Over-the-air upgrade method and device, and computer readable medium

Abstract

The invention provides an OTA upgrading method executed by client equipment. The method comprises the following steps: receiving a second upgrading package sent by server equipment; the second upgrade package comprises a server certificate and an upgrade file signed by a server private key; the server certificate is obtained by signing a server public key by a certificate platform according to a root private key, the server private key and the server public key are key pairs generated by server equipment in advance, the root private key and the root public key are key pairs generated by the certificate platform in advance, and the root public key is preset in client equipment; verifying the validity of the server public key in the server certificate by using the root public key; in response to validity of the server public key, verifying correctness of the upgrade file by using the server public key; and in response to the correctness of the upgrading file, upgrading by using the upgrading file. The invention further provides a method and equipment for OTA upgrading of other applications and a computer readable medium.

Description

Technical Field

[0001] The present disclosure relates to the technical field of Over the Air (OTA) upgrade, and in particular to a method and device for OTA upgrade, and a computer-readable medium. Background Art

[0002] Over the Air (OTA) upgrade refers to a remote management technology in which a client device obtains an upgrade file through the air interface of wireless communication and performs software / hardware upgrades and configuration updates based on the upgrade file.

[0003] However, it is difficult for the OTA upgrade method in related technologies to ensure convenience and security at the same time. Summary of the invention

[0004] The present disclosure provides an OTA upgrade method and device, and a computer-readable medium.

[0005] One aspect of an embodiment of the present disclosure provides an OTA upgrade method, which is performed by a client device, and the method includes:

[0006] Receive a second upgrade package sent by the server device; the second upgrade package includes a server certificate and an upgrade file signed by a server private key; the server certificate is obtained by signing a server public key with a root private key by a certificate platform, the server private key and the server public key are a key pair pre-generated by the server device, the root private key and the root public key are a key pair pre-generated by the certificate platform, and the root public key is pre-set in the client device;

[0007] Verifying the validity of the server public key in the server certificate using a root public key;

[0008] In response to the server public key being valid, verifying the correctness of the upgrade file using the server public key;

[0009] In response to the upgrade file being correct, the upgrade is performed using the upgrade file.

[0010] One aspect of an embodiment of the present disclosure provides an OTA upgrade method, which is performed by a publisher device, and the method includes:

[0011] Generate a first upgrade package; the first upgrade package includes a publisher certificate and an upgrade file signed by a publisher private key; the publisher certificate is obtained by signing the publisher public key according to the root private key of the certificate platform, the publisher private key and the publisher public key are a key pair pre-generated by the publisher device, and the root private key and the root public key are a key pair pre-generated by the certificate platform;

[0012] Send the first upgrade package to the server device.

[0013] One aspect of an embodiment of the present disclosure provides an OTA upgrade method, which is performed by a server device, and the method includes:

[0014] Receive a first upgrade package sent by a publisher device; the first upgrade package includes a publisher certificate and an upgrade file signed by a publisher private key; the publisher certificate is obtained by signing a publisher public key with a root private key by a certificate platform, the publisher private key and the publisher public key are a key pair pre-generated by the publisher device, the root private key and the root public key are a key pair pre-generated by the certificate platform, and the root public key is pre-set in the server device;

[0015] Verifying the validity of the publisher's public key in the publisher's certificate using a root public key;

[0016] In response to the publisher public key being valid, verifying the correctness of the upgrade file using the publisher public key;

[0017] In response to the upgrade file being correct, a second upgrade package is generated; the second upgrade package includes a server certificate and the upgrade file signed by a server private key; the server certificate is obtained by the certificate platform signing a server public key according to the root private key, and the server private key and the server public key are a key pair pre-generated by the server device;

[0018] The second upgrade package is sent to the client device.

[0019] One aspect of an embodiment of the present disclosure provides an OTA upgrade method, which includes:

[0020] The publisher device generates a first upgrade package; the first upgrade package includes a publisher certificate and an upgrade file signed by the publisher private key; the publisher certificate is obtained by signing the publisher public key according to the root private key of the certificate platform, the publisher private key and the publisher public key are a key pair pre-generated by the publisher device, and the root private key and the root public key are a key pair pre-generated by the certificate platform;

[0021] The publisher device sends the first upgrade package to the server device;

[0022] The server device receives the first upgrade package sent by the publisher device; the root public key is preset in the server device;

[0023] The server device verifies the validity of the publisher public key in the publisher certificate using the root public key;

[0024] In response to the publisher public key being valid, the server device verifies the correctness of the upgrade file using the publisher public key;

[0025] In response to the upgrade file being correct, the server device generates a second upgrade package; the second upgrade package includes a server certificate and the upgrade file signed by a server private key; the server certificate is obtained by the certificate platform signing a server public key according to the root private key, and the server private key and the server public key are a key pair pre-generated by the server device;

[0026] The server device sends the second upgrade package to the client device;

[0027] The client device receives the second upgrade package sent by the server device; the root public key is preset in the client device;

[0028] The client device verifies the validity of the server public key in the server certificate using the root public key;

[0029] In response to the server public key being valid, the client device verifies the correctness of the upgrade file using the server public key;

[0030] In response to the upgrade file being correct, the client device uses the upgrade file for upgrading.

[0031] One aspect provided by an embodiment of the present disclosure provides a client device, which includes a memory and a processor; the memory stores a computer program that can be executed by the processor, and when the computer program is executed by the processor, any one of the OTA upgrade methods of the embodiments of the present disclosure is implemented.

[0032] One aspect provided by an embodiment of the present disclosure provides a publisher device, which includes a memory and a processor; the memory stores a computer program that can be executed by the processor, and when the computer program is executed by the processor, it implements any one of the OTA upgrade methods of the embodiments of the present disclosure.

[0033] One aspect provided by an embodiment of the present disclosure provides a server device, which includes a memory and a processor; the memory stores a computer program that can be executed by the processor, and when the computer program is executed by the processor, it implements any one of the OTA upgrade methods of the embodiments of the present disclosure.

[0034] One aspect provided by an embodiment of the present disclosure provides a computer-readable medium having a computer program stored thereon, and when the computer program is executed by a processor, any one of the OTA upgrade methods of the embodiments of the present disclosure is implemented.

[0035] The OTA upgrade in the disclosed embodiment can be performed in a general wireless communication network, so it is flexible and convenient; at the same time, the upgrade file is doubly authenticated by asymmetric encryption of certificate (based on root private key) and signature (based on device private key) during all processes, so its security is greatly improved, and the confidentiality and integrity of the upgrade file can be well guaranteed. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] In the accompanying drawings of the embodiments of the present disclosure:

[0037] Figure 1 A flowchart of a method for OTA upgrade of a publisher device provided in an embodiment of the present disclosure;

[0038] Figure 2 A flowchart of a method for OTA upgrade of a server device provided in an embodiment of the present disclosure;

[0039] Figure 3 A flowchart of a method for OTA upgrade of a client device provided in an embodiment of the present disclosure;

[0040] Figure 4 A block diagram of a publisher device provided in an embodiment of the present disclosure;

[0041] Figure 5 A block diagram of a server device provided in an embodiment of the present disclosure;

[0042] Figure 6 A block diagram of a client device provided in an embodiment of the present disclosure;

[0043] Figure 7 A block diagram of a computer-readable medium provided for an embodiment of the present disclosure;

[0044] Figure 8 A schematic diagram of the architecture of a system used in a specific OTA upgrade method provided in an embodiment of the present disclosure;

[0045] Fig. 9 A schematic diagram of signaling transmission in a specific OTA upgrade method provided in an embodiment of the present disclosure;

[0046] Fig.10 A schematic diagram of the working process of a PKI platform (certificate platform) in a specific OTA upgrade method provided in an embodiment of the present disclosure;

[0047] Fig.11 A schematic diagram of the working process of an ECU supplier side (publisher device) in a specific OTA upgrade method provided in an embodiment of the present disclosure;

[0048] Fig.12A schematic diagram of the working process of an OTA cloud server (server device) in a specific OTA upgrade method provided in an embodiment of the present disclosure;

[0049] Fig.13 A schematic diagram of the working process of an OTA management unit (upgrade management module) of a vehicle-mounted terminal (client device) in a specific OTA upgrade method provided in an embodiment of the present disclosure;

[0050] Fig.14 A schematic diagram of the working process of EUC (functional module) of a vehicle-mounted terminal (client device) in a specific OTA upgrade method provided in an embodiment of the present disclosure;

[0051] Fig.15 A flowchart of an OTA upgrade method provided in an embodiment of the present disclosure. DETAILED DESCRIPTION

[0052] In order to enable those skilled in the art to better understand the technical solution of the present disclosure, the OTA upgrade method and device, and computer-readable medium provided by the embodiments of the present disclosure are described in detail below with reference to the accompanying drawings.

[0053] The present disclosure will be described more fully below with reference to the accompanying drawings, but the embodiments shown may be embodied in different forms, and the present disclosure should not be construed as being limited to the embodiments set forth below. On the contrary, the purpose of providing these embodiments is to make the present disclosure thorough and complete, and will enable those skilled in the art to fully understand the scope of the present disclosure.

[0054] The accompanying drawings of the embodiments of the present disclosure are used to provide a further understanding of the embodiments of the present disclosure, and constitute a part of the specification, and are used together with the detailed embodiments to explain the present disclosure, and do not constitute a limitation of the present disclosure. By describing the detailed embodiments with reference to the accompanying drawings, the above and other features and advantages will become more apparent to those skilled in the art.

[0055] The present disclosure may be described with reference to plan views and / or cross-sectional views by means of ideal schematic views of the present disclosure. Therefore, the exemplary illustrations may be modified according to manufacturing techniques and / or tolerances.

[0056] In the absence of conflict, the various embodiments of the present disclosure and the various features therein may be combined with each other.

[0057] The terms used in the present disclosure are only used to describe specific embodiments and are not intended to limit the present disclosure. The term "and / or" as used in the present disclosure includes any and all combinations of one or more related enumerated items. The singular forms "one" and "the" as used in the present disclosure are also intended to include plural forms, unless the context clearly indicates otherwise. The terms "including", "made of..." as used in the present disclosure specify the presence of the features, wholes, steps, operations, elements and / or components, but do not exclude the presence or addition of one or more other features, wholes, steps, operations, elements, components and / or groups thereof.

[0058] Unless otherwise defined, all terms (including technical and scientific terms) used in this disclosure have the same meaning as commonly understood by those of ordinary skill in the art. It will also be understood that terms such as those defined in commonly used dictionaries should be interpreted as having a meaning consistent with their meaning in the context of the relevant art and this disclosure, and will not be interpreted as having an idealized or overly formal meaning unless explicitly defined in this disclosure.

[0059] The present disclosure is not limited to the embodiments shown in the drawings, but includes modifications of the configurations formed based on the manufacturing process. Therefore, the regions illustrated in the drawings have schematic properties, and the shapes of the regions shown in the drawings illustrate the specific shapes of the regions of the elements, but are not intended to be limiting.

[0060] Over the Air (OTA) upgrade refers to a remote management technology that allows client devices to obtain upgrade files through the air interface of wireless communication and perform software / hardware upgrades and configuration updates based on the upgrade files. Through OTA upgrades, suppliers can remotely add functions, fix defects, and patch vulnerabilities to client devices, so OTA upgrades have been increasingly widely used. For example, many ECUs (electronic control units) in vehicles must be implemented under certain program control, and these programs can be upgraded through OTA upgrades.

[0061] In some related technologies, OTA upgrades can be performed in a specially constructed local area network. This method builds a relatively closed environment and has high security. However, the above method requires the client device to be upgraded and the server device with the upgrade file to form a separate local area network, so it loses the convenience of upgrading in an unspecified area through a wireless communication network, and the process is complicated and inflexible.

[0062] In other related technologies, wireless communication networks can be used directly for OTA upgrades, which is a more convenient method. However, the upgrade files transmitted in the above methods are easily tampered with, attacked, forged, etc. by third parties, causing security issues for client devices (such as vehicles). Although some security measures can also be taken in the above technologies, they still cannot effectively guarantee the security of the OTA upgrade process; for example, the upgrade file can be encrypted with a key before transmission, but the above process requires that both the server device and the client device store the key, which makes the key easy to be stolen.

[0063] However, it is difficult for the OTA upgrade method in related technologies to ensure convenience and security at the same time.

[0064] In a first aspect, an embodiment of the present disclosure provides an OTA upgrade method, which is performed by a publisher.

[0065] The OTA upgrade method of the disclosed embodiment is performed by a publisher device. The publisher device is a user terminal of the software and hardware supplier of the client device to be upgraded, that is, after the supplier has written the upgrade file for upgrading, it can be published to the server device through the client device for OTA upgrade.

[0066] Reference Figure 1 , the method of the embodiment of the present disclosure includes:

[0067] S101: Generate a first upgrade package.

[0068] Among them, the first upgrade package includes the publisher certificate and the upgrade file signed by the publisher's private key; the publisher certificate is obtained by the certificate platform signing the publisher's public key based on the root private key, the publisher's private key and the publisher's public key are the key pairs pre-generated by the publisher's device, and the root private key and the root public key are the key pairs pre-generated by the certificate platform.

[0069] Reference Fig.11 , the publisher device first generates a key pair (publisher public key and publisher private key), and sends a request for publisher certificate to the certificate platform, which at least includes the publisher public key.

[0070] Based on the above request, the certificate platform signs the publisher's public key with a pre-generated root private key (such as encrypting the publisher's public key with the root private key according to an asymmetric encryption algorithm), obtains a publisher certificate including the signed publisher's public key, and sends the publisher certificate to the publisher's device.

[0071] Furthermore, the publisher device can use its own private key (publisher private key) to sign the upgrade file (such as first using a digest algorithm and then using an asymmetric encryption algorithm to generate a signature image), and package the signed upgrade file (such as the source data of the upgrade file and the signature image) and the publisher certificate together to obtain the first upgrade package provided to the server device.

[0072] S102: Send the first upgrade package to the server device.

[0073] Reference Fig.11 After the upgrade file is written, when the upgrade file needs to be sent to the server device for downloading, the publisher device can send the first upgrade package to the server device so that the subsequent client device can download the upgrade file from the server device.

[0074] In a second aspect, an embodiment of the present disclosure provides an OTA upgrade method, which is executed by a server device.

[0075] The OTA upgrade method of the embodiment of the present disclosure is performed by a server device. The server device is a server storing upgrade files in the cloud, wherein the stored upgrade files can be downloaded by a client device for OTA upgrade.

[0076] Reference Figure 2 , the method of the embodiment of the present disclosure includes:

[0077] S201: Receive a first upgrade package sent by a publisher device.

[0078] Among them, the first upgrade package includes the publisher certificate and the upgrade file signed by the publisher's private key; the publisher certificate is obtained by the certificate platform signing the publisher's public key based on the root private key, the publisher's private key and the publisher's public key are the key pairs pre-generated by the publisher's device, the root private key and the root public key are the key pairs pre-generated by the certificate platform, and the root public key is pre-set in the server device.

[0079] S202: Use the root public key to verify the validity of the publisher's public key in the publisher's certificate.

[0080] S203: In response to the publisher's public key being valid, verify the correctness of the upgrade file using the publisher's public key.

[0081] Reference Fig.12 , the server device needs to obtain the public key of the publisher device (publisher public key) and the public key of the certificate platform (root public key) in advance.

[0082] Therefore, when the server device obtains the above first upgrade package, it can first use the root public key to verify the publisher public key in the publisher certificate in the first upgrade package (such as comparing whether the publisher public key obtained by decrypting with the root public key is consistent with the publisher public key obtained in advance) to determine whether the publisher public key is valid; if the verification passes (the publisher public key is valid), the server device then uses the publisher public key to verify the upgrade file in the first upgrade package (such as comparing whether the data obtained by decrypting with the publisher public key is consistent with the source data of the upgrade file) to determine whether the upgrade file is correct.

[0083] S204: In response to the upgrade file being correct, generate a second upgrade package.

[0084] Among them, refer to Fig.12 The second upgrade package includes a server certificate and an upgrade file signed by a server private key; the server certificate is obtained by signing the server public key with the root private key of the certificate platform, and the server private key and the server public key are a key pair pre-generated by the server device.

[0085] When both of the above double signature verifications are passed, it means that the integrity of the first upgrade package obtained by the server device is good, and the upgrade file therein is safe and reliable and can be downloaded by the client device.

[0086] Furthermore, the server device can generate its own key pair (server public key and server private key) in a similar manner, and then apply to the authentication platform for a server certificate including a signed server public key (such as using a root private key plus a server public key according to an asymmetric encryption algorithm); thereafter, the server device uses the server private key to sign the acquired upgrade file (such as first using a digest algorithm, and then using an asymmetric encryption algorithm to generate a signed image), and packages the signed upgrade file (such as the source data of the upgrade file and the signed image) and the server certificate together to obtain a second upgrade package for the client device to download.

[0087] S205: Send the second upgrade package to the client device.

[0088] Therefore, refer to Fig.12 When the client needs to be upgraded, the second upgrade package can be sent to the client device for the client to perform OTA upgrade.

[0089] In some embodiments, the second upgrade package is divided into a plurality of differential upgrade packages; and sending the second upgrade package to the client device (S205) includes:

[0090] S2051. Send at least part of the differential upgrade package to the client device.

[0091] Reference Fig.12As one method of the embodiment of the present disclosure, differential processing can be used when making the second upgrade package (of course, the corresponding signature process and other processes are also differential processing), so that the client device can only download the differential upgrade package that is actually needed, and then restore the differential upgrade package according to the differential strategy.

[0092] In a third aspect, an embodiment of the present disclosure provides an OTA upgrade method, which is executed by a client device.

[0093] The OTA upgrade method of the embodiment of the present disclosure is performed by a client device. The client device is a device including a module that actually needs to be upgraded using an upgrade file, such as a vehicle including an ECU that needs to be upgraded.

[0094] Reference Figure 3 , the method of the embodiment of the present disclosure includes:

[0095] S301: Receive a second upgrade package sent by a server device.

[0096] Among them, the second upgrade package includes the server certificate and the upgrade file signed by the server private key; the server certificate is obtained by the certificate platform signing the server public key based on the root private key, the server private key and the server public key are a key pair pre-generated by the server device, the root private key and the root public key are a key pair pre-generated by the certificate platform, and the root public key is pre-set in the client device.

[0097] When a module in the client device needs to be upgraded, the second upgrade package is received from the server device.

[0098] S302: Use the root public key to verify the validity of the server public key in the server certificate.

[0099] S303: In response to the server public key being valid, verify the correctness of the upgrade file using the server public key.

[0100] Reference Fig.13 , the client device also obtains the public key of the server device (server public key) and the public key of the certificate platform (root public key) in advance.

[0101] Therefore, when the client device obtains the above second upgrade package, it can use the root public key to verify the server public key in the server certificate in the second upgrade package in a similar manner (such as comparing the server public key obtained by decrypting the root public key with the server public key obtained in advance to see whether they are consistent) to determine whether it is valid; if the verification passes (the server public key is valid), the client device then uses the server public key to verify the upgrade file in the second upgrade package (such as comparing the data obtained by decrypting the server public key with the source data of the upgrade file to see whether they are consistent) to determine whether it is correct.

[0102] S304: In response to the upgrade file being correct, use the upgrade file to perform an upgrade.

[0103] Reference Fig.13 When both of the above double signature verifications are passed, it means that the integrity of the second upgrade package obtained by the client device is good, the upgrade file therein is safe and reliable, and the upgrade file can be used to actually perform the upgrade.

[0104] It can be seen that the OTA upgrade in the embodiment of the present disclosure can be performed in a general wireless communication network, so it is flexible and convenient; at the same time, the upgrade file is doubly authenticated by asymmetric encryption of certificate (based on root private key) and signature (based on device private key) in all processes, so its security is greatly improved, and the confidentiality and integrity of the upgrade file can be well guaranteed.

[0105] In some embodiments, the client device includes an upgrade management module and at least one functional module; the step of receiving the second upgrade package sent by the server device (S301), the step of verifying the validity of the server public key in the server certificate using the root public key (S302), and the step of verifying the correctness of the upgrade file using the server public key (S303) are performed by the upgrade management module;

[0106] Using the upgrade file to perform the upgrade (S304) includes:

[0107] S3041. The upgrade management module sends the upgrade file to the corresponding functional module.

[0108] S3042. The function module verifies the upgrade file.

[0109] S3043. In response to the verification being passed, the functional module installs the upgrade file.

[0110] Reference Fig.14 As one embodiment of the present disclosure, a client device (such as a vehicle) may actually include an upgrade management module (such as a central control module) for unified management of upgrade files, and one or more functional modules (such as ECU) that actually use the upgrade files for upgrading.

[0111] Therefore, the upgrade management module can be used to download and verify the second upgrade package. Only when the verification is passed will the upgrade file be sent to the required functional module through the channel inside the client device (such as a bus). After the functional module verifies the upgrade file, it actually uses it for upgrading, so as to further ensure the board-level communication security (Secoc, Security Onboard Communication) inside the client device and avoid the internal transmission messages from being intercepted, tampered with, replayed, etc.

[0112] It can be seen that through the above method, the embodiment of the present disclosure realizes "closed-loop" protection of the entire process of all links in the OTA upgrade process (the link in which the server device obtains the upgrade file, the link in which the client device obtains the upgrade file, and the link in which the functional module to be upgraded actually obtains the upgrade file), thereby ensuring the security of the OTA upgrade to the greatest extent.

[0113] In some embodiments, the function module verifies the upgrade file (S3042) including:

[0114] S3042A1. The function module uses a message verification code and / or a fresh value to verify the upgrade file.

[0115] As a method of an embodiment of the present disclosure, the upgrade file transmitted within the client device can be verified by using a message verification code (mainly to ensure data correctness), a freshness value (mainly to ensure anti-replay), etc.

[0116] In some embodiments, the upgrade management module sends the upgrade file to the corresponding function module (S3041) including:

[0117] S30411. The upgrade management module sends the second upgrade package to the corresponding functional module.

[0118] The function module verifies the upgrade file (S3042) including:

[0119] S3042B1, the function module verifies the validity of the server public key in the server certificate using the root public key;

[0120] S3042B2. In response to the server public key being valid, the function module uses the server public key to verify the correctness of the upgrade file.

[0121] As a method of an embodiment of the present disclosure, the upgrade management module can also send the second upgrade package to the corresponding functional module. Accordingly, the functional module can first use the root public key to verify the server public key in the server certificate, and then use the server public key to verify the upgrade file, that is, the above double signature verification method can also be adopted.

[0122] It should be understood that the above verification using "message verification code, fresh value" and the verification using "root public key, server public key" are two verification processes that are not necessarily related. Both verifications can be performed, or only one of them can be performed.

[0123] It should be understood that the specific form of each step in the OTA upgrade method of the embodiment of the present disclosure may be changed, or other steps may be included.

[0124] For example, in the process of applying for a publisher certificate and a server certificate, the certificate platform may first perform mutual identity authentication with the publisher device and the server device.

[0125] For another example, the publisher certificate and server certificate may also include basic information of the publisher device and server device, domain name and other information.

[0126] For another example, the publisher device and the server device may first authenticate each other before transmitting the first upgrade package; and the server device and the client device may first authenticate each other before transmitting the second upgrade package.

[0127] For another example, the triggering conditions of the upgrade process are various. For example, the server device may broadcast the information of the upgrade file therein (such as the upgrade file version), and the client device may start the upgrade process when it determines that it needs the upgrade file based on the broadcast. Alternatively, the client device may send a request to the server device to obtain the information of the upgrade file therein, and then decide whether to upgrade itself.

[0128] For another example, the order of the steps can be adjusted as needed. For example, the server device can make and store the second upgrade package after receiving the upgrade file, waiting for the client device to download it, or the server device can make the second upgrade package after receiving the download request from the client device.

[0129] For example, each signature and verification can adopt different known methods. For example, during the signature verification process, the public key pair can be used for decryption, and the decryption result can be compared with the directly obtained unencrypted data to see if they are consistent. Alternatively, the public key can be used for encryption, and the encryption result can be compared with the directly obtained encrypted file to see if they are consistent.

[0130] For another example, the key pair generation algorithm, symmetric encryption algorithm, asymmetric encryption algorithm, digest algorithm, etc. used in the upgrade can be any known specific algorithm.

[0131] For another example, the functional module may verify the upgrade file by other known verification methods.

[0132] For another example, when the verification fails, the corresponding OTA upgrade process should be stopped, and an alarm may be issued, or a request may be made to restart the upgrade process.

[0133] Fourthly, refer to Fig.15 The present disclosure provides an OTA upgrade method, which includes:

[0134] S401: A publisher device generates a first upgrade package.

[0135] Among them, the first upgrade package includes the publisher certificate and the upgrade file signed by the publisher's private key; the publisher certificate is obtained by the certificate platform signing the publisher's public key based on the root private key, the publisher's private key and the publisher's public key are the key pairs pre-generated by the publisher's device, and the root private key and the root public key are the key pairs pre-generated by the certificate platform.

[0136] S402: The publisher device sends the first upgrade package to the server device.

[0137] S403: The server device receives a first upgrade package sent by the publisher device.

[0138] The root public key is preset in the server device.

[0139] S404: The server device verifies the validity of the publisher's public key in the publisher's certificate using the root public key.

[0140] S405: In response to the publisher's public key being valid, the server device verifies the correctness of the upgrade file using the publisher's public key.

[0141] S406: In response to the upgrade file being correct, the server device generates a second upgrade package.

[0142] Among them, the second upgrade package includes a server certificate and an upgrade file signed by a server private key; the server certificate is obtained by the certificate platform signing the server public key based on the root private key, and the server private key and the server public key are a key pair pre-generated by the server device.

[0143] S407: The server device sends the second upgrade package to the client device.

[0144] S408: The client device receives the second upgrade package sent by the server device.

[0145] The root public key is preset in the client device.

[0146] S409: The client device verifies the validity of the server public key in the server certificate using the root public key.

[0147] S410 . In response to the server public key being valid, the client device verifies the correctness of the upgrade file using the server public key.

[0148] S411 . In response to the upgrade file being correct, the client device uses the upgrade file for upgrade.

[0149] The OTA upgrade method of the embodiment of the present disclosure is completed jointly by multiple devices (publisher device, server device, client device).

[0150] It should be understood that in the OTA upgrade method of the embodiment of the present disclosure, the specific process executed by the device at each end can further refer to the detailed content of the corresponding OTA upgrade method.

[0151] For example, if the client device includes an upgrade management module and a functional module, the upgrade file may be sent from the upgrade management module to the functional module, and the upgrade file sent from the upgrade management module to the functional module may be further verified.

[0152] Fifth, refer to Figure 4 The embodiment of the present disclosure provides a publisher device, which includes a memory and a processor; the memory stores a computer program that can be executed by the processor, and when the computer program is executed by the processor, any one of the OTA upgrade methods of the embodiment of the present disclosure is implemented.

[0153] Sixth, refer to Figure 5 An embodiment of the present disclosure provides a server device, which includes a memory and a processor; the memory stores a computer program that can be executed by the processor, and when the computer program is executed by the processor, any one of the OTA upgrade methods of the embodiments of the present disclosure is implemented.

[0154] Seventh, refer to Figure 6 An embodiment of the present disclosure provides a client device, which includes a memory and a processor; the memory stores a computer program that can be executed by the processor, and when the computer program is executed by the processor, any one of the OTA upgrade methods of the embodiments of the present disclosure is implemented.

[0155] Eighth aspect, refer to Figure 7 An embodiment of the present disclosure provides a computer-readable medium on which a computer program is stored. When the computer program is executed by a processor, any one of the OTA upgrade methods of the embodiments of the present disclosure is implemented.

[0156] Among them, the processor is a device with data processing capabilities, including but not limited to the central processing unit (CPU); the memory is a device with data storage capabilities, including but not limited to random access memory (RAM, more specifically SDRAM, DDR, etc.), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory (FLASH); the I / O interface (read-write interface) is connected between the processor and the memory, and can realize information exchange between the memory and the processor, including but not limited to the data bus (Bus), etc.

[0157] Example 1

[0158] Reference Figures 8 to 14 The following is an exemplary description of the overall OTA upgrade method of the embodiment of the present disclosure.

[0159] Reference Figure 8 The implementation of the OTA upgrade method of the embodiment of the present disclosure involves four parties: a PKI (Public Key Infrastructure) platform (certificate platform), an ECU supplier end (publisher device), an OTA cloud server (server device), and a vehicle-mounted end (client device). All parties are connected to a wireless communication network, so data can be transmitted through wireless communication.

[0160] Reference Fig. 9 ,The work of each party is respectively introduced in detail below.

[0161] (1) Work of the PKI platform

[0162] Reference Figure 8 The PKI platform is a public platform for producing and issuing user certificates based on key pairs (public-private key pairs). The PKI platform includes a CA (Certificate Authority) module. The CA module can generate user certificates according to user requests, and the PKI platform will issue the generated user certificates, so that users can use the CA root public key generated by the CA module to verify the validity of other user certificates. Among them, the PKI platform can also include other certificate modules such as RA module, CRL module, LADP module, etc.

[0163] Reference Fig.10 The steps performed by the PKI platform in the OTA upgrade method of the embodiment of the present disclosure may include:

[0164] A101, the CA module of the PKI platform pre-generates a key pair locally, namely the CA root public key (root public key) and the CA root private key (root private key), and sends the CA root public key to the OTA cloud server and the vehicle-mounted terminal respectively.

[0165] A102, the PKI platform receives the public keys of the ECU supplier and the OTA cloud server.

[0166] Among them, the ECU supplier side and OTA cloud server will generate their own key pairs in advance, and send their own public keys and application information to the PKI platform for the CA module of the PKI platform to produce user certificates.

[0167] A103. Use the CA root private key to create a supplier certificate (publisher certificate) and a cloud server certificate (server certificate) based on an asymmetric encryption algorithm and a digest algorithm, and send them to the ECU supplier and OTA cloud server, respectively.

[0168] Among them, the format of the user certificate can adopt the x509 format, etc., and the asymmetric encryption algorithm can adopt the national SM2 algorithm, the international RSA algorithm, the international ECC algorithm, etc., and the summary algorithm can adopt the national SM3 algorithm, the international SHA256 algorithm, the international MD5 algorithm, etc., which will not be described in detail here.

[0169] Among them, after the user certificate is produced, it is also recorded in the certificate library of the PKI platform. Any user can query all user certificates through the PKI platform.

[0170] (2) Work on the ECU supplier side

[0171] Reference Figure 8 , the ECU supplier is the provider of the software and hardware programs used by the ECU module on the vehicle side, that is, the writer (publisher) of the upgrade file, so it needs to send the upgrade file to the OTA cloud server through the ECU supplier side. The ECU supplier side includes a first certificate application module, a first key pair generation module, a first security module, a first upgrade package production module, a first sending module, a first receiving module, etc.

[0172] Reference Fig.11 The steps performed by the ECU supplier in the OTA upgrade method of the embodiment of the present disclosure may include:

[0173] B101. The ECU supplier uses the first key pair generation module to locally generate a key pair, namely, the supplier public key (publisher public key) and the supplier private key (publisher private key).

[0174] The supplier private key is used to sign the upgrade file generated by the ECU supplier, and the supplier public key is used to apply for the supplier certificate from the PKI platform.

[0175] B102. The first certificate application module applies for a supplier certificate from the PKI platform, that is, the supplier public key and supplier application information (such as supplier basic information, domain name, etc.) are sent to the PKI platform through the first sending module, and the CA module of the PKI platform signs the supplier public key and creates a supplier certificate, which is then received by the first receiving module.

[0176] B103. The ECU supplier generates an upgrade strategy for the defects that need to be repaired or the new functions that need to be added on the vehicle side, and obtains specific upgrade files.

[0177] B104. The first security module uses a digest algorithm to perform digest processing on the upgrade file, and then uses the supplier's private key to sign it according to an asymmetric encryption algorithm to generate a supplier-signed image.

[0178] Among them, the asymmetric encryption algorithm can adopt the national secret SM2 algorithm, the international RSA algorithm, the international ECC algorithm, etc., and the summary algorithm can adopt the national secret SM3 algorithm, the international SHA256 algorithm, the international MD5 algorithm, etc., which will not be described in detail here.

[0179] B105. The first upgrade package production module packages the signed upgrade file to obtain a supplier upgrade package (first upgrade package), which includes the upgrade file source data, supplier signature image, supplier certificate, supplier upgrade package basic information, etc., and uploads the supplier upgrade package to the OTA cloud server.

[0180] (3) OTA cloud server operation

[0181] Reference Figure 8 The OTA cloud server is used to receive and store the upgrade file provided by the ECU supplier, so as to send the upgrade file to the vehicle-mounted end when the vehicle-mounted end needs it. The OTA cloud server includes a second certificate application module, a second key pair generation module, a second security module, a second upgrade package production module, a second sending module, a second receiving module, etc.

[0182] Reference Fig.12 The steps performed by the OTA cloud server in the OTA upgrade method of the embodiment of the present disclosure may include:

[0183] C100 and OTA cloud server receive the CA root public key issued by the PKI platform and the supplier public key issued by the ECU supplier.

[0184] C101. The OTA cloud server uses the second key pair generation module to locally generate a key pair, namely, a cloud server public key (server public key) and a cloud server private key (server private key).

[0185] Among them, the cloud server private key is used to sign the upgrade file issued by the OTA cloud server, and the cloud server public key is used to apply for the cloud server certificate from the PKI platform.

[0186] C102, the second certificate application module applies for a cloud server certificate from the PKI platform, that is, the cloud server public key and cloud server application information (such as cloud server basic information, domain name, etc.) are sent to the PKI platform through the second sending module, and the CA module of the PKI platform signs the cloud server public key and creates a cloud server certificate, and then the second receiving module receives the cloud server certificate.

[0187] C103, receiving the supplier upgrade package sent by the ECU supplier.

[0188] Among them, the OTA cloud server may serve different types of vehicle-mounted terminals at the same time, and there may be multiple ECUs (functional modules) inside the same vehicle-mounted terminal. Therefore, it is possible that multiple upgrade packages from different suppliers (multiple upgrade packages from one ECU supplier, or different upgrade packages from multiple ECU supplier terminals) are received at the same time. At this time, multiple supplier upgrade packages need to be processed separately.

[0189] C104. The second security module verifies the signature of the received supplier upgrade package. During the verification process, the CA root public key is first used to verify the supplier public key in the supplier certificate in the supplier upgrade package. If the verification passes, the integrity of the supplier public key in the supplier certificate is confirmed, and then the supplier public key is used to verify the signature of the supplier upgrade package, for example, the verified upgrade file is compared with the upgrade file source data.

[0190] C105. If the verification is successful, the integrity of the supplier upgrade package can be confirmed; if not, the verification fails and an error message is returned to the ECU supplier.

[0191] C106, OTA cloud server stores the upgrade file for subsequent use.

[0192] C107, OTA cloud server uniformly packages the stored upgrade files to generate complete upgrade files, and then produces differential upgrade packages. After receiving the differential upgrade package, the vehicle-mounted end can restore it according to the differential strategy.

[0193] Among them, the upgrade file generated by integration is larger, which affects the transmission speed and has a higher risk of being intercepted and tampered with; while after differential production, the transmission efficiency can be improved and the transmission security can be enhanced.

[0194] C108. The second security module uses a digest algorithm to perform digest processing on the upgrade file (in the form of a differential upgrade package at this time), and then uses the cloud server private key to sign it according to the asymmetric encryption algorithm to generate a cloud server signature image.

[0195] Among them, the asymmetric encryption algorithm can adopt the national secret SM2 algorithm, the international RSA algorithm, the international ECC algorithm, etc., and the summary algorithm can adopt the national secret SM3 algorithm, the international SHA256 algorithm, the international MD5 algorithm, etc., which will not be described in detail here.

[0196] C109. The second upgrade package production module packages the signed upgrade file to obtain a cloud server upgrade package (a second upgrade package, in this case in the form of a differential upgrade package), which includes the upgrade file source data, the cloud server signature image, the cloud server certificate, the basic information of the cloud server upgrade package, etc.

[0197] C110, OTA cloud server sends an upgrade notification to each vehicle terminal to be upgraded. The upgrade notification may include information such as upgrade file version, upgrade content summary, upgrade package size, etc.

[0198] C111. The OTA cloud server receives the OTA upgrade request sent by the vehicle-mounted terminal, verifies the basic information of the vehicle-mounted terminal in the OTA upgrade request, analyzes whether to send the upgrade file, what upgrade file should be sent, etc. If the verification fails, an error message is returned to the vehicle-mounted terminal.

[0199] Among them, the basic information of the vehicle terminal may include vehicle terminal information (such as vehicle model information, owner identity information), required upgrade package version information, etc.

[0200] C112, OTA cloud server sends the corresponding cloud server upgrade package to the vehicle-mounted terminal (in the form of a differential upgrade package at this time).

[0201] The differential upgrade package can be downloaded through the CDN (Content Delivery Network) file service. The download can use the HTTPS protocol and can be protected by the TLS security protocol to ensure the communication security of the download process.

[0202] (4) Operation of the vehicle terminal

[0203] Reference Figure 8 The vehicle-mounted end is a control system on a vehicle (such as a car), which is used to control the vehicle according to certain programs, and these programs need to be upgraded and configured through upgrade files. The vehicle-mounted end includes an OTA management unit (upgrade management module) and at least one ECU (functional module). Each ECU is a module that actually uses upgrade files to upgrade and implement certain control functions, while the OTA management unit manages all upgrade files.

[0204] Reference Figure 8 The OTA management unit may include a third security module, a third sending module, and a third receiving module.

[0205] Reference Fig.13 The steps performed by the OTA management unit of the ECU supplier in the OTA upgrade method of the embodiment of the present disclosure may include:

[0206] D100 and the OTA management unit receive the CA root public key issued by the PKI platform and the cloud server public key issued by the OTA cloud server.

[0207] D101, the OTA management unit receives the upgrade notification sent by the OTA cloud server through the third receiving module, which includes information such as the upgrade file version, upgrade content summary, upgrade package size, etc., and displays the upgrade notification information to the customer.

[0208] D102. If the customer determines to perform OTA upgrade, the OTA management unit sends an OTA upgrade request to the OTA cloud server through the third sending module, and waits for verification by the OTA cloud server.

[0209] Among them, the OTA upgrade request includes basic information of the vehicle-mounted terminal, and the basic information of the vehicle-mounted terminal may include vehicle-mounted terminal information (such as vehicle model information, owner identity information), required upgrade package version information, etc.

[0210] D103. After the OTA upgrade request is verified, the OTA management unit starts downloading the upgrade package (in the form of a differential upgrade package) from the cloud server.

[0211] The above download process can use the HTTPS protocol and use the TLS security protocol for protection to ensure the communication security of the download process.

[0212] Among them, the above download process can be divided into two parts, one part is to download the differential upgrade package from the CDN file service, and the other part is to download the upgrade package file from the OTA cloud server. The upgrade package file includes the basic information of the cloud server upgrade package and the cloud server certificate.

[0213] D104. The third security module verifies the signature of the downloaded cloud server upgrade package. During the verification process, the CA root public key is first used to verify the cloud server public key in the cloud server certificate in the cloud server upgrade package; if the verification passes, the integrity of the cloud server public key in the cloud server certificate is confirmed, and then the cloud server public key is used to verify the signature of the cloud server upgrade package, for example, the verified upgrade file is compared with the upgrade file source data.

[0214] D105. If the verification is successful, the integrity of the cloud server upgrade package can be confirmed; if not, the verification fails and an error message is returned to the OTA cloud server.

[0215] D106. The OTA management unit distributes the upgrade file to the corresponding ECU.

[0216] Among them, the above distribution process uses CAN / ETH transmission method, and the security of the transmission process is guaranteed by the message verification code mechanism and the fresh value anti-replay mechanism.

[0217] Reference Figure 8 The ECU includes a fourth safety module, a fourth sending module, a fourth receiving module, and a Flash memory.

[0218] Reference Fig.14 The steps performed by each ECU on the vehicle side in the OTA upgrade method of the embodiment of the present disclosure may include:

[0219] E101. The fourth receiving module of the ECU receives the upgrade file sent by the OTA management unit.

[0220] E102. The fourth security module verifies the upgrade file.

[0221] Among them, the above verification includes message verification code and freshness value verification.

[0222] Among them, the upgrade file can be in the form of a supplier upgrade package, a cloud server upgrade package, etc., so the fourth security module can specifically use the above double signature verification method for verification.

[0223] E103. If the verification is passed, the integrity of the upgrade file can be confirmed; if not, the verification fails, and an error message is returned to the OTA management unit through the fourth sending module, indicating that the upgrade fails.

[0224] E104, ECU installs verified upgrade files.

[0225] The installation process may first store the upgrade file in the Flash memory, and then parse and install the content in the Flash memory.

[0226] Those skilled in the art will appreciate that all or some of the steps, systems, and functional modules / units in the apparatus disclosed above may be implemented as software, firmware, hardware, or a suitable combination thereof.

[0227] In hardware implementations, the division between functional modules / units mentioned in the above description does not necessarily correspond to the division of physical components; for example, one physical component may have multiple functions, or one function or step may be performed by several physical components in cooperation.

[0228] Some physical components or all physical components may be implemented as software executed by a processor, such as a central processing unit (CPU), a digital signal processor or a microprocessor, or implemented as hardware, or implemented as an integrated circuit, such as an application-specific integrated circuit. Such software may be distributed on a computer-readable medium, which may include a computer storage medium (or non-temporary medium) and a communication medium (or temporary medium). As known to those of ordinary skill in the art, the term computer storage medium includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, program modules or other data). Computer storage media include, but are not limited to, random access memory (RAM, more specifically SDRAM, DDR, etc.), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory (FLASH) or other disk storage; read-only compact disk (CD-ROM), digital versatile disk (DVD) or other optical disk storage; magnetic cassettes, magnetic tapes, disk storage or other magnetic storage; any other medium that can be used to store desired information and can be accessed by a computer. Furthermore, it is well known to those skilled in the art that communication media typically embodies computer readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave or other transport mechanism, and may include any information delivery media.

[0229] The present disclosure has disclosed example embodiments, and although specific terms are employed, they are used and should be interpreted only in a general illustrative sense and not for limiting purposes. In some instances, it will be apparent to those skilled in the art that, unless otherwise expressly stated, features, characteristics, and / or elements described in conjunction with a particular embodiment may be used alone or in combination with features, characteristics, and / or elements described in conjunction with other embodiments. Therefore, those skilled in the art will appreciate that various changes in form and detail may be made without departing from the scope of the present disclosure as set forth in the appended claims.

Claims

1. An over-the-air OTA upgrade method, executed by a client device, wherein: The method comprises: Receive a second upgrade package sent by the server device; the second upgrade package includes a server certificate and an upgrade file signed by a server private key; the server certificate is obtained by signing a server public key with a root private key by a certificate platform, the server private key and the server public key are a key pair pre-generated by the server device, the root private key and the root public key are a key pair pre-generated by the certificate platform, and the root public key is pre-set in the client device; Verifying the validity of the server public key in the server certificate using a root public key; In response to the server public key being valid, verifying the correctness of the upgrade file using the server public key; In response to the upgrade file being correct, the upgrade is performed using the upgrade file.

2. The method according to claim 1, wherein: The client device comprises an upgrade management module and at least one functional module; the step of receiving the second upgrade package sent by the server device, the step of verifying the validity of the server public key in the server certificate by using the root public key, and the step of verifying the correctness of the upgrade file by using the server public key are performed by the upgrade management module; The upgrading using the upgrade file comprises: The upgrade management module sends the upgrade file to the corresponding functional module; The functional module verifies the upgrade file; In response to the verification being passed, the functional module installs the upgrade file.

3. The method according to claim 2, wherein: The function module verifies the upgrade file including: The function module verifies the upgrade file using a message verification code and / or a fresh value.

4. The method according to claim 2, wherein: The upgrade management module sending the upgrade file to the corresponding functional module includes: the upgrade management module sending the second upgrade package to the corresponding functional module; The function module verifies the upgrade file including: The functional module verifies the validity of the server public key in the server certificate using the root public key; In response to the server public key being valid, the function module verifies the correctness of the upgrade file using the server public key.

5. An OTA upgrade method, performed by a publisher device, wherein: The method comprises: Generate a first upgrade package; the first upgrade package includes a publisher certificate and an upgrade file signed by a publisher private key; the publisher certificate is obtained by signing the publisher public key according to the root private key of the certificate platform, the publisher private key and the publisher public key are a key pair pre-generated by the publisher device, and the root private key and the root public key are a key pair pre-generated by the certificate platform; Send the first upgrade package to the server device.

6. A method for OTA upgrade, performed by a server device, wherein: The method comprises: Receive a first upgrade package sent by a publisher device; the first upgrade package includes a publisher certificate and an upgrade file signed by a publisher private key; the publisher certificate is obtained by signing a publisher public key with a root private key by a certificate platform, the publisher private key and the publisher public key are a key pair pre-generated by the publisher device, the root private key and the root public key are a key pair pre-generated by the certificate platform, and the root public key is pre-set in the server device; Verifying the validity of the publisher's public key in the publisher's certificate using a root public key; In response to the publisher public key being valid, verifying the correctness of the upgrade file using the publisher public key; In response to the upgrade file being correct, a second upgrade package is generated; the second upgrade package includes a server certificate and the upgrade file signed by a server private key; the server certificate is obtained by the certificate platform signing a server public key according to the root private key, and the server private key and the server public key are a key pair pre-generated by the server device; The second upgrade package is sent to the client device.

7. The method according to claim 6, wherein: The second upgrade package is divided into a plurality of differential upgrade packages; The sending the second upgrade package to the client device includes: sending at least part of the differential upgrade package to the client device.

8. A method for OTA upgrade, wherein: include: The publisher device generates a first upgrade package; The first upgrade package includes a publisher certificate and an upgrade file signed by a publisher's private key; The publisher certificate is obtained by signing the publisher public key with the root private key by the certificate platform, the publisher private key and the publisher public key are a key pair pre-generated by the publisher device, and the root private key and the root public key are a key pair pre-generated by the certificate platform; The publisher device sends the first upgrade package to the server device; The server device receives the first upgrade package sent by the publisher device; the root public key is preset in the server device; The server device verifies the validity of the publisher public key in the publisher certificate using the root public key; In response to the publisher public key being valid, the server device verifies the correctness of the upgrade file using the publisher public key; In response to the upgrade file being correct, the server device generates a second upgrade package; the second upgrade package includes a server certificate and the upgrade file signed by a server private key; The server certificate is obtained by the certificate platform signing the server public key according to the root private key, and the server private key and the server public key are a key pair pre-generated by the server device; The server device sends the second upgrade package to the client device; The client device receives the second upgrade package sent by the server device; the root public key is preset in the client device; The client device verifies the validity of the server public key in the server certificate using the root public key; In response to the server public key being valid, the client device verifies the correctness of the upgrade file using the server public key; In response to the upgrade file being correct, the client device uses the upgrade file for upgrading.

9. A client device, comprising a memory and a processor; the memory stores a computer program that can be executed by the processor, and when the computer program is executed by the processor, the OTA upgrade method described in any one of claims 1 to 4 is implemented.

10. A publisher device, comprising a memory and a processor; the memory stores a computer program executable by the processor, and the computer program implements the OTA upgrade method according to claim 5 when executed by the processor.

11. A server device, comprising a memory and a processor; the memory stores a computer program that can be executed by the processor, and when the computer program is executed by the processor, the OTA upgrade method according to claim 6 or 7 is implemented.

12. A computer-readable medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the OTA upgrade method according to any one of claims 1 to 8 is implemented.

Images