Safe and quick starting method of vehicle-mounted terminal and computer readable storage medium

Abstract

The invention discloses a safe and quick starting method for a vehicle-mounted terminal and a computer readable storage medium, and the method comprises the steps: obtaining software data and a preset symmetric key when the vehicle-mounted terminal is started; segmenting the software data according to a preset first byte number to obtain at least one segment of second segment data, and respectively obtaining the second segment data from the first segment data according to a preset value position and a preset second byte number; splicing the second segment data, and encrypting the spliced data according to the symmetric key to obtain a to-be-verified encryption value corresponding to the software data; and if the encryption value to be verified is consistent with an authentication encryption value corresponding to the software data pre-stored in the vehicle-mounted terminal, starting the vehicle-mounted terminal. According to the method, the integrity and authenticity of the software can be ensured, and the safe starting speed can be increased.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a safe and fast startup method for a vehicle-mounted terminal and a computer-readable storage medium. Background Art

[0002] With the rapid development of smart car software, its functions are increasing and it is becoming more and more intelligent. It brings great convenience to people's lives, but opportunities and risks coexist. The information security issues of car software should not be underestimated. While these smart software provide better services to people, they may also be replaced maliciously. Once replaced maliciously, these smart software may not only fail to provide corresponding services, but also cause serious harm to people and cars themselves.

[0003] At present, the software is generally verified at startup. However, the verification of the software will increase the startup delay and affect the startup performance. Therefore, how to make the vehicle terminal start safely and quickly has become a problem to be solved. Summary of the invention

[0004] The technical problem to be solved by the present invention is to provide a safe and fast startup method for a vehicle-mounted terminal and a computer-readable storage medium, which can ensure the integrity and authenticity of the software and improve the speed of safe startup.

[0005] In order to solve the above technical problems, the technical solution adopted by the present invention is: a safe and fast startup method of a vehicle-mounted terminal, comprising:

[0006] When the vehicle terminal is started, the software data and the preset symmetric key are obtained;

[0007] According to a preset first byte number, the software data is segmented to obtain at least one segment of second segment data, and according to a preset value position and a preset second byte number, the second segment data is respectively obtained from each first segment data;

[0008] The second segmented data are concatenated, and the concatenated data are encrypted according to the symmetric key to obtain the encrypted value to be verified corresponding to the software data;

[0009] If the encrypted value to be verified is consistent with the authentication encrypted value corresponding to the software data pre-stored in the vehicle terminal, the vehicle terminal is started.

[0010] The present invention also provides a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, the method described above is implemented.

[0011] The beneficial effects of the present invention are: by verifying the software data each time the vehicle-mounted terminal is started, the integrity and authenticity of the software data are guaranteed; by obtaining part of the data from the software data for verification, the delay added by the startup verification can be shortened, thereby improving the speed of safe startup. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] Figure 1 A flowchart of a method for safe and fast startup of a vehicle-mounted terminal of the present invention;

[0013] Figure 2 This is a flow chart of a method according to Embodiment 1 of the present invention. DETAILED DESCRIPTION

[0014] In order to explain the technical content, achieved objectives and effects of the present invention in detail, the following is a detailed description in conjunction with the implementation methods and the accompanying drawings.

[0015] See also Figure 1 , a safe and fast startup method for a vehicle terminal, comprising:

[0016] When the vehicle terminal is started, the software data and the preset symmetric key are obtained;

[0017] According to a preset first byte number, the software data is segmented to obtain at least one segment of second segment data, and according to a preset value position and a preset second byte number, the second segment data is respectively obtained from each first segment data;

[0018] The second segmented data are concatenated, and the concatenated data are encrypted according to the symmetric key to obtain the encrypted value to be verified corresponding to the software data;

[0019] If the encrypted value to be verified is consistent with the authentication encrypted value corresponding to the software data pre-stored in the vehicle terminal, the vehicle terminal is started.

[0020] From the above description, it can be seen that the beneficial effects of the present invention are: the integrity and authenticity of the software can be guaranteed, and the speed of secure boot can be improved.

[0021] Furthermore, when the vehicle-mounted terminal is started, before obtaining the software data and the preset symmetric key, the process further includes:

[0022] Segmenting the software data according to a preset first byte number to obtain at least one segment of second segment data, and obtaining the second segment data from each first segment data according to a preset value position and a preset second byte number;

[0023] The second segmented data are concatenated, and the concatenated data are encrypted according to a preset symmetric key to obtain an authentication encryption value corresponding to the software data.

[0024] Furthermore, when the vehicle-mounted terminal is started, before obtaining the software data and the preset symmetric key, it also includes:

[0025] The preset symmetric key is stored in a hardware security module, and the software data and its corresponding authentication encryption value are stored in a memory.

[0026] As can be seen from the above description, by storing the symmetric key inside the HSM, the symmetric key can be prevented from being stolen and the security of the symmetric key can be guaranteed.

[0027] Further, the concatenated data is encrypted according to the symmetric key to obtain the encrypted value to be verified corresponding to the software data, specifically:

[0028] According to the symmetric key, the concatenated data is encrypted using the CMAC algorithm to obtain a CMAC value as the encrypted value to be verified corresponding to the software data.

[0029] From the above description, it can be seen that encryption is achieved using the CAMC algorithm.

[0030] Furthermore, the value positions corresponding to the first segmented data are consistent, and the value positions are the head positions of the first segmented data.

[0031] It can be seen from the above description that the uniformity of the acquired second segmented data in the complete software data is ensured, thereby improving the accuracy of verification.

[0032] Furthermore, the value positions corresponding to the first segmented data are inconsistent; before obtaining the second segmented data from each first segmented data according to the preset value position and the preset second byte number, the method further includes:

[0033] The value position corresponding to each first segment data is determined according to the order of each first segment data in all the first segment data.

[0034] From the above description, it can be seen that by setting different value positions, the difficulty of cracking can be increased, and the accuracy of verification can be improved to a certain extent to ensure the authenticity of the software.

[0035] Furthermore, the second byte number is smaller than the first byte number; the first byte number is 1024, and the second byte number is 16.

[0036] The present invention also provides a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, the method described above is implemented.

[0037] Embodiment 1

[0038] Please refer to Figure 2 , Embodiment 1 of the present invention is: a safe and fast startup method for a vehicle-mounted terminal, which can be applied to a vehicle-mounted terminal, such as Figure 2 As shown, the following steps are included:

[0039] S1: Segment the software data according to a preset first byte number to obtain at least one segment of second segment data, and obtain second segment data from each first segment data according to a preset value position and a preset second byte number.

[0040] Among them, the second byte number is smaller than the first byte number. In this embodiment, the first byte number is 1024 and the second byte number is 16. In actual application scenarios, the first byte number and the second byte number can be determined according to the required startup time. The larger the first byte number and the smaller the second byte number, the shorter the verification time and the faster the startup; conversely, the smaller the first byte number and the larger the second byte number, the longer the verification time and the slower the startup.

[0041] In addition, in this embodiment, the value positions of each first segment data are consistent. For example, the data of an APP is segmented in units of 1k (1024 bytes), and the 16-byte data of the header is obtained from each segment data. Furthermore, if the number of bytes of the last segment data is less than 16 bytes, the actual number of bytes shall prevail, that is, all the data of the last segment is obtained.

[0042] In another optional embodiment, a polling mechanism may be used to obtain the second segmented data, that is, the value position corresponding to each first segmented data is determined according to the order of each first segmented data in all the first segmented data.

[0043] For example, take the first group of data with a length of 16 bytes in the first first segmented data (that is, take the data of the 1st to 16th bytes in the first first segmented data), take the second group of data with a length of 16 bytes in the second first segmented data (that is, take the data of the 17th to 32nd bytes in the second first segmented data), take the third group of data with a length of 16 bytes in the third first segmented data (that is, take the data of the 33rd to 48th bytes in the third first segmented data), and so on, take the data of the 16th (n-1) + 1 to 16n bytes in the nth first segmented data, and when n reaches 64, it is reset to 1, that is, start taking data from the first group of data with a length of 16 bytes again.

[0044] By setting different value positions, the difficulty of cracking can be increased, and the accuracy of verification can be improved to a certain extent to ensure the authenticity of the software.

[0045] S2: splicing the second segmented data, and encrypting the spliced ​​data according to a preset symmetric key to obtain an authentication encryption value corresponding to the software data.

[0046] In this embodiment, the CMAC (Cipher Block Chaining-Message Authentication Code, a message authentication code based on a symmetric key block encryption algorithm) algorithm is used to encrypt the spliced ​​data to obtain a CMAC value as the authentication encryption value corresponding to the software data.

[0047] S3: Storing the preset symmetric key in the hardware security module, and storing the software data and its corresponding authentication encryption value in the memory.

[0048] Specifically, before the vehicle terminal leaves the factory, the symmetric key is burned into the hardware security module (HSM) of the vehicle terminal through the host computer. The software data is burned into the flash memory (flash) of the vehicle terminal through the host computer, and the first address and size of the software data and the authentication encryption value corresponding to the software data are burned into the BPT (Boot Package Table, located at the front end of the boot loader Bootloader, storing relevant information of the Bootloader and relevant information of the image).

[0049] By storing the symmetric key in the HSM, the symmetric key can be prevented from being stolen and the security of the symmetric key can be guaranteed.

[0050] S4: When the vehicle terminal is started, the software data is obtained and the symmetric key is obtained from the hardware security module.

[0051] Specifically, when the Bootloader starts the boot program, the first address and size of the APP data are obtained from the BPT, and the data of the APP is obtained according to the first address and size. At the same time, the symmetric key is obtained from the HSM.

[0052] S5: Segment the software data according to the preset first byte number to obtain at least one second segment data, and obtain the second segment data from each first segment data according to the preset value position and the preset second byte number. This step can refer to step S1.

[0053] S6: concatenate the second segmented data, and encrypt the concatenated data according to the symmetric key to obtain the encrypted value to be verified corresponding to the software data. This step may refer to step S2.

[0054] S7: Obtain the authentication encryption value corresponding to the software data, and determine whether the encryption value to be verified is consistent with the authentication encryption value. If so, execute step S8; if not, the startup fails.

[0055] S8: Start the vehicle terminal, which means the safe start is successful.

[0056] This embodiment adopts a segmented interception method to obtain part of the data from the software data for verification, which can shorten the verification time, that is, shorten the delay added by the startup verification, thereby improving the speed of secure startup. For example, for a 2MB APP, if the CMAC value is calculated for all its data, it will take more than 100 milliseconds of delay, but if part of the data is obtained when the first byte number is 1024 and the second byte number is 16, only 32KB of data needs to be calculated for the CMAC value, which only takes about 5 milliseconds of delay.

[0057] This embodiment is mainly based on the principle of the key cryptographic system. Each time the vehicle terminal is started, before the various intelligent software of the vehicle are started, the Bootloader will be started first, and the CMAC algorithm will be used to verify the APP to ensure the integrity and authenticity of the APP. At the same time, it can shorten the delay added by the startup verification and speed up the speed of safe startup.

[0058] Embodiment 2

[0059] This embodiment is a computer-readable storage medium corresponding to the above embodiment, on which a computer program is stored. When the program is executed by the processor, it implements the various steps of a safe and quick startup method for a vehicle terminal in the above embodiment, and can achieve the same technical effect, which will not be repeated here.

[0060] In summary, the present invention provides a method for secure and fast startup of a vehicle-mounted terminal and a computer-readable storage medium. The method prevents the symmetric key from being stolen and ensures the security of the symmetric key by storing the symmetric key inside the HSM. The software data is verified each time the vehicle-mounted terminal is started to ensure the integrity and authenticity of the software data. The method obtains part of the data from the software data for verification to shorten the delay caused by the startup verification, thereby improving the speed of secure startup.

[0061] The above descriptions are merely embodiments of the present invention and are not intended to limit the patent scope of the present invention. Any equivalent transformations made using the contents of the present invention's specification and drawings, or directly or indirectly applied in related technical fields, are also included in the patent protection scope of the present invention.

Claims

1. A safe and fast startup method for a vehicle terminal, characterized in that: include: When the vehicle terminal is started, the software data and the preset symmetric key are obtained; According to a preset first byte number, the software data is segmented to obtain at least one segment of second segment data, and according to a preset value position and a preset second byte number, the second segment data is respectively obtained from each first segment data; The second segmented data are concatenated, and the concatenated data are encrypted according to the symmetric key to obtain the encrypted value to be verified corresponding to the software data; If the encrypted value to be verified is consistent with the authentication encrypted value corresponding to the software data pre-stored in the vehicle terminal, the vehicle terminal is started.

2. The safe and fast startup method of the vehicle terminal according to claim 1, characterized in that: When the vehicle-mounted terminal is started, before obtaining the software data and the preset symmetric key, the method further includes: Segmenting the software data according to a preset first byte number to obtain at least one segment of second segment data, and obtaining the second segment data from each first segment data according to a preset value position and a preset second byte number; The second segmented data are concatenated, and the concatenated data are encrypted according to a preset symmetric key to obtain an authentication encryption value corresponding to the software data.

3. The safe and fast startup method of the vehicle terminal according to claim 2, characterized in that: When the vehicle-mounted terminal is started, before obtaining the software data and the preset symmetric key, the method further includes: The preset symmetric key is stored in a hardware security module, and the software data and its corresponding authentication encryption value are stored in a memory.

4. The safe and fast startup method of the vehicle terminal according to claim 1, characterized in that: The concatenated data is encrypted according to the symmetric key to obtain the encrypted value to be verified corresponding to the software data, specifically: According to the symmetric key, the concatenated data is encrypted using the CMAC algorithm to obtain a CMAC value as the encrypted value to be verified corresponding to the software data.

5. The safe and fast startup method of the vehicle terminal according to claim 1, characterized in that: The value positions corresponding to the first segmented data are consistent, and the value positions are the head positions of the first segmented data.

6. The safe and fast startup method of the vehicle terminal according to claim 1, characterized in that: The value positions corresponding to the first segmented data are inconsistent; before obtaining the second segmented data from each first segmented data according to the preset value position and the preset second byte number, the method further includes: The value position corresponding to each first segment data is determined according to the order of each first segment data in all the first segment data.

7. The safe and fast startup method of the vehicle terminal according to claim 1, characterized in that: The second byte number is smaller than the first byte number; the first byte number is 1024, and the second byte number is 16.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images