MCU software upgrading method and system for realizing network security

Abstract

The embodiment of the invention provides an MCU software upgrading method and system for realizing network security, and belongs to the field of new energy automobiles. The MCU software upgrading method comprises the following steps: after receiving an upgrading instruction of a user, loading a software upgrading data packet to generate version information about the data packet, and calculating a first digest value of the data packet according to a Hash algorithm; the diagnostic apparatus calculates a signature value of the first digest value according to a private key of an RSA2048 asymmetric algorithm; the MCU verifies version information before the program is upgraded; after the version information is verified to be correct, the MCU verifies identity information of a sender before upgrading, and receives a data packet sent by the diagnostic apparatus after verification succeeds; and after the data packet is successfully received, the MCU verifies the data packet in the upgrading process. According to the MCU software upgrading method and system, the network security can be verified for multiple times in the upgrading process, so that the security risk in MCU upgrading is reduced.

Description

Technical Field

[0001] The present invention relates to the field of new energy vehicles, and in particular to an MCU software upgrade method and system for achieving network security. Background Art

[0002] As the automotive industry is shifting towards intelligence and networking, the application of network security technology in automobiles has become particularly important, especially the update of MCU electronic control software in key parts of automobiles. Traditional MCUs are easily vulnerable to network attacks during software updates, which puts the software program at risk of being tampered with, thereby endangering the property and life safety of users. Therefore, a MCU software upgrade method that can achieve network security functions is needed to reduce security risks in MCU upgrades. Summary of the invention

[0003] The purpose of the embodiments of the present invention is to provide an MCU software upgrade method and system for achieving network security. The MCU software upgrade method and system can verify network security multiple times during the upgrade process to reduce security risks in MCU upgrades.

[0004] In order to achieve the above-mentioned object, on the one hand, an embodiment of the present invention provides an MCU software upgrade method for realizing network security, and the MCU software upgrade method comprises:

[0005] After receiving the upgrade instruction from the user, the diagnostic instrument loads the data packet of the software upgrade to generate version information about the data packet, and calculates the first summary value of the data packet according to the hash algorithm;

[0006] The diagnostic instrument calculates the signature value of the first digest value according to the private key of the RSA2048 asymmetric algorithm;

[0007] The MCU verifies the version information before upgrading the program;

[0008] After verifying that the version information is correct, the MCU verifies the identity information of the sender before upgrading, and receives the data packet sent by the diagnostic instrument after successful verification;

[0009] After successfully receiving the data packet, the MCU verifies the data packet during the upgrade process;

[0010] After the MCU successfully verifies the data packet during the upgrade process, it verifies the sender information again and performs program upgrade according to the result.

[0011] Optionally, the MCU verifies the version information before upgrading the program, including:

[0012] The MCU receives the version information, the first digest value and the signature value sent by the diagnostic instrument;

[0013] The MCU determines whether the received version information is within the fixed upgrade version range in the MCU program;

[0014] When the version information is not within the fixed upgrade version range in the MCU program, exit the upgrade;

[0015] When the version information is within the fixed upgrade version range in the MCU program, the upgrade continues.

[0016] Optionally, after verifying that the version information is correct, the MCU verifies the sender identity information before upgrading, and after the verification is successful, receives the data packet sent by the diagnostic instrument, including:

[0017] The MCU uses the public key of the RSA2048 asymmetric algorithm to calculate the signature value to obtain a calculation summary value;

[0018] Comparing the received first digest value with the calculated digest value to see whether they are consistent;

[0019] When the first summary value is consistent with the calculated summary value, entering the BootLoader and requesting the diagnostic instrument to transmit the data packet;

[0020] When the diagnostic instrument receives the transmission request from the MCU, it transmits the data packet to the MCU until the transmission is completed;

[0021] When the first digest value and the calculated digest value are inconsistent, the upgrade is exited.

[0022] Optionally, after successfully receiving the data packet, the MCU verifies the data packet during the upgrade process, including:

[0023] The MCU receives the data packet;

[0024] The MCU calculates a second summary value of the data packet according to a hash algorithm;

[0025] comparing whether the first digest value and the second digest value are consistent;

[0026] When the first digest value and the second digest value are consistent, the MCU requests the diagnostic instrument to send secure boot data and its digest and signature value;

[0027] After receiving the request, the diagnostic instrument generates secure boot data and calculates a third summary value of the secure boot data according to a hash algorithm;

[0028] The diagnostic instrument calculates the first signature value of the third digest value using the private key of the RSA2048 asymmetric algorithm;

[0029] The diagnostic instrument sends the secure boot data and the first signature value to the MCU for upgrading;

[0030] When the first digest value and the second digest value are inconsistent, the upgrade is exited.

[0031] Optionally, after the MCU successfully verifies the data packet during the upgrade process, the MCU verifies the sender information again, and performs a program upgrade according to the result, including:

[0032] The MCU receives the secure boot data and the first signature value;

[0033] The MCU calculates a fourth digest value of the secure boot data according to a hash algorithm;

[0034] The MCU calculates the digest value of the first signature value according to the public key of the RSA2048 asymmetric algorithm;

[0035] Determine whether the fourth digest value is consistent with the digest value of the first signature value;

[0036] When the fourth digest value is consistent with the digest value of the first signature value, the received data packet is updated into the Flash and the BootLoader is exited;

[0037] When the fourth digest value is inconsistent with the digest value of the first signature value, the upgrade is stopped.

[0038] On the other hand, the present invention provides an MCU software upgrade system for realizing network security, the MCU software upgrade system comprising a diagnostic instrument and an MCU;

[0039] The diagnostic instrument is used to receive an upgrade instruction from a user, load a data packet of a software upgrade to generate version information about the data packet, and calculate a first summary value of the data packet according to a hash algorithm;

[0040] The diagnostic instrument calculates the signature value of the first digest value according to the private key of the RSA2048 asymmetric algorithm;

[0041] MCU is used to verify the version information before upgrading the program;

[0042] After verifying that the version information is correct, the MCU verifies the identity information of the sender before upgrading, and receives the data packet sent by the diagnostic instrument after successful verification;

[0043] After successfully receiving the data packet, the MCU verifies the data packet during the upgrade process;

[0044] After the MCU successfully verifies the data packet during the upgrade process, it verifies the sender information again and performs program upgrade according to the result.

[0045] Optionally, the MCU verifies the version information before upgrading the program, including:

[0046] The MCU receives the version information, the first digest value and the signature value sent by the diagnostic instrument;

[0047] The MCU determines whether the received version information is within the fixed upgrade version range in the MCU program;

[0048] When the version information is not within the fixed upgrade version range in the MCU program, exit the upgrade;

[0049] When the version information is within the fixed upgrade version range in the MCU program, the upgrade continues.

[0050] Optionally, after verifying that the version information is correct, the MCU verifies the sender identity information before upgrading, and after the verification is successful, receives the data packet sent by the diagnostic instrument, including:

[0051] The MCU uses the public key of the RSA2048 asymmetric algorithm to calculate the signature value to obtain a calculation summary value;

[0052] Comparing the received first digest value with the calculated digest value to see whether they are consistent;

[0053] When the first summary value is consistent with the calculated summary value, entering the BootLoader and requesting the diagnostic instrument to transmit the data packet;

[0054] When the diagnostic instrument receives the transmission request from the MCU, it transmits the data packet to the MCU until the transmission is completed;

[0055] When the first digest value and the calculated digest value are inconsistent, the upgrade is exited.

[0056] Optionally, after successfully receiving the data packet, the MCU verifies the data packet during the upgrade process, including:

[0057] The MCU receives the data packet;

[0058] The MCU calculates a second summary value of the data packet according to a hash algorithm;

[0059] comparing whether the first digest value and the second digest value are consistent;

[0060] When the first digest value and the second digest value are consistent, the MCU requests the diagnostic instrument to send secure boot data and its digest and signature value;

[0061] After receiving the request, the diagnostic instrument generates secure boot data and calculates a third summary value of the secure boot data according to a hash algorithm;

[0062] The diagnostic instrument calculates the first signature value of the third digest value using the private key of the RSA2048 asymmetric algorithm;

[0063] The diagnostic instrument sends the secure boot data and the first signature value to the MCU for upgrading;

[0064] When the first digest value and the second digest value are inconsistent, the upgrade is exited.

[0065] Optionally, after the MCU successfully verifies the data packet during the upgrade process, the MCU verifies the sender information again, and performs a program upgrade according to the result, including:

[0066] The MCU receives the secure boot data and the first signature value;

[0067] The MCU calculates a fourth digest value of the secure boot data according to a hash algorithm;

[0068] The MCU calculates the digest value of the first signature value according to the public key of the RSA2048 asymmetric algorithm;

[0069] Determine whether the fourth digest value is consistent with the digest value of the first signature value;

[0070] When the fourth digest value is consistent with the digest value of the first signature value, the received data packet is updated into the Flash and the BootLoader is exited;

[0071] When the fourth digest value is inconsistent with the digest value of the first signature value, the upgrade is stopped.

[0072] Through the above technical scheme, the diagnostic instrument of a MCU software upgrade method and system for realizing network security provided by the present invention can load the data packet of software upgrade after receiving the upgrade instruction of the user, so as to generate the version information about the data packet, and the diagnostic instrument can calculate the first summary value of the data packet according to the hash algorithm. The diagnostic instrument can calculate the signature value of the first summary value according to the private key of the RSA2048 asymmetric algorithm, and after obtaining the version information, the first summary value and the signature value of the first summary value, these values ​​can be sent to the MCU. The MCU receives these data, and can verify whether the version information is correct before the upgrade program, after verifying that the version information is correct, the MCU can also verify the sender identity information before the upgrade, and can receive the data packet sent by the diagnostic instrument after the verification is successful. After the MCU successfully receives the data packet, the data packet can also be verified again during the upgrade process. After the verification is completed during the upgrade process, the MCU can verify the sender information again, and can perform program upgrade according to the result, and the MCU software upgrade method and system can verify network security multiple times during the upgrade process to reduce the security risk in the MCU upgrade.

[0073] Other features and advantages of the embodiments of the present invention will be described in detail in the subsequent detailed description. BRIEF DESCRIPTION OF THE DRAWINGS

[0074] The accompanying drawings are used to provide a further understanding of the embodiments of the present invention and constitute a part of the specification. Together with the following specific implementations, they are used to explain the embodiments of the present invention, but do not constitute a limitation on the embodiments of the present invention. In the accompanying drawings:

[0075] Figure 1 is a flow chart of a method for upgrading MCU software to achieve network security according to an embodiment of the present invention;

[0076] Figure 2 is a flowchart of verifying version information of an MCU software upgrade method for realizing network security according to an embodiment of the present invention;

[0077] Figure 3 It is a flowchart of MCU pre-upgrade verification information of a method for MCU software upgrade to achieve network security according to an embodiment of the present invention;

[0078] Figure 4 It is a flowchart of verifying information during an MCU upgrade process of an MCU software upgrade method for realizing network security according to an embodiment of the present invention;

[0079] Figure 5 The present invention is a flowchart of an MCU re-verification information of an MCU software upgrade method for realizing network security according to an embodiment of the present invention. DETAILED DESCRIPTION

[0080] The specific implementation of the embodiment of the present invention is described in detail below in conjunction with the accompanying drawings. It should be understood that the specific implementation described here is only used to illustrate and explain the embodiment of the present invention, and is not used to limit the embodiment of the present invention.

[0081] Figure 1 The present invention is a flowchart of a method for upgrading MCU software to realize network security according to an embodiment of the present invention. The method for upgrading MCU software may include:

[0082] In step S1 , after receiving the upgrade instruction from the user, the diagnostic instrument loads the data packet of the software upgrade to generate version information about the data packet, and calculates the first digest value of the data packet according to the hash algorithm.

[0083] In step S2, the diagnostic instrument calculates a signature value of the first digest value according to a private key of the RSA2048 asymmetric algorithm.

[0084] In step S3, the MCU verifies the version information before upgrading the program.

[0085] In step S4, after verifying that the version information is correct, the MCU verifies the sender identity information before upgrading, and receives the data packet sent by the diagnostic instrument after the verification is successful.

[0086] In step S5, after successfully receiving the data packet, the MCU verifies the data packet during the upgrade process.

[0087] In step S6, after the MCU successfully verifies the data packet during the upgrade process, it verifies the sender information again and performs program upgrade according to the result.

[0088] In the present invention, when the MCU is upgraded, the diagnostic instrument can receive the user's upgrade instruction, and then load the data packet of the software upgrade so as to generate version information about the data packet, and calculate the first summary value of the data packet according to the hash algorithm. The diagnostic instrument can calculate the signature value of the first summary value according to the private key of the RSA2048 asymmetric algorithm. The diagnostic instrument can send the version information about the data packet, the first summary value and the signature value of the first summary value to the MCU. The MUC can verify the received version information before upgrading the program. After verifying that the version information is correct, the MCU can verify the identity information of the sender again before upgrading, and if the verification is successful, the data packet sent by the diagnostic instrument can be received. After successfully receiving the data packet, the MCU can also verify the data packet during the upgrade process to enhance the ability to detect whether the data is lost or tampered. After the MCU successfully verifies the data packet during the upgrade process, the sender information can be verified again, and the program can be upgraded according to the result. In the present invention, when the hash algorithm is calculated, 8 hash initial values ​​and 64 hash constants are initialized first, and then data preprocessing can be performed. There are two main steps for data preprocessing, namely, additional padding bits and additional length. After data preprocessing, the data can be decomposed into n 512-bit blocks, each block is 64 bytes of data; the CRC32 value of the middle 32 bytes of each block is calculated using the following polynomial, and then the CRC value is added to the 64 bytes of data to obtain a new 64-byte data:

[0089] X 32 +X 26 +X 23 +X 22 +X 16 +X 12 +X 11 +X 10 +X 8 +X 7 +X 5 +X 4 +X 2 +X 1 +X 0 .

[0090] This polynomial is a mathematical expression, represented as a 32-bit binary number, whose value is 0x04C11DB7, which is used in the calculation of CRC32.

[0091] Then each byte can be processed by f(x) = (x>>4|x<<4) to get new data. f(x) represents a calculation function, x is a byte, x>>4 represents a right shift of 4 bits, x<<4 represents a left shift of 4 bits, (x>>4|x<<4) represents the result of the right shift and the left shift, and the result is an OR operation, and finally a byte is output. In the previous step, 64 bytes or 16 words are obtained. The following formula can be used to calculate the remaining 48 words:

[0092]

[0093] XOR bitwise operation;

[0094] S n : Circularly shift right n bits, n can be 7, 18, 17, 19;

[0095] R n : Shift right by n bits, n can be 3 or 10;

[0096] W t : The last 48 words, t represents the subscript, and W represents the minimum operation unit (word);

[0097] α0, α1 represent the scale parameters.

[0098] Calculate the hash value of the first block: loop 64 times, use a series of nonlinear logic functions to calculate the initial value defined in the first step, the 64 words calculated in the fourth step, and the constants in the first step to get 8 new hash values. Loop to calculate the hash values ​​of n blocks to get the final hash value of the data.

[0099] In one embodiment of the present invention, Figure 2 As shown, the process of verifying version information may include:

[0100] In step S7, the MCU receives the version information, the first digest value and the signature value sent by the diagnostic instrument.

[0101] In step S8, the MCU determines whether the received version information is within the fixed upgrade version range in the MCU program.

[0102] In step S9, when the version information is not within the fixed upgrade version range in the MCU program, the upgrade is exited.

[0103] In step S10, when the version information is within the fixed upgrade version range in the MCU program, the upgrade is continued.

[0104] In the present invention, after the MCU receives the version information, the first digest value and the signature value sent by the diagnostic instrument, the MCU can determine whether the received version information is within the fixed upgrade version range in the MCU program. When the version information is not within the fixed upgrade version range in the MCU program, the upgrade can be exited. When the version information is within the fixed upgrade version range in the MCU program, the upgrade can continue to start. The MCU verifies the version information before upgrading the program, which can enhance the controlled range.

[0105] In one embodiment of the present invention, Figure 3 As shown, the process of verifying information before the MCU upgrade may include:

[0106] In step S11, the MCU calculates the signature value using the public key of the RSA2048 asymmetric algorithm to obtain the calculated digest value.

[0107] In step S12, the received first digest value is compared with the calculated digest value to see whether they are consistent.

[0108] In step S13, when the first digest value is consistent with the calculated digest value, the BootLoader is entered and the diagnostic instrument is requested to transmit a data packet.

[0109] In step S14, when the diagnostic instrument receives the transmission request from the MCU, it transmits the data packet to the MCU until the transmission is completed.

[0110] In step S15, when the first digest value and the calculated digest value are inconsistent, the upgrade is exited.

[0111] In the present invention, the MCU can verify the sender information before the program is upgraded. Specifically, the MCU can use the public key of the RSA2048 asymmetric algorithm to calculate the signature value so as to obtain the calculated summary value. After obtaining the calculated summary value, the first summary value and the calculated summary value can be compared to see if they are consistent. If the calculated summary value is consistent with the first summary value, it can be said that the identity authentication is successful, then the BootLoader can be entered and the diagnostic instrument can be requested to transmit the data packet. After the diagnostic instrument receives the transmission request from the MCU, it can start to transmit the data packet to the MCU until the transmission is completed. In the case where the first summary value and the calculated summary value are inconsistent, it can be said that the identity authentication has failed, then the upgrade can be exited. The sender's identity information is verified before the MCU upgrades the program. Only the private key end that matches the public key of the MCU end can be successfully authenticated, and then the subsequent upgrade can be carried out.

[0112] In one embodiment of the present invention, Figure 4 As shown, the process of verifying information during the MCU upgrade process may include:

[0113] In step S16, the MCU receives the data packet.

[0114] In step S17, the MCU calculates a second digest value of the data packet according to a hash algorithm.

[0115] In step S18, the first digest value and the second digest value are compared to see whether they are consistent.

[0116] In step S19, when the first digest value and the second digest value are consistent, the MCU requests the diagnostic instrument to send the secure boot data and its digest and signature value.

[0117] In step S20, after receiving the request, the diagnostic instrument generates secure boot data and calculates a third digest value of the secure boot data according to a hash algorithm.

[0118] In step S21 , the diagnostic instrument calculates a first signature value of the third digest value using a private key of the RSA2048 asymmetric algorithm.

[0119] In step S22 , the diagnostic instrument sends the secure boot data and the first signature value to the MCU for upgrading.

[0120] In step S23, when the first digest value and the second digest value are inconsistent, the upgrade is exited.

[0121] In the present invention, after the MCU receives the data packet, the data packet can be verified using a hash algorithm, and the second summary value of the data packet can be calculated, and then it can be compared with the first summary value received at the beginning. If the comparison is inconsistent, the upgrade can be exited. If the comparison is consistent, it can be explained that the data packet has not been tampered with during the transmission process, and the sent and received data are consistent. After the comparison is consistent, the MCU can start to request the diagnostic instrument to send safe boot data and its summary and signature value. After the diagnostic instrument receives the request, it can generate safe boot data, and can use the hash algorithm to calculate the third summary value of the safe boot data, and then use the private key of the RSA2048 asymmetric algorithm to calculate the first signature value of the third summary value, and then the safe boot data and the first signature value can be sent to the MCU, waiting for the MCU to respond to the upgrade. During the MCU upgrade process, the data is hashed, and after receiving all the data, it is compared with the summary sent by the diagnostic instrument to verify whether the data has been tampered with or lost during the transmission process, thereby further reducing the risk.

[0122] In one embodiment of the present invention, Figure 5 As shown, the process of the MCU re-verifying the information may include:

[0123] In step S24 , the MCU receives the secure boot data and the first signature value.

[0124] In step S25 , the MCU calculates a fourth digest value of the secure boot data according to a hash algorithm.

[0125] In step S26, the MCU calculates the digest value of the first signature value according to the public key of the RSA2048 asymmetric algorithm.

[0126] In step S27, it is determined whether the fourth digest value is consistent with the digest value of the first signature value.

[0127] In step S28, when the fourth digest value is consistent with the digest value of the first signature value, the received data packet is updated to the Flash and the BootLoader is exited.

[0128] In step S29, when the fourth digest value is inconsistent with the digest value of the first signature value, the upgrade is stopped.

[0129] In the present invention, after the MCU receives the secure boot data and the first signature value, the fourth summary value of the secure boot data can be calculated according to the hash algorithm, and then the summary value of the first signature value can be calculated using the public key of the RSA2048 asymmetric algorithm. After obtaining the summary value of the first signature value, the fourth summary value and the summary value of the first signature value can be compared to see if they are consistent. If they are inconsistent, it can be indicated that there is a problem with the data and the identity does not match, then the upgrade is stopped. The consistency of the two can indicate that the data matches, and the identity authentication is successful. The MCU can update the received data packet to the Flash, and then exit the BootLoader, and the software can reset the program to execute the upgrade. After the MCU data is transmitted, the identity information of the sender is further confirmed by the secure boot data, and at the same time, it is confirmed whether the upgrade program is valid according to the secure boot file, and the upgrade program is further executed.

[0130] On the other hand, the present invention can also provide an MCU software upgrade system for achieving network security, and the MCU software upgrade system includes a diagnostic instrument and an MCU.

[0131] The diagnostic instrument is used to receive an upgrade instruction from a user, load a data packet of a software upgrade to generate version information about the data packet, and calculate a first summary value of the data packet according to a hash algorithm.

[0132] The diagnostic instrument calculates the signature value of the first digest value according to the private key of the RSA2048 asymmetric algorithm.

[0133] The MCU is used to verify the version information before upgrading the program.

[0134] After verifying that the version information is correct, the MCU verifies the sender's identity information before upgrading, and receives the data packet sent by the diagnostic instrument after successful verification.

[0135] After receiving the data packet successfully, the MCU verifies the data packet during the upgrade process.

[0136] After the MCU successfully verifies the data packet during the upgrade process, it verifies the sender information again and upgrades the program based on the result.

[0137] In the present invention, when the MCU is upgraded, the diagnostic instrument can receive the user's upgrade instruction, and then load the data packet of the software upgrade so as to generate version information about the data packet, and calculate the first summary value of the data packet according to the hash algorithm. The diagnostic instrument can calculate the signature value of the first summary value according to the private key of the RSA2048 asymmetric algorithm. The diagnostic instrument can send the version information about the data packet, the first summary value and the signature value of the first summary value to the MCU. The MUC can verify the received version information before upgrading the program. After verifying that the version information is correct, the MCU can verify the identity information of the sender again before upgrading, and if the verification is successful, the data packet sent by the diagnostic instrument can be received. After successfully receiving the data packet, the MCU can also verify the data packet during the upgrade process to enhance the ability to detect whether the data is lost or tampered. After the MCU successfully verifies the data packet during the upgrade process, the sender information can be verified again, and the program can be upgraded according to the result. In the present invention, when the hash algorithm is calculated, 8 hash initial values ​​and 64 hash constants are initialized first, and then data preprocessing can be performed. There are two main steps for data preprocessing, namely, additional padding bits and additional length. After data preprocessing, the data can be decomposed into n 512-bit blocks, each block is 64 bytes of data; the CRC32 value of the middle 32 bytes of each block is calculated using the following polynomial, and then the CRC value is added to the 64 bytes of data to obtain a new 64-byte data:

[0138] X 32 +X 26 +X 23 +X 22 +X 16 +X 12 +X 11 +X 10 +X 8 +X 7 +X 5 +X 4 +X 2 +X 1 +X 0 .

[0139] This polynomial is a mathematical expression, represented as a 32-bit binary number, whose value is 0x04C11DB7, which is used in the calculation of CRC32.

[0140] Then each byte can be processed by f(x) = (x>>4|x<<4) to get new data. f(x) represents a calculation function, x is a byte, x>>4 represents a right shift of 4 bits, x<<4 represents a left shift of 4 bits, (x>>4|x<<4) represents the result of the right shift and the left shift, and the result is an OR operation, and finally a byte is output. In the previous step, 64 bytes or 16 words are obtained. The following formula can be used to calculate the remaining 48 words:

[0141]

[0142] XOR bitwise operation;

[0143] S n : Circularly shift right n bits, n can be 7, 18, 17, 19;

[0144] R n : Shift right by n bits, n can be 3 or 10;

[0145] W t : The last 48 words, t represents the subscript, and W represents the minimum operation unit (word);

[0146] α0, α1 represent the scale parameters.

[0147] Calculate the hash value of the first block: loop 64 times, use a series of nonlinear logic functions to calculate the initial value defined in the first step, the 64 words calculated in the fourth step, and the constants in the first step to get 8 new hash values. Loop to calculate the hash values ​​of n blocks to get the final hash value of the data.

[0148] In one embodiment of the present invention, the MCU verifies the version information before upgrading the program, including:

[0149] The MCU receives the version information, the first digest value and the signature value sent by the diagnostic instrument.

[0150] The MCU determines whether the received version information is within the fixed upgrade version range in the MCU program.

[0151] When the version information is not within the fixed upgrade version range in the MCU program, exit the upgrade.

[0152] When the version information is within the fixed upgrade version range in the MCU program, continue the upgrade.

[0153] In the present invention, after the MCU receives the version information, the first digest value and the signature value sent by the diagnostic instrument, the MCU can determine whether the received version information is within the fixed upgrade version range in the MCU program. When the version information is not within the fixed upgrade version range in the MCU program, the upgrade can be exited. When the version information is within the fixed upgrade version range in the MCU program, the upgrade can continue to start. The MCU verifies the version information before upgrading the program, which can enhance the controlled range.

[0154] In one embodiment of the present invention, after verifying that the version information is correct, the MCU verifies the sender identity information before upgrading, and after the verification is successful, receiving the data packet sent by the diagnostic instrument includes:

[0155] The MCU uses the public key of the RSA2048 asymmetric algorithm to calculate the signature value and obtain the digest value.

[0156] Compare the received first digest value and the calculated digest value to see if they are consistent.

[0157] When the first digest value is consistent with the calculated digest value, the BootLoader is entered and the diagnostic instrument is requested to transmit a data packet.

[0158] When the diagnostic instrument receives the transmission request from the MCU, it transmits the data packet to the MCU until the transmission is completed.

[0159] If the first digest value and the calculated digest value are inconsistent, the upgrade is aborted.

[0160] In the present invention, the MCU can verify the sender information before the program is upgraded. Specifically, the MCU can use the public key of the RSA2048 asymmetric algorithm to calculate the signature value so as to obtain the calculated summary value. After obtaining the calculated summary value, the first summary value and the calculated summary value can be compared to see if they are consistent. If the calculated summary value is consistent with the first summary value, it can be said that the identity authentication is successful, then the BootLoader can be entered and the diagnostic instrument can be requested to transmit the data packet. After the diagnostic instrument receives the transmission request from the MCU, it can start to transmit the data packet to the MCU until the transmission is completed. In the case where the first summary value and the calculated summary value are inconsistent, it can be said that the identity authentication has failed, then the upgrade can be exited. The sender's identity information is verified before the MCU upgrades the program. Only the private key end that matches the public key of the MCU end can be successfully authenticated, and then the subsequent upgrade can be carried out.

[0161] In one embodiment of the present invention, after successfully receiving the data packet, the MCU verifies the data packet during the upgrade process, including:

[0162] MCU receives the data packet.

[0163] The MCU calculates a second summary value of the data packet according to the hash algorithm.

[0164] Compare the first digest value and the second digest value to see if they are consistent.

[0165] When the first digest value and the second digest value are consistent, the MCU requests the diagnostic instrument to send the secure boot data and its digest and signature value.

[0166] After receiving the request, the diagnostic instrument generates secure boot data and calculates a third summary value of the secure boot data according to a hash algorithm.

[0167] The diagnostic instrument calculates a first signature value of the third digest value using a private key of the RSA2048 asymmetric algorithm.

[0168] The diagnostic instrument sends the secure boot data and the first signature value to the MCU for upgrading.

[0169] If the first digest value and the second digest value are inconsistent, the upgrade is aborted.

[0170] In the present invention, after the MCU receives the data packet, the data packet can be verified using a hash algorithm, and the second summary value of the data packet can be calculated, and then it can be compared with the first summary value received at the beginning. If the comparison is inconsistent, the upgrade can be exited. If the comparison is consistent, it can be explained that the data packet has not been tampered with during the transmission process, and the sent and received data are consistent. After the comparison is consistent, the MCU can start to request the diagnostic instrument to send safe boot data and its summary and signature value. After the diagnostic instrument receives the request, it can generate safe boot data, and can use the hash algorithm to calculate the third summary value of the safe boot data, and then use the private key of the RSA2048 asymmetric algorithm to calculate the first signature value of the third summary value, and then the safe boot data and the first signature value can be sent to the MCU, waiting for the MCU to respond to the upgrade. During the MCU upgrade process, the data is hashed, and after receiving all the data, it is compared with the summary sent by the diagnostic instrument to verify whether the data has been tampered with or lost during the transmission process, thereby further reducing the risk.

[0171] In one embodiment of the present invention, after the MCU successfully verifies the data packet during the upgrade process, the sender information is verified again, and the program upgrade is performed according to the result, including:

[0172] The MCU receives the secure boot data and the first signature value.

[0173] The MCU calculates a fourth digest value of the secure boot data according to the hash algorithm.

[0174] The MCU calculates the digest value of the first signature value according to the public key of the RSA2048 asymmetric algorithm.

[0175] Determine whether the fourth digest value is consistent with the digest value of the first signature value.

[0176] When the fourth digest value is consistent with the digest value of the first signature value, the received data packet is updated into the Flash and the BootLoader is exited.

[0177] When the fourth digest value is inconsistent with the digest value of the first signature value, the upgrade is stopped.

[0178] In the present invention, after the MCU receives the secure boot data and the first signature value, the fourth summary value of the secure boot data can be calculated according to the hash algorithm, and then the summary value of the first signature value can be calculated using the public key of the RSA2048 asymmetric algorithm. After obtaining the summary value of the first signature value, the fourth summary value and the summary value of the first signature value can be compared to see if they are consistent. If they are inconsistent, it can be indicated that there is a problem with the data and the identity does not match, then the upgrade is stopped. The consistency of the two can indicate that the data matches, and the identity authentication is successful. The MCU can update the received data packet to the Flash, and then exit the BootLoader, and the software can reset the program to execute the upgrade. After the MCU data is transmitted, the identity information of the sender is further confirmed by the secure boot data, and at the same time, it is confirmed whether the upgrade program is valid according to the secure boot file, and the upgrade program is further executed.

[0179] Through the above technical scheme, the diagnostic instrument of a MCU software upgrade method and system for realizing network security provided by the present invention can load the data packet of software upgrade after receiving the upgrade instruction of the user, so as to generate the version information about the data packet, and the diagnostic instrument can calculate the first summary value of the data packet according to the hash algorithm. The diagnostic instrument can calculate the signature value of the first summary value according to the private key of the RSA2048 asymmetric algorithm, and after obtaining the version information, the first summary value and the signature value of the first summary value, these values ​​can be sent to the MCU. The MCU receives these data, and can verify whether the version information is correct before the upgrade program, after verifying that the version information is correct, the MCU can also verify the sender identity information before the upgrade, and can receive the data packet sent by the diagnostic instrument after the verification is successful. After the MCU successfully receives the data packet, the data packet can also be verified again during the upgrade process. After the verification is completed during the upgrade process, the MCU can verify the sender information again, and can perform program upgrade according to the result, and the MCU software upgrade method and system can verify network security multiple times during the upgrade process to reduce the security risk in the MCU upgrade.

[0180] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0181] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0182] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0183] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0184] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0185] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0186] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0187] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0188] The above are only embodiments of the present application and are not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included within the scope of the claims of the present application.

Claims

1. A method for upgrading MCU software to achieve network security, characterized in that: The MCU software upgrade method comprises: After receiving the upgrade instruction from the user, the diagnostic instrument loads the data packet of the software upgrade to generate version information about the data packet, and calculates the first summary value of the data packet according to the hash algorithm; The diagnostic instrument calculates the signature value of the first digest value according to the private key of the RSA2048 asymmetric algorithm; The MCU verifies the version information before upgrading the program; After verifying that the version information is correct, the MCU verifies the identity information of the sender before upgrading, and receives the data packet sent by the diagnostic instrument after successful verification; After successfully receiving the data packet, the MCU verifies the data packet during the upgrade process; After the MCU successfully verifies the data packet during the upgrade process, it verifies the sender information again and performs program upgrade according to the result.

2. The MCU software upgrade method according to claim 1, characterized in that: The MCU verifies the version information before upgrading the program, including: The MCU receives the version information, the first digest value and the signature value sent by the diagnostic instrument; The MCU determines whether the received version information is within the fixed upgrade version range in the MCU program; When the version information is not within the fixed upgrade version range in the MCU program, exit the upgrade; When the version information is within the fixed upgrade version range in the MCU program, the upgrade continues.

3. The MCU software upgrade method according to claim 2, characterized in that: After verifying that the version information is correct, the MCU verifies the sender identity information before upgrading, and after successful verification, receives the data packet sent by the diagnostic instrument, including: The MCU uses the public key of the RSA2048 asymmetric algorithm to calculate the signature value to obtain a calculation summary value; Comparing the received first digest value with the calculated digest value to see whether they are consistent; When the first summary value is consistent with the calculated summary value, entering the BootLoader and requesting the diagnostic instrument to transmit the data packet; When the diagnostic instrument receives the transmission request from the MCU, it transmits the data packet to the MCU until the transmission is completed; When the first digest value and the calculated digest value are inconsistent, the upgrade is exited.

4. The MCU software upgrade method according to claim 3, characterized in that: After successfully receiving the data packet, the MCU verifies the data packet during the upgrade process including: The MCU receives the data packet; The MCU calculates a second summary value of the data packet according to a hash algorithm; comparing whether the first digest value and the second digest value are consistent; When the first digest value and the second digest value are consistent, the MCU requests the diagnostic instrument to send secure boot data and its digest and signature value; After receiving the request, the diagnostic instrument generates secure boot data and calculates a third summary value of the secure boot data according to a hash algorithm; The diagnostic instrument calculates the first signature value of the third digest value using the private key of the RSA2048 asymmetric algorithm; The diagnostic instrument sends the secure boot data and the first signature value to the MCU for upgrading; When the first digest value and the second digest value are inconsistent, the upgrade is exited.

5. The MCU software upgrade method according to claim 4, characterized in that: After the MCU successfully verifies the data packet during the upgrade process, it verifies the sender information again and performs a program upgrade based on the result, including: The MCU receives the secure boot data and the first signature value; The MCU calculates a fourth digest value of the secure boot data according to a hash algorithm; The MCU calculates the digest value of the first signature value according to the public key of the RSA2048 asymmetric algorithm; Determine whether the fourth digest value is consistent with the digest value of the first signature value; When the fourth digest value is consistent with the digest value of the first signature value, the received data packet is updated into the Flash and the BootLoader is exited; When the fourth digest value is inconsistent with the digest value of the first signature value, the upgrade is stopped.

6. An MCU software upgrade system for achieving network security, characterized in that: The MCU software upgrade system includes a diagnostic instrument and an MCU; The diagnostic instrument is used to receive an upgrade instruction from a user, load a data packet of a software upgrade to generate version information about the data packet, and calculate a first summary value of the data packet according to a hash algorithm; The diagnostic instrument calculates the signature value of the first digest value according to the private key of the RSA2048 asymmetric algorithm; MCU is used to verify the version information before upgrading the program; After verifying that the version information is correct, the MCU verifies the identity information of the sender before upgrading, and receives the data packet sent by the diagnostic instrument after successful verification; After successfully receiving the data packet, the MCU verifies the data packet during the upgrade process; After the MCU successfully verifies the data packet during the upgrade process, it verifies the sender information again and performs program upgrade according to the result.

7. The MCU software upgrade system according to claim 6, characterized in that: The MCU verifies the version information before upgrading the program, including: The MCU receives the version information, the first digest value and the signature value sent by the diagnostic instrument; The MCU determines whether the received version information is within the fixed upgrade version range in the MCU program; When the version information is not within the fixed upgrade version range in the MCU program, exit the upgrade; When the version information is within the fixed upgrade version range in the MCU program, the upgrade continues.

8. The MCU software upgrade system according to claim 7, characterized in that: After verifying that the version information is correct, the MCU verifies the sender identity information before upgrading, and after successful verification, receives the data packet sent by the diagnostic instrument, including: The MCU uses the public key of the RSA2048 asymmetric algorithm to calculate the signature value to obtain a calculation summary value; Comparing the received first digest value with the calculated digest value to see whether they are consistent; When the first summary value is consistent with the calculated summary value, entering the BootLoader and requesting the diagnostic instrument to transmit the data packet; When the diagnostic instrument receives the transmission request from the MCU, it transmits the data packet to the MCU until the transmission is completed; When the first digest value and the calculated digest value are inconsistent, the upgrade is exited.

9. The MCU software upgrade system according to claim 8, characterized in that: After successfully receiving the data packet, the MCU verifies the data packet during the upgrade process including: The MCU receives the data packet; The MCU calculates a second summary value of the data packet according to a hash algorithm; comparing whether the first digest value and the second digest value are consistent; When the first digest value and the second digest value are consistent, the MCU requests the diagnostic instrument to send secure boot data and its digest and signature value; After receiving the request, the diagnostic instrument generates secure boot data and calculates a third summary value of the secure boot data according to a hash algorithm; The diagnostic instrument calculates the first signature value of the third digest value using the private key of the RSA2048 asymmetric algorithm; The diagnostic instrument sends the secure boot data and the first signature value to the MCU for upgrading; When the first digest value and the second digest value are inconsistent, the upgrade is exited.

10. The MCU software upgrade system according to claim 9, characterized in that: After the MCU successfully verifies the data packet during the upgrade process, it verifies the sender information again and performs a program upgrade based on the result, including: The MCU receives the secure boot data and the first signature value; The MCU calculates a fourth digest value of the secure boot data according to a hash algorithm; The MCU calculates the digest value of the first signature value according to the public key of the RSA2048 asymmetric algorithm; Determine whether the fourth digest value is consistent with the digest value of the first signature value; When the fourth digest value is consistent with the digest value of the first signature value, the received data packet is updated into the Flash and the BootLoader is exited; When the fourth digest value is inconsistent with the digest value of the first signature value, the upgrade is stopped.

Images