Vehicle gateway security authentication method and device based on embedded Linux system

Abstract

The application relates to the field of information security and discloses a vehicle-mounted gateway security authentication method and device based on an embedded Linux system. The application is used to solve the problems of slow authentication speed and poor security of the existing vehicle-mounted gateway security authentication method. The application comprises the following steps: obtaining an upgrade software package, inputting the upgrade software package into a vehicle-mounted network security authentication system, and obtaining an authentication result; the upgrade software package comprises an upgrade file and an upgrade header file; and the vehicle-mounted network security authentication system processing process is as follows: initializing libp11 and libpkcs-hse modules, starting a PKCS11 session, establishing a slot and a token, searching for a slot and a token corresponding to HSE, enumerating all public keys in the token, obtaining an RSA public key used for signature verification of the upgrade file from the token, inputting the upgrade file and the RSA public key into a secure memory area of HSE, sending a signature verification service request to HSE after selecting a signature scheme, and performing signature verification; and if the signature verification fails, the previous version is restored. The application is used for vehicle-mounted gateway security authentication.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of information security, in particular to a vehicle gateway security authentication method and device based on an embedded Linux system. BACKGROUND

[0002] With the advent of new energy vehicles and the continuous development of Internet of Vehicles technology, vehicles are not only a means of transportation, but also cover communication, entertainment and office functions. Vehicle networks will play an increasingly important role, and at the same time, the importance of information security is self-evident. Vehicle networks have high security requirements for some important data, such as keys, over-the-air (OTA) upgrade packages, etc., so a reliable and efficient security authentication method is needed.

[0003] The security authentication method commonly used in OTA upgrades at present is to sign data packets using a private key, and the receiving party verifies the signature of the data packet using a public key. The embedded Linux system generally uses the library functions provided by openssl for security authentication, and both key management and signature verification operations require the resources of the main CPU, resulting in slow security authentication speed, and operations in non-secure memory areas are less secure and vulnerable to attacks. SUMMARY

[0004] The present application aims to solve the problems of slow authentication speed and poor security of existing vehicle gateway security authentication methods, and proposes a vehicle gateway security authentication method and device based on an embedded Linux system.

[0005] Obtain an upgrade software package, input the upgrade software package into a vehicle network security authentication system, and complete security authentication;

[0006] The upgrade software package comprises: an upgrade file and an upgrade header file.

[0007] The vehicle gateway security authentication system runs in a Linux kernel signature image;

[0008] The Linux kernel signature image is implemented by loading a u-boot signature image;

[0009] The vehicle network security authentication system comprises: a libp11 module, an ibpkcs-hse module, an initialization module, an RSA public key acquisition module, a digital signature / verification module, an upgrade module, and a rollback module.

[0010] The security engine of the HSE is configured using a SYS-IMG image;

[0011] The libp11 module is used for encapsulation of the PKCS11 interface.

[0012] The ibpkcs-hse module is configured to provide an interface between PKCS11 and HSE;

[0013] The initialization module is configured to initialize the libp11 and libpkcs-hse modules, start a PKCS11 session, and send the initialization result to the RSA public key acquisition module;

[0014] The RSA public key acquisition module is configured to establish a slot and a token, then find the corresponding slot and token of HSE, enumerate all public keys in the token, acquire the RSA public key used for signature verification of the upgrade file from the token, and send the RSA public key used for signature verification of the upgrade file to the digital signature / verification module;

[0015] The digital signature / verification module is configured to input the upgrade file and the RSA public key into the secure memory area of HSE, send a signature verification service request to HSE after selecting a signature scheme, and thus perform signature verification; if the signature verification is successful, a message indicating the successful signature verification is sent to the upgrade module; if the signature verification fails, a message indicating the failed signature verification is sent to the rollback detection module;

[0016] The upgrade module is configured to save the current upgrade file into the system, then check whether the version number in the current upgrade header file is greater than the current version number of the system; if the version number in the current upgrade header file is greater than the current version number of the system, the current upgrade file is used to perform version upgrade and complete security authentication; if the version number in the current upgrade header file is less than or equal to the current version number of the system, a message indicating that the version number in the current upgrade header file is less than or equal to the current version number of the system is sent to the rollback module;

[0017] The rollback module is configured to restore the upgrade file to the previous version and complete security authentication.

[0018] Further, the digital signature / verification module is configured to input the upgrade file and the RSA public key into the secure memory area of HSE, send a signature verification service request to HSE after selecting a signature scheme, and thus perform signature verification, specifically as follows:

[0019] First, a hash code of the upgrade file is acquired;

[0020] Then, a hash code of the decrypted upgrade file after digital signature is acquired;

[0021] Finally, the hash code of the upgrade file is compared with the hash code obtained after decryption of the upgrade file after digital signature; if the two hash codes are consistent, it indicates that the signature verification is successful, and a signature verification success flag is returned; if the two hash codes are inconsistent, it indicates that the signature verification fails, and a signature verification failure flag is returned.

[0022] Further, the current upgrade file is saved into the Linux system, specifically as follows:

[0023] The computing system currently remaining storage space size, if the system current remaining storage space is greater than a given threshold, then directly save the current upgrade file; if the system current remaining space is less than or equal to a given threshold, then delete the lowest version of the upgrade file, and then save the current upgrade file.

[0024] Further, the Linux kernel signature image is obtained by the following way:

[0025] Step one, using openssl to generate RSA key pair key2 and certificate cert1, adding key2 and cert1 to the dtb file of u-boot;

[0026] Step two, edit the configuration file secboot.its;

[0027] The configuration file secboot.its includes: the location of the Linux kernel image file and the signature algorithm used for verification;

[0028] Step three, add the RSA key pair key3 generated by openssl to the Linux device tree file;

[0029] Step four, using the private key in key2 to sign the Linux kernel image and the Linux device tree file obtained in step three, to generate FIT image, that is, Linux kernel signature image.

[0030] Further, the u-boot signature image is obtained by the following way:

[0031] Generate RSA key pair key1 on the host using secure sockets layer library openssl, and digitally sign the u-boot image.

[0032] Further, the SYS-IMG image is obtained by the following way:

[0033] Create a temporary buffer in the secure memory area;

[0034] Generate a formatted key directory, that is, key directory, in the buffer;

[0035] Import the RSA public key in key1 into a slot in the key directory;

[0036] Configure the core reset CR and the secure storage area SMR table item in the temporary buffer;

[0037] Use the HSE firmware to make the temporary buffer content into a system configuration image SYS-IMG.

[0038] The vehicle-mounted gateway security authentication device based on an embedded Linux system comprises a processor and a memory, and at least one instruction is stored in the memory, the at least one instruction is loaded and executed by the processor to realize the vehicle-mounted gateway security authentication method based on the embedded Linux system.

[0039] A storage medium stores at least one instruction, which is loaded and executed by a processor to realize a vehicle-mounted gateway security authentication method based on an embedded Linux system.

[0040] The present application has the following advantages:

[0041] The present application uses HSE management keys, has higher security, all operations of the present application are completed in a secure memory area and are realized by secure firmware, and the present application is not vulnerable to attacks, the present application uses HSE for encryption / decryption and signature / verification, reduces CPU occupation, and improves security authentication speed, the present application uses the PKCS11 standard interface realized by libp11 encapsulation, has less code, is safe and reliable, and improves security. BRIEF DESCRIPTION OF DRAWINGS

[0042] Figure 1 A constituent diagram of a u-boot signature image;

[0043] Figure 2 A constituent diagram of a Linux kernel signature image;

[0044] Figure 3 An HSE installation and configuration flowchart;

[0045] Figure 4 A security authentication flowchart of an upgrade package. DETAILED DESCRIPTION

[0046] The s32g series of NXP integrates multiple network communication protocols such as CAN, LIN and Ethernet, and hardware modules such as HSE (high security engine) and PFE (packet forwarding engine), and can meet the basic requirements of security authentication. The HSE not only provides a secure storage medium for important data such as keys and startup images, but also has an independent CPU subsystem that performs cryptographic operations using a secure memory area, greatly reducing the risk of external attacks. In addition, the HSE can take over the startup of the entire embedded Linux system and provide a trusted root for the first startup image, thereby ensuring the integrity of the trust chain. Next, the present application will be described in conjunction with specific embodiments.

[0047] Specific embodiment one: the specific process of the vehicle-mounted gateway security authentication method based on the embedded Linux system in the embodiment is as follows: obtaining an OTA upgrade software package, inputting the OTA upgrade software package into a vehicle-mounted gateway security authentication system, and completing security authentication.

[0048] The OTA upgrade software package comprises: an upgrade file, an upgrade package header file;

[0049] The vehicle-mounted gateway security authentication system runs in a Linux kernel signature image;

[0050] The Linux kernel signature image is loaded by a u-boot signature image;

[0051] The vehicle-mounted gateway security authentication system comprises: a libp11 module, an ibpkcs-hse module, an initialization module, an RSA public key acquisition module, a digital signature / verification module, an upgrade module, and a rollback module;

[0052] The libp11 module is used for encapsulation of a PKCS11 interface;

[0053] The ibpkcs-hse module is used for providing an interface between PKCS11 and HSE;

[0054] The security engine of the HSE is configured by a SYS-IMG image;

[0055] The initialization module: initializes the libp11 and libpkcs-hse modules, starts a PKCS11 session, and sends an initialization result to the RSA public key acquisition module;

[0056] The RSA public key acquisition module: establishes a slot and a token, then finds a corresponding slot and token of the HSE, enumerates all public keys in the token, acquires an RSA public key used for verification of an OTA upgrade file from the token, and sends the RSA public key used for verification of the upgrade file to the digital signature / verification module;

[0057] The digital signature / verification module: copies the upgrade file and the RSA public key as input data to a secure memory area of the HSE, selects a signature scheme as SH256+RSA, sends a verification service request to the HSE, and uses a special CPU subsystem of the HSE server to process data (the upgrade file and the digital signature) in the secure memory area, thereby performing verification (calculating a hash code of the upgrade file, and comparing the hash code with a hash code obtained after decryption of the digitally signed upgrade file, if consistent, it means that the verification is successful), if the verification is successful, sends a message of successful verification to the upgrade module, if the verification fails, sends a message of failed verification to the rollback detection module;

[0058] The upgrade module is used to calculate the current remaining storage space size of the system, if the current remaining storage space of the system is greater than a given threshold, the current upgrade file is directly saved; if the current remaining storage space of the system is less than or equal to the given threshold, the lowest version upgrade file is deleted, and then the current upgrade file is saved; then it is verified whether the version number in the current upgrade header file is greater than the current version number of the system; if it is greater than the current version number, the current upgrade file is used for version upgrade, and security authentication is completed; if the version number in the current upgrade header file is less than or equal to the current version number of the system, a message that the version number in the current upgrade header file is less than or equal to the current version number of the system is sent to the rollback module;

[0059] The rollback module is used to restore the upgrade file to the previous version, and complete security authentication.

[0060] Specific implementation two: the vehicle-mounted gateway security authentication system runs in the Linux kernel signature image, and is obtained by the following way:

[0061] Step one, use openssl to generate RSA key pair key2 and certificate cert1, and add them to the dtb file of u-boot;

[0062] Step two, edit the configuration file secboot.its, which includes the location of the Linux kernel image file and the adopted signature algorithm;

[0063] Step three, add the RSA key pair key3 generated by openssl to the Linux device tree file, which is used to verify the signature of the published security authentication application system; use the private key in key2 to sign the Linux kernel image and the Linux device tree file, and generate the FIT image, i.e. the Linux kernel signature image.

[0064] In this step, the Linux kernel is compiled, and the configuration items related to HSE need to be added; the RSA key and certificate are generated using openssl; the configuration file secboot.its is edited, which includes the location of the Linux kernel image file and the adopted signature algorithm; the device tree.dtb file is generated under the dts directory of u-boot; the Linux kernel image is digitally signed; the RSA key and certificate are saved to the dtb file of u-boot, and the dtb file is merged into the signature image of u-boot; the merged u-boot image is burned to the SD card; the signed Linux kernel image and its device tree file are merged into the FIT image, and burned to the SD card; the HSE firmware is burned to the SD card.

[0065] Specific implementation three: the Linux kernel signature image is implemented by u-boot signature image, and the u-boot signature image is obtained by the following method:

[0066] An RSA key pair key1 is generated on the host using openssl (Secure Sockets Layer Cryptographic Library) to digitally sign the u-boot image.

[0067] In this step, u-boot is compiled, wherein the HSE and FIT_SIGNATURE options are added; and an RSA key pair is generated using openssl for u-boot image digital signature.

[0068] Specific implementation four: the security engine of the HSE is configured by a SYS-IMG image, and the SYS-IMG image is obtained by the following method:

[0069] A command for installing HSE firmware is started in the u-boot command mode, and the operation is performed.

[0070] A temporary buffer is created in the secure memory region for making a system configuration image (SYS-IMG); a formatted key directory, i.e., a key directory, is generated in the buffer; an RSA public key in key1 is imported into a slot in the key directory; a CR (core reset) and SMR (secure memory region) table item is configured; the buffer content is made into a system configuration image by the HSE firmware; and a start flag is set to a secure boot mode.

[0071] In this step, the HSE firmware is installed. The u-boot is entered into the command mode in the u-boot start stage; the HSE firmware is installed, the key directory is formatted, the RSA public key used for u-boot signature verification is imported into the key directory; a CR (core reset) and SMR (secure memory region) table item is configured; a SYS-IMG is generated and burned to an SD card; and a start flag is set to a secure boot mode.

[0072] In the application, the HSE firmware is firstly run after power on; the HSE loads the SYS-IMAGE from the SD card to the secure RAM; the HSE analyzes the CR table and the SMR table in the SYS-IMAGE; the corresponding CPU subsystem is released according to the CR table item, and the location of the u-boot signature image is obtained according to the SMR table item; the RSA public key is imported from the key directory in the SYS-IMAGE, the u-boot signature image is verified, and the u-boot boot stage is entered after success. The u-boot boots the Linux kernel, mainly including: loading the FIT image containing the signed kernel image and kernel device tree; exporting the RSA public key and certificate from the device tree file of the u-boot; verifying the Linux kernel and device tree respectively; entering the Linux kernel startup stage after successful verification. The kernel loads the root file system and automatically executes the core business program. In order to avoid the core business program from being damaged, it can be digitally signed, and the corresponding RSA public key is saved in the kernel code. The network transmission important data involved in the core business is jumped to the vehicle gateway security authentication system. The dependent library for compiling the vehicle gateway security authentication system needs to use the libp11 library and the HSE PKCS11 module, and the implementation method is: cross-compile openssl1.1.1, copy the generated library file to the cross-compile tool chain for backup; cross-compile libp110.4.11; cross-compile HSE PKCS11 module, copy the generated libpkcs-hse.so and libhse.so.1.0 library files to the / usr / lib directory of the development board; copy the openssl and libp11 library files obtained by cross-compiling before to the / usr / lib directory of the development board. The functions that the vehicle gateway security authentication system needs to realize are: initializing the libp11 and libpkcs-hse modules; creating the HSE corresponding slot (slot) and token (token); generating RSA key pair using openssl; storing the key pair to the HSE or exporting the key pair from the HSE; removing the key pair from the HSE; encrypting / decrypting the original data; signing the original data or verifying the signed data. The security authentication process takes OTA upgrade as an example: login pkcs11; enumerate all certificates in the token; select the certificate to be used, and extract the RSA public key therefrom; use the RSA public key to verify the signature data packet; after the verification is passed, the extracted data is distributed to the corresponding ECU.

[0073] Specific embodiment five: a vehicle gateway security authentication device based on an embedded Linux system, comprising a processor and a memory, wherein the memory stores at least one instruction, and the at least one instruction is loaded and executed by the processor to realize a vehicle gateway security authentication method based on an embedded Linux system.

[0074] Specific implementation six: a storage medium, at least one instruction is stored, the instruction is loaded and executed by the processor to realize the vehicle gateway security authentication method based on embedded Linux system.

[0075] Embodiments:

[0076] In this embodiment, the compiling method of u-boot and Linux kernel, the security boot process, the writing method and the compiling process of security authentication subprogram are included. A PC (host) loaded with Ubuntu 18.04 is needed, and an NXP s32g development board. The development board is connected to the host through a USB data line, and the host runs minicom software as a console terminal.

[0077] First, compile u-boot and Linux kernel, and the constitution of the signature image is as shown in the attached Figures 1-2

[0078] A, set the u-boot compilation options, u-boot version 2020.04, find and open CONFIG_HSE_SECBOOT item and CONFIG_FIT_SIGNATURE item in menuconfig menu;

[0079] A1, compile to generate u-boot.bin;

[0080] A2, compile u-boot device tree fsl-s32g274ardb2.dtb;

[0081] B, set the Linux kernel compilation options, version 5.10, find and open all configuration items related to HSE in menuconfig menu.

[0082] B1, compile to generate Linux kernel image Image;

[0083] B2, generate RSA key boot_key.key and certificate boot_key.crt using openssl;

[0084] B3, write the configuration file secboot.its of FIT, which contains the relative path of the kernel image Image and the Linux device tree fsl-s32g274a-rdb2.dtb, and the signature algorithm "sha1,rsa2048"; add the RSA key pair key3 generated by openssl to the Linux device tree file;

[0085] ​B4, pack the Linux kernel and device tree using the u-boot tool tools / mkimage, generate the FIT signature image secboot.itb, and add the contents of the RSA key boot_key.key and the certificate boot_key.crt to the u-boot device tree fsl-s32g274ardb2.dtb;

[0086] C, burn each image to the SD card, use the EXT_DTB option to pack the u-boot device tree fsl-s32g274ardb2.dtb into u-boot.bin, generate the image file u-boot.s32; next, use the u-boot tool tools / s32gen1_secboot.sh to sign u-boot.s32, and burn the signed u-boot image and HSE firmware to the SD card; manually copy the FIT image secboot.itb to the fat partition of the SD card; the root file system can use the BSP provided by NXP;

[0087] Then, install and configure the HSE module, set the secure boot mode, as shown in Figure 3 .

[0088] D, select the SD card startup mode on the development board, pause the u-boot startup after power on to enter the command line mode, run

[0089] HSE installation command, complete the following operations

[0090] D1, format the key directory of the HSE, the key directory contains various slots, and each slot can only import a specific key;

[0091] D2, extract the RSA public key from the u-boot code segment and import it into the corresponding slot in the key directory;

[0092] D3, configure the CR and SMR table entries, specify the CPU subsystem to be enabled and the executable code to be loaded;

[0093] D4, write the above information to SYS-IMAGE, and then copy SYS-IMAGE to the SD card;

[0094] D5, set the secure boot mode flag in the IVT table of the SD card;

[0095] E, the development board reboots and enters the secure boot mode:

[0096] E1, first load and run the HSE firmware, use the cortex M7 core;

[0097] E2, after the HSE firmware runs, load SYS-IMAGE from the SD card to the secure RAM;

[0098] E3, parse SYS-IMAGE, get CR, SMR table item information, and export the RSA public key from the key directory;

[0099] E4, use the RSA public key to verify u-boot, i.e. SMR#0, and go to E5 after success, otherwise reset the system;

[0100] E5, release the cortex A53_0 CPU subsystem, i.e. CR#0, jump to u-boot, and start execution;

[0101] E6, u-boot loads the Linux kernel and device tree signature image, and performs verification;

[0102] E7, the Linux kernel uses the public key in key3 to verify the application, and runs the application after passing;

[0103] Finally, write a security authentication subprogram.

[0104] F, compile dependent libraries, cross-compile openssl1.1.1, libp11 0.4.11, and HSE PKCS11 module on the host in sequence, and copy the generated library file to / usr / lib in the root file system of the development board.

[0105] G, write an upgrade package security authentication program to realize the security authentication process as shown in Figure 4 G1, check whether the version number in the header file is greater than the current version number;

[0106] G2, check whether the header file has a verification success flag;

[0107] G3, verify the upgrade package, and if the verification fails, exit the update and enter the normal startup process;

[0108] G4, after verification succeeds, calculate the size of the remaining storage space, if it is less than a given threshold, delete the lowest version of the upgrade package file, and then save the current upgrade package, otherwise, directly save the new version.

[0109] G5, set the verification success flag of the header file, and the upgrade package update is complete, and restart.

[0110] H, write an upgrade package verification subprogram, as shown in Table 1:

[0111] Table 1: Upgrade package security verification steps based on libp11

[0112] Table 1: Upgrade package security verification steps based on libp11

[0113]

[0114] H1, initialize the PKCS11 context, load the pkcs11-hse module;

[0115] H2, find the slot and the token corresponding to the HSE; select the RSA public key associated with the specified data packet;

[0116] H3, initiate a service request to the token (HSE), and use the RSA public key and the HSE firmware to verify the signature.

Claims

1. A vehicle gateway security authentication method based on an embedded Linux system, characterized in that The method comprises the following steps: obtaining an upgrade software package, inputting the upgrade software package into a vehicle-mounted network security authentication system, and completing security authentication; The upgrade software package comprises: an upgrade file and an upgrade header file; The vehicle-mounted network security authentication system runs in a Linux kernel signature image; The Linux kernel signature image is loaded by using a u-boot signature image; The vehicle-mounted network security authentication system comprises: a libp11 module, an ibpkcs-hse module, an initialization module, an RSA public key obtaining module, a digital signature / verification module, an upgrade module, and a rollback module; The libp11 module is used for encapsulating a PKCS11 interface; The ibpkcs-hse module is used for providing an interface between the PKCS11 and HSE; The security engine of the HSE is configured by using a SYS-IMG image; The initialization module is used for initializing the libp11 and libpkcs-hse modules, starting a PKCS11 session, and sending an initialization result to the RSA public key obtaining module; The RSA public key obtaining module is used for establishing a slot and a token, then searching for a corresponding slot and token of the HSE, enumerating all public keys in the token, obtaining an RSA public key used for verifying the upgrade file from the token, and sending the RSA public key used for verifying the upgrade file to the digital signature / verification module; The digital signature / verification module is used for inputting the upgrade file and the RSA public key into a secure memory area of the HSE, sending a verification service request to the HSE after selecting a signature scheme, thereby performing verification, sending a verification success message to the upgrade module if the verification succeeds, and sending a verification failure message to the rollback module if the verification fails; The upgrade module is used for saving a current upgrade file into a system, then verifying whether a version number in a current upgrade header file is greater than a current version number of the system, performing version upgrade by using the current upgrade file if the version number in the current upgrade header file is greater than the current version number of the system, and completing security authentication, and sending a message that the version number in the current upgrade header file is less than or equal to the current version number of the system to the rollback module if the version number in the current upgrade header file is less than or equal to the current version number of the system. The rollback module is used for restoring the upgrade file to a previous version, and completing security authentication.

2. The method for security authentication of an in-vehicle gateway based on an embedded Linux system according to claim 1, characterized in that: The digital signature / verification module is used for inputting the upgrade file and the RSA public key into a secure memory area of the HSE, sending a verification service request to the HSE after selecting a signature scheme, thereby performing verification, and specifically comprising the following steps: Firstly, a hash code of the upgrade file is obtained; Then, a hash code obtained after decryption of a digitally signed upgrade file is obtained; Finally, the hash code of the upgrade file is compared with the hash code obtained after decryption of the digitally signed upgrade file, if the hash codes are consistent, it is indicated that the verification succeeds, and a verification success flag is returned; if the hash codes are inconsistent, it is indicated that the verification fails, and a verification failure flag is returned.

3. The method for security authentication of an in-vehicle gateway based on an embedded Linux system according to claim 2, characterized in that: The current upgrade file is saved into the system, and specifically comprising the following steps: The size of a current remaining storage space of the system is calculated, and if the size of the current remaining storage space of the system is greater than a given threshold, the current upgrade file is directly saved. If the current remaining space of the system is less than or equal to a given threshold, the lowest version of the upgrade file is deleted, and the current upgrade file is saved.

4. The method for security authentication of an in-vehicle gateway based on an embedded Linux system according to claim 3, characterized in that: The Linux kernel signature image is obtained by the following way: Step one, generate RSA key pair key2 and certificate cert1 by using openssl, and add key2 and cert1 to the dtb file of u-boot; Step two, edit the configuration file secboot.its; The configuration file secboot.its includes the location of the Linux kernel image file and the signature algorithm used for verification; Step three, add the RSA key pair key3 generated by openssl to the Linux device tree file; Step four, use the private key in key2 to sign the Linux kernel image and the Linux device tree file obtained in step three, and generate FIT image, i.e., Linux kernel signature image.

5. The method for security authentication of an in-vehicle gateway based on an embedded Linux system according to claim 4, characterized in that: The u-boot signature image is obtained by the following way: Generate RSA key pair key1 on the host using secure sockets layer password library openssl, and digitally sign the u-boot image.

6. The method for security authentication of an in-vehicle gateway based on an embedded Linux system according to claim 5, characterized in that: The SYS-IMG image is obtained by the following way: Create a temporary buffer in the secure memory area; Generate a formatted key directory, i.e., key directory, in the buffer; Import the RSA public key in key1 into a slot in the key directory; Configure the core reset CR and secure storage area SMR table entries in the temporary buffer; Use the HSE firmware to make the temporary buffer content into a system configuration image SYS-IMG.

7. A vehicle gateway security authentication device based on an embedded Linux system, characterized in that: The device includes a processor and a memory, and the memory stores at least one instruction, which is loaded and executed by the processor to implement the vehicle gateway security authentication method based on the embedded Linux system as claimed in any one of claims 1 to 6.

8. A storage medium characterized by: The storage medium stores at least one instruction, which is loaded and executed by the processor to implement the vehicle gateway security authentication method based on the embedded Linux system as claimed in any one of claims 1 to 6.

Images