A method and system for OTA remote security upgrade of intelligent connected vehicles

Abstract

The present invention discloses a method and system for remote secure OTA upgrade of intelligent connected vehicles. The current OTA software upgrade package is decomposed into multiple software upgrade subpackages, and the HASH value of each software upgrade subpackage is calculated in turn. Then, a Merkle tree is constructed based on these HASH values, and the HASH value of the root of the Merkle tree is calculated. After the software upgrade subpackage is transmitted to ECU-UA by UC-master through a gateway or a domain controller, the HASH value of each software upgrade subpackage is calculated again, and the Merkle tree is reconstructed again based on these HASH values, and the HASH value of the root of the Merkle tree is calculated again, and the two HASH values ​​are compared. If the two are equal, the normal upgrade program can be started; otherwise, UC-master immediately terminates this OTA remote upgrade. The present invention solves the problem of secondary verification of the upgrade subpackage after the current OTA upgrade software package is unpacked.

Description

Technical Field

[0001] The present invention relates to automobile OTA upgrade technology, and in particular to an OTA remote security upgrade method and system for intelligent networked automobiles. Background Art

[0002] In recent years, intelligent connected vehicles have become the strategic direction of the development of the global automotive industry, and the automotive industry has gradually embarked on the road of software defined vehicle (SDV) transformation. With the "electrification, intelligence, networking, and sharing" of automobiles, SDV has become a new industry consensus in recent years. With the rapid development of intelligent connected vehicles, the intelligence level of automotive parts has continued to improve, more and more software is installed inside the vehicle, the complexity of the vehicle has increased, and the in-vehicle software updates have become more and more frequent. The difficulties faced by car companies and users in software maintenance are also increasing. In this context, remote upgrades (Over The Air, OTA) have emerged to achieve remote management of vehicle systems and applications through the air interface of mobile communications, and have gradually become the mainstream technology for achieving in-vehicle software maintenance and management. OTA technology can not only bring a more convenient way to upgrade in-vehicle software, but also allow consumers to experience a more intelligent and convenient car experience. Moreover, for the majority of car companies, OTA technology can help car companies achieve vehicle function upgrades, performance optimization, and defect repairs, which can greatly reduce the recall cost of vehicles, achieve unified management of in-vehicle software and in-vehicle data, and improve the efficiency and quality of after-sales service.

[0003] However, as cars are becoming more electrified and connected, OTA will expose the entry point for vehicle software updates to the Internet, increasing the attack surface of automotive network security and causing vehicles to face three main security threats. The first is identity impersonation attack, in which the attacker pretends to be the sender or receiver in OTA communication. The second is eavesdropping attack, in which the attacker steals data packets during OTA transmission to obtain sensitive information in the upgrade package. The third is data tampering, in which the attacker tampers with the OTA upgrade package and attacks the vehicle by implanting malware, viruses, etc.

[0004] At present, domestic OEMs generally integrate OTA upgrade functions on mass-produced models, and implement security strategies such as upgrade verification mode to ensure the security of OTA upgrades. At present, there are two common OTA upgrade verification modes: one is based on HASH algorithms, such as MD5, SHA-1, etc. to calculate the HASH value of the upgrade package. When the upgrade package is received by the vehicle, the vehicle-side upgrade controller (UC-master) uses the same HASH algorithm to calculate the HASH value of the received upgrade package. By comparing the HASH values ​​of the upgrade package before and after sending and receiving, the integrity of the received upgrade package is verified, thereby realizing OTA upgrade verification. However, attackers can bypass this verification method by tampering with the HASH value and tampering with the verification logic. The second is signature verification based on the signature algorithm. This verification method uses the PKI system to generate a public-private key pair for the OTA cloud server. The OTA cloud server uses the private key to perform encryption operations on the upgrade package data or other variables related to the data content to realize the signature of the upgrade data packet. The vehicle-side UC-master uses the public key of the OTA cloud server to verify the received "digital signature" to realize the integrity verification of the upgrade data packet and ensure the security of OTA upgrades. Although the "signature verification" method can ensure the legitimacy and integrity of the upgrade data package, in the actual upgrade process, one upgrade data package is usually packaged into multiple upgrade packages according to the different types and configurations of the electronic control unit (ECU), and then transmitted to the target ECU through the gateway or domain controller to upgrade the target ECU. Usually, the target ECU will not perform a secondary verification on the upgrade package. As the attacker's attack methods are constantly upgraded, the attacker can replace / tamper with the target ECU upgrade package after UC-Master completes the verification and unpacking of the entire upgrade package, so as to achieve the purpose of malicious upgrade. Although there are also solutions that use digital signatures or hash message authentication codes (HMAC) for secondary verification, and then perform upgrade flashing and installation after the verification is successful, the secondary signature or hash message authentication code HMAC requires encryption and decryption operations, which have high requirements on the performance and security of ECU and other components themselves. It is only suitable for intelligent ECUs, not embedded ECUs, and has low execution efficiency.

[0005] Among the three upgrade methods mentioned above, the first two have certain security threats. The verification based on the signature algorithm ensures the legitimacy and integrity of the entire upgrade package, but the target ECU upgrade package cannot be verified twice during the upgrade process, resulting in certain security risks in the current OTA, affecting the security of the vehicle OTA upgrade. The third upgrade method uses a digital signature or message authentication code HMAC for secondary signature verification, but due to the large number of sub-packages that need to be verified, coupled with the impact of the performance and security of components such as the ECU itself, the execution efficiency is low, and this method is only suitable for intelligent ECUs, not embedded ECUs. Therefore, how to achieve efficient verification, storage, and flexible addition or modification of current ECU upgrade sub-packages is a key technical problem to be solved. Summary of the invention

[0006] In view of the security threats existing in the prior art of vehicle-side software upgrade package verification based on a one-time signature algorithm, and the inability of the secondary signature verification method based on digital signature or message authentication code HMAC to solve the problem of efficient upgrade of embedded ECU software, the present invention provides a remote security upgrade method and system for intelligent networked vehicles to solve the secondary verification problem of the upgrade sub-package after the current OTA upgrade software package is unpacked. It prevents attackers from replacing or tampering with the upgrade software sub-package of the target ECU after the vehicle-side UC-master completes the verification and unpacking of the entire upgrade package, thereby achieving the purpose of malicious upgrade.

[0007] The purpose of the present invention is achieved through the following technical solutions.

[0008] A method for remote secure OTA upgrade of intelligent connected vehicles includes three stages: system key initialization, software upgrade package production, and vehicle-side software upgrade package download, secondary verification and upgrade. Vehicle-side software upgrade package download, secondary verification and upgrade stage: After the vehicle-mounted UC-master downloads the encrypted software upgrade package from the CDN network, it first uses its private key to decrypt the downloaded encrypted software upgrade package, and then completes the first integrity verification of the OTA software upgrade package through a digital signature algorithm. If the integrity verification of the first OTA software upgrade package passes, the current OTA software upgrade package will be decomposed into multiple software upgrade sub-packages, and a HASH operation will be performed on each software upgrade sub-package, and the HASH value of each software upgrade sub-package will be calculated in turn. Then, a Merkle tree will be constructed based on these HASH values, and the HASH value of the root of this Merkle tree will be calculated. After the software upgrade sub-package is transmitted from UC-master to ECU-UA through the gateway or domain controller, the HASH value of each software upgrade sub-package will be calculated again, and the Merkle tree will be reconstructed again based on these HASH values, and the HASH value of the root of this Merkle tree will be calculated again. The HASH value of the Merkle tree root after UC-master receives the software upgrade sub-package and the HASH value of the Merkle tree root when ECU-UA receives the software upgrade sub-package are compared to achieve the second integrity verification of the software upgrade package. If the two are equal, it means that the software upgrade subpackage has not been replaced or tampered with during the transmission process, the integrity of the upgrade package has been protected, and the normal upgrade program can be started; otherwise, it means that the software upgrade subpackage has been replaced or tampered with during the transmission process, and UC-master immediately terminates this OTA remote upgrade.

[0009] System key initialization phase: The OTA cloud service platform and the vehicle-side OTA system interact with the PKI service cloud platform to configure the key of the OTA cloud service platform to (PK2, SK1); the key of the vehicle-side OTA system is configured to (PK1, SK2), where PK1 and SK1 are the public key and private key of the OTA cloud service platform, respectively, and PK2 and SK2 are the public key and private key of the vehicle-side OTA system, respectively.

[0010] The software upgrade package production phase is used to complete the preparation of the vehicle-side software upgrade package, upload the software upgrade package to the CDN network, and form a download link URL. Specifically, the software upgrade package supplier uploads the smart connected car software upgrade package Packet to the OTA cloud service platform. The OTA cloud service platform uses the private key SK1 to digitally sign the entire software upgrade package Packet, and then uses the public key PK2 of the vehicle-side UC-master to encrypt the upgrade package Packet, the digital signature, and the HASH value of the Merkle tree root constructed according to the HASH value of the software upgrade sub-packages P1, P2, ..., Pn, and uploads the encrypted Packet to the CDN network to form a download link URL.

[0011] Download, secondary verification and upgrade phase of the vehicle-side software package: The vehicle-side UC-master downloads the encrypted software upgrade package Packet″, first decrypts Packet″ with its own private key SK2, verifies the digital signature with the public key PK1 of the OTA cloud service platform, and converts the decrypted Merkle tree root HASH value H 1n Transmitted to the comparison module through a secure channel; if the signature verification is successful, each software upgrade subpackage P1, P2, ..., Pn is transparently transmitted to the target ECU-UA through the gateway or domain controller, and then a Merkle tree is constructed based on the HASH value of the upgrade subpackage received by each ECU-UA, and the HASH value of the root of this Merkle tree is calculated And sent to the comparison module; if The second integrity verification of the software upgrade package is completed, and then the upgrade is flashed and installed on each ECU.

[0012] The specific implementation steps of the system key initialization phase include:

[0013] S1: OTA system activation, OTA cloud service platform applies for public and private key pair (PK1, SK1) from PKI service cloud platform;

[0014] S2: The PKI service cloud platform generates a public-private key pair (PK1, SK1) and returns the public-private key pair (PK1, SK1) to the OTA cloud service platform. The OTA cloud service platform saves the private key SK1 and then sends the public key PK1 to the UC-master of the vehicle-side OTA system. S3: The vehicle-side UC-master applies for a public-private key pair (PK2, SK2) from the PKI service cloud platform. The PKI cloud platform generates a public-private key pair (PK2, SK2) and sends it to the UC-master. The UC-master saves the private key SK2 and then sends the public key PK2 to the OTA cloud service platform.

[0015] The specific implementation steps of the software upgrade package production phase include:

[0016] S4: The software upgrade package supplier uploads the intelligent connected vehicle software upgrade package Packet = P (P1, P2, ..., Pn) to the OTA cloud service platform;

[0017] S5: The OTA cloud service platform performs HASH operations on the software upgrade subpackages P1, P2, ..., Pn respectively to obtain hash values ​​H1, H2, ..., Hn, then constructs a Merkle tree and calculates the hash value H of the Merkle tree root. 1n , transmit it to the encryption algorithm module;

[0018] S6: The OTA cloud service platform performs a HASH operation on the software upgrade package Packet to obtain a message digest D = H (Packet), and then encrypts the message digest D with its private key SK1 to form an encrypted digest D′ = EN SK1 (D), where EN SK1 (#) indicates that the private key SK1 is used to encrypt #, and the encrypted summary D′ is attached to the back of Packet to form a data packet Packet′=(Packet, D′), and then the public key PK2 of the vehicle-side UC-master is used to encrypt the data packets Packet′ and H′. 1n Perform encryption operations to form an encrypted data packet for upgrading software Then distribute the encrypted upgrade data packet Packet" to the CDN network;

[0019] S7: The CDN network returns a download link URL formation message. After receiving the download link URL formation message, the OTA administrator sends an upgrade command to the CDN network through the Web console.

[0020] The specific steps for downloading, re-verifying and upgrading the vehicle-side software package include:

[0021] S8: The vehicle-side UC-master downloads the upgrade software encrypted data packet Packet″ according to the download link URL;

[0022] S9: The vehicle-side UC-master uses its private key SK2 to decrypt the downloaded encrypted software upgrade package Packet″ in Denotes that the private key SK2 is used to decrypt #, and the original software upgrade package Packet = P(P1, P2, ..., Pn), the encrypted summary D', and the HASH value H of the Merkle tree root are obtained. 1n ;

[0023] S10: The vehicle-side UC-master performs signature verification on the decrypted software upgrade package Packet. The verification process is as follows: The vehicle-side UC-master first uses the public key PK1 of the OTA cloud service platform to perform a decryption operation on the encrypted summary D′ to obtain the summary of the original software upgrade package. Then perform a HASH operation on the decrypted original software upgrade package Packet to obtain the message digest D for verification * =H(Packet), then check D*? =D. If the two are equal, the first integrity verification of the software upgrade package passes; otherwise, the vehicle-side UC-master destroys the received Packet″ and terminates the upgrade process;

[0024] S11: Perform the second integrity verification of the software upgrade sub-package received by ECU-UA. The specific verification process is as follows: UC-master unpacks the original software upgrade package Packet obtained by decryption to obtain software upgrade sub-packages P1, P2, ..., Pn, and then transmits them to the ECU-UA corresponding to each ECU through the communication gateway and communication network between ECUs such as CAN bus, local area network interconnection network LIN, vehicle Ethernet, WIFI or Bluetooth. UC-master performs HASH operation on the software upgrade sub-packages P1, P2, ..., Pn received by each ECU-UA to obtain their corresponding HASH values Then according to Figure 2 Construct a Merkle tree in the manner shown and calculate the HASH value of the Merkle tree root And check If the two are not equal, it indicates that at least one of the software upgrade sub-packages P1, P2, ..., Pn has been tampered with and its integrity has been destroyed during the process of transparent transmission to the target ECU-UA through the gateway or domain controller. At this time, the ECU-UA destroys the received software upgrade sub-packages P1, P2, ..., Pn and terminates the upgrade of each ECU;

[0025] S12: If the two are equal, the second verification is passed, and UC-master upgrades and flashes each ECU to complete the upgrade operation.

[0026] A smart connected vehicle OTA remote security upgrade system includes an OTA cloud service platform, a PKI service cloud platform, and a vehicle-side OTA system, wherein the OTA cloud service platform includes an OTA service platform, a CDN file service, an OME-IT system, and a Web console, which are used to implement OEM cloud docking, vehicle model / vehicle / ECU version information management, upgrade software management, upgrade strategy creation, ECU associated upgrade configuration, upgrade mode configuration, release, etc.; the PKI service cloud platform is used to generate public and private key pairs for encryption and decryption, which are used to implement signature generation and signature verification of upgrade packages; the vehicle-side OTA system includes an OTA upgrade master control, a signature verification module, a Merkle tree construction and root HASH value calculation module, a Merkle tree root HASH value comparison module, an upgraded ECU, an inter-ECU communication gateway, and a communication network between ECUs in the vehicle.

[0027] Compared with the prior art, the advantages of the present invention are: 1) The software upgrade package downloaded by the vehicle-side UC-master from the CDN network is transmitted in an encrypted manner, which can ensure the confidentiality of sensitive information in the software upgrade package, prevent the adverse consequences caused by the leakage of sensitive information, and effectively protect the interests of car companies and software suppliers. 2) In the process of transparent transmission from the UC-master to the target ECU through the gateway or domain controller, the integrity verification of the software upgrade subpackage is realized by comparing the Merkle tree root HASH value before and after transmission. Due to the use of simple HASH operations, it can be applied to embedded ECUs with limited resources that the secondary signature algorithm cannot apply. Compared with the secondary signature scheme, this method is not only efficient and low in energy consumption, but also simpler in implementation, saving the time of vehicle-mounted software upgrade. 3) It can greatly reduce storage overhead. The secondary signature scheme creates an independent signature for each software upgrade subpackage. The Merkle tree only needs to store a Merkle root HASH value and a signature of the entire package to realize the second integrity verification of the downloaded software upgrade package, with very small storage overhead. 4) It has a high local modification efficiency. When a software upgrade subpackage is modified or a new ECU corresponding to a software upgrade subpackage is added, unlike the secondary signature scheme, which requires re-signing the software upgrade subpackages corresponding to all ECUs, only the HASH values ​​of the affected related nodes need to be recalculated, and the efficiency of local modification is higher. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] Figure 1 It is a flow chart of the present invention.

[0029] Figure 2 The figure is a diagram of the system composition and working principle of the present invention.

[0030] Figure 3This is a schematic diagram of Merkle tree construction and root HASH value calculation when the number of software upgrade subpackages is an even number (taking 4 upgrade subpackages as an example).

[0031] Figure 4 This is a schematic diagram of Merkle tree construction and root HASH value calculation when the number of software upgrade subpackages is an odd number (taking 5 upgrade subpackages as an example). DETAILED DESCRIPTION

[0032] The present invention is described in detail below in conjunction with the accompanying drawings and specific embodiments.

[0033] like Figure 1 As shown, a method for remote secure OTA upgrade of intelligent connected vehicles includes three stages: system key initialization, software upgrade package production, and vehicle-side software package download, secondary verification and upgrade. After the vehicle-mounted UC-master downloads the encrypted software upgrade package from the CDN network, it first uses its private key to decrypt the downloaded encrypted software upgrade package, and then completes the first integrity verification of the OTA software upgrade package through the digital signature algorithm. If the first integrity verification of the OTA software upgrade package passes, the current OTA software upgrade package is decomposed into multiple software upgrade sub-packages, and each software upgrade sub-package is hashed, and the HASH value of each software upgrade sub-package is calculated in turn, and then a Merkle tree is constructed based on these HASH values, and the HASH value of the root of this Merkle tree is calculated. When the software upgrade sub-package is transmitted from UC-master to ECU-UA through the gateway or domain controller, the HASH value of each software upgrade sub-package is calculated again, and the Merkle tree is reconstructed again based on these HASH values, and the HASH value of the root of this Merkle tree is calculated. The HASH value of the Merkle tree root after UC-Master receives the software upgrade sub-package is compared with the HASH value of the Merkle tree root of the software upgrade sub-package received by ECU-UA to achieve the second integrity verification. If the two are equal, it means that the sub-upgrade data package has not been replaced or tampered with during the transmission process, the integrity of the upgrade package has been protected, and the normal upgrade program can be started; otherwise, it means that the software upgrade sub-package has been replaced or tampered with during the transmission process, and UC-master immediately terminates this OTA remote upgrade.

[0034] System key initialization phase: The OTA cloud service platform and the vehicle-side OTA system interact with the PKI service cloud platform to configure the key of the OTA cloud service platform to (PK2, SK1); the key of the vehicle-side OTA system is configured to (PK1, SK2), where PK1 and SK1 are the public key and private key of the OTA cloud service platform, respectively, and PK2 and SK2 are the public key and private key of the vehicle-side OTA system, respectively.

[0035] The software upgrade package production phase is used to complete the preparation of the vehicle-side software upgrade package, upload the software upgrade package to the CDN network, and form a download link URL. Specifically, the software upgrade package supplier uploads the smart connected car software upgrade package Packet to the OTA cloud service platform. The OTA cloud service platform uses the private key SK1 to digitally sign the entire software upgrade package Packet, and then uses the public key PK2 of the vehicle-side UC-master to encrypt the upgrade package Packet, signature, and the HASH value of the Merkle tree root constructed according to the HASH value of the software upgrade sub-packages P1, P2, ..., Pn, and uploads the encrypted Packet" to the CDN network to form a download link URL.

[0036] Download, secondary verification and upgrade phase of the vehicle-side software package: The vehicle-side UC-master downloads the encrypted software upgrade package Packet″, first decrypts Packet″ with its own private key SK2, verifies the signature with the public key PK1 of the OTA cloud service platform, and then sends the decrypted Merkle tree root HASH value H 1n Transmitted to the comparison module through a secure channel; if the signature verification is successful, each software upgrade subpackage P1, P2, ..., Pn is transparently transmitted to the target ECU-UA through the gateway or domain controller, and then a Merkle tree is constructed based on the HASH value of the upgrade subpackage received by each ECU-UA, and the HASH value of the root of this Merkle tree is calculated And sent to the comparison module. The second integrity verification of the software upgrade subpackage is completed, and then the upgrade is flashed and installed on each ECU.

[0037] Compared with the above-mentioned secondary signature verification scheme, the Merkle tree can efficiently realize the second integrity verification of the software upgrade subpackage, which has four obvious advantages. 1) The software upgrade package downloaded by the vehicle-side UC-master from the CDN network is transmitted in an encrypted manner, which can ensure the confidentiality of sensitive information in the software upgrade package, prevent the adverse consequences caused by the leakage of sensitive information, and effectively protect the interests of car companies and software suppliers. 2) In the process of transparent transmission from the UC-master to the target ECU through the gateway or domain controller, the integrity verification of the software upgrade subpackage is realized by comparing the Merkle tree root HASH value before and after transmission. Due to the use of simple HASH operations, it can be applied to embedded ECUs with limited resources that the secondary signature algorithm cannot apply. Compared with the secondary signature scheme, this method is not only efficient and low in energy consumption, but also simpler to implement, saving the time of vehicle software upgrade. 3) It can greatly reduce storage overhead. The secondary signature scheme creates a signature for each software upgrade subpackage independently. The Merkle tree only needs to store a Merkle root HASH value and a signature of the entire package to realize the second integrity verification of the downloaded software upgrade package, with very small storage overhead. 4) It has high local modification efficiency. When a software upgrade subpackage is modified or a new ECU corresponding to a software upgrade subpackage is added, unlike the secondary signature scheme, which requires re-signing the software upgrade subpackages corresponding to all ECUs, it only needs to recalculate the HASH value of the affected related nodes, and the local modification efficiency is high.

[0038] The specific implementation steps of the system key initialization phase include:

[0039] S1: OTA system activation, OTA cloud service platform applies for public and private key pair (PK1, SK1) from PKI service cloud platform;

[0040] S2: The PKI service cloud platform generates a public-private key pair (PK1, SK1) and returns the public-private key pair (PK1, SK1) to the OTA cloud service platform. The OTA cloud service platform saves the private key SK1 and then sends the public key PK1 to the UC-master of the vehicle-side OTA system.

[0041] S3: The vehicle-side UC-master applies for a public-private key pair (PK2, SK2) from the PKI service cloud platform. The PKI cloud platform generates a public-private key pair (PK2, SK2) and sends it to the UC-master. The UC-master saves the private key SK2 and then sends the public key PK2 to the OTA cloud service platform.

[0042] The specific implementation steps of the software upgrade package production phase include:

[0043] S4: The software upgrade package supplier uploads the intelligent connected vehicle software upgrade package Packet = P (P1, P2, ..., Pn) to the OTA cloud service platform;

[0044] S5: The OTA cloud service platform performs HASH operations on the software upgrade subpackages P1, P2, ..., Pn respectively to obtain hash values ​​H1, H2, ..., Hn, then constructs a Merkle tree and calculates the hash value H of the Merkle tree root. 1n , transmit it to the encryption algorithm module;

[0045] S6: The OTA cloud service platform performs a HASH operation on the software upgrade package Packet to obtain a message digest D = H (Packet), and then encrypts the message digest D with its private key SK1 to form an encrypted digest in It indicates that the private key SK1 is used to encrypt #, and the encrypted summary D′ is attached to the back of Packet to form a data packet Packet′=(Packet, D′), and then the public key PK2 of the vehicle-side UC-master is used to encrypt the data packets Packet′ and H 1n Perform encryption operations to form an encrypted software upgrade package Then distribute the encrypted software upgrade package Packet" to the CDN network;

[0046] S7: The CDN network returns a download link URL formation message. After receiving the download link URL formation message, the OTA administrator sends an upgrade command to the CDN network through the Web console.

[0047] The specific steps for downloading, re-verifying and upgrading the vehicle-side software package include:

[0048] S8: The vehicle-side UC-master downloads the upgrade software encrypted data packet Packet″ according to the download link URL;

[0049] S9: The vehicle-side UC-master uses its private key SK2 to decrypt the encrypted data packet Packet″ of the downloaded upgrade software in Denotes that the private key SK2 is used to decrypt #, and the original software upgrade package Packet = P(P1, P2, ..., Pn), the encrypted summary D', and the HASH value H of the Merkle tree root are obtained. 1n ;

[0050] S10: The vehicle-side UC-master performs signature verification on the decrypted software upgrade package Packet. The verification process is as follows: The vehicle-side UC-master first uses the public key PK1 of the OTA cloud service platform to perform a decryption operation on the encrypted summary D′ to obtain the summary of the original software upgrade package. Then perform a HASH operation on the decrypted original software upgrade package Packet to obtain the message digest D for verification * =H(Packet), then check D*? =D. If the two are equal, the first integrity verification of the software upgrade package passes; otherwise, the vehicle-side UC-master destroys the received encrypted software upgrade package Packet″ and terminates the upgrade process;

[0051] S11: Perform the second integrity verification of the software upgrade sub-package received by ECU-UA. The specific verification process is as follows: UC-master unpacks the original software upgrade package Packet obtained by decryption to obtain software upgrade sub-packages P1, P2, ..., Pn, and then transmits them to the ECU-UA corresponding to each ECU through the communication gateway and communication network between ECUs such as CAN bus, local area network interconnection network LIN, vehicle Ethernet, WIFI or Bluetooth. UC-master performs HASH operation on the software upgrade sub-packages P1, P2, ..., Pn received by each ECU-UA to obtain their corresponding HASH values. Then according to Figure 2 Construct a Merkle tree in the manner shown and calculate the HASH value of the Merkle tree root And check If the two are not equal, it indicates that at least one of the sub-upgrade packages P1, P2, ..., Pn has been tampered with and its integrity has been destroyed during the process of transparent transmission to the target ECU-UA through the gateway or domain controller. At this time, the ECU-UA destroys the received sub-upgrade packages P1, P2, ..., Pn and terminates the upgrade of each ECU;

[0052] S12: If the two are equal, the second integrity verification is passed, and UC-master upgrades and flashes each ECU to complete the upgrade operation.

[0053] like Figure 2As shown, an OTA remote security upgrade system for intelligent connected vehicles includes an OTA cloud service platform, a PKI service cloud platform, and a vehicle-side OTA system, wherein the OTA cloud service platform includes an OTA service platform, a CDN file service, an OME-IT system, and a Web console, which are used to realize OEM cloud docking, vehicle model / vehicle / ECU version information management, upgrade software management, upgrade strategy creation, ECU associated upgrade configuration, upgrade mode configuration, and release; the PKI service cloud platform is used to generate public and private key pairs for encryption and decryption, which are used to realize signature generation and signature verification of the upgrade package; the vehicle-side OTA system includes an OTA upgrade master control, a signature verification module, a Merkle tree construction and root HASH value calculation module, a Merkle tree root HASH value comparison module, an upgraded ECU, an inter-ECU communication gateway, and a communication network between ECUs in the vehicle.

[0054] like Figure 3 and 4 As shown in the figure, when the vehicle-side UC-master receives the software upgrade package from the CDN network, it first performs signature verification to verify the legitimacy and integrity of the received software upgrade package. If the signature verification fails, it means that the software upgrade package has been tampered with or forged during transmission to the vehicle-side UC-master, and the unpacking and upgrade work is terminated immediately; if the signature verification passes, the vehicle-side UC-master starts unpacking and unpacks the upgrade package P into P1, P2, ..., Pn. After the software upgrade sub-package is transmitted to the ECU-UA, the HASH value of each software upgrade sub-package is calculated respectively, and a Merkle tree is constructed based on these HASH values, and the HASH value of the Merkle tree root is calculated.

[0055] from Figure 3 and 4 It can be seen that as long as any of the software upgrade sub-packages P1, P2, ..., Pn is tampered with or forged, the HASH value of the parent node, grandparent node, ... of the upper layer will change, and eventually the HASH value of the root of this Merkle tree will change. The on-board UC-master transmits the unpacked software upgrade sub-packages P1, P2, ..., Pn to the ECU-UA (UCE Update Agent) corresponding to each ECU through the communication gateway and communication network between ECUs such as CAN bus, local area network interconnection network LIN, vehicle Ethernet or other technologies (WIFI or Bluetooth). Then, UC-master calculates the HASH value of the software upgrade sub-packages that arrive at ECU-UA in the same order, and builds the Merkle tree and calculates the HASH value of the Merkle tree root in the same way as before, preparing for the integrity verification of the ECU software upgrade sub-packages.

Claims

1. A method for remote security upgrade of OTA of intelligent connected vehicles, characterized in that It includes three stages: system key initialization, software upgrade package production, and vehicle-side software package download, secondary verification and upgrade. After the vehicle-mounted UC-master downloads the OTA software upgrade package from the CDN network, it first uses its private key to decrypt the received OTA software upgrade package, and then performs the first integrity verification on the OTA software upgrade package through the digital signature algorithm. If the integrity verification of the OTA software upgrade package passes, the current OTA software upgrade package is decomposed into multiple software upgrade sub-packages, and each software upgrade sub-package is hashed, and the HASH value of each software upgrade sub-package is calculated in turn, and then a Merkle tree is constructed based on these HASH values, and the root of this Merkle tree is calculated After the software upgrade subpackage is transmitted from UC-master to ECU-UA through the gateway or domain controller, the HASH value of each software upgrade subpackage is calculated again, and the Merkle tree is reconstructed again based on these HASH values, and the HASH value of the root of this Merkle tree is calculated. The HASH value of the Merkle tree root after UC-Master receives the software upgrade subpackage is compared with the HASH value of the Merkle tree root after ECU-UA receives the software upgrade subpackage to achieve the second integrity verification. If the two are equal, it means that the software upgrade subpackage has not been replaced or tampered with during the transmission process, the integrity of the upgrade package has been protected, and the normal upgrade program can be started; Otherwise, it indicates that the software upgrade subpackage has been replaced or tampered with during the transmission process, and UC-master immediately terminates this OTA remote upgrade; The software upgrade package production phase is used to complete the preparation of the vehicle-side software upgrade package, upload the software upgrade package to the CDN network, and form a download link URL. Specifically, the software upgrade package supplier uploads the smart connected car software upgrade package Packet to the OTA cloud service platform. The OTA cloud service platform uses its private key SK1 to sign the entire software upgrade package Packet, and then uses the vehicle-side UC-master's public key PK2 to encrypt the upgrade package Packet, signature, and the HASH value of the Merkle tree root constructed according to the HASH value of the software upgrade sub-packages P1, P2, ..., Pn, and uploads the encrypted value to the CDN network to form a download link URL; Download, secondary verification and upgrade phase of the vehicle-side software package: The vehicle-side UC-master downloads the OTA software upgrade package Packet″, first decrypts Packet″ with its own private key SK2, verifies the signature with the public key PK1 of the OTA cloud service platform, and decrypts the Merkle tree root HASH value obtained by decryption 1n transmitting to the comparison module via a secure channel; If the signature verification is successful, each software upgrade subpackage P1, P2, ..., Pn is transparently transmitted to the target ECU-UA through the gateway or domain controller, and then a Merkle tree is constructed based on the HASH value of the upgrade subpackage received by each ECU-UA, and the HASH value of the root of this Merkle tree is calculated. And sent to the comparison module; if If the second integrity verification of the software upgrade subpackage is passed, each ECU is then upgraded and flashed and installed; The specific implementation steps of the software upgrade package production phase include: S4: The software upgrade package supplier uploads the intelligent connected vehicle software upgrade package Packet = P (P1, P2, ..., Pn) to the OTA cloud service platform; S5: The OTA cloud service platform performs HASH operations on the software upgrade subpackages P1, P2, ..., Pn respectively to obtain hash values ​​H1, H2, ..., Hn, and then constructs a Merkle tree based on these HASH values, calculates the hash value H1n of the Merkle tree root, and transmits it to the encryption algorithm module; S6: The OTA cloud service platform performs a HASH operation on the software upgrade package Packet to obtain a message digest D = H (Packet), and then encrypts the message digest D with its private key SK1 to form an encrypted digest D′ = EN SK1 (D), where EN SK1 (#) indicates that the private key SK1 is used to encrypt #, and the encrypted summary D′ is attached to the back of Packet to form a data packet Packet′=(Packet , D′), and then use the public key PK2 of the vehicle-side UC-Master to encrypt the data packets Packet′ and H 1n Perform encryption operations to form an encrypted data packet for upgrading software Then the encrypted upgrade data packet "Packet" is distributed to the CDN network.

2. The method for remote secure OTA upgrade of an intelligent connected vehicle according to claim 1, characterized in that System key initialization phase: The OTA cloud service platform and the vehicle-side OTA system interact with the PKI service cloud platform to configure the key of the OTA cloud service platform to (PK2, SK1); the key of the vehicle-side OTA system is configured to (PK1, SK2), where PK1 and SK1 are the public key and private key of the OTA cloud service platform, respectively, and PK2 and SK2 are the public key and private key of the vehicle-side OTA system, respectively.

3. A method for remote security upgrade of OTA of an intelligent connected vehicle according to claim 1 or 2, characterized in that The specific implementation steps of the system key initialization phase include: S1: OTA system activation, OTA cloud service platform applies for public and private key pair (PK1, SK1) from PKI service cloud platform; S2: The PKI service cloud platform generates a public-private key pair (PK1, SK1) and returns the public-private key pair (PK1, SK1) to the OTA cloud service platform. The OTA cloud service platform saves the private key SK1 and then sends the public key PK1 to the UC-master of the vehicle-side OTA system. S3: The vehicle-side UC-master applies for a public-private key pair (PK2, SK2) from the PKI service cloud platform. The PKI cloud platform generates a public-private key pair (PK2, SK2) and sends it to the UC-master. The UC-master saves the private key SK2 and then sends the public key PK2 to the OTA cloud service platform. S7: The CDN network returns a download link URL formation message. After receiving the download link URL formation message, the OTA administrator sends an upgrade command to the CDN network through the Web console.

4. The method for remote security upgrade of an intelligent connected vehicle OTA according to claim 1, characterized in that The specific steps for downloading, re-verifying and upgrading the vehicle-side software package include: S8: The vehicle-side UC-master downloads the upgrade software encrypted data packet Packet″ according to the download link URL; S9: The vehicle-side UC-master uses its private key SK2 to decrypt the downloaded upgrade software encrypted data packet Packet″ in Denotes that the private key SK2 is used to decrypt #, and the original software upgrade package Packet = P(P1, P2, ..., Pn), the encrypted summary D', and the HASH value H of the Merkle tree root are obtained. 1n ; S10: The vehicle-side UC-master performs signature verification on the decrypted software upgrade package Packet. The verification process is as follows: The vehicle-side UC-master first uses the public key PK1 of the OTA cloud service platform to perform a decryption operation on the encrypted summary D′ to obtain the summary of the original software upgrade package. Then perform a HASH operation on the decrypted original software upgrade package Packet to obtain the message digest D*=H(Packet) for verification, and then check D * ? =D, if the two are equal, the first integrity verification of the software upgrade package passes; otherwise, the vehicle-side UC-master destroys the received Packet″ and terminates the upgrade process; S11: Perform integrity verification of the software upgrade sub-package received by ECU-UA to complete the second integrity verification. The specific verification process is as follows: UC-master unpacks the original software upgrade package Packet obtained by decryption to obtain software upgrade sub-packages P1, P2, ..., Pn, and then transmits them to the ECU-UA corresponding to each ECU through the communication gateway and communication network between ECUs such as CAN bus, local area network interconnection network LIN, vehicle Ethernet, WIFI or Bluetooth. UC-master performs HASH operation on the software upgrade sub-packages P1, P2, ..., Pn received by each ECU-UA to obtain their corresponding HASH values Then construct the Merkle tree according to the method shown in Figure 2 and calculate the HASH value of the Merkle tree root And check If the two are not equal, it indicates that at least one of the sub-upgrade packages P1, P2, ..., Pn has been tampered with and its integrity has been destroyed during the process of transparent transmission to the target ECU-UA through the gateway or domain controller. At this time, the ECU-UA destroys the received sub-upgrade packages P1, P2, ..., Pn and terminates the upgrade of each ECU; S12: If the two are equal, the second integrity verification is passed, and UC-master upgrades and flashes each ECU to complete the upgrade operation.

5. An OTA remote security upgrade system for intelligent connected vehicles, characterized in that A method for remote secure OTA upgrade of a smart connected vehicle for implementing any of claims 1-4, comprising an OTA cloud service platform, a PKI service cloud platform, and a vehicle-side OTA system, wherein the OTA cloud service platform comprises an OTA service platform, a CDN file service, an OME-IT system, and a Web console, which are used to implement OEM cloud docking, vehicle model / vehicle / ECU version information management, upgrade software management, upgrade strategy creation, ECU associated upgrade configuration, upgrade mode configuration, and release, etc.; the PKI service cloud platform is used to generate public and private key pairs for encryption and decryption, which are used to implement signature generation and signature verification of the upgrade package; the vehicle-side OTA system comprises an OTA upgrade master control, a signature verification module, a Merkle tree construction and root HASH value calculation module, a Merkle tree root HASH value comparison module, an upgraded ECU, an inter-ECU communication gateway, and an in-vehicle ECU communication network.

Images