Method and device for processing information security of in-vehicle infotainment system, medium and vehicle

Abstract

The invention discloses a processing method and device for information security of a vehicle-mounted infotainment system, a medium and a vehicle, and the processing method comprises the steps: initializing security settings of the vehicle-mounted infotainment system, the security settings comprising any one or more of access authority, trusted execution environment, system log output, system protection, factory mode, main interface entry or browser application; and obtaining an operation instruction, and processing the operation instruction according to the security setting. The embodiment of the invention can improve the information security of the in-vehicle infotainment system, and can be widely applied to the technical field of vehicle information security.

Description

Technical Field

[0001] The present invention relates to the field of vehicle information security technology, and in particular to a method, device, medium and vehicle for processing vehicle system information security. Background Art

[0002] With the continuous development of smart cars, smart cockpits are attracting more and more attention from car buyers. People hope that smart cockpits will become an extension of daily life and a movable living space. With the rapid iteration of software and hardware technology levels such as automotive chips, human-computer interaction, and automotive systems, car cockpits have begun to enter the intelligent stage in an all-round way. The cockpit entertainment system is constantly enriched, and multiple applications such as navigation, games, and life are gradually installed on the vehicle system, gradually turning from physical buttons to full touch control. Voice interaction technology has matured and developed. Smart cockpits can significantly improve the intelligent experience of cars and gradually become one of the important factors affecting consumers' car purchases. As consumers pay more and more attention to smart cockpits, information security issues in cars are becoming increasingly prominent. The gradual increase in functions makes connected cars more vulnerable to hacker attacks. Due to the highly integrated nature of car computers, they may become targets of hacker attacks. ECU (electronic control unit in the car) is connected through CAN (controller area network cable technology), LIN (vehicle area network system), etc. If a hacker attacks the network in the car, the ECU can be controlled arbitrarily, or the CAN can be invalidated by sending an error message, thereby causing the ECU to fail. Therefore, it is necessary to improve the information security of the car computer system. Summary of the invention

[0003] In view of this, an object of the embodiments of the present invention is to provide a method, device, medium and vehicle for processing information security of a vehicle system, which can improve the information security of the vehicle system.

[0004] On the one hand, an embodiment of the present invention provides a method for processing vehicle system information security, including:

[0005] Initialize the security settings of the vehicle system, which include any one or more of access rights, trusted execution environment, system log output, system protection, factory mode, main interface entry, or browser application;

[0006] An operation instruction is obtained, and the operation instruction is processed according to the security setting.

[0007] Optionally, the access rights include access rights to the vehicle operating system, and the access rights to the vehicle operating system are securely set in the following manner:

[0008] Access control measures are used to restrict access to the core resources of the vehicle operating system; the vehicle operating system uses minimal service permissions for access;

[0009] Limit the static permissions and / or dynamic permissions of applications in the vehicle operating system.

[0010] Optionally, the access rights include port access rights and / or network access rights of the vehicle system, and the port access rights and / or network access rights of the vehicle system are securely set in the following manner:

[0011] Close ports that are not used by the business and prohibit opening public agreed ports;

[0012] And / or, prohibit the first external network address from directly accessing the vehicle system, and restrict the second external network address from remote access.

[0013] Optionally, the system log output is securely configured in the following manner:

[0014] It is prohibited to output system logs containing sensitive information; the sensitive information includes any one or more of access point names, remote communication information, passwords, server addresses, account permissions or kernel module key information.

[0015] Optionally, the system protection is securely set in the following manner:

[0016] Detect malicious programs running on the system; the malicious program detection engine supports periodic updates of the virus database;

[0017] If a vulnerability is detected, upgrade the vehicle system version or fix the vulnerability.

[0018] Optionally, the factory mode is securely set in the following manner:

[0019] Reducing the operable functions in the factory mode and lowering the operation authority of the factory mode;

[0020] And / or, regularly replace the operation logic of the factory mode.

[0021] Optionally, the factory mode is entered in the following way:

[0022] In the first preset interface, obtaining a preset operation to enter the second preset interface; wherein the first preset interface refers to the front interface for entering the hidden interface, and the second preset interface refers to the front interface for entering the factory mode;

[0023] The input content is obtained through the second preset interface; if the input content is correct, the factory mode is entered; if the input content is incorrect, the factory mode is locked for a preset time.

[0024] Alternatively, enter the main interface in the following ways:

[0025] Displaying the initial interface, obtaining a feedback signal of the initial interface, activating the vehicle system, and entering the main interface;

[0026] Or, obtain a password file, and if the password file meets the preset requirements, enter the main interface.

[0027] Optionally, the browser performs security settings in the following manner:

[0028] The vehicle system is prohibited from downloading third-party applications through the browser and obtaining third-party applications through the preset application store.

[0029] On the other hand, an embodiment of the present invention provides a system for processing vehicle system information security, including:

[0030] A setting module, used to initialize the security settings of the vehicle system, wherein the security settings include any one or more of access rights, trusted execution environment, system log output, system protection, factory mode, main interface entry or browser application;

[0031] The execution module is used to obtain an operation instruction and process the operation instruction according to the security setting.

[0032] On the other hand, an embodiment of the present invention provides a device for processing vehicle system information security, including:

[0033] at least one processor;

[0034] at least one memory for storing at least one program;

[0035] When the at least one program is executed by the at least one processor, the at least one processor implements the above processing method.

[0036] On the other hand, an embodiment of the present invention provides a computer-readable storage medium, in which a program executable by a processor is stored. When the program executable by the processor is executed by the processor, it is used to perform the above-mentioned processing method.

[0037] On the other hand, an embodiment of the present invention provides a vehicle, comprising the above-mentioned vehicle system information security processing device.

[0038] Implementation of the embodiments of the present invention includes the following beneficial effects: the embodiments of the present invention first initialize the security settings of the vehicle system, the security settings include any one or more of access rights, trusted execution environment, system log output, system protection, factory mode, main interface entry or browser application; when the vehicle system obtains external operation instructions, the operation instructions are processed according to the security settings, and the vehicle system is provided with all-round, multi-angle and multi-level security protection from multiple aspects such as access rights, trusted execution environment, system log output, system protection, factory mode, main interface entry or browser, thereby reducing the probability of the vehicle being maliciously attacked and improving the information security of the vehicle system and the security of user information. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] Figure 1 is a structural schematic diagram of a vehicle system provided by an embodiment of the present invention;

[0040] Figure 2 It is a flowchart of a method for processing vehicle system information security provided by an embodiment of the present invention;

[0041] Figure 3 It is a flowchart of steps for security setting of access rights of a vehicle operating system provided by an embodiment of the present invention;

[0042] Figure 4 It is a schematic diagram of a flow chart of steps for securely setting port access rights and network access rights of a vehicle system provided by an embodiment of the present invention;

[0043] Figure 5 It is a flowchart of steps for performing security settings on system protection provided by an embodiment of the present invention;

[0044] Figure 6 It is a flowchart of steps for performing security settings on a factory mode provided by an embodiment of the present invention;

[0045] Figure 7 is a flow chart of steps for entering factory mode provided by an embodiment of the present invention;

[0046] Figure 8 This is a flowchart of steps for entering the main interface provided by an embodiment of the present invention;

[0047] Fig. 9 It is a structural block diagram of a vehicle system information security processing system provided by an embodiment of the present invention;

[0048] Fig.10 It is a structural block diagram of a vehicle system information security processing device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0049] The present invention is further described in detail below in conjunction with the accompanying drawings and specific embodiments. The step numbers in the following embodiments are only provided for the convenience of explanation and description, and the order between the steps is not limited in any way. The execution order of each step in the embodiment can be adaptively adjusted according to the understanding of those skilled in the art.

[0050] It should be noted that, although the functional module division is performed in the device schematic diagram and the logical order is shown in the flow chart, in some cases, the steps shown or described can be performed in a different order from the module division in the device or the order in the flow chart. The terms "first", "second", etc. in the specification and claims and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described here can be implemented in an order other than those illustrated or described here. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0051] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art to which this application belongs. The terms used herein are only for the purpose of describing the embodiments of this application and are not intended to limit this application.

[0052] Some technical terms in this embodiment are explained below.

[0053] Linux system: is a computer operating system that supports multiple users and multiple tasks. Multiple users can run different programs on the same computer at the same time without interference between different programs. Linux system is highly customizable, highly secure, highly stable, easy to learn and use, and is widely used in many fields. In the embodiment of the present invention, Linux system is applied to the instrument of the vehicle.

[0054] SELinux: An extended mandatory access control security module for Linux developed by the developer, a security mechanism that controls access to file system resources at the process level.

[0055] Android system: is a computer operating system, including: Linux kernel layer, system runtime layer, application framework layer and application layer. Android system has openness, rich application programs, powerful hardware support and good user experience. Android system has a wide range of applications, such as smart phones, tablet computers, smart homes and wearable devices. In this embodiment, Android system is used to control system and entertainment projects.

[0056] RH850 series chips are generally widely used in the field of automotive electronics, including key automotive control systems such as engine control units, brake systems, and driver assistance systems. The RH850 series has powerful computing capabilities, high-precision timing counters, and a rich set of peripheral interfaces, which can meet the speed, safety, and functionality requirements of automotive electronic systems. In this embodiment, RH850 is used as an MCU for the transmission and reception of automotive signals, as well as the communication between the Linux system and the Android system.

[0057] RTOS system: A real-time operating system (RTOS) is an operating system that can accept and process external events or data at a fast enough speed when they occur, and its processing results can control the production process or respond quickly to the processing system within the specified time, dispatch all available resources to complete real-time tasks, and control the coordinated operation of all real-time tasks.

[0058] See also Figure 1 In this embodiment, the vehicle system is composed of multiple systems, such as Linux system and Android system, and the Linux system and Android system communicate through MCU. The Linux system and Android system are responsible for different applications respectively, such as Linux system is used for vehicle instruments, and Android system is used for control systems and entertainment projects. In this embodiment, the selection of MCU is determined according to the actual application, and this embodiment does not make specific restrictions. For example, MCU uses RH850 series chips. It should be noted that the number of different operating systems in the vehicle system is not limited, such as the vehicle system includes a Linux system and two Android systems.

[0059] In order to ensure the security requirements of the vehicle system operation and avoid malicious attacks and exploitation of the vehicle system, the vehicle system needs to meet the following security requirements: implement system log output control, implement boundary firewall, implement port and network access control requirements for networking functions, implement browser security, implement factory mode protection, and implement normal interface entry security, etc.

[0060] See also Figure 2The embodiment of the present invention provides a method for processing vehicle system information security, which is applied to an Android system and includes:

[0061] S100, initializing the security settings of the vehicle system, the security settings including any one or more of access rights, trusted execution environment, system log output, system protection, factory mode, main interface entry or browser application.

[0062] Before the vehicle system is running, the security settings of the vehicle system are initialized; after the vehicle system is running, the vehicle system protects the information security of the vehicle system according to the initialized security settings. Access rights refer to the mechanism of limiting access to certain information items or certain controls based on the identity of the user and his / her membership in various predefined groups, such as the rights and restrictions of accessing the vehicle system, ports or applications. Trusted execution environment is a security mechanism built in a computer system. It creates a secure environment through hardware technology to ensure the security of the code and data running in it and prevent attackers from accessing or tampering with it. The system log is information that records hardware, software and system problems in the system, and can also monitor events that occur in the system; the cause of the error can be checked through the system log, or traces left by the attacker when attacked can be found; the system log includes system log, application log and security log. System protection refers to methods or measures to protect the operation security of the vehicle system. The factory mode is a design mode that provides a way to create objects so that the process of creating objects is separated from the process of using objects, thereby improving the maintainability and scalability of the system. The main interface refers to the interface that the car purchase user normally uses after the vehicle is off the assembly line. The browser application refers to applications such as access or download through the browser.

[0063] In this embodiment, the vehicle system is based on the TrustZone / TEE trusted execution environment to achieve hardware and software security isolation and provide security services. TrustZone is a hardware architecture that can build a security architecture to defend against various possible attacks. TrustZone divides the hardware and software resources of the system on chip into two areas: secure and non-secure areas; operations that need to be kept confidential are performed in the secure area, and other operations are performed in the non-secure area. The secure area and the non-secure area can be switched in mode. In a specific embodiment, the Linux kernels of the two Android systems in the vehicle system support SELinux.

[0064] S200: Acquire an operation instruction, and process the operation instruction according to security settings.

[0065] Operation instructions refer to instructions for operating the vehicle system through the outside or inside, such as control instructions, query instructions, download instructions, access instructions or output log instructions, etc. The triggering methods of operation instructions include but are not limited to obtaining through the human-computer interaction interface or issuing from the server. After the vehicle system obtains the operation instruction, it processes the operation instruction accordingly according to the security settings. For example, after obtaining the access instruction, it determines whether there is access permission and the size of the permission based on the access instruction and security settings. If there is access permission, the access is executed; after obtaining the download instruction, it determines whether the download conditions are met based on the download instruction and security settings. If the download conditions are met, the corresponding content is downloaded.

[0066] See also Figure 3 The access rights include the access rights to the vehicle operating system. The access rights to the vehicle operating system are securely set in the following ways:

[0067] S011. Use access control measures to restrict access to the core resources of the vehicle operating system; the vehicle operating system uses minimal service permissions for access;

[0068] S012. Limit static permissions and / or dynamic permissions of the application program of the vehicle operating system.

[0069] Core resources refer to resources that have an important impact on the operation of the vehicle operating system. The specific requirements are determined according to the actual application and are not specifically limited in this embodiment. Specific requirements for vehicle system permission control: The vehicle system should manage access rights. The vehicle operating system should use minimized service permissions for access. Access to the system core (communication, vehicle control, kernel, root directory, etc.) resources requires access control measures to limit access.

[0070] The vehicle system will manage the access rights of each APK (Android application package). The vehicle operating system should limit the static and dynamic permissions of the application through access control measures; it should be able to effectively authorize or deny dynamic requests for non-access resource permissions. When the vehicle system starts, the permissions requested in the preset APP (Application) permission list will be authorized by default. The APP permission list refers to the static and dynamic permissions that the APP applies to the system. If the permissions are not in the permission list, they cannot be accessed.

[0071] See also Figure 4 The access rights include the port access rights and / or network access rights of the vehicle system. The port access rights and / or network access rights of the vehicle system are securely set in the following ways:

[0072] S013. Close ports not used by the business and prohibit opening public agreed ports;

[0073] S014, and / or, prohibiting the first external network address from directly accessing the vehicle system, and restricting the second external network address from remote access.

[0074] System port and network access control requirements: The vehicle computer operating system should close all ports that are not used by the business, prohibit the opening of public agreed ports, and minimize port services. The vehicle computer network solution prohibits direct access to the vehicle computer from external network addresses. T-Box will restrict remote access to external network addresses and add domain name whitelist restrictions. If the domain name is not in the whitelist, T-Box will intercept it. The vehicle computer is allowed to communicate with the TSP, and the communication security must be guaranteed. The firewall functions for external network data flow control are all deployed in the T-Box. The T-Box boundary firewall ensures the legitimacy of the external network data flow. The vehicle computer no longer develops and integrates firewall functions.

[0075] T-Box (Telematics Box, remote / vehicle communication module) is an intelligent terminal device that integrates vehicle body network and wireless communication functions. T-Box realizes a wireless router between multimedia car machine and TSP and the Internet, giving users the opportunity to access remotely. The various ECUs (Electronic Control Units) equipped in the vehicle can realize remote control of the vehicle's engine start and stop, air conditioning, sunroof, trunk door, door, flashing lights and honking, etc., and T-Box is designed with MCU to receive and process CAN messages and directly access the various ECUs equipped in the vehicle. The system security goal is to correctly respond to authorized operations and handle abnormal behaviors through identity authority management and access control mechanisms that meet the application scenarios of T-Box, fight against various security threats such as overflow attacks, brute force cracking, man-in-the-middle attacks, replay, tampering, forgery, etc., ensure the availability, confidentiality, integrity and auditability of system files and data, ensure normal access to various resources, and ensure that the system can still operate as expected under malicious attacks.

[0076] TSP (Telematics Service Provider) plays an important role in automobile safety, driving behavior, intelligent navigation, etc. The vehicle network TSP mainly consists of three components: the vehicle side, the communication network and the cloud. The vehicle side mainly refers to hardware such as vehicle-mounted devices and sensors, as well as software such as vehicle status monitoring. These devices and software transmit the real-time status of the vehicle to the cloud and receive instructions and data from the cloud; at the same time, they can also enable the relevant functions provided by the vehicle network TSP to be displayed in the car in a timely manner, so that the driver can monitor and control the vehicle status. The communication network mainly refers to the network connecting the car and the cloud, including 4G, 5G networks, Wi-Fi, Bluetooth and other wireless communication technologies; through these communication networks, the vehicle network TSP can realize vehicle status monitoring, remote command, data transmission and other functions. The cloud mainly refers to the cloud computer platform, including cloud-based data processing and analysis platforms, and platforms that provide cloud storage services; through the cloud, the vehicle network TSP can realize vehicle data analysis, data mining, artificial intelligence algorithms, intelligent maintenance and predictive maintenance and other services.

[0077] Optionally, syslog output is secured via:

[0078] S015. It is prohibited to output system logs containing sensitive information; sensitive information includes any one or more of access point names, remote communication information, passwords, server addresses, account permissions, or kernel module key information.

[0079] System log output requirements: The vehicle operating system should limit the content of log output during operation, and prohibit the output of sensitive information including APN (Access Point Name), TSP, and MCU to prevent attackers from using the log output content to carry out further attacks. The vehicle system log is retained for analysis and location of problems. During the SOP (Start Of Production) stage, the system log cannot output sensitive information, including content: information such as the password used, information such as the TSP server address, information such as account permissions, and key information of the chip kernel module.

[0080] APN is an identifier used by mobile devices when they connect to the Internet or other data networks. APN defines how mobile devices communicate with specific network service providers, including the type of data transmission and security settings. Each operator has its own APN settings, and users need to configure APN according to the specific information provided by their own operator so that the device can correctly connect to the Internet or corporate internal network. If the configuration is incorrect, it may result in the inability to connect to the data network or incur additional charges.

[0081] See also Figure 5, system protection is set up securely in the following ways:

[0082] S016. Detect malicious programs running on the system; the malicious program detection engine supports periodic updates of the virus database;

[0083] S017. If a vulnerability is detected, upgrade the vehicle system version or fix the vulnerability.

[0084] System protection security requirements: The system needs to use a new version with fewer vulnerabilities; when a vulnerability with a larger impact breaks out, users should be forced to upgrade to the latest version of the system. The system should have a malware detection function to detect malicious programs running on the system and prevent malicious programs from damaging the system. The malware detection engine should support virus library updates. The virus library update cycle is determined according to actual applications. This embodiment does not impose specific restrictions, for example, once a week or once a month. The malware detection engine performs periodic virus detection during system operation, and performs real-time detection of designated directories or applications during events such as system startup, software installation, and insertion of a USB flash drive. For example, the Android system of the car computer uses a new version, Android P, with fewer vulnerabilities. When a vulnerability with a larger impact breaks out in the operating system, the manufacturer provides after-sales service to support upgrading to the latest version of the system or installing software plug-ins to fix the vulnerability.

[0085] See also Figure 6 , the factory mode is securely set up in the following ways:

[0086] S018. Reduce the operable functions in the factory mode and lower the operation authority of the factory mode;

[0087] S019, and / or, regularly replace the operation logic of the factory mode.

[0088] Some menus are usually hidden in the car system, namely the factory mode menu, which is used by developers to perform debugging, configuration settings and other operations. If the entrance to the factory mode is not secure, the entrance will also become an entrance for hacker attacks. When using the factory mode, you need to set a password to enter the factory mode and store the password securely. Strictly protect the startup logic of the factory mode to prevent the leakage of the operation logic. Reduce the functions that can be operated in the factory mode and reduce the operation permissions of the factory mode. Regularly change the operation logic of starting the factory mode. The factory mode entry is protected by a high-strength password, and only certain permissions are given to specific users.

[0089] See also Figure 7 , factory mode is entered in the following ways, including:

[0090] S021. In the first preset interface, obtaining a preset operation to enter the second preset interface; wherein the first preset interface refers to a front interface for entering the hidden interface, and the second preset interface refers to a front interface for entering the factory mode;

[0091] S022. Obtain input content through the second preset interface; if the input content is correct, enter the factory mode; if the input content is incorrect, lock the factory mode for a preset time.

[0092] The hidden interface refers to an interface presented in a specific form, and the preset mode refers to a specific mode set in advance. The hidden interface and the preset mode are determined according to actual applications, and this embodiment does not make specific restrictions. First, enter the hidden interface in a specific way, and then enter the factory mode in a specific way on the hidden interface.

[0093] The first preset interface refers to the front interface for entering the hidden interface, and the second preset interface refers to the front interface for entering the factory mode. Both the first preset interface and the second preset interface are determined according to actual applications, and are not specifically limited in this embodiment. The preset operation refers to the operation of presetting the second preset interface, which is determined according to actual applications, and is not specifically limited in this embodiment, such as click operation, sliding operation or zoom operation. In the first preset interface, the user performs a certain operation. If the operation performed by the user is the same as the preset operation, the vehicle system displays the second preset interface. If the operation performed by the user is different from the preset operation, the vehicle system remains in the first preset interface; in the second preset interface, the user enters the corresponding content according to the content displayed on the second preset interface. If the user inputs the same content as the preset content, the input content is correct and the factory mode is entered. If the user inputs the content differently from the preset content, the input content is wrong, and the factory mode is locked for a preset time. During the lock time of the factory mode, the factory mode cannot be entered again. It should be noted that the preset content and the preset time are determined according to actual applications, and are not specifically limited in this embodiment. For example, the preset content includes the character content of the password, and the preset time is set to 3 minutes.

[0094] In a specific embodiment, the factory mode uses a hidden HMI (Human Machine Interface) interface and uses a specific gesture to enter. The specific entry method is as follows:

[0095] 1. In the audio settings interface, click on the text position of sound balance 5 times;

[0096] 2. Enter the password input interface and enter the password as follows: The password length is 11 characters; The password is a combination of English characters and numbers; The password for the vehicle computer of a project is the same; The password should be properly kept and only provided to relevant R&D personnel, technicians, and production personnel, and must not be leaked or disseminated;

[0097] 3. If the password is entered incorrectly three times, the factory mode function will be locked for 5 minutes.

[0098] See also Figure 8 , the main interface can be entered by:

[0099] S023, display the initial interface, obtain the feedback signal of the initial interface, activate the vehicle system, and enter the main interface;

[0100] S024, or, obtain the password file, if the password file meets the preset requirements, enter the main interface.

[0101] There are many ways to enter the main interface. The way a car buyer enters the main interface is different from the way a parking lot commissioning staff enters the main interface. In this embodiment, the car buyer enters the main interface through the initial interface, and the parking lot commissioning staff enters the main interface through an encrypted file. The permissions of the car buyer and the parking lot commissioning staff after entering the main interface are also different. The initial interface refers to the interface before the vehicle system is activated, and the feedback signal refers to the signal received by the vehicle system through the initial interface. The initial interface and the feedback signal are determined according to the actual application, and this embodiment does not make specific restrictions. For example, for ease of use, the initial interface uses a QR code interface, and the feedback signal uses a QR code scanning signal.

[0102] In a specific embodiment, the initial interface of IVI (In-Vehicle Infotainment) after the vehicle leaves the factory is a QR code interface. In order to maintain the user's sense of ceremony after purchasing the vehicle, the user needs to scan the QR code to activate the vehicle system and enter the normal IVI interface. After the vehicle is offline, there is a need for development, quality assurance and other personnel to bypass the QR code and enter the normal interface for upgrades, testing, verification and other operations. In order to prevent attackers from performing illegal operations through this entrance, the security requirements for bypassing the initial QR code to enter the normal interface are as follows:

[0103] 1) It is necessary to set a key to bypass the initial QR code interface and enter the normal interface, and store the key securely;

[0104] 2) Strictly manage keys and limit the personnel who can issue keys;

[0105] 3) Limit operating permissions and do not provide any special permissions other than bypassing the QR code to enter the normal interface function;

[0106] 4) After the operation is completed, the initial QR code interface needs to be restored until the user activates it.

[0107] The in-vehicle infotainment system (IVI) is an in-vehicle comprehensive information processing system that uses a dedicated in-vehicle central processor, based on the body bus system and Internet services. IVI can realize a series of applications including three-dimensional navigation, real-time traffic conditions, IPTV, assisted driving, fault detection, vehicle information, body control, mobile office, wireless communication, online entertainment functions and TSP services, which greatly improves the level of vehicle electrification, networking and intelligence.

[0108] The password file refers to a security file containing encryption or decoding, etc. The preset requirements include but are not limited to content requirements or deadline requirements, etc. The preset requirements are determined according to actual applications and are not specifically limited in this embodiment. The way to obtain the password file includes but is not limited to a USB flash drive or an external device.

[0109] In a specific embodiment, after the vehicle is offline, the vehicle computer bypasses the initial QR code and enters the normal interface by verifying the KEY file in the USB flash drive. This function is implemented by the application ecosystem supplier, and its specific security design is as follows:

[0110] The OEM provides an encrypted KEY file and distributes it to the relevant vehicle maintenance personnel. The vehicle maintenance personnel copy the KEY file to the U disk; the vehicle computer detects the insertion of the U disk, reads the KEY file in the U disk and decrypts it; the validity period is set in the KEY file, the vehicle computer synchronizes the current correct time and verifies the validity period of the KEY file. If it is within the validity period, the vehicle computer directly skips the QR code interface and enters the normal interface; if the KEY file exceeds the validity period, the verification fails and the KEY file needs to be re-applied; the KEY file is only used to bypass the QR code and does not provide other special operation permissions. After entering the normal interface, the vehicle maintenance personnel can perform normal and legal operations such as music, Internet access, and upgrades; after the U disk is unplugged and powered on again, the vehicle computer still stays in the QR code interface until the user activates it. KEY files are usually a file format used to store keys, licenses, or other encrypted information. They can be used to encrypt and decrypt data, verify the legitimacy of software, or perform other security-related operations.

[0111] Optionally, the browser application is configured with security settings in the following ways:

[0112] S025. The vehicle system is prohibited from downloading third-party applications through the browser and obtaining third-party applications through the preset application store.

[0113] Third-party applications refer to software developed and provided by third-party companies or individuals other than vehicle system developers. Third-party applications include various types of applications, such as office software, games, media players, tool software, etc. The default application store refers to the application store established or designated by the vehicle system developer.

[0114] For third-party applications for car computers, users are prohibited from installing third-party applications through browser downloads, third-party application stores, USB and other channels. Car manufacturers establish their own application stores to uniformly manage applications submitted by third-party developers. APPs are installed, started, and uninstalled normally. They cannot be unable to be uninstalled or require the help of third-party software to uninstall. APPs use car manufacturer signatures, APPs cannot use public signatures, and APPs are not allowed to rely on jumping to web pages or third-party APPs to obtain content and functions. APPs contain album music, novels, pictures, videos and other content, and corresponding copyrights must be provided. APPs cannot apply for permissions that are not related to the application, such as a calculator applying for address book permissions. APPs cannot automatically connect to the Internet frequently, consuming a large amount of user traffic.

[0115] The third-party libraries provided by the car manufacturer used in the development of the car computer itself should ensure the security and vulnerability repair issues of the third-party SDK (Software Development Kit); the security and vulnerability repair issues of the SDK or APK provided by other suppliers such as the DVR (Digital Video Recorder) integrated in the car computer should ensure the corresponding security issues.

[0116] SDK refers to a collection of development tools for building application software by using specific software packages, software frameworks, hardware platforms, operating systems, etc. DVR can record images of vehicles while driving, and transmit, store and analyze them in real time through the Internet. The functions of DVR include: real-time monitoring and recording, Internet connection, collision detection, lane departure warning, voice control, remote control, intelligent analysis and security and anti-theft. Real-time monitoring and recording means that when the vehicle is driving, it automatically starts and records the video of the surrounding environment, including road conditions, traffic signs and other vehicles. Internet connection means uploading the recorded video to the cloud or other devices via Wi-Fi or cellular network, so that users can view and playback the history at any time. Collision detection means that when the vehicle collides, the emergency recording mode is automatically triggered to record the video clips before and after the accident. Lane departure warning means that the built-in sensor monitors the driving trajectory of the vehicle. If the vehicle is found to deviate from the lane, an alarm will be issued to remind the driver. Voice control means that it supports voice commands, such as "start recording" and "stop recording", making the operation more convenient. Remote control means that through the mobile phone APP or web page, users can remotely view the vehicle status, real-time images, recorded videos, etc. Intelligent analysis refers to the analysis of video content to identify information such as license plate numbers and vehicle types, helping users deal with traffic accidents, violation inquiries, etc. Security and anti-theft refers to the vehicle positioning and anti-theft tracking functions. Once a theft occurs, the location can be quickly locked and clues for recovery can be provided.

[0117] In addition, for communication security, the vehicle system has multiple external connection methods such as Bluetooth, Wi-Fi and USB. For the communication connection between Wi-Fi and the dashcam controller, Wi-Fi communication is required to implement a secure transmission protocol above TLS1.2. For the use of USB, it should be ensured that any executable program in the USB cannot be executed by the system, and the execution permission of the USB partition is controlled as a protection method for the security of external connections. The communication security between Bluetooth modules generally requires the use of a secure simple pairing strategy (Secure Simple Pairing, SSP), in which the elliptic curve Diffie-Hellman (ECDH) key protocol replaces the outdated key protocol when generating link keys, and low-power Bluetooth uses SCP (Secure Copy) secure connection pairing method. SCP (Secure Copy) is a secure file transfer command in the Linux system. It is based on SSH (Secure Shell) and transfers files between local and remote hosts in an encrypted manner. SSH is a protocol used for secure remote login and other secure network services on an insecure network. SSH is a security protocol based on the application layer. The use of the SSH protocol can effectively prevent information leakage during remote management. SSH was originally a program on UNIX systems, and later quickly expanded to other operating platforms. When used correctly, SSH can fill in the loopholes in the network. SSH clients are suitable for a variety of platforms, and almost all UNIX platforms and other platforms can run SSH.

[0118] When applying Wi-Fi, attention should be paid to the security of the settings to avoid malicious connection access. If the Wi-Fi connection information is directly exposed, any unauthorized user can connect to the Wi-Fi hotspot, thereby performing malicious connection events. Wi-Fi setting security requirements must be met: Wi-Fi usernames and passwords must be met at the factory. Each device must be set with a different username and password to reduce the possibility of misconnection and malicious human connection. If the default initial password, username, etc. are all the same, it is easier for users to make misconnections and increase the possibility of malicious connections. When Wi-Fi is used as a hotspot, high-security authentication mechanisms such as WPA2-PSK (WPA2-Preshared Key, the second version of WPA pre-shared key) need to be used to reduce the risk of Wi-Fi authentication protocols being cracked. When Wi-Fi connects and communicates with other controllers, it is required to implement a secure transmission protocol above TLS1.2. TLS is a two-layer protocol set consisting of multiple protocols, working between the application layer and the transport layer. The TLS protocol contains two layers of protocols: the record layer protocol and the handshake protocol. The record layer protocol is used to encapsulate multiple upper layer protocols, and the handshake protocol is used to perform mutual authentication before transmitting / receiving application data, and to negotiate the encryption algorithm and the key to be used. There are many ways for the record layer protocol to achieve secure data transmission. For example, if the link is private, the application data is encrypted using a symmetric encryption paradigm; if the link is reliable, the message integrity is verified using an information authentication code, which can be calculated using a hash function. The handshake protocol provides multiple ways to secure data transmission. For example, the identity of the other end can be authenticated through an asymmetric algorithm, public key, encryption, etc.; the process of negotiating a shared key is secure, and an eavesdropper cannot obtain the negotiated key; the negotiation is reliable, and an attacker cannot modify the negotiation message without being detected by the link.

[0119] The car computer should use TLS to establish an information security channel with the back-end service platform, third-party server or mobile phone to ensure data security during transmission; the TLS version used should not be lower than V1.2. The algorithm suite used is recommended to be ECDHE-RSA2048-AES128-GCM-SHA256. The car computer should encapsulate or integrate the cryptographic service module to provide secure encryption for the upper-layer applications of the car computer through the API.

[0120] Implementation of the embodiments of the present invention includes the following beneficial effects: the embodiments of the present invention first initialize the security settings of the vehicle system, the security settings include any one or more of access rights, trusted execution environment, system log output, system protection, factory mode, main interface entry or browser application; when the vehicle system obtains external operation instructions, the operation instructions are processed according to the security settings, and the vehicle system is provided with all-round, multi-angle and multi-level security protection from multiple aspects such as access rights, trusted execution environment, system log output, system protection, factory mode, main interface entry or browser, thereby reducing the probability of the vehicle being maliciously attacked and improving the information security of the vehicle system and the security of user information.

[0121] See also Fig. 9 The embodiment of the present invention provides a system for processing vehicle system information security, including:

[0122] A setting module, used to initialize the security settings of the vehicle system, wherein the security settings include any one or more of access rights, trusted execution environment, system log output, system protection, factory mode, main interface entry or browser application;

[0123] The execution module is used to obtain an operation instruction and process the operation instruction according to the security setting.

[0124] It can be seen that the contents of the above method embodiments are all applicable to the present system embodiments, the functions specifically implemented by the present system embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0125] See also Fig.10 The embodiment of the present invention provides a device for processing vehicle system information security, including:

[0126] at least one processor;

[0127] at least one memory for storing at least one program;

[0128] When at least one program is executed by at least one processor, the at least one processor implements the above processing method.

[0129] Among them, the memory, as a non-transient computer-readable storage medium, can be used to store non-transient software programs and non-transient computer executable programs. The memory may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some embodiments, the memory may optionally include a remote memory remotely arranged relative to the processor, and these remote memories may be connected to the processor via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0130] It can be seen that the contents of the above method embodiments are all applicable to the present device embodiments, the functions specifically implemented by the present device embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0131] In addition, the embodiment of the present application also discloses a computer program product or a computer program, which is stored in a computer-readable storage medium. The processor of the computer device can read the computer program from the computer-readable storage medium, and the processor executes the computer program, so that the computer device performs the above method.

[0132] The embodiment of the present invention further provides a computer-readable storage medium, which stores a program executable by a processor, and the program executable by the processor is used to implement the above method when executed by the processor. Similarly, the contents of the above method embodiment are all applicable to the present storage medium embodiment, and the functions specifically implemented by the present storage medium embodiment are the same as those of the above method embodiment, and the beneficial effects achieved are also the same as those achieved by the above method embodiment.

[0133] It is understood that all or some steps and systems in the disclosed method above can be implemented as software, firmware, hardware and appropriate combinations thereof. Some physical components or all physical components can be implemented as software executed by a processor, such as a central processing unit, a digital signal processor or a microprocessor, or implemented as hardware, or implemented as an integrated circuit, such as an application-specific integrated circuit. Such software can be distributed on a computer-readable medium, and the computer-readable medium can include a computer storage medium (or a non-transitory medium) and a communication medium (or a temporary medium). As known to those of ordinary skill in the art, the term computer storage medium includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, program modules or other data). Computer storage media include, but are not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disk (DVD) or other optical disk storage, magnetic cassette, magnetic tape, disk storage or other magnetic storage device, or any other medium that can be used to store desired information and can be accessed by a computer. Furthermore, it is well known to those skilled in the art that communication media typically embodies computer readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave or other transport mechanism, and may include any information delivery media.

[0134] An embodiment of the present invention provides a vehicle, and the vehicle includes the above-mentioned vehicle system information security processing device.

[0135] The embodiment further provides a vehicle, which includes an electric drive assembly of the above-mentioned vehicle system information security processing system (or device) or computer device (or electronic device). Specifically, the vehicle can be a private car, such as a sedan, SUV, MPV or pickup truck. The vehicle can also be an operating vehicle, such as a van, bus, small truck or large trailer. The vehicle can be a gasoline vehicle or a new energy vehicle. When the vehicle is a new energy vehicle, it can be a hybrid vehicle or a pure electric vehicle.

[0136] It should be understood that in the present application, "at least one (item)" means one or more, and "plurality" means two or more. "And / or" is used to describe the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" can mean: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally indicates that the objects associated before and after are in an "or" relationship. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple.

[0137] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.

[0138] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0139] The above is a specific description of the preferred implementation of the present invention, but the invention is not limited to the embodiments. Those skilled in the art may make various equivalent modifications or substitutions without violating the spirit of the present invention. These equivalent modifications or substitutions are all included in the scope defined by the claims of this application.

Claims

1. A method for processing information security of a vehicle computer system, It is characterized in that include: Initialize the security settings of the vehicle system, which include any one or more of access rights, trusted execution environment, system log output, system protection, factory mode, main interface entry, or browser application; An operation instruction is obtained, and the operation instruction is processed according to the security setting.

2. The processing method according to claim 1, It is characterized in that The access rights include the access rights of the vehicle operating system, and the access rights of the vehicle operating system are securely set in the following ways: Access control measures are used to restrict access to the core resources of the vehicle operating system; the vehicle operating system uses minimal service permissions for access; Limit the static permissions and / or dynamic permissions of applications in the vehicle operating system.

3. The processing method according to claim 1, It is characterized in that The access rights include port access rights and / or network access rights of the vehicle system, and the port access rights and / or network access rights of the vehicle system are securely set in the following manner: Close ports that are not used by the business and prohibit opening public agreed ports; And / or, prohibit the first external network address from directly accessing the vehicle system, and restrict the second external network address from remote access.

4. The processing method according to claim 1, It is characterized in that The system log output is secured in the following ways: It is prohibited to output system logs containing sensitive information; the sensitive information includes any one or more of access point names, remote communication information, passwords, server addresses, account permissions or kernel module key information.

5. The processing method according to claim 1, It is characterized in that The system protection is securely set up in the following ways: Detect malicious programs running on the system; the malicious program detection engine supports periodic updates of the virus database; If a vulnerability is detected, upgrade the vehicle system version or fix the vulnerability.

6. The processing method according to claim 1, It is characterized in that The factory mode is securely set up in the following way: Reducing the operable functions in the factory mode and lowering the operation authority of the factory mode; And / or, regularly replace the operation logic of the factory mode.

7. The processing method according to claim 1, It is characterized in that The factory mode is entered in the following way: In the first preset interface, obtaining a preset operation to enter the second preset interface; wherein the first preset interface refers to the front interface for entering the hidden interface, and the second preset interface refers to the front interface for entering the factory mode; The input content is obtained through the second preset interface; if the input content is correct, the factory mode is entered; if the input content is incorrect, the factory mode is locked for a preset time.

8. The processing method according to claim 1, It is characterized in that The main interface is accessed in the following ways: Displaying the initial interface, obtaining a feedback signal of the initial interface, activating the vehicle system, and entering the main interface; Or, obtain a password file, and if the password file meets the preset requirements, enter the main interface.

9. The processing method according to claim 1, It is characterized in that The browser application is securely configured in the following ways: The vehicle system is prohibited from downloading third-party applications through the browser and obtaining third-party applications through the preset application store.

10. A processing device for vehicle system information security, It is characterized in that include: at least one processor; at least one memory for storing at least one program; When the at least one program is executed by the at least one processor, the at least one processor implements the method according to any one of claims 1 to 9.

11. A computer-readable storage medium having a program executable by a processor stored therein, It is characterized in that The processor-executable program is used to perform the method according to any one of claims 1 to 9 when executed by the processor.

12. A vehicle, It is characterized in that The vehicle includes the vehicle system information security processing device as claimed in claim 10.

Images