Method for upgrading firmware of Bluetooth module and related product

Abstract

The invention discloses a method for upgrading firmware of a Bluetooth module and a related product. The method comprises the following steps: receiving a firmware upgrading challenge code; calculating the firmware upgrade challenge code by using the control management module to obtain a response code to be verified; performing first security verification on the firmware upgrading token by utilizing a control management module; performing second security verification on each segment of firmware upgrade packet of the firmware upgrade packet by using a control management module; receiving an overall firmware upgrade package, and performing third security verification on the overall firmware upgrade package by using the control management module; writing the main body of the firmware upgrade package into the firmware upgrade slot, and performing fourth security verification on the upgraded firmware by using the firmware master device; and confirming that the firmware upgrading of the Bluetooth module is completed. According to the scheme, the security of the Bluetooth module in the firmware upgrading process is comprehensively improved by combining a random challenge code mechanism, a firmware upgrading token, a firmware upgrading package digital signature and other multi-layer security mechanisms.

Description

Technical Field

[0001] The present invention generally relates to the field of wireless communication technology. More specifically, the present invention relates to a method for upgrading Bluetooth module firmware and related products. Background Art

[0002] The Bluetooth module is an embedded device with built-in Bluetooth communication function. After the Bluetooth module leaves the factory, it needs to be periodically or irregularly upgraded in firmware to fix defects, improve functions, and enhance device performance in daily use.

[0003] The existing methods for upgrading Bluetooth module firmware mainly include wired and wireless methods. When wireless upgrading is adopted, the device is remotely upgraded and updated through Bluetooth wireless communication. It mainly adopts Bluetooth OTA (Over-the-Air) technology based on Bluetooth communication protocol. Since the Bluetooth communication protocol defines the communication specifications and data exchange methods between devices, including data transmission rate, communication frequency, data format, etc., it provides a reliable communication basis for firmware upgrades. When the Bluetooth module adopts wireless method for remote firmware upgrade, through OTA (Over-The-Air) technology, the Bluetooth device can update the firmware without directly connecting to the server. This method usually relies on network communication protocols such as Ymodem protocol.

[0004] In the traditional Bluetooth Low Energy (BLE) OTA upgrade scenario, when upgrading the Bluetooth module firmware, the terminal device (such as the firmware master device) responds to the upgrade command of the server, and stores the firmware file for the upgrade by setting an external storage device or a built-in flash memory of the device. The firmware usually includes operating system, driver, application and other parts. When the firmware upgrade package is received, the terminal device uses the decompression function to decompress the firmware upgrade package and writes the decompressed firmware upgrade package to the firmware upgrade slot. The terminal device verifies the firmware version through the saved preset version information and performs the firmware upgrade. If the verification or upgrade fails, a firmware upgrade failure signal is sent to the server to wait for re-upgrade.

[0005] In the above-mentioned conventional firmware upgrade process, due to the credibility issues of both the firmware source and the transmission channel, as well as the possibility of file corruption or tampering during the upgrade process, there are serious security issues in the OTA upgrade process, which makes it vulnerable to attacks.

[0006] In view of this, there is an urgent need to provide a method for Bluetooth module firmware upgrade to prevent firmware files that have not been security-verified from entering the Bluetooth module, effectively improve the security during firmware upgrades, and reduce potential security risks. Summary of the invention

[0007] In order to at least solve one or more of the technical problems mentioned above, the present invention proposes a method for upgrading Bluetooth module firmware in multiple aspects.

[0008] In a first aspect, the present invention provides a method for upgrading firmware of a Bluetooth module, wherein the Bluetooth module comprises a control management module and a firmware master device, wherein the firmware master device is configured with a firmware upgrade slot; the method comprises: receiving a firmware upgrade challenge code, wherein the firmware upgrade challenge code comprises a random number, a digital operation, a hash comparison or an encryption and decryption process; utilizing the control management module to calculate the firmware upgrade challenge code according to a predetermined algorithm to obtain a response code to be verified; returning the response code to be verified to a sender of the challenge code to obtain a verification result of the sender of the challenge code; in response to the firmware upgrade challenge code being verified, receiving a firmware upgrade token for upgrading firmware of the Bluetooth module; utilizing the control management module to perform a first security check on the firmware upgrade token; in response to the first security check being passed, receiving a firmware upgrade package for upgrading firmware of the Bluetooth module; wherein the firmware upgrade package comprises a firmware upgrade package that is dynamically divided into a segment or A plurality of firmware upgrade packets, and each firmware upgrade packet of the firmware upgrade packet has a verification code; using the control management module to perform a second security check on each firmware upgrade packet of the firmware upgrade packet, wherein the second security check includes verifying the verification code of the firmware upgrade packet; in response to the second security check passing, using the control management module to merge all the received firmware upgrade packets into an overall firmware upgrade package, wherein the overall firmware upgrade package includes a main body and a digital signature of the firmware upgrade package; using the control management module to perform a third security check on the entire firmware upgrade package; wherein the third security check includes verifying the digital signature of the firmware upgrade package; in response to the third security check passing, writing the main body of the firmware upgrade package into the firmware upgrade slot, and using the firmware master device to perform a fourth security check on the upgraded firmware; and in response to the fourth security check passing, confirming that the firmware upgrade of the Bluetooth module is completed.

[0009] In some embodiments, the firmware upgrade token includes: the version number of the firmware, and a timestamp and a random number dynamically generated by the firmware upgrade package server.

[0010] In some embodiments, receiving a firmware upgrade package for performing firmware upgrade on the Bluetooth module includes: receiving one or more segments of firmware upgrade packets, and the one or more segments of firmware upgrade packets are sent in a random order.

[0011] In some embodiments, the digital signature of the firmware upgrade package is a digital signature of the main body of the firmware upgrade package using the private key and / or random number in a pair of public and private keys generated by a firmware upgrade package server, wherein the digital signature includes performing a hash calculation on the main content of the firmware upgrade package to obtain a hash value, and signing the hash value using the private key and / or random number to generate the digital signature of the firmware upgrade package.

[0012] In some embodiments, the third security check includes: extracting the main body (message) and digital signature (signature) of the firmware upgrade package from the overall firmware upgrade package, using the same hash algorithm as the signature to perform hash calculation on the main content of the firmware upgrade package to obtain a new hash value data'; using the extended Euclidean algorithm to calculate the modular inverse k of the random number k with respect to the modulus n -1 ; According to the digital signature, use the public key exponent e and the module inverse k -1 Verifying the digital signature; and comparing the new hash value with the original hash value, if the two are the same, the digital signature passes the third security check.

[0013] In some embodiments, the fourth security check includes: the Bluetooth module is restarted to verify whether the upgraded firmware is successfully loaded and run.

[0014] In a second aspect, the present invention provides a Bluetooth module, comprising: a control management module, a firmware master device, and a firmware upgrade slot and a firmware backup slot mounted on the firmware master device; wherein the control management module is configured to receive a firmware upgrade package, and perform a first security check, a second security check, and a third security check on the firmware upgrade package as described in the method of the first aspect; the firmware upgrade slot is configured to upgrade the firmware of the firmware master device; the firmware master device is configured to perform a fourth security check on the upgraded firmware as described in the method of the first aspect; and the firmware backup slot is configured to back up a verified firmware version.

[0015] In a third aspect, the present invention provides a computer-readable storage medium, which includes program instructions for upgrading Bluetooth module firmware. When the program instructions are executed by a processor, the method according to any one of the first aspects is implemented.

[0016] Through the method for Bluetooth module firmware upgrade provided above, the embodiment of the present invention can ensure that the connected Bluetooth module device to be upgraded is an authorized device by performing challenge code verification at the beginning of the Bluetooth module firmware upgrade. Further, in some embodiments, by the first security check of the firmware upgrade token, the reliability of the source of the firmware upgrade package and the security of the transmission process can be ensured. Furthermore, in some embodiments, by dynamically dividing the firmware upgrade package into multiple firmware upgrade packets for transmission, and each firmware upgrade packet has a check code, it can adapt to the memory limitations of the Bluetooth module and ensure the security and reliability of the transmission.

[0017] Furthermore, in some embodiments, the digital signature of the firmware upgrade package can prevent the firmware file from being intercepted and tampered with by a third party during the transmission process. In some embodiments, after the firmware download is completed, the firmware upgrade package is verified using a hash algorithm to ensure that the firmware upgrade package has not been tampered with. And due to the existence of the digital signature verification of the firmware upgrade package, the firmware file cannot pass the verification even if it has been tampered with, thereby ensuring the authenticity and integrity of the firmware upgrade package.

[0018] Through the solution provided by the present invention, combined with multi-layer security mechanisms such as random challenge code mechanism, firmware upgrade token and firmware upgrade package digital signature, the security of the Bluetooth module during the firmware upgrade process is comprehensively improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] By reading the following detailed description with reference to the accompanying drawings, the above and other objects, features and advantages of the exemplary embodiments of the present invention will become readily understood. In the accompanying drawings, several embodiments of the present invention are shown in an exemplary and non-limiting manner, and the same or corresponding reference numerals represent the same or corresponding parts, wherein:

[0020] Figure 1 An exemplary flow chart of a method for upgrading Bluetooth module firmware according to an embodiment of the present invention is shown;

[0021] Figure 2 An exemplary flow chart of a Bluetooth module firmware upgrade process according to some embodiments of the present invention is shown; and

[0022] Figure 3 An exemplary structural block diagram of a Bluetooth module according to an embodiment of the present invention is shown. DETAILED DESCRIPTION

[0023] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0024] It should be understood that when the terms "first", "second", "third" and "fourth" are used in the claims, description and drawings of the present invention, they are only used to distinguish different objects, rather than to describe a specific order. The terms "include" and "comprise" used in the description and claims of the present invention indicate the presence of the described features, wholes, steps, operations, elements and / or components, but do not exclude the presence or addition of one or more other features, wholes, steps, operations, elements, components and / or their collections.

[0025] It should also be understood that the terms used in this specification of the present invention are only for the purpose of describing specific embodiments and are not intended to limit the present invention. As used in the specification of the present invention and the claims, the singular forms of "a", "an" and "the" are intended to include the plural forms unless the context clearly indicates otherwise. It should also be further understood that the term "and / or" used in the specification of the present invention and the claims refers to any combination of one or more of the associated listed items and all possible combinations, and includes these combinations.

[0026] As used in this specification and claims, the term "if" may be interpreted as "when" or "upon" or "in response to determining" or "in response to detecting," depending on the context. Similarly, the phrase "if it is determined" or "if [described condition or event] is detected" may be interpreted as meaning "upon determination" or "in response to determining" or "upon detection of [described condition or event]" or "in response to detecting [described condition or event]," depending on the context.

[0027] The specific embodiments of the present invention are described in detail below with reference to the accompanying drawings.

[0028] Figure 1 An exemplary flow chart of a method 100 for upgrading Bluetooth module firmware according to an embodiment of the present invention is shown.

[0029] In actual use, the firmware of the Bluetooth module needs to be upgraded to fix defects or improve functions, or for the needs of product operation and maintenance. Firmware version updates can fix product defects and improve product stability and reliability; secondly, firmware upgrades can also enrich product functions and increase user stickiness; and firmware upgrades can also help products quickly iterate and upgrade, reduce overall development costs, and maintain or improve device performance. In order to ensure the security of the Bluetooth module upgrade process, the technical personnel of the present invention have proposed a technical solution for Bluetooth module firmware upgrade by conducting detailed analysis and verification of each link of the firmware upgrade process, combined with multiple rounds of experiments and demonstrations.

[0030] like Figure 1 As shown, a specific implementation example of the firmware upgrade process is described in method 100. In the multi-level verification of this embodiment, a challenge verification code is proposed for the device identity of the firmware upgrade to verify the identity of the upgrade device. When the upgrade service party provides the upgrade package, an upgrade token mechanism is designed to ensure that the upgrade request meets the requirements of security and timeliness. In view of the fact that low-power Bluetooth is limited by the data transmission speed, its application is also limited to the case of small data transmission. In combination with the needs of security, a mechanism is designed to dynamically divide the upgrade package into multiple segments and transmit it randomly on the basis of the existing encrypted transmission. At the same time, for the overall security of the received data packet, the present invention designs a digital signature mechanism to verify the integrity and authenticity. Finally, after the upgrade installation is completed, a measure for running the overall verification integrity is designed. Based on the above-mentioned comprehensive design, random numbers are also introduced and integrated into the upgrade process, so that from device security, upgrade package security to convenient transmission, as well as overall verification, the security protection in the firmware upgrade process is further strengthened.

[0031] Specifically, at step S101, a firmware upgrade challenge code is received. When the Bluetooth module is upgrading its firmware, in one embodiment, the upgrade server sends a firmware upgrade challenge code in a predetermined manner, and the firmware upgrade challenge code may include a random number, digital operation, hash comparison, or encryption and decryption process.

[0032] When the Bluetooth module receives the firmware upgrade challenge code, the process proceeds to step S102, and the control management module is used to calculate the firmware upgrade challenge code according to a predetermined algorithm to obtain a response code to be verified. In one embodiment, the predetermined algorithm includes: a hash algorithm, an asymmetric encryption algorithm and / or a symmetric encryption algorithm.

[0033] After obtaining the response code to be verified, the process proceeds to step S103, and the response code to be verified is returned to the service party that sent the challenge code to obtain the verification result of the service party that sent the challenge code. The service party that sends the challenge code here can be a firmware server of the firmware upgrade service end, or an upgrade tool (such as a smartphone APP, PC software), or a device such as a gateway.

[0034] In the specific embodiment of the above steps S102 to S103, the firmware upgrade challenge code response mechanism can execute the following example process: in a scenario where a random number is received, after the Bluetooth module receives the random number sent by the firmware upgrade service party or the firmware upgrade service end, it uses an internal algorithm (such as a hash function) to process the random number and sends the processing result back to the firmware upgrade service party. After the service party receives the response result, it verifies whether the hash value is consistent with the predetermined result, thereby confirming the legitimacy of the Bluetooth module. Therefore, through the verification of the challenge code (random number), the legitimacy and security of the firmware upgrade request are enhanced, and unauthorized Bluetooth modules can be prevented from simulating and attempting firmware upgrades. In addition, during the research process of the technical solution, the technical personnel of the present invention also found that the design of the challenge code mechanism can effectively counter man-in-the-middle attacks (MITM) and other attack security threats.

[0035] In some embodiments, when the challenge code is a digital operation, hash comparison or encryption and decryption process, through the teachings of the embodiments of the present invention, those skilled in the art can understand that the control management module will make a corresponding challenge code response code result according to the specific form of the challenge code through the internal corresponding preset algorithm and send it to the service party for verification.

[0036] Further, in step S104, in response to the firmware upgrade challenge code verification being passed, a firmware upgrade token for the Bluetooth module to perform firmware upgrade is received, and in step S105, the firmware upgrade token is subjected to a first security check using the control management module.

[0037] Specifically in an embodiment scenario, if the challenge code verification is passed, the firmware upgrade server will allow the next upgrade process to proceed; otherwise, the firmware upgrade server will reject the upgrade request. The firmware upgrade server will generate a dynamic firmware upgrade token before continuing to perform the firmware upgrade. The firmware upgrade token includes: the version number of the firmware, and the timestamp and random number dynamically generated by the firmware upgrade package server. Specifically, the firmware upgrade server uses a secure random number generator to generate a random number of sufficient length, and obtains the current timestamp. Then the firmware upgrade server combines the version number, timestamp and random number of this upgrade to form an initial token string. By selecting a strong encryption algorithm, such as AES or RSA algorithm, the initial token string is encrypted using the server's private key or symmetric key. Then use a digital signature algorithm (such as ECDSA) and the server's private key to sign the encrypted token, and finally send the encrypted and signed token to the Bluetooth module. After receiving the token, the Bluetooth module uses the corresponding public key or symmetric key to decrypt the token through the control management module. For the decrypted token, the control management module first verifies whether the firmware version number is greater than the current version number. If the version number is not greater than the current version number, it returns a verification failure result and refuses to continue upgrading. This version number management can prevent attackers from upgrading with old versions of firmware and bypassing new security measures.

[0038] If the version number verification passes, then continue to verify whether the timestamp is within the allowed time window to ensure the timeliness of the token. Since the token contains a timestamp, the expiration time can be set. Therefore, during the timestamp verification process, if the timestamp expires, the token automatically becomes invalid and a new token needs to be obtained, thus ensuring that each token is only used for one firmware upgrade and is no longer used afterwards.

[0039] Finally, check whether the random number in the token is consistent with the random number sent by the firmware server. If the random numbers match, the token is considered legitimate and can be used to upgrade the firmware. If the random numbers do not match or the signature verification fails, take exception handling measures, such as rejecting the firmware upgrade request.

[0040] Furthermore, by verifying the token signature, the authenticity of the token can be ensured. If the token signature verification is successful, the Bluetooth module approves the server's firmware upgrade request and proceeds to the next step of receiving the firmware upgrade package. If the token signature verification fails, the Bluetooth module will take corresponding processing mechanisms, such as refusing the upgrade, recording events, and alarming. By verifying the token, the Bluetooth module can ensure that it communicates with the real firmware upgrade package server, not a malicious middleman.

[0041] In the firmware upgrade request mentioned above, if the Bluetooth module detects an abnormal token request, such as one with too high a frequency or from an abnormal IP address, there may be a security risk and an alarm needs to be issued to ensure the security and effectiveness of the dynamic firmware upgrade token used.

[0042] Further, after the firmware upgrade token verification is passed, the process comes to step S106, and in response to the passing of the first security verification, a firmware upgrade package for the Bluetooth module to perform firmware upgrade is received. Among them, the firmware upgrade package includes a firmware upgrade packet dynamically divided into one or more segments, and each firmware upgrade packet of the firmware upgrade package carries a verification code. In one embodiment, receiving a firmware upgrade package for the Bluetooth module to perform firmware upgrade may include receiving one or more segments of firmware upgrade packets, and the one or more segments of firmware upgrade packets are sent in a random order. Through the above-mentioned scheme design of the present invention, since the firmware upgrade package is dynamically divided into multiple segments of packets and randomly sent out of order, it can be avoided that the firmware upgrade package is not easily tampered with even if it is intercepted during transmission, thereby effectively ensuring the security of the firmware upgrade package. In addition, due to the memory limitation of the Bluetooth module and the data transmission speed limitation, the firmware upgrade package is dynamically divided into multiple segments of packets, which can also reduce the impact of transmission interruption caused by network transmission bandwidth, and even if packet loss occurs, it is not necessary to retransmit all firmware upgrade packages.

[0043] Further, at step S107, the control management module is used to perform a second security check on each firmware upgrade packet of the firmware upgrade package, wherein the second security check includes verifying the check code of the firmware upgrade packet. And at step S108, in response to the second security check passing, the control management module is used to merge all the received firmware upgrade packets into an overall firmware upgrade package, wherein the overall firmware upgrade package includes the main body of the firmware upgrade package and a digital signature.

[0044] For the above steps S106 to S108, in an embodiment scenario, the firmware upgrade package is dynamically divided into one or more firmware upgrade packets, wherein the size of each firmware upgrade packet can be determined according to actual needs and the characteristics of the transmission medium. Further, a check code can be attached to each firmware upgrade packet. The check code can be a check code generated using a predetermined algorithm for each firmware data segment. For example, the content of the data segment is processed using the CRC32 algorithm to generate a 32-bit check value. Then, the generated check code is attached to the end of the corresponding data segment, or sent together as a separate check information. After receiving each data segment, the receiver of the Bluetooth module uses the same check algorithm to check the data segment. Then, the recalculated check code is compared with the check code attached during transmission. If the check code matches, the data segment is considered to be complete and not tampered with; if it does not match, it is considered that the data segment may have been damaged or tampered with during transmission. If the data segment check fails, the receiver can request the sender to resend the data segment. Furthermore, all receiving and verification processes can be logged to facilitate problem diagnosis and security auditing.

[0045] When sending multiple firmware upgrade packets, the sending server can send them in random order to reduce the risk of the complete firmware upgrade package being intercepted. When the Bluetooth module receives all the firmware upgrade packets, it can reassemble the firmware upgrade package according to the serial number of each firmware upgrade packet and the correct order of the original firmware upgrade packet. Therefore, by providing a verification mechanism for the dynamic segmented transmission of the firmware upgrade package, the security and reliability of the firmware upgrade are ensured.

[0046] Further, at step S109, the control management module is used to perform a third security check on the overall firmware upgrade package. Wherein, the third security check includes verifying the digital signature of the firmware upgrade package. In one embodiment, after receiving and verifying each firmware upgrade packet, the Bluetooth module restores it to a complete overall firmware upgrade package. Since the overall firmware upgrade package includes the main body and digital signature of the firmware upgrade package, the control management module in the Bluetooth module can perform an integrity check on the digital signature of the firmware upgrade package based on the main body of the firmware upgrade package. The digital signature of the firmware upgrade package is a digital signature of the main body of the firmware upgrade package using the private key and / or random number in a pair of public and private keys generated by the firmware upgrade package server, wherein the digital signature includes hashing the main content of the firmware upgrade package to obtain a hash value, and signing the hash value using the private key and / or random number to generate the digital signature of the firmware upgrade package. The generation of the specific digital signature includes the following calculation steps:

[0047] Calculate the hash value (data) of the main content of the firmware upgrade package. The formula is: data = Hash(message); where message is the main content of the firmware upgrade package to be signed.

[0048] Generate a random number k, where 1 < k < n - 1 and k is relatively prime to the algorithm modulus n, that is, the greatest common divisor gcd(k, n) = 1.

[0049] According to the hash value data, use the private key and / or the random number k to generate a digital signature: signature = (data d ·k e·m ) mod n. Where e is the public key exponent, n is the algorithm modulus, d is the private key exponent, and m is a certain representation of the firmware upgrade package. This representation can be a value related to the firmware upgrade package, such as the hash value of the firmware upgrade package, the length of the firmware upgrade package, or the timestamp. By introducing the random number k into the digital signature as described above, it can be ensured that even if the same firmware upgrade package is signed multiple times, the generated signatures will be different, which increases the difficulty of cracking the digital signature.

[0050] In the above signature design scheme of the present invention, by designing and introducing the formula k e·m , the result of multiplying the random number k with e and m is exponentiated to be used to add a random factor in the digital signature to enhance the security of the signature. Further, through the above design, certain types of cryptographic analysis attacks, such as side-channel attacks, can also be prevented. It is ensured that even if the same upgrade package is signed at different times, due to the existence of m (which may include a timestamp), the generated signatures will be unique.

[0051] In one embodiment, if the signature contains timestamp information, it can be verified whether the timestamp is within the valid period, and then the final signature verification result can be obtained by comprehensively comparing the hash value and the result of timestamp verification. Therefore, by designing and introducing elements such as the random number k and the timestamp, the digital signature generation and verification formula increases the difficulty of cracking, while providing additional security and flexibility. In practical application scenarios, these complex calculations can be implemented with the support of a cryptographic library.

[0052] Further, the steps of the third security check in one embodiment include: extracting the main body (message) and the digital signature (signature) of the firmware upgrade package from the overall firmware upgrade package, and then using the same hash algorithm as when signing to perform a hash calculation on the main content of the firmware upgrade package to obtain a new hash value data'; the formula is data' = Hash(message). Subsequently, use the extended Euclidean algorithm to calculate the modular inverse k of the random number k with respect to the modulus n -1 , the formula is: k -1=k -1 mod n; and satisfy k·k -1 ≡1(mod n). According to the digital signature, use the public key exponent e and the modulo inverse k -1 Verify the digital signature, where the formula for obtaining the original hash value (verified_data) is: verified_data = (signature e ·k -1 ) mod n. Finally, the new hash value is compared with the original hash value. If verified_data is the same as data', the digital signature passes the third security check.

[0053] In order for those skilled in the art to more clearly understand the technical solution of the present invention, the complete process of specific digital signature verification is described below by way of example. Before the firmware upgrade package is released, the manufacturer generates a pair of public and private keys for the upgrade package, wherein the private key is used to sign the firmware and the public key is used to verify the validity of the signature. When the firmware upgrade package is signed using the private key, in some embodiments, the signing process described in step S109 above, by hashing the main content of the firmware upgrade package and encrypting the hash value using the private key, can further be combined with a random number to generate a digital signature for the firmware upgrade package. Then, the manufacturer will publish the main content of the signed firmware upgrade package together with the digital signature to the firmware server. When the firmware upgrade package is transmitted to the Bluetooth module, the control management module of the Bluetooth module extracts the main content of the firmware upgrade package and the corresponding digital signature (signature) from the downloaded firmware upgrade data packet. Then, the main content of the firmware upgrade package is calculated using the same hash algorithm as when signing to obtain a new hash value. Finally, the digital signature is decrypted using the public key to obtain the original hash value. The specific calculation steps are as follows:

[0054] The content (message) of the extracted firmware upgrade package is hashed in the same way as the signature to obtain data', the formula is data'=Hash(message). The modular inverse k of the random number k with respect to the modulus n is calculated by using the extended Euclidean algorithm. -1 , the formula is: -1 =k -1 mod n; and satisfy k·k -1 ≡1(mod n); Finally, use the public key exponent e and the modular inverse k -1 Verify the digital signature, where the formula for obtaining the original hash value (verified_data) is: verified_data = (signature e ·k -1 )mod n. where k·k -1≡1(mod n) means that under the modulus n, k is multiplied by its modular inverse k -1 The result is 1.

[0055] The new hash value is then compared with the original hash value obtained by decryption. If verified_data and data' are the same, the digital signature passes the third security check. This proves that the main content of the firmware upgrade package has not been tampered with during the transmission process and is confirmed to be from a trusted manufacturer.

[0056] Further, in step S110, in response to the passing of the third security check, the main body of the firmware upgrade package is written into the firmware upgrade slot, and the firmware master device is used to perform a fourth security check on the upgraded firmware. In one embodiment scenario, the fourth security check includes: the Bluetooth module is restarted to verify whether the upgraded firmware is successfully loaded and run. It is also possible to use CRC (cyclic redundancy check) to check the entire firmware to verify the integrity of the firmware after the upgrade. In one embodiment, the verification process may also include checking the entry point of the firmware and executing some self-test programs. Once the new firmware is successfully loaded and run, the hardware of the Bluetooth module will execute the startup program in the new firmware, thereby completing the entire upgrade process. If the above-mentioned fourth security check fails, or the upgrade fails, or an error is detected during the upgrade process, since the firmware master device of the Bluetooth module of the present invention is also configured with a firmware backup slot, the firmware master device will switch to the firmware backup slot, so that the firmware version will roll back to the old version of the firmware or enter the safe mode to wait for user intervention. This technical method also provides a security guarantee for the firmware master device in the firmware upgrade environment to restore the working state under the upgrade abnormality.

[0057] Further, in step S111, in response to the fourth security check passing, the firmware upgrade of the Bluetooth module is confirmed to be completed. The firmware upgrade can repair known software defects of the Bluetooth module, reduce system crashes or abnormal behaviors, and improve the stability of the device.

[0058] Through the method for upgrading the firmware of the Bluetooth module provided above, multi-level verification of the firmware upgrade package is utilized during the firmware upgrade process, thereby ensuring the security of the Bluetooth module during the firmware upgrade.

[0059] Figure 2 An exemplary flow chart of a Bluetooth module firmware upgrade process 200 according to some embodiments of the present invention is shown. The upgrade process 200 may include more details of the operation of the system 100 described above, so the specific description of the upgrade process below can be regarded as a possible implementation of the method 100.

[0060] like Figure 2As shown, when the Bluetooth module receives or sends a firmware upgrade request, it starts to enter the upgrade mode of step S201. After confirming that the upgrade has started, in step S202, the Bluetooth module receives a challenge code sent by the firmware upgrade server, which may include a random number, a digital operation, a hash comparison or an encryption and decryption process. Subsequently, in step S203, the control management module of the Bluetooth module starts to calculate the challenge code according to a predetermined algorithm or processing method to generate a response code to be verified, and returns the generated response code to be verified to the server that sends the challenge code, waiting for the verification result of the sending server in step S204 to be correct. The predetermined algorithm may include: a hash algorithm, an asymmetric encryption algorithm and / or a symmetric encryption algorithm. Through the verification of the above-mentioned challenge code mechanism, it can be ensured that the Bluetooth module to be upgraded is the correct upgrade device.

[0061] Further, after the challenge code verification determines that it is the correct upgrade device, the process proceeds to step S205 to receive the firmware upgrade token. The firmware upgrade token may include: the version number of the firmware, and the timestamp and random number dynamically generated by the firmware upgrade package server. In step S206, the received firmware upgrade token is verified, and first verify whether the firmware version is greater than the current version number. If it does not meet the requirements, the upgrade is interrupted. At the same time, the process returns to step S205 to receive the firmware upgrade token again. And step S209 is executed at the same time, the verification failure information is returned to the server, and an alarm is issued. In the specific implementation process, the alarm method can be that the device light flashes, a preset alarm sound is issued, or the monitoring screen displays a "version error" message, etc. In actual application scenarios, the specific alarm form can be one or more. Therefore, the present invention does not make any restrictive provisions regarding the method of the warning.

[0062] Further, the firmware upgrade token is verified, and the process proceeds to step S207 to receive the firmware upgrade package. In one embodiment scenario, the firmware upgrade package can be dynamically divided into one or more firmware upgrade packets, and each firmware upgrade packet of the firmware upgrade package carries a verification code. When the firmware upgrade packets are sent in random order, the correct order of the firmware upgrade packets can also be identified by the verification code so that they can be reassembled into a complete firmware upgrade package in order. In order to ensure security during transmission, during the transmission of the firmware upgrade packets, the transmitted data is encrypted using a strong encryption algorithm, for example, AES can be used for encryption. Through the above-mentioned dynamic segmentation and segmented transmission of the firmware upgrade package, the problem of the Bluetooth module having limited transmission bandwidth and being unsuitable for sending large files is overcome. It can be sent randomly in segments to ensure transmission efficiency, and at the same time, the risk of the firmware upgrade package being intercepted or even tampered with during transmission can be avoided.

[0063] Further, in step S208 of the process, a second security check is performed on the received firmware upgrade package. If the second security check fails, background alarm in step S209 is carried out. Meanwhile, the upgrade process will return to step S205 to receive the firmware upgrade package token again.

[0064] When the second security check passes, the process proceeds to step S210, where all the received firmware upgrade sub-packages are merged into an overall firmware upgrade package by using the control and management module. Among them, the overall firmware upgrade package includes the main body of the firmware upgrade package and a digital signature. Through the digital signature in the overall firmware upgrade package, the third security check in step S211 can be performed. The digital signature of the firmware upgrade package is a digital signature of the main body of the firmware upgrade package using the private key and / or a random number in a pair of public and private keys generated by the firmware upgrade package server. Among them, the digital signature includes calculating a hash value for the main body content of the firmware upgrade package to obtain a hash value, and using the private key and / or the random number to sign the hash value to generate the digital signature of the firmware upgrade package.

[0065] In a specific calculation formula in an embodiment scenario, it may include: calculating the hash value (data) of the main body content of the firmware upgrade package, and the formula is: data = Hash(message); where message is the main body content of the firmware upgrade package to be signed. Then a random number k is generated, where 1 < k < n - 1 and is relatively prime to the modulus n, that is, the greatest common divisor gcd(k, n) = 1. Finally, according to the hash value data, a digital signature is generated using the private key and / or the random number k: signature = (data d · k e·m ) mod n; where e is the public key exponent, n is the modulus of the algorithm, d is the private key exponent, and m is a certain representation of the firmware upgrade package. Among them, m can be a value related to the firmware upgrade package, such as the hash value of the upgrade package, the length of the upgrade package, or the value of the timestamp, etc.

[0066] Further, in an embodiment, the third security check may include: by extracting the main body (message) and digital signature (signature) of the firmware upgrade package from the overall firmware upgrade package, performing a hash calculation on the main body content of the firmware upgrade package using the same hash algorithm as when signing to obtain a new hash value; the specific calculation steps may be: first, performing the same hash processing on the extracted main body content (message) of the firmware upgrade package to obtain data', and the formula is data' = Hash(message). Then using the extended Euclidean algorithm to calculate the modular inverse k of the random number k with respect to the modulus n -1 , and the formula is: k -1 = k -1 mod n; and it satisfies k · k-1 ≡1(mod n). And according to the digital signature, use the public key exponent e and the modulo inverse k -1 Verify the digital signature, where the formula for obtaining the original hash value (verified_data) is: verified_data = (signature e ·k -1 )mod n.

[0067] Finally, the new hash value is compared with the original hash value. If the two are the same, the signature passes the third security check. By using digital signature verification, the integrity of the firmware upgrade package and the reliability of the source can be ensured, thereby ensuring the security of the firmware upgrade process.

[0068] If the third security check fails, the process goes to step S214, and the firmware backup slot is used to trace back to the original firmware version and execute the application program in step S215, or if the upgrade process continues, the upgrade process will return to step S207 to receive the firmware upgrade package again. The specific jump processing after failure can be selected according to the actual scenario, and the present invention does not make any restrictive provisions on this.

[0069] When the third security check passes, the process proceeds to step S212, where the main body of the firmware upgrade package is written into the firmware upgrade slot, and the firmware upgrade process begins. In some cases, the firmware upgrade may require power off and reset during or after the writing process to ensure that the new firmware can be correctly loaded.

[0070] After the upgrade is completed, the Bluetooth module restarts and performs the fourth security verification at step S213. In the fourth security verification, an embodiment scenario is that one or more of the following steps can be combined to verify whether the firmware has been successfully upgraded. Specific steps may include: verifying that the hardware identification (such as MAC address) of the device has not changed, so as to ensure that it is the same device. Check the system log or boot log of the device to confirm the startup information of the new firmware. And you can use Bluetooth diagnostic tools (such as nRF Connect applications) to check the firmware version of the device, and read the firmware version information of the device through Bluetooth or other communication interfaces to observe whether the operating behavior of the device is consistent with the characteristics and expectations of the new firmware version. You can even run the application to test the new functions or performance improvements of the device to see if they match the characteristics of the new firmware version to confirm that the device has no errors or abnormal behaviors that may be introduced by the new firmware. You can also verify whether the device functions as expected by executing automated test scripts. In addition, you can also check whether the device is still using updated keys and certificates to ensure a secure connection.

[0071] Through the above steps, it is possible to more comprehensively verify whether the Bluetooth module has been successfully upgraded to the new firmware version. In response to the fourth security check passing, it indicates that the firmware upgrade process has been successfully completed, and jump to step S215 to start the Bluetooth module application. Otherwise, if it is found that the device is not upgraded as expected, it may be necessary to re-execute the OTA process. The process will return to step S207 and receive the firmware upgrade package again.

[0072] Figure 3 FIG. 4 shows an exemplary structural block diagram of a Bluetooth module 300 according to an embodiment of the present invention.

[0073] like Figure 3 As shown, the Bluetooth module 300 includes: a control management module 304, a firmware master device 301, and a firmware upgrade slot 302 and a firmware backup slot 303 mounted on the firmware master device. The control management module 304 is configured to receive a firmware upgrade package and perform the following operations: Figure 1 Method 100 or Figure 2 The first security check, the second security check and the third security check of the firmware upgrade package described in process 200. The firmware upgrade slot 302 is configured to upgrade the firmware of the firmware master device 301; the firmware master device 301 is configured as follows Figure 1 In the method 100 or Figure 2 The process 200 includes performing a fourth security check on the upgraded firmware; and the firmware backup slot 303 is configured to back up the verified firmware version.

[0074] In the specific firmware upgrade process, the Bluetooth module hardware can use flash memory or other non-volatile memory to allocate sufficient storage space to receive and store the new firmware image. In one embodiment, the firmware master device 301 can periodically send an upgrade request to the upgrade service device, and the upgrade service device sends an upgrade instruction after responding to the request. Or in another embodiment scenario, the upgrade service device sends an upgrade request to the firmware master device 301, and the firmware master device 301 responds to the upgrade request through the control management module 304, and the upgrade service device starts sending upgrade instructions according to the response request. After receiving the upgrade instruction, the control management module 304 controls the communication line of the bus through the bus switch of the Bluetooth module, connects the firmware master device 301, and notifies the firmware master device 301 to prepare for the upgrade. At the same time, the control management module 304 is set to a receiving mode to prepare for receiving an upgrade data packet.

[0075] Before the Bluetooth module receives the firmware upgrade package, it is necessary to verify whether the Bluetooth module is authorized to upgrade. The present invention verifies the legitimacy of the upgrade request by adopting the method of verifying the challenge code rule. The specific challenge code may include a random number, a digital operation, a hash comparison or an encryption and decryption process. The control management module 304 starts to calculate the challenge code according to a predetermined algorithm or a verification method, and returns the calculated challenge code result to be verified to the server that sends the challenge code to obtain the correctness verification of the challenge code result by the server. Through the verification of the challenge code, the legitimacy and security of the firmware upgrade request are enhanced to prevent the generation of unauthorized firmware upgrade requests. In one embodiment, the method of verifying the challenge code can also be used to verify the identity of the upgraded Bluetooth module or the device ID. Based on the teaching of the embodiment of the present invention, those skilled in the art can understand that the purpose of designing the verification method is to verify the identity of the device to be upgraded to prevent the firmware upgrade package from being sent to an unauthorized receiving device. Therefore, the verification method is in addition to the above-mentioned embodiment, and the present invention does not make any restrictive provisions to this.

[0076] Based on the authentication of the Bluetooth module to be upgraded, the firmware upgrade server generates a dynamic firmware upgrade token before each firmware upgrade. The token contains the firmware version number and timestamp, as well as a random number generated by a cryptographically secure random number generator. The firmware upgrade server combines the random number with other necessary information such as the firmware version number and timestamp to form a token structure, and digitally signs the token structure using the private key of the firmware server. The signed token is then sent to the Bluetooth module. The Bluetooth module receives the token and decrypts and verifies the signed token using the public key of the firmware server.

[0077] In the verification of the token, the firmware version must be checked first to ensure that it is greater than the current version number and that it is compatible with the Bluetooth module hardware and software to be upgraded. Secondly, it is also necessary to check whether the timestamp in the token is within a reasonable and valid range to ensure the timeliness of the token. If the timestamp exceeds the valid range, the token will automatically become invalid and a new token will need to be obtained to ensure that each token is only used for one firmware upgrade and will not be used again afterwards. Finally, check whether the random number in the token is consistent with the random number sent by the firmware server. If the random number matches, the token is considered legitimate and the token can be used for firmware upgrades. If the random number does not match or the signature verification fails, take exception handling measures, such as rejecting the firmware upgrade request. Therefore, through the above token verification, the validity of the firmware upgrade token can be ensured, thereby improving the security of the firmware upgrade process.

[0078] The Bluetooth module receives the firmware upgrade package data from the server or mobile device through a wireless connection. The firmware upgrade package will be dynamically divided into multiple data packets on the server, and each data packet may contain a part of the firmware upgrade package. And each data packet will be attached with a verification code, which may include the serial number of the data packet to ensure that the Bluetooth module can reassemble the complete data packet in the correct order.

[0079] During the data transmission process, asymmetric encryption technology (such as RSA or ECC) can be used to encrypt the firmware to ensure that the firmware cannot be decrypted even if it is intercepted during the transmission process. TLS1.3 or higher versions can also be used for firmware data transmission to ensure the security and integrity of data transmission. Those skilled in the art should understand that the present invention does not impose any restrictions on the conventional functions of data transmission using different encryption algorithms. Furthermore, the firmware data implements the breakpoint resume function during transmission, so that it can be restored from the interruption point when the transmission is interrupted, instead of restarting the transmission of the entire firmware. Therefore, by dividing the firmware upgrade package into multiple small packets for transmission, it is possible to adapt to the memory limitations of the Bluetooth module and ensure the reliability of transmission.

[0080] Furthermore, the control management module 304 verifies the received data packets to ensure the integrity and correctness of the data. Since the firmware upgrade package is digitally signed by the manufacturer using a private key before being released, the authenticity and integrity of the firmware upgrade package are ensured. After receiving the firmware upgrade package, the Bluetooth module uses the manufacturer's public key to decrypt the digital signature of the firmware upgrade package, calculates the hash value of the firmware upgrade package, and compares it with the original hash value in the firmware upgrade package. If the two are verified, it can be proved that the firmware upgrade package has not been tampered with, thereby confirming the integrity of the firmware upgrade package file.

[0081] The verified firmware upgrade package is written into the firmware upgrade slot or memory of the Bluetooth module. In some embodiments, the integrity check of the firmware upgrade package can be implemented by CRC check or other hash algorithms such as SHA-256. In addition, in some scenarios, the firmware upgrade can also be powered off and reset during the writing process or after the writing is completed to ensure that the new firmware can be loaded correctly. And during the firmware upgrade process, the upgrade status is monitored in real time to ensure the smooth progress of the upgrade process.

[0082] After the Bluetooth module is restarted, it can also verify whether the new firmware is correctly loaded and running by checking the firmware entry point and executing some self-test programs. Further, before the firmware is upgraded, in an embodiment scenario, the Bluetooth module can also automatically check the compatibility of the firmware with the current hardware and software to avoid device failure caused by incompatible firmware.

[0083] If the new firmware is successfully loaded and verified, the Bluetooth module will switch to running with the new firmware, erase the old firmware, and update the firmware pointer in the memory, thus completing the upgrade process.

[0084] Through the solutions described in the above aspects and embodiments of the present invention, during the entire firmware upgrade process, the control management module of the Bluetooth module serves as the management center of the firmware upgrade core and is responsible for coordinating the entire upgrade process, including communicating with the wireless module, controlling the firmware upgrade slot operation, executing firmware upgrade package verification and firmware switching, etc. In addition, the control management module also monitors the power management during the upgrade process to ensure that the device can operate stably during the entire upgrade process.

[0085] In summary, the firmware upgrade of the Bluetooth module provided by the present invention, combined with the challenge code mechanism, upgrade token and random number verification, firmware digital signature, firmware integrity verification and other mechanisms, significantly improves the security of the firmware upgrade process, forming a comprehensive security protection system for firmware upgrades.

[0086] The Bluetooth module firmware upgrade solution provided by the present invention has a wide range of application scenarios in practical applications. For example, smart lamps, smart sockets, smart speakers and other devices in the field of smart home devices can obtain new functions and improve the experience through OTA upgrades. Industrial automation equipment, sensor nodes, etc. in the field of industrial Internet of Things equipment need to update firmware regularly to adapt to changes in the production environment and fix vulnerabilities. In the field of wearable devices, such as smart watches and health monitoring equipment, it is necessary to update software and drivers regularly without affecting user use. And in the field of intelligent transportation, such as smart cars, drones, etc., maps can be updated, performance adjusted, and security enhanced through OTA upgrades.

[0087] In another embodiment, the present invention further provides a computer-readable storage medium, which includes program instructions for upgrading the firmware of a Bluetooth module, and when the program instructions are executed by a processor, the method described in any one of the embodiments of the method 100 or the process 200 is implemented. Through the above method, the firmware of the Bluetooth module can be upgraded, thereby ensuring the security of the Bluetooth module firmware upgrade process.

[0088] The computer-readable storage medium may be any suitable magnetic storage medium or magneto-optical storage medium, such as RRAM (Resistive Random Access Memory), DRAM (Dynamic Random Access Memory), SRAM (Static Random-Access Memory), EDRAM (Enhanced Dynamic Random Access Memory), HBM (High-Bandwidth Memory), HMC (Hybrid Memory Cube), etc., or any other medium that can be used to store the required information and can be accessed by the application, the module, or both. Any such computer storage medium may be part of the device or accessible or connectable to the device. Any application or module described in the present invention may be implemented using computer-readable / executable instructions that may be stored or otherwise maintained by such a computer-readable medium.

[0089] Although multiple embodiments of the present invention have been shown and described herein, it will be apparent to those skilled in the art that such embodiments are provided by way of example only. Those skilled in the art may conceive of many changes, modifications, and alternatives without departing from the thought and spirit of the present invention. It should be understood that in the process of practicing the present invention, various alternatives to the embodiments of the present invention described herein may be adopted. The appended claims are intended to define the scope of protection of the present invention, and therefore cover equivalents or alternatives within the scope of these claims.

Claims

1. A method for upgrading Bluetooth module firmware, characterized in that: The Bluetooth module includes a control and management module and a firmware master device. Among them, the firmware master device is configured with a firmware upgrade slot; the method includes: Receiving a firmware upgrade challenge code, where the firmware upgrade challenge code includes a random number, a digital operation, a hash comparison, or an encryption / decryption process; Using the control and management module to calculate the firmware upgrade challenge code according to a predetermined algorithm to obtain a response code to be verified; Returning the response code to be verified to the challenge code sender to obtain the verification result of the challenge code sender; In response to the successful verification of the firmware upgrade challenge code, receiving a firmware upgrade token for firmware upgrade of the Bluetooth module; Using the control and management module to perform a first security check on the firmware upgrade token; In response to the successful completion of the first security check, receiving a firmware upgrade package for firmware upgrade of the Bluetooth module; among them, the firmware upgrade package includes firmware upgrade small packages dynamically divided into one or more segments, and each segment of the firmware upgrade small package of the firmware upgrade package carries a check code; Using the control and management module to perform a second security check on each segment of the firmware upgrade small package of the firmware upgrade package, where the second security check includes verifying the check code of the firmware upgrade small package; In response to the successful completion of the second security check, using the control and management module to merge all the received firmware upgrade small packages into an overall firmware upgrade package, where the overall firmware upgrade package includes the main body of the firmware upgrade package and a digital signature; Using the control and management module to perform a third security check on the overall firmware upgrade package; among them, the third security check includes verifying the digital signature; In response to the successful completion of the third security check, writing the main body of the firmware upgrade package into the firmware upgrade slot, and using the firmware master device to perform a fourth security check on the upgraded firmware; and In response to the successful completion of the fourth security check, confirming the completion of the firmware upgrade of the Bluetooth module.

2. The method according to claim 1, characterized in that The firmware upgrade token includes: the version number of the firmware, and a timestamp and a random number dynamically generated by the firmware upgrade package server.

3. The method according to claim 1, characterized in that The receiving the firmware upgrade package for firmware upgrade of the Bluetooth module includes: receiving one or more segments of firmware upgrade small packages, and the one or more segments of firmware upgrade small packages are sent in a random order.

4. The method according to claim 1, characterized in that The digital signature is a digital signature of the main body of the firmware upgrade package using the private key and / or random number in a pair of public and private keys generated by the firmware upgrade package server. Among them, the digital signature includes: Performing a hash calculation on the main body content of the firmware upgrade package to obtain a hash value, and Signing the hash value using the private key and / or random number to generate the digital signature of the firmware upgrade package.

5. The method according to claim 4, characterized in that The generation formula of the digital signature includes: Calculating the hash value (data) of the main body content of the firmware upgrade package, and the formula is: data = Hash(message); where message is the main body content of the firmware upgrade package to be signed; Generating a random number k, where 1 < k < n - 1 and relatively prime to the algorithm modulus n: gcd(k, n) = 1; According to the hash value data, a digital signature is generated using a private key and / or a random number k: signature = (data d ·k e ·m )modn; where e is the public key exponent, n is the modulus of the algorithm, d is the private key exponent, and m is some representation of the firmware upgrade package.

6. The method according to claim 5, characterized in that The third security check includes: Extracting the body (message) and digital signature (signature) of the firmware upgrade package from the overall firmware upgrade package, The main content of the firmware upgrade package is hashed using the same hash algorithm as used for signing to obtain a new hash value data'; the formula is data'=Hash(message); Compute the modular inverse k of a random number k modulo n using the extended Euclidean algorithm -1 , the formula is: -1 =k -1 mod n; and satisfy k·k -1 ≡1(mod n); According to the digital signature, the public key exponent e and the modulo inverse k are used. -1 Verify the digital signature, where the formula for obtaining the original hash value (verified_data) is: verified_data=(signature e ·k -1 )mod n; The new hash value is compared with the original hash value. If verified_data and data' are identical, the digital signature passes the third security check.

7. The method according to claim 1, characterized in that The fourth safety check includes: the Bluetooth module is restarted to verify whether the upgraded firmware is successfully loaded and run.

8. The method according to claim 1, characterized in that The firmware master device configuration also includes a firmware backup slot, and when the fourth security check fails, the firmware master device switches to the firmware backup slot.

9. A Bluetooth module, characterized in that: include: Control management module, firmware master device, and firmware upgrade slot and firmware backup slot mounted on the firmware master device; in The control management module is configured to receive a firmware upgrade package, and perform a first security check, a second security check, and a third security check on the firmware upgrade package in the method according to claim 1; The firmware upgrade slot is configured to upgrade the firmware of the firmware master device; The firmware master device is configured to perform a fourth security check on the upgraded firmware in the method according to claim 1; as well as The firmware backup slot is configured to back up a verified firmware version.

10. A computer-readable storage medium comprising program instructions for upgrading Bluetooth module firmware, wherein when the program instructions are executed by a processor, the method according to any one of claims 1 to 8 is implemented.

Images