Electronic control unit flashing method, device, equipment and storage medium

Abstract

An embodiment of the present invention provides an electronic control unit flashing method, device, equipment and storage medium, including: obtaining a file to be flashed, a first random number generated by a flashing tool and a first encrypted ciphertext generated based on the first random number, a second random number generated by an electronic control unit, dividing the file to be flashed into blocks according to a preset rule, generating at least one target block file, generating a first hash value for first verification data through a flashing tool, and sending the first verification data to the electronic control unit, the first verification data including the target block file, the first random number, the second random number and the first encrypted ciphertext, receiving a second hash value for the first verification data returned by the electronic control unit, and comparing the second hash value with the first hash value, and determining the flashing strategy of the electronic control unit according to the comparison result. The embodiment of the present invention realizes monitoring of the transmission process, while increasing the difficulty for attackers to tamper with data, thereby ensuring the security of flashing.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to an electronic control unit flashing method, device, equipment and storage medium. Background Art

[0002] As the degree of automobile electrification increases, the role of ECU (Electronic Control Unit) in vehicles is becoming more and more important. ECU achieves function upgrade and optimization by flashing programs, and the security of flashing is crucial. If the flashing process is maliciously attacked, it may cause ECU function failure and even cause safety hazards to the vehicle.

[0003] Existing solutions mainly protect the flashed data through hardware encryption or software encryption. For example, some solutions use symmetric encryption or asymmetric encryption to encrypt the flashed data for transmission to prevent the data from being intercepted and tampered with. Some solutions use digital signatures to perform integrity checks on the flashed data to prevent data tampering.

[0004] However, the encryption method used in the above solution is relatively simple and easy to be cracked, and it only relies on static verification before flashing. It lacks real-time monitoring of data integrity during transmission and cannot promptly detect data tampering during transmission. The firmware flashed into the ECU may be damaged because the data is modified during transmission. Summary of the invention

[0005] The purpose of the embodiments of the present invention is to provide an electronic control unit flashing method, device, equipment and storage medium to solve the problem that the existing electronic control unit flashing adopts a relatively simple encryption method that is easy to be cracked, and only relies on static verification before flashing, lacks real-time monitoring of data integrity during transmission, and cannot timely detect data tampering during transmission. The firmware flashed into the ECU may be damaged because the data is modified during transmission. The specific technical solution is as follows:

[0006] In a first aspect of the present invention, a method for flashing an electronic control unit is provided, wherein the method comprises:

[0007] Obtain a file to be flashed, a first random number generated by a flashing tool and a first encrypted ciphertext generated based on the first random number, and a second random number generated by an electronic control unit;

[0008] Divide the file to be flashed into blocks according to a preset rule to generate at least one target block file;

[0009] Generate a first hash value for first verification data by a flashing tool, and send the first verification data to an electronic control unit, wherein the first verification data includes a target block file, the first random number, the second random number, and the first encrypted ciphertext;

[0010] receiving a second hash value of the first verification data returned by the electronic control unit, and comparing the second hash value with the first hash value;

[0011] The flashing strategy of the electronic control unit is determined according to the comparison result.

[0012] Optionally, before obtaining the flash file of the firmware to be flashed, the first random number generated by the flash tool and the first encrypted ciphertext generated based on the first random number, and the second random number generated by the electronic control unit, the process further includes:

[0013] Setting a first encryption key for the flashing tool and a second encryption key for the electronic control unit, wherein the first encryption key includes a first public key and a first private key, and the second encryption key includes a second public key and a second private key;

[0014] Encrypting the first random number based on a first private key held by the flashing tool to generate a first encrypted ciphertext;

[0015] sending the first encrypted ciphertext to the electronic control unit through an initial communication channel;

[0016] The electronic control unit decrypts the first encrypted ciphertext using the first public key to obtain a first plaintext;

[0017] Encrypting the second random number based on a second private key held by the electronic control unit to generate a second encrypted ciphertext;

[0018] sending the second encrypted ciphertext to the flashing tool through an initial communication channel;

[0019] The flashing tool decrypts the second encrypted ciphertext by using the second public key to obtain a second plaintext;

[0020] If the first plaintext is consistent with the first random number and the second plaintext is consistent with the second random number, it is determined that the initial communication channel is a secure communication channel.

[0021] Optionally, before dividing the file to be flashed into blocks according to a preset rule to generate at least one target block file, the method further includes:

[0022] Generate a target hash value for second verification data by the flashing tool, where the second verification data includes the file to be flashed, the first random number, the second random number, and the first encrypted ciphertext;

[0023] sending the second verification data to an electronic control unit;

[0024] Receiving a third hash value of the second verification data returned by the electronic control unit;

[0025] Comparing the third hash value with the target hash value;

[0026] If the comparison result is consistent, the electronic control unit is controlled to continue flashing.

[0027] Optionally, determining the flashing strategy of the electronic control unit according to the comparison result includes:

[0028] If the second hash value is consistent with the first hash value, the flashing tool sends a flashing instruction through a secure communication channel;

[0029] In response to the flashing instruction, executing a flashing operation by the electronic control unit;

[0030] If the second hash value is inconsistent with the first hash value, the flashing tool sends a stop flashing instruction through a secure communication channel;

[0031] In response to the stop flashing instruction, the flashing operation is interrupted by the electronic control unit.

[0032] Optionally, before generating a first hash value for the first verification data by using a flashing tool and sending the first verification data to the electronic control unit, the method further includes:

[0033] Obtaining target parameters regarding the operating state of the electronic control unit, the target parameters including central processing unit load, memory usage and temperature;

[0034] When it is determined that the CPU load is less than a first preset value, the memory usage is less than a second preset value, and the temperature is less than a third preset value, a first random number threshold range is generated, wherein the first preset value, the second preset value, and the third preset value are initial thresholds of the target parameter;

[0035] Control the first random number generated by the flash writing tool and the second random number generated by the electronic control unit to be within the first random number threshold range;

[0036] When it is determined that the CPU load is greater than a first preset value, the memory usage is greater than a second preset value, or the temperature is greater than a third preset value, generating a second random number threshold range;

[0037] The first random number generated by the flash writing tool and the second random number generated by the electronic control unit are controlled to be within the second random number threshold range.

[0038] Optionally, the sending the first verification data to an electronic control unit further includes:

[0039] When it is determined that the first random number and the second random number are within the first random number threshold range, increasing the initial threshold of the target parameter, and sending the first verification data to an electronic control unit;

[0040] When it is determined that the first random number and the second random number are within the second random number threshold range, the initial threshold of the target parameter is reduced, and the transmission rate of sending the first verification data to the electronic control unit is reduced or the transmission is suspended.

[0041] In a second aspect of the present invention, there is also provided an electronic control unit flashing device, characterized in that it comprises:

[0042] A first acquisition module, used to acquire a file to be flashed, a first random number generated by a flashing tool and a first encrypted ciphertext generated based on the first random number, and a second random number generated by an electronic control unit;

[0043] A first generating module, configured to divide the file to be flashed into blocks according to a preset rule, and generate at least one target block file;

[0044] A second generating module, configured to generate a first hash value of first verification data by a flashing tool, and send the first verification data to an electronic control unit, wherein the first verification data includes a target block file, the first random number, the second random number, and the first encrypted ciphertext;

[0045] A first receiving module, configured to receive a second hash value of the first verification data returned by the electronic control unit, and compare the second hash value with the first hash value;

[0046] The first determination module is used to determine the flashing strategy of the electronic control unit according to the comparison result.

[0047] In a third aspect of the implementation of the present invention, there is also provided a communication device, comprising: a transceiver, a memory, a processor, and a program stored in the memory and executable on the processor;

[0048] The processor is used to read the program in the memory to implement any of the above-mentioned electronic control unit flashing methods.

[0049] In a fourth aspect of the present invention, a computer-readable storage medium is provided, wherein instructions are stored in the computer-readable storage medium, and when the computer-readable storage medium is run on a computer, the computer executes any of the electronic control unit flashing methods described above.

[0050] A fifth aspect of an embodiment of the present application provides a vehicle, comprising: the above-mentioned electronic control unit flashing device.

[0051] The electronic control unit flashing method provided by the embodiment of the present invention obtains a file to be flashed, a first random number generated by a flashing tool and a first encrypted ciphertext generated based on the first random number, and a second random number generated by the electronic control unit; divides the file to be flashed into blocks according to a preset rule to generate at least one target block file, and by dividing the file to be flashed into blocks, it is possible to monitor the transmission process of the file to be flashed, and timely discover data tampering problems during the transmission process, and then generate a first hash value for first verification data through the flashing tool, and send the first verification data to the electronic control unit, the first verification data including the target block file, the first random number, the second random number and the first encrypted ciphertext; receives a second hash value for the first verification data returned by the electronic control unit, and compares the second hash value with the first hash value; determines the flashing strategy of the electronic control unit according to the comparison result, and in addition to the target block file itself, additional verification data is added to increase the tampering risk of an attacker The difficulty of data tampering is that the attacker not only needs to modify the firmware data, but also needs to ensure that the embedded ciphertext and random number information are consistent with expectations. The embodiment of the present invention can realize real-time monitoring of data integrity during the transmission process by transmitting the file to be flashed in blocks, and can also promptly detect data tampering during the transmission process, thereby avoiding damage to the firmware flashed into the ECU due to modification of the data during transmission. When setting encryption, additional verification information is added, which increases the difficulty for attackers to tamper with the data, and further ensures the security of data transmission. In addition, the embodiment of the present invention also adds a two-way identity authentication process for the flashing tool and the electronic control unit, and establishes a secure communication channel based on this, thereby ensuring the security of data transmission through the secure communication channel. Furthermore, the embodiment of the present invention also pauses / resumes the flashing or adjusts the transmission rate according to the operating status of the electronic control unit to ensure that the flashing process is carried out within the safe operating range of the ECU to prevent flashing failure or damage to the ECU due to overload. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for describing the embodiments or the prior art are briefly introduced below.

[0053] Figure 1 A flowchart of a method for flashing an electronic control unit provided by an embodiment of the present invention;

[0054] Figure 2 A flowchart of another method for flashing an electronic control unit provided by an embodiment of the present invention;

[0055] Figure 3 A flowchart of another method for flashing an electronic control unit provided by an embodiment of the present invention;

[0056] Figure 4 It is a structural schematic diagram of an electronic control unit flashing device provided by an embodiment of the present invention;

[0057] Figure 5 It is a structural diagram of a communication device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0058] To make the purpose, technical scheme and advantages of the embodiments of the present invention clearer, the embodiments of the present invention will be described in detail below in conjunction with the accompanying drawings. However, it will be appreciated by those skilled in the art that in the embodiments of the present invention, many technical details are proposed in order to enable the reader to better understand the present application. However, even without these technical details and various changes and modifications based on the following embodiments, the technical scheme claimed in the present application can be implemented. The division of the following embodiments is for the convenience of description, and should not constitute any limitation on the specific implementation of the present invention. The various embodiments can be combined and referenced with each other without contradiction.

[0059] Reference Figure 1 , shows a flowchart of the steps of a flashing method for an electronic control unit provided by an embodiment of the present invention, the method may include:

[0060] Step 101, obtaining a file to be flashed, a first random number generated by a flashing tool and a first encrypted ciphertext generated based on the first random number, and a second random number generated by an electronic control unit.

[0061] In the embodiment of the present invention, the first encrypted ciphertext generated based on the first random number is generated by encrypting with the exclusive private key held by the flashing tool. The generation of the first random number and the second random number will be restricted according to the current state of the electronic control unit, but the specific value will not be restricted. Only a range will be set. For example, when the operating state of the electronic control unit is good, a range of [50-100] is set. The generated first random number and second random number need to randomly select a number from this range, which can be 56, 66, 84, etc. The specific value is not specifically limited in the present invention.

[0062] Step 102: divide the file to be flashed into blocks according to a preset rule to generate at least one target block file.

[0063] The preset rule in the embodiment of the present invention is used to specify the block size of the file to be flushed. For example, it is specified that the file to be flushed is divided into data blocks of 1KB in size, and one 1KB data block corresponds to one target block file.

[0064] It should be noted that before the file to be flashed is divided into blocks, the integrity of the file to be flashed will be verified first. If the file to be flashed has not been tampered with, it will be transmitted in blocks, so as to achieve the purpose of monitoring the data transmission process. When the integrity of the file to be flashed is verified, in addition to verifying the flashing file (including firmware data) itself, in order to increase the difficulty of tampering by attackers, the first random number, the second random number and the first encrypted ciphertext are used as additional inputs to calculate the hash value together. The process includes: the flashing tool first generates a target hash value as the correct hash value H based on the file to be flashed, the first random number, the second random number and the first encrypted ciphertext, and then sends the file to be flashed, the first random number, the second random number and the first encrypted ciphertext to the electronic control unit. The electronic control unit calculates the third hash value G based on the received information, returns the third hash value to the flashing tool, and compares it with the target hash value. If they are consistent, it indicates that it has not been tampered with during the transmission process. The specific execution steps include:

[0065] Generate a target hash value for second verification data by using a flashing tool, where the second verification data includes a file to be flashed, a first random number, a second random number, and a first encrypted ciphertext;

[0066] sending the second verification data to the electronic control unit;

[0067] receiving a third hash value of the second verification data returned by the electronic control unit;

[0068] comparing the third hash value with the target hash value;

[0069] If the comparison results are consistent, the electronic control unit is controlled to continue flashing.

[0070] The above verification process shows that the file to be flashed has not been tampered with. At this time, the flashing can continue. If the comparison result is inconsistent, the flashing is stopped. By adding additional input for verification, even if attackers try to tamper with the firmware data, if they cannot simultaneously forge the original information corresponding to the first random number, the second random number and the first encrypted ciphertext, the hash value verification will fail, thereby enhancing the robustness of the firmware integrity check. The firmware integrity check performs strict hash value comparison on the firmware data before and after flashing, and monitors the hash value of the data block during the transmission process in real time. It can detect and prevent any form of data tampering in a timely manner, ensure that the flashed firmware has not been illegally modified, and maintain the software integrity of the vehicle's core system.

[0071] Step 103: Generate a first hash value for the first verification data by using a flashing tool, and send the first verification data to the electronic control unit.

[0072] In the embodiment of the present invention, the first verification data includes a target block file, a first random number, a second random number and a first encrypted ciphertext. The transmission process is monitored by dividing the file to be flashed into blocks, and the target block files are required to be transmitted in sequence according to the order in the file to be flashed. Each transmission will include a target block file, a first random number, a second random number and a first encrypted ciphertext, and for subsequent verification, the flashing tool needs to calculate the corresponding hash value before sending the first verification data. In addition, in order to avoid data loss and for counting, after calculating the first hash value of each transmission, it will be accumulated with the previously calculated hash value.

[0073] For example, there are three target block files to be transmitted, namely target block files 1 to 3, and the target block file 2 is currently being transmitted. The calculated first hash value is 4, and the first hash value of the target block file 1 that has been transmitted is 3. The cumulative hash value obtained at this time is 3+4=7. It should be noted that the values ​​at this time can be changed according to actual conditions, and the present invention does not make specific limitations here.

[0074] Step 104: Receive a second Hash value related to the first verification data returned by the electronic control unit, and compare the second Hash value with the first Hash value.

[0075] In the embodiment of the present invention, the flashing tool sends the first verification data to the electronic control unit, and the electronic control unit calculates according to the received data to generate a second hash value, and then sends the second hash value to the flashing tool, so that the flashing tool compares the returned second hash value with the first hash value, and includes the hash values ​​of the first random number, the second random number and the first encrypted ciphertext in the verification range. In this way, even if an attacker tampers with a certain data block, the tampering behavior is easier to be discovered in time because the ciphertext and random number information are also verified.

[0076] It should be noted that the flashing tool will calculate the cumulative hash value when calculating the hash value, so the electronic control unit will also generate a second hash value, accumulate it, and then return the cumulative hash value while returning the second hash value. The two returned hash values ​​are compared to further determine the integrity of the data transmission.

[0077] Step 105 , determining the flashing strategy of the electronic control unit according to the comparison result.

[0078] There are two kinds of comparison results in the embodiment of the present invention. One is that the comparison results are consistent. At this time, it is considered that the target block file in the transmitted first verification data has not been tampered with. At this time, the electronic control unit can perform flashing according to the target block file. The other is that the comparison results are inconsistent. At this time, it is considered that the transmitted first verification data has been tampered with. At this time, the flashing operation needs to be interrupted. The specific execution steps include:

[0079] If the second hash value is consistent with the first hash value, the flashing tool sends a flashing instruction through a secure communication channel;

[0080] In response to the flashing instruction, executing the flashing operation by the electronic control unit;

[0081] If the second hash value is inconsistent with the first hash value, the flashing tool sends a stop flashing instruction through a secure communication channel;

[0082] In response to the stop flashing instruction, the flashing operation is interrupted by the electronic control unit.

[0083] It should be noted that after sending a stop command through the secure channel to interrupt the flashing operation, a trigger alarm can also be set to indicate that the staff may have tampered with the data transmission at this time. The flashing tool and the electronic control unit should then use the established secure channel to negotiate a recovery strategy, such as re-authentication, re-transmitting the file to be flashed (including firmware data), etc., which greatly shortens the troubleshooting and recovery time and improves the system's availability and maintenance efficiency.

[0084] The electronic control unit flashing method provided by the embodiment of the present invention obtains a file to be flashed, a first random number generated by a flashing tool, a second random number generated by an electronic control unit, and a first encrypted ciphertext generated based on the first random number; divides the file to be flashed into blocks according to a preset rule to generate at least one target block file, and by dividing the file to be flashed into blocks, it is possible to monitor the transmission process of the file to be flashed, and timely discover data tampering problems during the transmission process, and then generate a first hash value for first verification data through the flashing tool, and send the first verification data to the electronic control unit, the first verification data including the target block file, the first random number, the second random number and the first encrypted ciphertext; receives the first verification data returned by the electronic control unit The second hash value is obtained, and the second hash value is compared with the first hash value; the flashing strategy of the electronic control unit is determined according to the comparison result. In addition to the target block file itself, additional verification data is added, which increases the difficulty for attackers to tamper with the data, because the attacker not only needs to modify the firmware data, but also needs to ensure that the embedded ciphertext and random number information are consistent with expectations. The embodiment of the present invention can realize real-time monitoring of data integrity during transmission by transmitting the file to be flashed in blocks, and can also promptly detect data tampering during transmission, thereby avoiding damage to the firmware flashed into the ECU due to data modification during transmission. When setting encryption, additional verification information is added, which increases the difficulty for attackers to tamper with data, and further ensures the security of data transmission.

[0085] Reference Figure 2, shows a flowchart of another method for flashing an electronic control unit provided by an embodiment of the present invention, the method may include:

[0086] Step 201, setting a first encryption key for the flashing tool and a second encryption key for the electronic control unit, wherein the first encryption key includes a first public key and a first private key, and the second encryption key includes a second public key and a second private key.

[0087] In the flashing process of the embodiment of the present invention, it is necessary to establish a secure communication channel for the flashing tool and the electronic control unit, which is not only used for the subsequent transmission of the files to be flashed, but also for the secure exchange of status monitoring data to ensure the communication security of the entire flashing process. Therefore, the flashing tool and the electronic control unit each hold a pair of exclusive public keys and private keys, wherein the first encryption key of the flashing tool includes a first public key (marked by A) and a first private key (marked by a), and the second encryption key of the electronic control unit includes a second public key (marked by B) and a second private key (marked by b).

[0088] Step 202: Encrypt the first random number based on the first private key held by the flashing tool to generate a first encrypted ciphertext.

[0089] In the embodiment of the present invention, the flashing tool generates a first random number (marked by X), encrypts it using a first private key, and generates a first encrypted ciphertext (marked by C).

[0090] Step 203: Send the first encrypted ciphertext to the electronic control unit through the initial communication channel.

[0091] The initial communication signal in the embodiment of the present invention can be preliminarily established based on an existing secure communication protocol (such as TLS) to ensure secure transmission of the initial message.

[0092] Step 204: The electronic control unit decrypts the first encrypted ciphertext using the first public key to obtain a first plaintext.

[0093] In the embodiment of the present invention, the electronic control unit obtains the first public key A provided by the flashing tool, uses A to decrypt the first encrypted ciphertext C to obtain the first plaintext D, and then verifies the identity of the flashing tool by comparing the first plaintext and the first random number.

[0094] Step 205: Encrypt the second random number based on the second private key held by the electronic control unit to generate a second encrypted ciphertext.

[0095] The embodiment of the present invention also verifies the identity of the electronic control unit. Similarly, the electronic control unit generates a second random number (marked by Y), encrypts it using the second private key b, and generates a second encrypted ciphertext (marked by E).

[0096] Step 206, sending the second encrypted ciphertext to the flashing tool through the initial communication channel.

[0097] Step 207: The flashing tool decrypts the second encrypted ciphertext using the second public key to obtain the second plaintext.

[0098] In the embodiment of the present invention, the flashing tool obtains the second public key B provided by the electronic control unit, decrypts the second encrypted ciphertext E to obtain the second plaintext F, and then verifies the identity of the electronic control unit by comparing the second plaintext and the second random number.

[0099] Step 208: If the first plaintext is consistent with the first random number and the second plaintext is consistent with the second random number, it is determined that the initial communication channel is a secure communication channel.

[0100] The embodiment of the present invention verifies the identity of the flashing tool by comparing the first plain text with the first random number, and if the results are consistent, it is determined that the identity of the flashing tool is valid. The identity of the electronic control unit is verified by comparing the second plain text with the second random number, and if the results are consistent, it is determined that the identity of the electronic control unit is valid. At this point, the flashing tool and the electronic control unit complete two-way identity authentication and formally establish a secure communication channel based on public key encryption for subsequent transmission of files to be flashed and exchange of status monitoring data.

[0101] Step 209, obtaining the file to be flashed, the first random number generated by the flashing tool and the first encrypted ciphertext generated based on the first random number, and the second random number generated by the electronic control unit.

[0102] Step 210: divide the file to be flashed into blocks according to a preset rule to generate at least one target block file.

[0103] Step 211: Generate a first hash value for first verification data by using a flashing tool, and send the first verification data to an electronic control unit.

[0104] Step 212: Receive a second Hash value of the first verification data returned by the electronic control unit, and compare the second Hash value with the first Hash value.

[0105] Step 213, determining the flashing strategy of the electronic control unit according to the comparison result.

[0106] The above steps 209-213 refer to the discussion of the above steps 101-105, and the present invention will not elaborate on them here.

[0107] In the embodiment of the present invention, the establishment of a secure channel is based on public key encryption technology, which provides end-to-end encryption protection for the communication between the flashing tool and the ECU, ensuring that sensitive data (such as identity information, firmware data, and status monitoring data) are not stolen or tampered with during transmission, thereby enhancing the security of communication. The establishment of a secure channel also provides a unified and protected path for the subsequent exchange of status monitoring data, making the information exchange in the entire flashing process more efficient and reliable. The two-way identity authentication ensures that the flashing tool and the electronic control unit involved in the flashing operation are both legal entities, preventing unauthorized or malicious devices from intervening in the flashing process, and effectively preventing data leakage and illegal operations.

[0108] Reference Figure 3 , shows a flowchart of another method for flashing an electronic control unit provided by an embodiment of the present invention, the method may include:

[0109] Step 301, obtaining target parameters about the operating state of the electronic control unit, the target parameters including central processing unit load, memory usage and temperature.

[0110] The embodiment of the present invention also monitors the operating status of the electronic control unit in real time, and then adjusts the flashing rate or interrupts the flashing according to the operating status of the electronic control unit. Therefore, it is necessary to first obtain the target parameters about the operating status of the electronic control unit. Conventional target parameters include central processing unit load, memory usage and temperature, as well as some parameters such as operating voltage, vibration frequency, mechanical impact force, etc. The present invention does not make specific limitations here.

[0111] Step 302, generating a first random number threshold range when it is determined that the CPU load is less than a first preset value, the memory usage is less than a second preset value, and the temperature is less than a third preset value.

[0112] The first preset value, the second preset value and the third preset value in the embodiment of the present invention are initial threshold values ​​of the target parameter, and these initial threshold values ​​can be obtained by summarizing the rules of historical data. For example, the first preset value is set to 80%, the second preset value is set to 90%, and the third preset value is set to 90°C. Because the above values ​​are set according to statistical rules, they can be changed according to actual conditions, and the present invention does not make specific limitations here.

[0113] Because the attacker may also modify the target parameters of the electronic control unit, the embodiment of the present invention also uses the generated first random number and the second random number as additional references, that is, different random number threshold ranges are set according to the operating state of the electronic control unit, so as to facilitate the subsequent process to further determine the operating state of the electronic control unit according to the range of random numbers, and to determine whether the operating state of the electronic control unit has been tampered with according to the comparison between the random number and the operating state of the electronic control unit. Based on the above reasons, when the CPU load is less than the first preset value, the memory usage rate is less than the second preset value, and the temperature is less than the third preset value, it is considered that the operating state of the electronic control unit is good, and the first random number threshold range is generated. The random numbers generated within this range all indicate that the operating state of the electronic control unit is good at this time.

[0114] Step 303: Control the first random number generated by the flashing tool and the second random number generated by the electronic control unit to be within a first random number threshold range.

[0115] In the embodiment of the present invention, when it is determined that the operation state of the electronic control unit is good, a first random number threshold range is set, and then the first random number generated by the flashing tool and the second random number generated by the electronic control unit are controlled to be within the first random number threshold range. For example, the first random number threshold range is set to [50-100], then the first random number and the second random number generated at this time can be 56, 62, 75, 86, etc., as long as they are within [50-100], without specific limitation.

[0116] Step 304: when it is determined that the CPU load is greater than the first preset value, the memory usage is greater than the second preset value, or the temperature is greater than the third preset value, generate a second random number threshold range.

[0117] The embodiment of the present invention will also set a second random number threshold range when it is determined that the operating state of the electronic control unit is poor (at this time the central processing unit load is greater than the first preset value or the memory usage is greater than the second preset value or the temperature is greater than the third preset value, that is, as long as one of the items is met, it will be considered that the operating state of the electronic control unit at this time is poor).

[0118] Step 305 , controlling the first random number generated by the flashing tool and the second random number generated by the electronic control unit to be within a second random number threshold range.

[0119] In the embodiment of the present invention, when it is determined that the operating state of the electronic control unit is poor, a second random number threshold range is set, and then the first random number generated by the flashing tool and the second random number generated by the electronic control unit are controlled to be within the second random number threshold range. For example, the second random number threshold range is set to [0-50], then the first random number and the second random number generated at this time can be 3, 12, 26, 45, etc., as long as they are within [0-50], without specific limitation.

[0120] Step 306, obtaining the file to be flashed, the first random number generated by the flashing tool and the first encrypted ciphertext generated based on the first random number, and the second random number generated by the electronic control unit.

[0121] Step 307: divide the file to be flashed into blocks according to a preset rule to generate at least one target block file.

[0122] The above steps 306 and 307 refer to the discussion of the above steps 101 and 102, and the present invention will not elaborate on them here.

[0123] Step 308: Generate a first hash value for the first verification data by using a flashing tool, and send the first verification data to the electronic control unit.

[0124] The embodiment of the present invention generates random numbers in different ranges according to the operating state of the electronic control unit, and also uses the value of the random number as an additional reference, that is, the operating state of the electronic control unit can be directly determined according to the value of the random number. In addition, because some electronic control unit flashing systems may use a fixed threshold to determine that the electronic control unit is overloaded, and only passively stop flashing when the threshold is reached, lacking the ability to dynamically adjust the flashing rate, the static threshold may not be applicable to all scenarios, resulting in premature or late stopping of flashing. Therefore, the present application sets a dynamic threshold based on random numbers, that is, when the first random number and the second random number fall into a specific range, the threshold requirements for its operating state parameters are relaxed or tightened, increasing the difficulty for attackers to predict and interfere with the flashing process. When the first random number and the second random number meet specific conditions, a more conservative flashing strategy is preferred, such as reducing the transmission rate or suspending the flashing in advance, to deal with possible unknown threats. The specific steps include:

[0125] When it is determined that the first random number and the second random number are within the first random number threshold range, increasing the initial threshold of the target parameter and sending the first verification data to the electronic control unit;

[0126] When it is determined that the first random number and the second random number are within the second random number threshold range, the initial threshold of the target parameter is reduced, and the transmission rate of sending the first verification data to the electronic control unit is reduced or the transmission is suspended.

[0127] In the above steps, when the first random number and the second random number are within the first random number threshold range, it indicates that the electronic control unit is in good operating condition at this time. At this time, the threshold requirement can be relaxed, that is, the initial threshold of the target parameter is increased, and the flashing operation can be performed at this time, so the first verification data carrying the flashing data is sent to the electronic control unit to allow it to perform the flashing operation. When the first random number and the second random number are within the second random number threshold range, it indicates that the electronic control unit is in poor operating condition at this time. At this time, the threshold requirement needs to be tightened, that is, the initial threshold of the target parameter is reduced. At this time, a more conservative flashing strategy is preferred, such as reducing the transmission rate or suspending the flashing in advance, that is, reducing the transmission rate of sending the first verification data to the electronic control unit or suspending the sending.

[0128] Step 309: Receive a second hash value of the first verification data returned by the electronic control unit, and compare the second hash value with the first hash value.

[0129] Step 310: determine the flashing strategy of the electronic control unit according to the comparison result.

[0130] The above steps 309 and 310 refer to the discussion of the above steps 104 and 105, and the present invention will not elaborate on them here.

[0131] The embodiment of the present invention collects the key performance indicators of the electronic control unit, such as CPU load, memory usage and temperature, in real time through the electronic control unit operation status monitoring function, provides real-time feedback for the flashing process, and helps prevent overload or abnormal situations. The safe flashing decision dynamically adjusts the flashing rate or suspends the flashing operation based on the monitoring data to ensure that the electronic control unit always operates within a safe working range, avoids hardware damage or system crash caused by the flashing process, and significantly improves the stability and success rate of the flashing process. At the same time, when abnormal situations such as data tampering or ECU overload are detected, the present invention can quickly send a pause instruction through a secure channel to stop the flashing operation in time to prevent the problem from further deteriorating. In addition, the embodiment of the present invention can show consumers its high attention to vehicle information security and advanced technical strength by providing a set of comprehensive and multi-level safe flashing solutions, enhance brand image and user trust, and help enhance market competitiveness.

[0132] Reference Figure 4 , shows a schematic diagram of the structure of an electronic control unit flashing device provided by an embodiment of the present invention, such as Figure 4 As shown, the device may include:

[0133] The first acquisition module 401 is used to acquire the file to be flashed, the first random number generated by the flashing tool and the first encrypted ciphertext generated based on the first random number, and the second random number generated by the electronic control unit.

[0134] The first generating module 402 is used to divide the file to be flashed into blocks according to a preset rule to generate at least one target block file.

[0135] The second generation module 403 is used to generate a first hash value about the first verification data through a flashing tool, and send the first verification data to the electronic control unit. The first verification data includes a target block file, a first random number, a second random number and a first encrypted ciphertext.

[0136] The first receiving module 404 is used to receive a second hash value of the first verification data returned by the electronic control unit, and compare the second hash value with the first hash value.

[0137] The first determination module 405 is used to determine the flashing strategy of the electronic control unit according to the comparison result.

[0138] Optionally, the electronic control unit flashing device further includes:

[0139] The setting module is used to set a first encryption key for the flashing tool and a second encryption key for the electronic control unit, wherein the first encryption key includes a first public key and a first private key, and the second encryption key includes a second public key and a second private key.

[0140] The third generating module is used to encrypt the first random number based on the first private key held by the flashing tool to generate a first encrypted ciphertext.

[0141] The first sending module is used to send the first encrypted ciphertext to the electronic control unit through the initial communication channel.

[0142] The second acquisition module is used for the electronic control unit to decrypt the first encrypted ciphertext through the first public key to obtain the first plaintext.

[0143] The fourth generating module is used to encrypt the second random number based on the second private key held by the electronic control unit to generate a second encrypted ciphertext.

[0144] The second sending module is used to send the second encrypted ciphertext to the flashing tool through the initial communication channel.

[0145] The third acquisition module is used for the flashing tool to decrypt the second encrypted ciphertext through the second public key to obtain the second plaintext.

[0146] The second determination module is configured to determine that the initial communication channel is a secure communication channel if the first plaintext is consistent with the first random number and the second plaintext is consistent with the second random number.

[0147] The fifth generation module is used to generate a target hash value for second verification data through a flashing tool, where the second verification data includes a file to be flashed, a first random number, a second random number and a first encrypted ciphertext.

[0148] The third sending module is used to send the second verification data to the electronic control unit.

[0149] The first receiving module is used to receive a third hash value of the second verification data returned by the electronic control unit.

[0150] The first comparison module is used to compare the third Hash value with the target Hash value.

[0151] The first flashing module is used to control the electronic control unit to continue flashing if the comparison results are consistent.

[0152] Optionally, the first determining module 405 specifically includes:

[0153] The first sending submodule is used for, if the second hash value is consistent with the first hash value, the flashing tool sending the flashing instruction through the secure communication channel.

[0154] The first response submodule is used to respond to the flashing instruction and execute the flashing operation through the electronic control unit.

[0155] The second sending submodule is used for, if the second hash value is inconsistent with the first hash value, the flashing tool sending a stop flashing instruction through a secure communication channel.

[0156] The second response submodule is used to interrupt the flashing operation through the electronic control unit in response to the stop flashing instruction.

[0157] Optionally, the electronic control unit flashing device further includes:

[0158] The fourth acquisition module is used to acquire target parameters about the operating state of the electronic control unit, and the target parameters include central processing unit load, memory usage and temperature.

[0159] The sixth generation module is used to generate a first random number threshold range when it is determined that the central processing unit load is less than the first preset value, the memory usage is less than the second preset value and the temperature is less than the third preset value, wherein the first preset value, the second preset value and the third preset value are initial thresholds of the target parameters.

[0160] The first control module is used to control the first random number generated by the flashing tool and the second random number generated by the electronic control unit to be within a first random number threshold range.

[0161] The seventh generating module is used to generate a second random number threshold range when it is determined that the CPU load is greater than the first preset value, the memory usage is greater than the second preset value, or the temperature is greater than the third preset value.

[0162] The second control module is used to control the first random number generated by the flashing tool and the second random number generated by the electronic control unit to be within a second random number threshold range.

[0163] Optionally, the second generating module 403 specifically includes:

[0164] The third sending submodule is used to increase the initial threshold of the target parameter and send the first verification data to the electronic control unit when it is determined that the first random number and the second random number are within the first random number threshold range.

[0165] The fourth sending submodule is used to reduce the initial threshold of the target parameter and reduce the transmission rate of sending the first verification data to the electronic control unit or suspend sending when it is determined that the first random number and the second random number are within the second random number threshold range.

[0166] The electronic control unit flashing method provided by the embodiment of the present invention obtains a file to be flashed, a first random number generated by a flashing tool and a first encrypted ciphertext generated based on the first random number, and a second random number generated by the electronic control unit; divides the file to be flashed into blocks according to a preset rule to generate at least one target block file, and by dividing the file to be flashed into blocks, it is possible to monitor the transmission process of the file to be flashed, and timely discover data tampering problems during the transmission process, and then generate a first hash value for first verification data through the flashing tool, and send the first verification data to the electronic control unit, the first verification data including the target block file, the first random number, the second random number and the first encrypted ciphertext; receives a second hash value for the first verification data returned by the electronic control unit, and compares the second hash value with the first hash value; determines the flashing strategy of the electronic control unit according to the comparison result, and in addition to the target block file itself, additional verification data is added to increase the tampering risk of an attacker The difficulty of data tampering is that the attacker not only needs to modify the firmware data, but also needs to ensure that the embedded ciphertext and random number information are consistent with expectations. The embodiment of the present invention can realize real-time monitoring of data integrity during the transmission process by transmitting the file to be flashed in blocks, and can also promptly detect data tampering during the transmission process, thereby avoiding damage to the firmware flashed into the ECU due to modification of the data during transmission. When setting encryption, additional verification information is added, which increases the difficulty for attackers to tamper with the data, and further ensures the security of data transmission. In addition, the embodiment of the present invention also adds a two-way identity authentication process for the flashing tool and the electronic control unit, and establishes a secure communication channel based on this, thereby ensuring the security of data transmission through the secure communication channel. Furthermore, the embodiment of the present invention also pauses / resumes the flashing or adjusts the transmission rate according to the operating status of the electronic control unit to ensure that the flashing process is carried out within the safe operating range of the ECU to prevent flashing failure or damage to the ECU due to overload.

[0167] The embodiment of the present invention also provides a communication device, such as Figure 5 As shown, it includes a processor 501, a communication interface 502, a memory 503 and a communication bus 504, wherein the processor 501, the communication interface 502, and the memory 503 communicate with each other through the communication bus 504.

[0168] Memory 503, used for storing computer programs;

[0169] The processor 501 is used to execute the program stored in the memory 503, and implements the following steps:

[0170] Obtain a file to be flashed, a first random number generated by a flashing tool and a first encrypted ciphertext generated based on the first random number, and a second random number generated by an electronic control unit;

[0171] Divide the file to be flashed into blocks according to a preset rule to generate at least one target block file;

[0172] Generate a first hash value for first verification data by a flashing tool, and send the first verification data to an electronic control unit, wherein the first verification data includes a target block file, the first random number, the second random number, and the first encrypted ciphertext;

[0173] receiving a second hash value of the first verification data returned by the electronic control unit, and comparing the second hash value with the first hash value;

[0174] The flashing strategy of the electronic control unit is determined according to the comparison result.

[0175] The communication bus mentioned in the above terminal can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The communication bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus.

[0176] The communication interface is used for communication between the above terminal and other devices.

[0177] The memory may include a random access memory (RAM) or a non-volatile memory, such as at least one disk memory. Optionally, the memory may also be at least one storage device located away from the aforementioned processor.

[0178] The above-mentioned processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components.

[0179] The present invention also provides a readable storage medium. When the instructions in the storage medium are executed by a processor of an electronic device, the electronic device can execute the electronic control unit flashing method of the aforementioned embodiment.

[0180] Based on the same inventive concept, an embodiment of the present invention further provides a vehicle, which may specifically include: the above-mentioned electronic control unit flashing device.

[0181] As for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0182] The algorithm and display provided herein are not inherently related to any particular computer, virtual device or other equipment. According to the above description, it is obvious that the structure required for constructing this type of device is. In addition, the present invention is not directed to any specific programming language. It should be understood that various programming languages ​​can be utilized to realize the content of the present invention described herein, and the description of the above specific language is to disclose the best mode of the present invention.

[0183] In the description provided herein, a large number of specific details are described. However, it is understood that embodiments of the present invention can be practiced without these specific details. In some instances, well-known methods, structures and techniques are not shown in detail so as not to obscure the understanding of this description.

[0184] Similarly, it should be understood that in order to streamline the present invention and aid in understanding one or more of the various inventive aspects, in the above description of exemplary embodiments of the present invention, various features of the present invention are sometimes grouped together into a single embodiment, figure, or description thereof. However, this disclosed method should not be interpreted as reflecting the following intention: that the claimed invention requires more features than those expressly recited in each claim. Rather, as reflected in the claims below, inventive aspects lie in less than all of the features of the individual embodiments disclosed above. Therefore, the claims that follow the detailed description are hereby expressly incorporated into the detailed description, with each claim itself serving as a separate embodiment of the present invention.

[0185] Those skilled in the art will appreciate that the modules in the devices in the embodiments may be adaptively changed and arranged in one or more devices different from the embodiments. The modules or units or components in the embodiments may be combined into one module or unit or component, and in addition they may be divided into a plurality of submodules or subunits or subcomponents. Except that at least some of such features and / or processes or units are mutually exclusive, all features disclosed in this specification (including the accompanying claims, abstracts and drawings) and all processes or units of any method or device disclosed in this manner may be combined in any combination. Unless otherwise expressly stated, each feature disclosed in this specification (including the accompanying claims, abstracts and drawings) may be replaced by an alternative feature providing the same, equivalent or similar purpose.

[0186] The various component embodiments of the present invention may be implemented in hardware, or in software modules running on one or more processors, or in a combination thereof. It should be understood by those skilled in the art that a microprocessor or digital signal processor (DSP) may be used in practice to implement some or all of the functions of some or all of the components in the sorting device according to the present invention. The present invention may also be implemented as a device or apparatus program for executing part or all of the methods described herein. Such a program for implementing the present invention may be stored on a computer-readable medium, or may be in the form of one or more signals. Such a signal may be downloaded from an Internet website, or provided on a carrier signal, or provided in any other form.

[0187] It should be noted that the above embodiments illustrate the present invention rather than limit it, and that those skilled in the art may devise alternative embodiments without departing from the scope of the appended claims. In the claims, any reference symbol between brackets shall not be construed as a limitation on the claims. The word "comprising" does not exclude the presence of elements or steps not listed in the claims. The word "one" or "an" preceding an element does not exclude the presence of a plurality of such elements. The present invention may be implemented by means of hardware comprising a number of different elements and by means of a suitably programmed computer. In a unit claim enumerating a number of devices, several of these devices may be embodied by the same hardware item. The use of the words first, second, and third, etc., does not indicate any order. These words may be interpreted as names.

[0188] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the above-described devices, apparatuses and units can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0189] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

[0190] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any person skilled in the art can easily think of changes or substitutions within the technical scope disclosed by the present invention, which should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.

[0191] It should be noted that the various data-related processes in the embodiments of the present application are all carried out in compliance with the corresponding data protection laws and policies of the country where the device is located, and with the authorization given by the owner of the corresponding device.

Claims

1. A flashing method for an electronic control unit, characterized in that: The method comprises: Acquire a file to be flashed, a first random number generated by a flashing tool and a first encrypted ciphertext generated based on the first random number, and a second random number generated by an electronic control unit, wherein the first random number and the second random number are within a preset random number threshold range, and the random number threshold range represents an operating state of the electronic control unit; Divide the file to be flashed into blocks according to a preset rule to generate at least one target block file; Generate a first Hash value for first verification data by a flashing tool, and send the first verification data to an electronic control unit, wherein the first verification data includes a target block file, the first random number, the second random number, and the first encrypted ciphertext, and the target block files are transmitted sequentially according to the order in the file to be flashed; Receiving a second Hash value of the first verification data returned by the electronic control unit, and comparing the second Hash value with the first Hash value, the second Hash value being calculated and generated by the electronic control unit according to the received first verification data; The flashing strategy of the electronic control unit is determined according to the comparison result.

2. The method according to claim 1, characterized in that: Before obtaining the flash file of the firmware to be flashed, the first random number generated by the flash tool and the first encrypted ciphertext generated based on the first random number, and the second random number generated by the electronic control unit, the method further includes: Setting a first encryption key for the flashing tool and a second encryption key for the electronic control unit, wherein the first encryption key includes a first public key and a first private key, and the second encryption key includes a second public key and a second private key; Encrypting the first random number based on a first private key held by the flashing tool to generate a first encrypted ciphertext; sending the first encrypted ciphertext to the electronic control unit through an initial communication channel; The electronic control unit decrypts the first encrypted ciphertext using the first public key to obtain a first plaintext; Encrypting the second random number based on a second private key held by the electronic control unit to generate a second encrypted ciphertext; sending the second encrypted ciphertext to the flashing tool through an initial communication channel; The flashing tool decrypts the second encrypted ciphertext by using the second public key to obtain a second plaintext; If the first plaintext is consistent with the first random number and the second plaintext is consistent with the second random number, it is determined that the initial communication channel is a secure communication channel.

3. The method according to claim 1, characterized in that Before dividing the file to be flashed into blocks according to a preset rule to generate at least one target block file, the method further includes: Generate a target hash value for second verification data by the flashing tool, where the second verification data includes the file to be flashed, the first random number, the second random number, and the first encrypted ciphertext; sending the second verification data to an electronic control unit; Receiving a third hash value of the second verification data returned by the electronic control unit; Comparing the third hash value with the target hash value; If the comparison result is consistent, the electronic control unit is controlled to continue flashing.

4. The method according to claim 1, characterized in that The step of determining the flashing strategy of the electronic control unit according to the comparison result includes: If the second hash value is consistent with the first hash value, the flashing tool sends a flashing instruction through a secure communication channel; In response to the flashing instruction, executing a flashing operation by the electronic control unit; If the second hash value is inconsistent with the first hash value, the flashing tool sends a stop flashing instruction through a secure communication channel; In response to the stop flashing instruction, the flashing operation is interrupted by the electronic control unit.

5. The method according to claim 1, characterized in that Before the flashing tool is used to generate a first hash value for the first verification data and the first verification data is sent to the electronic control unit, the method further includes: Obtaining target parameters regarding the operating state of the electronic control unit, the target parameters including central processing unit load, memory usage and temperature; When it is determined that the CPU load is less than a first preset value, the memory usage is less than a second preset value, and the temperature is less than a third preset value, a first random number threshold range is generated, wherein the first preset value, the second preset value, and the third preset value are initial thresholds of the target parameter; Control the first random number generated by the flash writing tool and the second random number generated by the electronic control unit to be within the first random number threshold range; When it is determined that the CPU load is greater than a first preset value, the memory usage is greater than a second preset value, or the temperature is greater than a third preset value, generating a second random number threshold range; The first random number generated by the flash writing tool and the second random number generated by the electronic control unit are controlled to be within the second random number threshold range.

6. The method according to claim 5, characterized in that The sending the first verification data to the electronic control unit also includes: When it is determined that the first random number and the second random number are within the first random number threshold range, increasing the initial threshold of the target parameter, and sending the first verification data to an electronic control unit; When it is determined that the first random number and the second random number are within the second random number threshold range, the initial threshold of the target parameter is reduced, and the transmission rate of sending the first verification data to the electronic control unit is reduced or the transmission is suspended.

7. An electronic control unit flashing device, characterized in that: include: A first acquisition module is used to acquire a file to be flashed, a first random number generated by a flashing tool and a first encrypted ciphertext generated based on the first random number, and a second random number generated by an electronic control unit, wherein the first random number and the second random number are within a preset random number threshold range, and the random number threshold range represents an operating state of the electronic control unit; A first generating module, configured to divide the file to be flashed into blocks according to a preset rule, and generate at least one target block file; A second generating module is used to generate a first hash value of first verification data by a flashing tool, and send the first verification data to an electronic control unit, wherein the first verification data includes a target block file, the first random number, the second random number and the first encrypted ciphertext, and the target block files are transmitted in sequence according to the order in the file to be flashed; A first receiving module, used for receiving a second Hash value of the first verification data returned by the electronic control unit, and comparing the second Hash value with the first Hash value, wherein the second Hash value is calculated and generated by the electronic control unit according to the received first verification data; The first determination module is used to determine the flashing strategy of the electronic control unit according to the comparison result.

8. A communication device, characterized in that: include: A transceiver, a memory, a processor, and a program stored on the memory and executable on the processor; The processor is used to read the program in the memory to implement the steps in the electronic control unit flashing method as described in any one of claims 1-6.

9. A readable storage medium for storing a program, characterized in that: When the stored program is executed by the processor, the steps in the electronic control unit flashing method as claimed in any one of claims 1 to 6 are implemented.

10. A vehicle, characterized in that: include: The electronic control unit flashing device as claimed in claim 7.

Images