Encryption and decryption method of executable file, flashing device and controller
By encrypting the address information and verification data of the executable file, and filling the encrypted information into the file, combining the grouping and hash encryption algorithms, the problem that executable file data in the prior art is easily reverse engineered, and improves the problem that executable file data is easily reverse engineered, Security and encryption efficiency ensure the security and integrity of files in the controller.
Patent Information
- Application Number
- CN202310780912.4
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2023-06-28
- Publication Date
- 2024-12-31
AI Technical Summary
In the prior art, the data of the executable file is easily reverse engineered and analyzed, with poor security, and is inefficient by manually adding verification information and changing verification data.
By encrypting the address information and verification data in the executable file, verify information is generated and filled into the executable file. Group encryption and hash encryption algorithms are used, combined with asymmetric encryption algorithms, to ensure the security of the file. Sex and integrity.
Improve the security and encryption efficiency of executable files, prevent files from being tampered with and deleted, ensure that files can pass the controller's security check, and save inefficient operations of manually adding verification information.
Smart Images
Figure CN119227090A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the field of information security technology, and in particular to an encryption and decryption method, a flashing device and a controller for an executable file. Background Art
[0002] At present, the electrical characteristics of new energy vehicles are becoming more and more complex, and the corresponding safety requirements of various functional modules are becoming higher and higher. In the process of domain controller development, it is inevitable that the controller program needs to be updated, and the compiled executable file needs to be flashed into the controller to implement the domain control function.
[0003] The related technology generally improves the security of the source code by manually adding verification information and changing verification data to the source code, encrypting it, and then compiling the encrypted source code file into an executable file.
[0004] However, the related technology only encrypts the source code and then generates an executable file. The data in the executable file can be easily decompiled and analyzed by reverse engineering, resulting in data leakage and destruction. The security is relatively good, and there are problems such as low efficiency by manually adding verification information and changing verification data. Summary of the invention
[0005] One of the purposes of the present invention is to provide an encryption method for an executable file to solve the problem that the data in the executable file in the prior art is easily decompiled and analyzed by reverse engineering, has poor security, and has low efficiency by manually adding verification information and changing verification data; the second purpose is to provide a decryption method for an executable file; the third purpose is to provide a flashing device; and the fourth purpose is to provide a controller.
[0006] In order to achieve the above object, the technical solution adopted by the present invention is as follows:
[0007] A method for encrypting an executable file, the method being applied to a flashing device, wherein the method comprises the following steps: obtaining an executable file to be encrypted; extracting address information that needs to be verified and verification data corresponding to the address information in the executable file, encrypting the address information and the verification data to obtain verification information; and filling the verification information into a preset position of the executable file to obtain a new executable file carrying the verification information.
[0008] According to the above-mentioned technical means, the embodiment of the present application encrypts the address information that needs to be verified in the executable file and the verification data corresponding to the address information, which has high security. After encryption, verification information corresponding to the controller program is generated, and the verification information is filled into the executable file to obtain a new executable file carrying the verification information, thereby ensuring that the new executable file can pass the security check of the controller program and improving encryption efficiency.
[0009] Further, the encrypting the address information and the verification data to obtain the verification information includes: encrypting the address information once to obtain the encrypted address information; encrypting the verification data twice to obtain the verification value; and generating the verification information according to the encrypted address information and the verification value.
[0010] According to the above technical means, the embodiment of the present application can encrypt address information and verification data with high security to prevent the executable file from being tampered with and the content from being deleted.
[0011] Further, encrypting the address information once to obtain the encrypted information includes: encrypting the address information in groups to obtain the encrypted address information.
[0012] According to the above technical means, the embodiment of the present application can encrypt the address information in groups with high security.
[0013] Further, the second encryption of the verification data to obtain the verification value includes: performing hash encryption on the verification data to obtain a message digest; and performing group encryption on the message digest to obtain the verification value.
[0014] According to the above technical means, the embodiment of the present application can perform secondary encryption on the verification data to obtain a verification value for comparison and verification with the controller program.
[0015] Further, the verification data is hashed and encrypted to obtain a message digest, including: filtering the verification data to obtain data rows; storing the data rows in multiple partitions in a cache; encrypting the data of each partition using a hash algorithm to obtain a message digest of each partition, and integrating the message digests of each partition to obtain final summary information.
[0016] Further, the filling of the verification information into the preset position of the executable file to obtain a new executable file carrying the verification information includes: filling the encrypted address information in the first line of the preset position; filling the verification value and the checksum of the executable file in sequence after the first line; and generating a new executable file carrying the verification information after the filling is completed.
[0017] According to the above technical means, the embodiment of the present application can fill the verification data into the executable file, so that the new executable file can pass the security check inside the controller.
[0018] Furthermore, after the verification data is encrypted twice to obtain the verification value, the method further includes: using a public key to asymmetrically encrypt the verification value to obtain an encrypted verification value, wherein the controller decrypts the encrypted verification value using a private key.
[0019] According to the above technical means, the embodiment of the present application can encrypt the verification value with a public key through an asymmetric encryption algorithm and then store it, so that the private key is used inside the controller to decrypt it in order to confirm the identity of the executable file being flashed.
[0020] A method for decrypting an executable file, the method being applied to a controller, wherein the method comprises the following steps: obtaining a new executable file carrying verification information written by a flashing device, wherein the verification information comprises a verification value, address encryption information and a checksum; decrypting the address encryption information and the verification value, and generating address information to be verified based on the checksum, and extracting verification data corresponding to the address information in the new executable file; encrypting the verification data to obtain an encrypted value, and if the encrypted value is consistent with the decrypted verification value, determining that the new executable file has passed verification.
[0021] A flashing device comprises: a memory, a processor and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the encryption method of the executable file as described in any one of the above embodiments.
[0022] A controller comprises: a memory, a processor and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the method for decrypting an executable file as described in the above embodiment.
[0023] Beneficial effects of the present invention:
[0024] (1) The embodiment of the present application has high security by encrypting the address information that needs to be verified in the executable file and the verification data corresponding to the address information. After encryption, verification information corresponding to the controller program is generated, and the verification information is filled into the executable file to obtain a new executable file carrying the verification information, thereby ensuring that the new executable file can pass the security check of the controller program and improving the encryption efficiency.
[0025] (2) The embodiments of the present application can encrypt address information and verification data, which is highly secure and prevents executable files from being tampered with or having their contents deleted.
[0026] (3) The embodiment of the present application can perform group encryption on address information, which has high security.
[0027] (4) The embodiment of the present application can perform secondary encryption on the verification data to obtain a verification value for comparison and verification with the controller program.
[0028] (5) The embodiment of the present application can fill the verification data into the executable file so that the new executable file can pass the security verification inside the controller.
[0029] (6) In the embodiment of the present application, the verification value can be encrypted with a public key through an asymmetric encryption algorithm and then stored, so that it can be decrypted using a private key inside the controller to confirm the identity of the executable file being flashed. BRIEF DESCRIPTION OF THE DRAWINGS
[0030] Figure 1 A flowchart of an executable file encryption method provided by an embodiment of the present invention;
[0031] Figure 2 A simplified diagram of generating a new executable file provided by an embodiment of the present invention;
[0032] Figure 3 A schematic diagram of an encryption process of an executable file provided by an embodiment of the present invention;
[0033] Figure 4 The present invention provides a flowchart of a method for decrypting an executable file. DETAILED DESCRIPTION
[0034] The following will describe the embodiments of the present invention with reference to the accompanying drawings and preferred embodiments. Those skilled in the art can easily understand other advantages and effects of the present invention from the contents disclosed in this specification. The present invention can also be implemented or applied through other different specific embodiments, and the details in this specification can also be modified or changed in various ways based on different viewpoints and applications without departing from the spirit of the present invention. It should be understood that the preferred embodiments are only for illustrating the present invention, not for limiting the scope of protection of the present invention.
[0035] It should be noted that the illustrations provided in the following embodiments are only schematic illustrations of the basic concept of the present invention, and thus the drawings only show components related to the present invention rather than being drawn according to the number, shape and size of components in actual implementation. In actual implementation, the type, quantity and proportion of each component may be changed arbitrarily, and the component layout may also be more complicated.
[0036] Specifically, Figure 1 A flowchart of an executable file encryption method provided in an embodiment of the present application.
[0037] The controller software upgrade method is applied to a flash device and includes the following steps:
[0038] In step S101, an executable file to be encrypted is obtained.
[0039] The executable file may be a configuration file or a startup file of an application. When the controller program needs to be updated, the compiled executable file needs to be written into the controller to implement the domain control function. In order to ensure the security, integrity, and authenticity of the written executable file, the embodiment of the present application can obtain the executable file to be encrypted so as to encrypt the executable file in the development process of the dedicated controller in the future, and prevent the executable file from being tampered with and the content from being deleted.
[0040] In the actual execution process, the embodiment of the present application can be based on the matlab platform, select the format of the executable file and the input document through the matlab function uigetfile(), and open it to prepare for subsequent data reading.
[0041] In step S102, address information that needs to be verified and verification data corresponding to the address information are extracted from the executable file, and the address information and the verification data are encrypted to obtain verification information.
[0042] Among them, the address information includes the initial address and the end address of the address segment. The embodiment of the present application encrypts the address information and the verification data corresponding to the address information, generates the verification information corresponding to the controller program to pass the security check, improves the encryption efficiency, saves time cost, and ensures the security of flashing executable files.
[0043] During the actual implementation process, the embodiment of the present application can parameterize the initial address and the end address of the address segment that needs to be verified, and different address segment lengths can be selected. The change can be completed by entering the starting address segment and the ending address segment that need to be verified, and data verification can be performed freely and flexibly according to the specifications of the security department.
[0044] In one embodiment of the present application, encrypting address information and verification data to obtain verification information includes: encrypting the address information once to obtain encrypted address information; encrypting the verification data twice to obtain a verification value; and generating verification information based on the encrypted address information and the verification value.
[0045] Specifically, the embodiment of the present application obtains encrypted address information by performing group encryption on address information, obtains a message digest by performing hash encryption on verification data, and obtains a verification value by performing group encryption on the message digest.
[0046] As a possible implementation method, the group encryption in the embodiment of the present application can use the AES256 algorithm, and the hash encryption algorithm can be the MD5 algorithm, which has better security. The combination of the two can be used to verify the integrity and authenticity of the executable file to prevent the executable file from being tampered with and the content deleted.
[0047] In one embodiment of the present application, the verification data is hashed and encrypted to obtain a message digest, including: filtering the verification data to obtain data rows; storing the data rows in multiple partitions in the cache; encrypting the data of each partition using a hash algorithm to obtain a message digest of each partition, and integrating the message digests of each partition to obtain final summary information.
[0048] It is understandable that the embodiment of the present application can capture the address information in the executable file through the matlab function strcmp() function, filter the verification data, and select the correct complete data row; and copy the correct complete data into the buffer area through the sprintf() function. Among them, the embodiment of the present application can create a bin file for storing the data stream of the executable file extracted in the encryption process, as a verification data buffer area read or stored in the executable file.
[0049] Furthermore, the embodiment of the present application can store the data row in multiple partitions in the cache, generate a message digest for each partition through the SHA-256 algorithm, and combine several message digests. The combined message digest is used as the input of the AES256 algorithm, and the algorithm function interface is called to calculate and generate a check value.
[0050] During the actual execution process, the embodiments of the present application may use CRC-8 and CRC-16 encryption function interfaces to ensure that data transmission will not go wrong during encryption.
[0051] In one embodiment of the present application, after the verification data is encrypted twice to obtain the verification value, it also includes: using a public key to asymmetrically encrypt the verification value to obtain an encrypted verification value, wherein the controller decrypts the encrypted verification value using a private key.
[0052] Among them, asymmetric encryption means that the decryption key cannot be calculated from the encryption key. The encryption key does not need to be kept confidential and can be made public as a public key. Only the decryption key needs to be kept confidential, and the decryption key is a private key. The public key and the private key are paired. Common asymmetric encryption algorithms include: RSA, Elgamal, etc. In the embodiment of the present application, the check value can be encrypted with a public key by an asymmetric encryption algorithm and then stored, so that the private key is used inside the controller for decryption to confirm the identity of the executable file being flashed. Among them, the asymmetric encryption algorithm can be the RSA-2048 algorithm.
[0053] In step S103, the verification information is filled into a preset position of the executable file to obtain a new executable file carrying the verification information.
[0054] It can be understood that the embodiment of the present application fills the verification information into the executable file to achieve the regeneration of the executable file, fills the encrypted address information in the first line of the preset position, and fills the verification value and the checksum of the executable file in sequence after the first line; after the filling is completed, a new executable file carrying the verification information is generated, and there is no need for inefficient operations such as manually adding verification information and changing verification data, and the verification information in the new executable file can pass the security check inside the controller, which can ensure the security and integrity of the flashing.
[0055] The calculation formula for the checksum is: checksum = 0xFF - the lower eight bits of (length byte + address byte + data byte).
[0056] For example, the executable file example is: S31520100060544550010000000000000000000000000070, the checksum is the last byte at the end of the executable file, and the example checksum = 0xFF-(0x15+0x20+0x10+0x00+0x60+0x54+0x45+0x50+0x01...+0x00+0x00)=0xFF-(the lower eight bits of data of 0x18F)=0xFF-0x8F=0x70.
[0057] In summary, the embodiment of the present application can use the .m tool platform in matlab to specifically encrypt the executable file in the development process of the dedicated controller to achieve the generation of a new executable file, such as Figure 2 As shown, you only need to input an executable file that meets the rules, and after running it, you can get an executable file with verification information, which greatly improves the generation efficiency and saves time. The encryption process of the executable file in the tool of the embodiment of the present application is as follows Figure 3 As shown, the following steps are included:
[0058] Step 1: Select the executable file to be input.
[0059] Step 2: Filter the data rows based on the executable file rules.
[0060] Step 3: Get the cached data segment and call the MD5 interface to generate a data digest.
[0061] Step 4: Encrypt the data summary using AES128 to obtain the checksum.
[0062] Step 5: Fill in information in the executable file to obtain a new executable file.
[0063] According to the encryption method of the executable file proposed in the embodiment of the present application, the address information that needs to be verified in the executable file and the verification data corresponding to the address information are encrypted, which has high security. After encryption, verification information corresponding to the controller program is generated, and the verification information is filled into the executable file to obtain a new executable file carrying the verification information, which ensures that the new executable file can pass the security check of the controller program and improves the encryption efficiency. Thus, the data in the executable file of the prior art is easily decompiled and analyzed by reverse engineering, which has poor security, and the problem of low efficiency by manually adding verification information and changing verification data is solved.
[0064] Next, a method for decrypting an executable file according to an embodiment of the present application is described with reference to the accompanying drawings, wherein the method is applied to a controller.
[0065] Figure 4 : is a flowchart of a method for decrypting an executable file according to an embodiment of the present application, comprising the following steps:
[0066] In step S401, a new executable file carrying verification information written by a flashing device is obtained, wherein the verification information includes a verification value, address encryption information and a checksum.
[0067] In step S402, the address encryption information and the check value are decrypted, and the address information to be checked is generated according to the checksum, and the check data corresponding to the address information in the new executable file is extracted.
[0068] In step S403, the verification data is encrypted to obtain an encrypted value. If the encrypted value is consistent with the decrypted verification value, it is determined that the new executable file has passed the verification.
[0069] It can be understood that since the flashing device is parameterized with a verification start address and a verification end address, during the security verification process of the controller program running, the embodiment of the present application can decrypt the address encryption information, obtain the verification address information in the executable file, and group and encrypt the verification data corresponding to the verification address information to obtain an encrypted value, which is stored in ciphertext. The controller uses a private key to decrypt the verification value. When the encrypted value and the decrypted verification value are consistent, it is confirmed that the information flashed by the executable file has passed the security verification inside the controller, and after passing, it is flashed to achieve the update of the controller program.
[0070] According to the executable file decryption method proposed in the embodiment of the present application, by obtaining the new executable file with verification information written by the flashing device, decrypting the address encryption information and verification value in the new executable file, and determining the verification data corresponding to the address information in the new executable file, encrypting the verification data to obtain the encrypted value, and when the encrypted value and the decrypted verification value are consistent, it is determined that the new executable file has passed the verification. In this way, the executable file can be prevented from being tampered with and the content deleted, and the security, integrity and authenticity of the flashed executable file can be guaranteed.
[0071] In addition, an embodiment of the present application also proposes a flashing device, including: a memory, a processor, and a computer program stored in the memory and executable on the processor, and the processor executes the program to implement an encryption method for an executable file as in the above embodiment.
[0072] A controller includes: a memory, a processor, and a computer program stored in the memory and executable on the processor. The processor executes the program to implement the decryption method of the executable file as described in the above embodiment.
[0073] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present application. In this specification, the schematic representations of the above terms are not necessarily directed to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or N embodiments or examples in a suitable manner. In addition, those skilled in the art may combine and combine the different embodiments or examples described in this specification and the features of the different embodiments or examples, without contradiction.
[0074] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of technical features indicated. Therefore, a feature defined as "first" or "second" may explicitly or implicitly include at least one of the features. In the description of this application, "N" means at least two, such as two, three, etc., unless otherwise clearly and specifically defined.
[0075] Any process or method description in a flowchart or otherwise described herein may be understood to represent a module, fragment or portion of code comprising one or N executable instructions for implementing the steps of a custom logical function or process, and the scope of the preferred embodiments of the present application includes alternative implementations in which functions may not be performed in the order shown or discussed, including performing functions in a substantially simultaneous manner or in reverse order depending on the functions involved, which should be understood by technicians in the technical field to which the embodiments of the present application belong.
[0076] It should be understood that the various parts of the present application can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiment, the N steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array, a field programmable gate array, etc.
[0077] A person skilled in the art may understand that all or part of the steps in the method for implementing the above-mentioned embodiment may be completed by instructing related hardware through a program, and the program may be stored in a computer-readable storage medium, which, when executed, includes one or a combination of the steps of the method embodiment.
[0078] Although the embodiments of the present application have been shown and described above, it can be understood that the above embodiments are exemplary and cannot be understood as limitations on the present application. Ordinary technicians in this field can change, modify, replace and modify the above embodiments within the scope of the present application.
Claims
1. A method for encrypting an executable file, characterized in that: The method is applied to a flashing device, wherein the method comprises the following steps: Get the executable file to be encrypted; Extracting address information that needs to be verified and verification data corresponding to the address information from the executable file, and encrypting the address information and the verification data to obtain verification information; The verification information is filled into a preset position of the executable file to obtain a new executable file carrying the verification information.
2. The method for encrypting an executable file according to claim 1, characterized in that: The encrypting the address information and the verification data to obtain verification information includes: Encrypting the address information once to obtain encrypted address information; Performing secondary encryption on the verification data to obtain a verification value; The verification information is generated according to the encrypted address information and the verification value.
3. The method for encrypting an executable file according to claim 2, characterized in that: The step of encrypting the address information once to obtain encrypted information includes: The address information is encrypted in groups to obtain the encrypted address information.
4. The method for encrypting an executable file according to claim 2, characterized in that: The step of performing secondary encryption on the verification data to obtain a verification value includes: Performing hash encryption on the verification data to obtain a message digest; The message digest is encrypted in groups to obtain the check value.
5. The method for encrypting an executable file according to claim 4, characterized in that: The verification data is hashed to obtain a message digest, including: Filtering the verification data to obtain data rows; storing the data row in a plurality of partitions in a cache; The data of each partition is encrypted by using a hash algorithm to obtain a message digest of each partition, and the message digests of each partition are integrated to obtain final summary information.
6. The method for encrypting an executable file according to claim 1, characterized in that: The step of filling the verification information into a preset position of the executable file to obtain a new executable file carrying the verification information includes: Fill the first row of the preset position with the encrypted address information; Filling the check value and the checksum of the executable file in sequence after the first line; After the filling is completed, a new executable file is generated with verification information.
7. The method for encrypting an executable file according to claim 2, characterized in that: After the verification data is encrypted twice to obtain the verification value, the method further includes: The verification value is asymmetrically encrypted using a public key to obtain an encrypted verification value, wherein the controller decrypts the encrypted verification value using a private key.
8. A method for decrypting an executable file, characterized in that: The method is applied to a controller, wherein the method comprises the following steps: Obtaining a new executable file carrying verification information written by a flashing device, wherein the verification information includes a verification value, address encryption information, and a checksum; Decrypting the address encryption information and the check value, generating address information to be checked according to the checksum, and extracting the check data corresponding to the address information in the new executable file; The verification data is encrypted to obtain an encrypted value. If the encrypted value is consistent with the decrypted verification value, it is determined that the new executable file has passed the verification.
9. A flash writing device, characterized in that: include: A memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the encryption method for an executable file according to any one of claims 1 to 7.
10. A controller, characterized in that: include: A memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the method for decrypting an executable file as claimed in claim 8.