Software method for optimizing safe starting time performance of vehicle-mounted ECU (Electronic Control Unit)

Abstract

The invention discloses a software method for optimizing the safe starting time performance of a vehicle-mounted ECU (Electronic Control Unit). The software method comprises the following steps of: 1, programming BootStart, Bootloader and application programs and configuring related information of the BootStart, the Bootloader and the application programs; 2, a vehicle-mounted ECU power-on system is started, firstly, a BootStart program is started, and safety verification is carried out on Bootloader program data; 3, the Bootloader program is started, and safety verification is carried out on the application program data; 4, the application is started, whether an upgrading request exists or not is checked, if the upgrading request exists, the program is reset, the BootStart program is firstly entered, then the Bootloader program is entered, and the application is upgraded and updated. According to the method, the whole vehicle ECU system software not only meets the information safety requirement during safe starting, but also meets the quick starting requirement.

Description

Technical Field

[0001] The present invention relates to the field of automotive electronic technology, and in particular to a software method and system for optimizing the safety startup time performance of an on-vehicle ECU. Background Art

[0002] Modern cars are constantly developing towards electrification, networking, intelligence and sharing, which indicates that the future development of cars will rely more on the functions and performance of software, making the role of software increasingly important. At the same time, it also means that the software of the vehicle ECU system is becoming more and more complex, especially the development of networking, which places higher and higher requirements on information security.

[0003] Since the bootloader needs to be verified for legitimacy and correctness at startup, the bootloader is allowed to run only if the verification passes. When the bootloader is running, if there is no upgrade request, the application needs to be verified for legitimacy and correctness, and the application is allowed to start only if the verification passes.

[0004] However, according to the requirements of mainstream car manufacturers, legality generally uses symmetric or asymmetric encryption algorithms, and correctness generally uses the sha256 algorithm to calculate the characteristic values ​​of program data, and the calculation time generally exceeds 1 second. In other words, the algorithm calculation alone takes more than 1 second, and the loading of the program itself at startup must also be considered, including reading the data from the EEPROM. In-vehicle products are generally required to complete startup and send corresponding network messages within 200ms, and some safety products require a shorter startup time. For example, safety products such as airbags need to monitor relevant sensor signals at all times. They cannot fail to monitor key sensors for a long period of time due to any abnormal startup, and miss the opportunity to take effective safety measures and cause harm.

[0005] To this end, the vehicle ECU system software must meet both the safe startup information security requirements and the rapid startup requirements. In-depth research is needed to provide reasonable solutions to the above issues. Summary of the invention

[0006] The present invention provides a software method for optimizing the safety startup time performance of an on-vehicle ECU, so as to solve the deficiencies of the prior art.

[0007] The present invention provides a software method for optimizing the safety startup time performance of an on-vehicle ECU, comprising the following steps:

[0008] Step 1: Burn BootStart, Bootloader and application programs and configure related information;

[0009] Step 2: The vehicle ECU is powered on and the system is started, and the BootStart program is started, specifically: reading the number of system resets and the counter value, reading the check calculation threshold calibration value, calculating the safety check lock value, and judging whether the system reset counter value is equal to the safety check lock value, if they are equal, starting the Bootloader program;

[0010] Step 3, the Bootloader program starts, reads the system reset counter value, reads the check calculation threshold calibration value, calculates the security check lock value, determines whether the reset counter value is equal to the security check lock value, and if so, starts the application program; if they are not equal, reads the security flag data and decrypts it, determines whether the decrypted security flag value is equal to the specified value, and if not, performs a security check on the application program data; if the decrypted security flag value is equal to the specified value, continues to determine whether the system reset counter value is equal to the count threshold, and if it is equal to the count threshold, performs a security check on the application program data;

[0011] Step 4: The application starts and checks whether there is an upgrade request. If there is an upgrade request, the program is reset and the BootStart program is entered first.

[0012] Furthermore, the step 1 is specifically as follows:

[0013] (a1) First, on the production line, combine the three program execution files of BootStart, Bootloader and application into a hex file, burn it into the corresponding MCU, power on and start the program. After the startup is completed, the MCU runs the application program and writes a specified production line counter value to the corresponding address of the MCU data storage space through the diagnostic host computer tool; wherein, after each restart of the program, the program automatically detects whether the production line counter value is greater than 0. If it is greater than 0, the production line counter value is reduced by 1, and the production line counter value = production line counter value – 1, and enters step (a2);

[0014] (a2) By diagnosing the host computer in a specific process, the MCU is requested to write the safety check threshold calibration quantity. When the MCU application receives this request, it will query whether the production line counter value is greater than 0. If it is greater than 0, a random number is automatically generated through the system's random number function. The safety check threshold calibration quantity low byte = random number & 0x3F, the safety check threshold calibration quantity high byte = (random number >> 8) & 0x3F, then the safety check threshold calibration quantity = random number & 0x3F3F, and then the safety check threshold calibration quantity is written to the corresponding address of the storage space, and then enter step (a3);

[0015] (a3) When the relevant processes of the production line are basically completed, the production line counter value of the corresponding address of the MCU data storage space is cleared to 0 through the diagnostic host computer tool, so that the safety check threshold calibration value cannot be modified after leaving the factory, and the system reset counter value is set to 0, the safety mark data value is set to 0, and saved to the corresponding address of the storage space.

[0016] Furthermore, the step 2 is specifically as follows:

[0017] (b1) BootStart program starts running, first reads the system reset times counter value at the address specified by FLASH, then reads the check calculation threshold calibration quantity at the corresponding address, and then calculates counting threshold 1 and counting threshold 2, counting threshold 1 = checking calculation threshold calibration quantity low byte, counting threshold 2 = checking calculation threshold calibration quantity high byte, and then goes to step (b2);

[0018] (b2) Calculate the safety check lock value, safety check lock value = count threshold 1 + count threshold 2 + count lock base value, and determine whether the system reset times counter value is equal to the safety check lock value. If they are equal, it means that the safety check is in a locked state and there is no need to start the safety check algorithm, then go to step (b6). If they are not equal, then go to step (b3);

[0019] (b3) Read the security flag data at the address specified by FLASH again, decrypt it after reading, and determine whether the decrypted security flag data is equal to the specified value. If they are equal, proceed to step (b4); if they are not equal, proceed to step (b5);

[0020] (b4) If the value of the system reset times counter is equal to the counting threshold 1, or the value of the system reset times counter is equal to (counting threshold 2 + compensation constant, where the compensation constant range is 100-128), then proceed to step (b5); otherwise, proceed to step (b6);

[0021] (b5) The BootStart program confirms the identity information of the Bootloader program, and then confirms the integrity of the Bootloader program Falsh data. When making the file, the host computer tool performs a CRC32 algorithm on the Bootloader program data to calculate the characteristic value, and then uses a symmetric or asymmetric algorithm to encrypt the characteristic value, and stores the ciphertext behind the file data; the BootStart program uses the corresponding secret key to decrypt the ciphertext to obtain the plaintext, which is the CRC32 characteristic value 1 of the Bootloader program, and then performs a CRC32 calculation on the program data to obtain the CRC32 characteristic value 2. If the CRC32 characteristic value 1 is equal to the CRC32 characteristic value 2, then the identity information and data integrity are both verified correctly, and the process goes to step (b6); if the CRC32 characteristic value 1 is not equal to the CRC32 characteristic value 2, it means that the identity information or data integrity is not verified correctly, and the process goes to step (b7);

[0022] (b6) Start the Bootloader program;

[0023] (b7) The illegal reason of the Bootloader program is recorded and written into the specified FLASH address in the format specified by the security log. The program enters a fault state.

[0024] Furthermore, the step 3 is specifically as follows:

[0025] (c1) Bootloader program starts running, first reads the system reset counter value of the address specified by FLASH, then reads the check calculation threshold calibration value in the corresponding address, and then calculates counting threshold 1 and counting threshold 2, counting threshold 1 = checking calculation threshold calibration value low byte, counting threshold 2 = checking calculation threshold calibration value high byte, and enters step (c2);

[0026] (c2) Calculate the safety check lock value, safety check lock value = count threshold 1 + count threshold 2 + count lock base value, and determine whether the system reset times counter value is equal to the safety check lock value. If they are equal, it means that the safety check is in a locked state and there is no need to start the safety check algorithm, then go to step (c6); if they are not equal, then go to step (c3);

[0027] (c3) Read the security flag data at the address specified by FLASH again. This flag is encrypted and stored, and then decrypted after reading. It is determined whether the decrypted security flag data is equal to the specified value. If they are equal, proceed to step (c4). If they are not equal, proceed to step (c5);

[0028] (c4) If the value of the system reset times counter is equal to (counting threshold 1 + compensation constant, where the compensation constant range is 100-128), or the value of the system reset times counter is equal to counting threshold 2, then proceed to step (c5); otherwise, proceed to step (c6);

[0029] (c5) The Bootloader program confirms the identity information of the application program, and then confirms the integrity of the application program Falsh data. The application program is started only after ensuring that the identity information and data integrity are correct. When making a file, the host computer tool uses the SHA256 algorithm to calculate the characteristic value of the application program data, and then uses a symmetric or asymmetric algorithm to encrypt the characteristic value, and stores the ciphertext behind the file data; the Bootloader program uses the corresponding secret key to decrypt the ciphertext to obtain the plaintext, which is the SHA256 characteristic value 1 of the application program, and then performs SHA256 calculation on the program data to obtain SHA256 characteristic value 2. If SHA256 characteristic value 1 is equal to SHA256 characteristic value 2, it means that the identity information and data integrity are both verified correctly, and then the process goes to step (c6); if SHA256 characteristic value 1 is not equal to SHA256 characteristic value 2, it means that the identity information or data integrity are not verified correctly, and then the process goes to step (c10);

[0030] (c6) If the system reset times counter value is not equal to the safety check lock value, and the system reset times counter value is greater than or equal to the threshold (compensation constant + count threshold 1 + count threshold 2), the system reset times counter value is illegal, and the process goes to step (c7); if the system reset times counter value is not equal to the safety check lock value, and the system reset times counter value is less than (compensation constant + count threshold 1 + count threshold 2), the system reset times counter value is legal, and the process goes to step (c8);

[0031] (c7) Set the system reset times counter value to 0, set the security flag data value to 0, then write the system reset times counter value and the security flag data value into the corresponding FLASH address, and go to step (c9);

[0032] (c8) The system reset times counter value is increased by 1. If the system reset times counter value is equal to (compensation constant + counting threshold 1 + counting threshold 2), the system reset times counter value is set to security check lock value (counting threshold 1 + counting threshold 2 + counting lock base value), and then the system reset times counter value is written into the corresponding FLASH address, and the process goes to step (c9);

[0033] (c9) Start the application program;

[0034] (c10) The illegal reason of the application program is recorded and written to the specified FLASH address in the format specified by the security log. The program enters a fault state.

[0035] Furthermore, the step 4 is specifically as follows:

[0036] (d1) The host computer and the ECU application communicate with each other. The host computer requests an upgrade, and the master ECU application sends a SEED to request unlocking. The host computer calculates a KEY1 for SEED according to a specified algorithm and sends it to the ECU application. The ECU application also uses the specified algorithm to calculate a KEY2 for SEED, and then compares KEY1 and KEY2. If they are the same, the upgrade is allowed and the process goes to step (d2). Otherwise, the download is rejected and the process goes to step (d6).

[0037] (d2) The application program of the ECU writes an upgrade request flag in the specified address of the shared memory, and then resets the program so that the ECU program restarts; first, the BootStart program is started, and when the BootStart program checks that the value in the upgrade request flag address is equal to the upgrade flag value, it enters step (d3);

[0038] (d3) Start the Bootloader program. When the Bootloader program checks that the value in the upgrade request flag address is equal to the upgrade flag value, it notifies the host computer that it is ready and starts upgrading. The host computer sends the program file data frame by frame according to the fixed frame length. The ECU writes each received frame of data into the corresponding FLASH address, completes the data download, and starts to confirm the identity information and data integrity of the application program data to ensure that the identity information and data integrity verification are correct. If the verification passes, proceed to step (d4). Otherwise, notify the host computer that the download fails and proceed to step (d6).

[0039] (d4) Determine whether the decrypted security flag data is equal to the specified value. If not, set the security flag data equal to the specified value, encrypt according to the specified algorithm, and store the ciphertext in the specified address of FLASH; set the system reset times counter value equal to 0, set the security flag data value equal to 0, and then write the system reset times counter value and the security flag data value into the corresponding FLASH address, and enter step (d5);

[0040] (d5) starting the updated application program. During the startup process, first, when it is checked that the value in the upgrade request flag address is equal to the upgrade flag value, the system configuration information is set to default, and then the value in the upgrade request flag address is set to 0, and the process proceeds to step (d6);

[0041] (d6)End.

[0042] Furthermore, in step 2, if the value of the system reset counter is not equal to the security check lock value, the security flag data is read and then decrypted to determine whether the decrypted security flag value is equal to the specified value; if the decrypted security flag value is equal to the specified value and the system reset counter value is not equal to the counting threshold, the Bootloader program is directly started; if the decrypted security flag value is equal to the specified value and the system reset counter value is equal to the counting threshold, the identity information and integrity information of the Bootloader program are verified; if the verification passes, the Bootloader program is started; if the verification fails, the reason why the Bootloader program is illegal is recorded.

[0043] Furthermore, in step 3, if the system reset times counter value is equal to the safety check lock value, the application program is directly started.

[0044] Furthermore, if the security check on the application program data in step 3 passes, it is determined whether the system reset times counter value is greater than or equal to a threshold, where the threshold = compensation constant + counting threshold 1 + counting threshold 2. If so, the system reset times counter value is set equal to 0, the security flag data value is set equal to 0, and the data is saved; if the security check on the application program data fails, the reason why the application program is illegal is recorded.

[0045] Furthermore, if the system reset times counter value is less than the threshold, where the threshold = compensation constant + count threshold 1 + count threshold 2, then the system reset times counter value is increased by 1, and it is determined whether the system reset times counter value is equal to the threshold. If it is not equal, the application program is started; if it is equal, the system reset times counter value is set = security check lock value (count threshold 1 + count threshold 2 + count lock base value), and saved, and then the application program is started.

[0046] The beneficial effects of the present invention are:

[0047] (1) The present invention ensures that the safety check threshold calibration value can only be written on the production line. However, if the production line counter value is not cleared to 0 as required, it will automatically decrease by one each time it is started after leaving the factory until it reaches 0.

[0048] (2) The BootStart program in the present invention performs a secure boot check on the Bootloader. In order to stagger the two secure boot checks, two calculation thresholds are set to meet the information security requirements during secure boot;

[0049] (3) In order to reduce the system startup time in the present invention, after the security flash, the Bootloader and the application program are generally subjected to two security checks respectively, and measures are provided to prevent human tampering with the system.

[0050] (4) In the present invention, since the counting threshold 1 and the counting threshold 2 are randomly generated on the production line and are different for each device, the security check lock value and the security check threshold are also different in each device. In addition, the system reset times counter value itself also has a legal check, which increases the difficulty for illegal users to crack and solves the problem of slow security startup time.

[0051] (5) In the present invention, after each flash is completed, the downloaded program data will be subject to a security check. Only after passing the check will the security flag be written. For confidentiality, the security flag is generally stored in an encrypted manner. At the same time, the system reset times counter value will be cleared to 0 to ensure that the above security check method is effectively executed after each upgrade. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] The drawings described herein are used to provide a further understanding of the present invention and constitute a part of the present invention. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the drawings:

[0053] Figure 1 It is a BootStart startup operation flow chart of the present invention.

[0054] Figure 2 It is the BootLoader startup operation flow chart of the present invention. DETAILED DESCRIPTION

[0055] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the specific embodiments of the present invention and the corresponding drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0056] The technical solutions provided by various embodiments of the present invention are described in detail below in conjunction with the accompanying drawings.

[0057] In order to solve the problem that the ECU safe startup time is relatively long, the present invention proposes a software method for optimizing the performance of the vehicle-mounted ECU safe startup time. The specific steps of the method are as follows:

[0058] (1) For an on-board ECU that meets information security requirements, the general program consists of three parts: BootStart, Bootloader, and application. The program needs to be burned and related information configured on the production line. The specific steps are as follows:

[0059] (a1) First, on the production line, combine the three program execution files of BootStart, Bootloader and application into a hex file, burn it into the corresponding MCU, power on and start the program. After the startup is completed, the MCU runs the application (application), and writes a specified production line counter value to the corresponding address of the MCU data storage space through the diagnostic host computer tool. In this method, the value of the production line counter is 0xa5. Since there are many processes on the production line, it will be turned on and off many times. After each restart of the program, the program will automatically detect whether the production line counter value is greater than 0. If it is greater than 0, the production line counter value will be reduced by 1, and the production line counter value = production line counter value – 1. Go to step (a2);

[0060] (a2) By diagnosing the upper computer in a specific process, request the MCU to write the safety check threshold calibration quantity. The length in this method is two bytes. When the MCU application receives this request, it will query whether the production line counter value is greater than 0. If it is greater than 0, a random number is automatically generated through the system's random number function. The low byte of the safety check threshold calibration quantity = random number & 0x3F, the high byte of the safety check threshold calibration quantity = (random number >> 8) & 0x3F, that is, the random number is shifted right by 8 bits, and then ANDed with 0x3F. The reason for the AND operation with 0x3F is to control the data not to exceed 128 to prevent the data from being too large. Then write the safety check threshold calibration quantity to the corresponding address of the storage space. Go to step (a3);

[0061] (a3) When the relevant processes of the production line are basically completed, the production line counter value of the corresponding address of the MCU data storage space is cleared to 0 through the diagnostic host computer tool, so that the safety check threshold calibration value cannot be modified after leaving the factory. Even if the production line forgets to clear 0, the production line counter value will decrease after each startup, and the safety check threshold calibration value can be prohibited from being modified after a period of time.

[0062] (2) The vehicle ECU is powered on and the system is started. The BootStart program is relatively simple and is generally one-time. Once it is burned into the corresponding address, it is not allowed to be modified. The relevant FLASH area needs to be configured to prohibit read and write operations. At the same time, in order to stagger the security check of the Bootloader and application, two counting thresholds are defined, namely counting threshold 1 and counting threshold 2, and a counting lock base value is defined as 0x1ae5. The specific steps of the BootStart program startup process are as follows:

[0063] (b1) BootStart program starts running, first reads the system reset times counter value at the address specified by FLASH, which has a length of two bytes in this method. Then reads the check calculation threshold calibration value at the corresponding address, which has a length of two bytes in this method, and then calculates counting threshold 1 and counting threshold 2, calculates counting threshold 1 = check calculation threshold calibration value low byte, calculates counting threshold 1 = check calculation threshold calibration value high byte; enters step (b2);

[0064] (b2) Calculate the safety check lock value, safety check lock value = count threshold 1 + count threshold 2 + count lock base value, and determine whether the system reset times counter value is equal to the safety check lock value. If they are equal, it means that the safety check is in a locked state and there is no need to start the safety check algorithm, then go to step (b6). If they are not equal, then go to step (b3);

[0065] (b3) Read the security flag data at the specified address of FLASH again. Generally, this flag will be stored in encrypted form and then decrypted after reading. In order not to affect the startup time, the encryption algorithm is relatively simple and is implemented by shifting. Determine whether the decrypted security flag data is equal to the specified value. In this method, the specified value is 0x090501a3. If they are equal, proceed to step (b4). If they are not equal, proceed to step (b5);

[0066] (b4) If the value of the system reset times counter is equal to the counting threshold 1, or the value of the system reset times counter is equal to (counting threshold 2+100), then proceed to step (b5); otherwise, proceed to step (b6);

[0067] (b5) The BootStart program confirms the identity information of the Bootloader program, and then confirms the integrity of the Bootloader program Falsh data. The Bootloader program is started only after ensuring that the identity information and data integrity are correct. In this method, when making a file, the host computer tool performs a CRC32 algorithm on the Bootloader program data to calculate the characteristic value, and then uses a symmetric or asymmetric algorithm to encrypt the characteristic value, and stores the ciphertext behind the file data. The BootStart program uses the corresponding secret key to decrypt the ciphertext to obtain the plaintext, which is the CRC32 characteristic value 1 of the Bootloader program. The program data is then CRC32 calculated to obtain the CRC32 characteristic value 2. If the CRC32 characteristic value 1 is equal to the CRC32 characteristic value 2, it means that the identity information and data integrity are both verified correctly, and then the process goes to step (b6). If the CRC32 characteristic value 1 is not equal to the CRC32 characteristic value 2, it means that the identity information or data integrity is not verified correctly, and then the process goes to step (b7);

[0068] (b6) Start the Bootloader program, see step (3) for details;

[0069] (b7) The reason why the Bootloader program is illegal is recorded, and the program enters a fault state.

[0070] (3) When the Bootloader program is started, it will perform a security check on the application data. The specific steps are as follows:

[0071] (c1) Bootloader program starts running, first reads the system reset times counter value at the address specified by FLASH, which has a length of two bytes in this method. Then reads the check calculation threshold calibration value at the corresponding address, which has a length of two bytes in this method, and then calculates counting threshold 1 and counting threshold 2, calculating counting threshold 1 = checking calculation threshold calibration value low byte, calculating counting threshold 1 = checking calculation threshold calibration value high byte; enter step (c2);

[0072] (c2) Calculate the safety check lock value, safety check lock value = count threshold 1 + count threshold 2 + count lock base value, and determine whether the system reset times counter value is equal to the safety check lock value. If they are equal, it means that the safety check is in a locked state and there is no need to start the safety check algorithm, then go to step (c6). If they are not equal, then go to step (c3);

[0073] (c3) Read the security flag data at the specified address of FLASH again. Generally, this flag will be stored in encrypted form and then decrypted after reading. In order not to affect the startup time, the encryption algorithm is relatively simple and is implemented by shifting. Determine whether the decrypted security flag data is equal to the specified value. In this method, the specified value is 0x090501a3. If they are equal, proceed to step (c4). If they are not equal, proceed to step (c5);

[0074] (c4) If the value of the system reset times counter is equal to the counting threshold 2, or the value of the system reset times counter is equal to (counting threshold 1+100), then proceed to step (c5); otherwise, proceed to step (c6);

[0075] (c5) The Bootloader program confirms the identity information of the application program, and then confirms the Falsh data integrity of the application program. The application program is started only after the identity information and data integrity are ensured to be correct. In this method, when making a file, the host computer tool uses the SHA256 algorithm to calculate the characteristic value of the application program data, and then uses a symmetric or asymmetric algorithm to encrypt the characteristic value, and stores the ciphertext behind the file data. The Bootloader program uses the corresponding secret key to decrypt the ciphertext to obtain the plaintext, which is the SHA256 characteristic value 1 of the application program. The SHA256 calculation is then performed on the program data to obtain the SHA256 characteristic value 2. If the SHA256 characteristic value 1 is equal to the SHA256 characteristic value 2, it means that the identity information and data integrity are both verified correctly, and the process goes to step (c6). If the SHA256 characteristic value 1 is not equal to the SHA256 characteristic value 2, it means that the identity information or data integrity are not verified correctly, and the process goes to step (c10);

[0076] (c6) If the system reset counter value is not equal to the security check lock value, and the system reset counter value is greater than or equal to (100 + count threshold 1 + count threshold 2), it means that the system reset counter value is illegal, and go to step (c7). If the system reset counter value is not equal to the security check lock value, and the system reset counter value is less than (100 + count threshold 1 + count threshold 2), it means that the system reset counter value is legal, and go to step (c8);

[0077] (c7) Set the system reset times counter value to 0, set the security flag data value to 0, then write the system reset times counter value and the security flag data value into the corresponding FLASH address, and go to step (c9);

[0078] (c8) The system reset times counter value is increased by 1. If the system reset times counter value is equal to (100 + counting threshold 1 + counting threshold 2), the system reset times counter value is set to security check lock value (counting threshold 1 + counting threshold 2 + counting lock base value), and then the system reset times counter value is written to the corresponding FLASH address, and the process goes to step (c9);

[0079] (c9) Start the Bootloader program, see step (4) for details;

[0080] (c10) The reason why the Bootloader program is illegal is recorded, and the program enters a fault state.

[0081] (4) After the application is started, it will check whether there is an upgrade request. If there is an upgrade request, the program will be reset and the Bootloader program will be entered to upgrade the application. The specific process is as follows:

[0082] (d1) The host computer and the ECU application communicate with each other. When the host computer requests an upgrade, the master ECU application sends SEED to request unlocking. The host computer calculates a KEY1 based on the specified algorithm and sends it to the ECU application. The ECU application also uses the specified algorithm to calculate a KEY2 based on SEED, and then compares KEY1 and KEY2. If they are the same, the upgrade is allowed and the process goes to step (d2). Otherwise, the download is rejected and the process goes to step (d6).

[0083] (d2) The ECU application program will write an upgrade request flag in the specified address of the shared memory. In this method, the upgrade request flag value is 0xA5A5E5E5, and then reset the program to restart the ECU program. First, start the BootStart program. When the BootStart program checks that the value in the upgrade request flag address is equal to the upgrade flag value, go to step (d3);

[0084] (d3) Start the Bootloader program. When the Bootloader program checks that the value in the upgrade request flag address is equal to the upgrade flag value, it notifies the host computer that it is ready and can start the upgrade. The host computer sends the program file data frame by frame according to the fixed frame length, and the ECU writes each received frame of data to the corresponding FLASH address. After completing the data download, start to confirm the identity information and data integrity of the application program data to ensure that the identity information and data integrity verification are correct. If the verification passes, go to step (d4). Otherwise, notify the host computer that the download failed and go to step (d6);

[0085] (d4) Determine whether the decrypted security flag data is equal to the specified value. If not, set the security flag data equal to the specified value, encrypt according to the specified algorithm, and store the ciphertext in the specified address of FLASH; set the system reset times counter value equal to 0, set the security flag data value equal to 0, and then write the system reset times counter value and the security flag data value into the corresponding FLASH address. Go to step (d5);

[0086] (d5) starting the updated application program. During the startup process, when it is checked that the value in the upgrade request flag address is equal to the upgrade flag value, the system configuration information is set to default, such as clearing the fault information, and then the value in the upgrade request flag address is set to 0, and the process proceeds to step (d6);

[0087] (d6)End.

[0088] In summary, the present invention achieves the following beneficial effects through the above method:

[0089] (1) In the present invention, the production line counter value is first written through the host computer tool and saved in the FLASH address specified by the MCU. After each system startup, the production line counter value will automatically decrease by one until it reaches 0. During the normal process, the production line counter value will be set to 0 through the host computer after all the production line processes are completed. During a specific process, the safety check threshold calibration value will be written through the host computer tool. The writing condition is that the production line counter value is greater than 0, so as to ensure that the safety check threshold calibration value can only be written on the production line. However, if the production line counter value is not cleared to 0 as required, it will automatically decrease by one each time it is started after leaving the factory until it reaches 0.

[0090] (2) In the present invention, the BootStart program performs a secure boot check on the Bootloader, and the Bootloader program performs a secure boot check on the application. In order to stagger the two secure boot checks, two calculation thresholds are set. When the security flag is confirmed to be correct, the verification condition for the BootStart program to perform a secure boot on the Bootloader is that the system reset count counter value is equal to the count threshold 1, or the system reset count counter value is equal to (count threshold 2+100). The verification condition for the Bootloader program to perform a secure boot on the application is that the system reset count counter value is equal to the count threshold 2, or the system reset count counter value is equal to (count threshold 1+100);

[0091] (3) In order to reduce the system startup time in the present invention, after the security flash, the Bootloader and application programs are generally subjected to two security checks respectively. In order to prevent human tampering with the system reset counter value, it is first determined whether the system reset counter value is greater than (100 + count threshold 1 + count threshold 2). If it is satisfied, it means that the system reset counter value is illegal, and the security flag information is directly cleared. When the system reset counter value is legal, the system reset counter value is increased by 1. If the system reset counter value is equal to (100 + count threshold 1 + count threshold 2), the security startup algorithm is locked. In this way, the system reset counter value does not need to be increased by one, and the system does not need to start the security check.

[0092] (4) In the present invention, since the counting threshold 1 and the counting threshold 2 are randomly generated on the production line and are different for each device, the security check lock value and the security check threshold are also different in each device. In addition, the system reset times counter value itself also has a legal check, which increases the difficulty for illegal users to crack and solves the problem of slow security startup time.

[0093] (5) In the present invention, after each flash is completed, the downloaded program data will be subject to a security check. Only after passing the check will the security flag be written. For confidentiality, the security flag is generally stored in an encrypted manner. At the same time, the system reset times counter value will be cleared to 0 to ensure that the above security check method is effectively executed after each upgrade.

[0094] The above description is only an embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent substitution, improvement, etc. made within the spirit and principle of the present invention should be included in the scope of the claims of the present invention.

Claims

1. A software method for optimizing the safety startup time performance of an on-vehicle ECU, characterized in that: The following steps are involved: Step 1: Burn BootStart, Bootloader and application programs and configure related information; Step 2: The vehicle ECU is powered on and the system is started, and the BootStart program is started, specifically: reading the number of system resets and the counter value, reading the check calculation threshold calibration value, calculating the safety check lock value, and judging whether the system reset counter value is equal to the safety check lock value, if they are equal, starting the Bootloader program; Step 3: Bootloader starts, reads the system reset counter value, reads the check calculation threshold calibration value, calculates the safety check lock value, and determines whether the reset counter value is equal to the safety check lock value. If so, the application is started. If they are not equal, the security flag data is read and decrypted to determine whether the decrypted security flag value is equal to the specified value. If not, the application data is security checked. If the decrypted security flag value is equal to the specified value, then continue to determine whether the system reset times counter value is equal to the count threshold. If it is equal to the count threshold, perform security check on the application data. Step 4: The application starts and checks whether there is an upgrade request. If there is an upgrade request, the program is reset and the BootStart program is entered first.

2. A software method for optimizing the safe startup time performance of an on-vehicle ECU according to claim 1, characterized in that: The step 1 is specifically as follows: (a1) First, on the production line, combine the three program execution files of BootStart, Bootloader and application into a hex file, burn it into the corresponding MCU, power on and start the program. After the startup is completed, the MCU runs the application program and writes a specified production line counter value to the corresponding address of the MCU data storage space through the diagnostic host computer tool; wherein, after each restart of the program, the program automatically detects whether the production line counter value is greater than 0. If it is greater than 0, the production line counter value is reduced by 1, and the production line counter value = production line counter value – 1, and enters step (a2); (a2) By diagnosing the host computer in a specific process, the MCU is requested to write the safety check threshold calibration quantity. When the MCU application receives this request, it will query whether the production line counter value is greater than 0. If it is greater than 0, a random number is automatically generated through the system's random number function. The safety check threshold calibration quantity low byte = random number & 0x3F, the safety check threshold calibration quantity high byte = (random number >> 8) & 0x3F, then the safety check threshold calibration quantity = random number & 0x3F3F, and then the safety check threshold calibration quantity is written to the corresponding address of the storage space, and then enter step (a3); (a3) When the relevant processes of the production line are basically completed, the production line counter value of the corresponding address of the MCU data storage space is cleared to 0 through the diagnostic host computer tool, so that the safety check threshold calibration value cannot be modified after leaving the factory, and the system reset counter value is set to 0, the safety mark data value is set to 0, and saved to the corresponding address of the storage space.

3. A software method for optimizing the safe startup time performance of an on-vehicle ECU according to claim 1, characterized in that: The step 2 is specifically as follows: (b1) BootStart program starts running, first reads the system reset times counter value at the address specified by FLASH, then reads the check calculation threshold calibration quantity at the corresponding address, and then calculates counting threshold 1 and counting threshold 2, counting threshold 1 = checking calculation threshold calibration quantity low byte, counting threshold 2 = checking calculation threshold calibration quantity high byte, and then goes to step (b2); (b2) Calculate the safety check lock value, safety check lock value = count threshold 1 + count threshold 2 + count lock base value, and determine whether the system reset times counter value is equal to the safety check lock value. If they are equal, it means that the safety check is in a locked state and there is no need to start the safety check algorithm, then go to step (b6). If they are not equal, then go to step (b3); (b3) Read the security flag data at the address specified by FLASH again, decrypt it after reading, and determine whether the decrypted security flag data is equal to the specified value. If they are equal, proceed to step (b4); if they are not equal, proceed to step (b5); (b4) If the value of the system reset times counter is equal to the counting threshold 1, or the value of the system reset times counter is equal to (counting threshold 2 + compensation constant, where the compensation constant range is 100-128), then proceed to step (b5); otherwise, proceed to step (b6); (b5) The BootStart program confirms the identity information of the Bootloader program, and then confirms the integrity of the Bootloader program Falsh data. When making the file, the host computer tool performs a CRC32 algorithm on the Bootloader program data to calculate the characteristic value, and then uses a symmetric or asymmetric algorithm to encrypt the characteristic value, and stores the ciphertext behind the file data; the BootStart program uses the corresponding secret key to decrypt the ciphertext to obtain the plaintext, which is the CRC32 characteristic value 1 of the Bootloader program, and then performs a CRC32 calculation on the program data to obtain the CRC32 characteristic value 2. If the CRC32 characteristic value 1 is equal to the CRC32 characteristic value 2, then the identity information and data integrity are both verified correctly, and the process goes to step (b6); if the CRC32 characteristic value 1 is not equal to the CRC32 characteristic value 2, it means that the identity information or data integrity is not verified correctly, and the process goes to step (b7); (b6) Start the Bootloader program; (b7) The illegal reason of the Bootloader program is recorded and written into the specified FLASH address in the format specified by the security log. The program enters a fault state.

4. A software method for optimizing the safety startup time performance of an on-vehicle ECU according to claim 1, characterized in that: The step 3 is specifically as follows: (c1) Bootloader program starts running, first reads the system reset counter value of the address specified by FLASH, then reads the check calculation threshold calibration value in the corresponding address, and then calculates counting threshold 1 and counting threshold 2, counting threshold 1 = checking calculation threshold calibration value low byte, counting threshold 2 = checking calculation threshold calibration value high byte, and enters step (c2); (c2) Calculate the safety check lock value, safety check lock value = count threshold 1 + count threshold 2 + count lock base value, and determine whether the system reset times counter value is equal to the safety check lock value. If they are equal, it means that the safety check is in a locked state and there is no need to start the safety check algorithm, then go to step (c6); if they are not equal, then go to step (c3); (c3) Read the security flag data at the address specified by FLASH again. This flag is encrypted and stored, and then decrypted after reading. It is determined whether the decrypted security flag data is equal to the specified value. If they are equal, proceed to step (c4). If they are not equal, proceed to step (c5); (c4) If the value of the system reset times counter is equal to (counting threshold 1 + compensation constant, where the compensation constant range is 100-128), or the value of the system reset times counter is equal to counting threshold 2, then proceed to step (c5); otherwise, proceed to step (c6); (c5) The Bootloader program confirms the identity information of the application program, and then confirms the integrity of the application program Falsh data. The application program is started only after ensuring that the identity information and data integrity are correct. When making a file, the host computer tool uses the SHA256 algorithm to calculate the characteristic value of the application program data, and then uses a symmetric or asymmetric algorithm to encrypt the characteristic value, and stores the ciphertext behind the file data; the Bootloader program uses the corresponding secret key to decrypt the ciphertext to obtain the plaintext, which is the SHA256 characteristic value 1 of the application program, and then performs SHA256 calculation on the program data to obtain SHA256 characteristic value 2. If SHA256 characteristic value 1 is equal to SHA256 characteristic value 2, it means that the identity information and data integrity are both verified correctly, and then the process goes to step (c6); if SHA256 characteristic value 1 is not equal to SHA256 characteristic value 2, it means that the identity information or data integrity are not verified correctly, and then the process goes to step (c10); (c6) If the system reset times counter value is not equal to the safety check lock value, and the system reset times counter value is greater than or equal to the threshold (compensation constant + count threshold 1 + count threshold 2), the system reset times counter value is illegal, and the process goes to step (c7); if the system reset times counter value is not equal to the safety check lock value, and the system reset times counter value is less than (compensation constant + count threshold 1 + count threshold 2), the system reset times counter value is legal, and the process goes to step (c8); (c7) Set the system reset times counter value to 0, set the security flag data value to 0, then write the system reset times counter value and the security flag data value into the corresponding FLASH address, and go to step (c9); (c8) The system reset times counter value is increased by 1. If the system reset times counter value is equal to (compensation constant + counting threshold 1 + counting threshold 2), the system reset times counter value is set to security check lock value (counting threshold 1 + counting threshold 2 + counting lock base value), and then the system reset times counter value is written into the corresponding FLASH address, and the process goes to step (c9); (c9) Start the application program; (c10) The illegal reason of the application program is recorded and written to the specified FLASH address in the format specified by the security log. The program enters a fault state.

5. A software method for optimizing the safety startup time performance of an on-vehicle ECU according to claim 1, characterized in that: The step 4 is specifically as follows: (d1) The host computer and the ECU application communicate with each other. When the host computer requests an upgrade, the master ECU application sends SEED to request unlocking. The host computer calculates a KEY1 based on the SEED according to the specified algorithm and sends it to the ECU application. The ECU application also uses the specified algorithm to calculate a KEY2 based on the SEED, and then compares KEY1 and KEY2. If they are the same, the upgrade is allowed and the process goes to step (d2). Otherwise, the download is rejected and the process goes to step (d6). (d2) The application program of the ECU writes an upgrade request flag in the specified address of the shared memory, and then resets the program so that the ECU program restarts; first, the BootStart program is started, and when the BootStart program checks that the value in the upgrade request flag address is equal to the upgrade flag value, it enters step (d3); (d3) Start the Bootloader program. When the Bootloader program checks that the value in the upgrade request flag address is equal to the upgrade flag value, it notifies the host computer that it is ready and starts the upgrade. The host computer sends the program file data frame by frame according to the fixed frame length. The ECU writes each frame of data received to the corresponding FLASH address to complete the data download and start to confirm the identity information and data integrity of the application program data to ensure that the identity information and data integrity verification are correct. If the verification is passed, proceed to step (d4); otherwise, notify the host computer that the download has failed and proceed to step (d6); (d4) Determine whether the decrypted security flag data is equal to the specified value. If not, set the security flag data equal to the specified value, encrypt according to the specified algorithm, and store the ciphertext in the specified address of FLASH; Set the system reset times counter value to 0, set the security flag data value to 0, then write the system reset times counter value and the security flag data value into the corresponding FLASH address, and go to step (d5); (d5) starting the updated application program. During the startup process, first, when it is checked that the value in the upgrade request flag address is equal to the upgrade flag value, the system configuration information is set to default, and then the value in the upgrade request flag address is set to 0, and the process proceeds to step (d6); (d6)End.

6. A software method for optimizing the safety startup time performance of an on-vehicle ECU according to claim 1, characterized in that: In step 2, if the value of the system reset counter is not equal to the security check lock value, the security flag data is read and decrypted to determine whether the decrypted security flag value is equal to the specified value. If the decrypted security flag value is equal to the specified value and the system reset counter value is not equal to the counting threshold, the Bootloader program is directly started. If the decrypted security flag value is equal to the specified value and the system reset counter value is equal to the counting threshold, the identity information and integrity information of the Bootloader program are verified. If the verification passes, the Bootloader program is started. If the verification fails, the reason why the Bootloader program is illegal is recorded.

7. A software method for optimizing the safety startup time performance of an on-vehicle ECU according to claim 1, characterized in that: In step 3, if the system reset times counter value is equal to the safety check lock value, the application program is directly started.

8. A software method for optimizing the safety startup time performance of an on-vehicle ECU according to claim 1, characterized in that: If the security check on the application data in step 3 passes, then determine whether the system reset times counter value is greater than or equal to a threshold, where the threshold = compensation constant + counting threshold 1 + counting threshold 2. If so, set the system reset times counter value equal to 0, set the security flag data value equal to 0, and save the data; if the security check on the application data fails, record the reason why the application is illegal.

9. A software method for optimizing the safety startup time performance of an on-vehicle ECU according to claim 8, characterized in that: If the system reset times counter value is less than the threshold value, where the threshold value = compensation constant + counting threshold value 1 + counting threshold value 2, then the system reset times counter value is increased by 1, and it is determined whether the system reset times counter value is equal to the threshold value. If it is not equal, the application program is started; if it is equal, the system reset times counter value is set to the security check lock value (counting threshold value 1 + counting threshold value 2 + counting lock base value), and it is saved, and then the application program is started.

Images