symmetric encryption operation on the software package based on the second symmetric key to generate a second message, and send the second message to the first controller; The second controller is further configured to receive a second message sent by the cloud through the first controller; and decrypt the second message based on the first symmetric key to obtain a software package; The second controller is further configured to generate a seed, randomly select a first public key from the asymmetric key table, and obtain an asymmetric key identifier; and send the asymmetric key identifier and the seed to the first controller; The first controller is configured to send the asymmetric key identifier to the cloud, so that the cloud obtains a first private key from an asymmetric key table based on the asymmetric key identifier, where the first private key and the first public key form an asymmetric key pair; generate a second public key based on a seed received from the second controller; send the second public key to the cloud and the second controller respectively, so that the cloud digitally signs the second public key based on the first private key, obtain a third message, and send it to the first controller; send the third message to the second controller; and receive the third message from the first controller; The second controller is further configured to perform digital signature verification on a third message from the first controller based on the first public key; when the verification is successful, determining that the identity of the first controller is legitimate; The first controller and the second controller both pre-store the symmetric key table and the asymmetric key table, and the cloud pre-stores the symmetric key table and the asymmetric key table.

5. An electronic device for realizing vehicle over-the-air downloading, characterized in that: The electronic device is a vehicle controller, which includes a first controller and a second controller. The first controller is used to implement data interaction between the vehicle and the cloud during over-the-air download. The second controller is an intelligent driving domain controller and is the object to be upgraded via over-the-air download. The controller includes a processor and a memory, wherein the memory stores code, and the processor is used to call the code stored in the memory to implement the following functions: The first controller randomly selects a first symmetric key from the symmetric key table to obtain a symmetric key identifier; The first controller sends the symmetric key identifier to the second controller, so that the second controller obtains the first symmetric key from the symmetric key table based on the symmetric key identifier; The first controller encrypts a first random number from the cloud based on the first symmetric key to obtain a first message; The first controller sends the symmetric key identifier and the first message to the cloud, so that the cloud obtains a second symmetric key from the symmetric key table based on the symmetric key identifier, decrypts the first message based on the second symmetric key to obtain a second random number, and compares the first random number with the second random number. When the comparison results are the same, it is determined that the cloud identity is legitimate; The second controller receives a second message sent by the cloud through the first controller, where the second message is generated by the cloud encrypting the software package based on the second symmetric key after determining the legitimacy of the cloud identity and the first controller identity, and then sent to the first controller; The second controller decrypts the second message based on the first symmetric key to obtain a software package; The second controller is further configured to generate a seed, randomly select a first public key from the asymmetric key table, and obtain an asymmetric key identifier; and send the asymmetric key identifier and the seed to the first controller; The first controller is configured to send the asymmetric key identifier to the cloud, so that the cloud obtains a first private key from an asymmetric key table based on the asymmetric key identifier, where the first private key and the first public key form an asymmetric key pair; generate a second public key based on a seed received from the second controller; send the second public key to the cloud and the second controller respectively, so that the cloud digitally signs the second public key based on the first private key, obtain a third message, and send the third message to the first controller; and send the third message to the second controller; The second controller is further configured to receive a third message from the first controller; perform digital signature verification on the third message from the first controller based on the first public key; and determine that the identity of the first controller is legitimate when the verification passes; The first controller and the second controller both pre-store the symmetric key table and the asymmetric key table, and the cloud pre-stores the symmetric key table and the asymmetric key table.

6. A computer-readable storage medium, characterized in that The computer-readable storage medium is used to store a computer program, and the computer program is used to execute the method according to any one of claims 1 to 3.

Images