Method and system for safely starting vehicle-mounted gateway equipment
By introducing hardware security chips and signature encryption mechanisms into vehicle gateway equipment, the problem of lack of security mechanisms for on-board gateway equipment in the existing technology is solved, and security verification and information security guarantees are realized when starting equipment.
Patent Information
- Application Number
- CN202411750331.7
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-12-02
- Publication Date
- 2025-03-14
AI Technical Summary
The existing vehicle gateway equipment startup method lacks an effective security mechanism and is easily cracked by attackers, resulting in malware execution and information security threats.
By introducing independent hardware security chips into the on-board gateway equipment, processing and parsing data information transmitted by the master control, performing security verification, and adopting signature and encryption mechanisms to ensure the integrity and source legitimacy of the boot program and application.
Effectively prevent malicious or unauthorized software from being executed, ensure that the on-board gateway equipment is in a safe state when started, and improve the vehicle's information security and normal operation reliability.
Smart Images
Figure CN119621185A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the technical field of software security and vehicle-mounted electronic equipment, and in particular to a method and system for securely starting a vehicle-mounted gateway device. Background Art
[0002] With the continuous advancement of automobile technology, automotive electronic systems are becoming more complex and intelligent. As the key hub of the internal network of the car, the vehicle gateway device connects different electronic control units (ECUs) with vehicle sensors, and is responsible for data transmission, routing, and protocol conversion. It plays a vital role in ensuring efficient communication among vehicle systems, achieving advanced driver assistance functions, and improving the overall performance of the vehicle. However, this highly integrated and interconnected feature has also brought about new security challenges. Malicious attackers may use vulnerabilities in the vehicle network to attack the gateway device, thereby gaining control of the vehicle, stealing user privacy information, or destroying key vehicle functions.
[0003] In the traditional way of starting up vehicle gateway devices, effective security mechanisms are often lacking. The startup process may be relatively simple and easily cracked by attackers. For example, the integrity of the startup code may not be checked, or the encryption method used may not be strong enough. In order to deal with these security threats, it is extremely important to ensure the secure startup of vehicle gateway devices. The secure startup method should verify the integrity and authenticity of the startup code when the device is started to prevent tampered code from being executed. Therefore, a safe and reliable method for starting up vehicle gateway devices is needed to ensure the normal operation and information security of the vehicle. Summary of the invention
[0004] The purpose of the present invention is to solve the shortcomings of the above-mentioned prior art, and to provide a method and system for secure startup of an in-vehicle gateway device to solve the security problems existing in the startup process of the in-vehicle gateway device in the prior art. By adding a security chip, a signature and encryption mechanism are added to ensure that the main control boot program and the application program are credible when the device is started, preventing malicious or unauthorized software from being executed.
[0005] On the one hand, a method for securely starting a vehicle gateway device is provided, comprising the following steps: S1: Receive the boot program, start and initialize the security chip first; S2: Verify the integrity of the boot program. After the verification passes, load and run the boot program. S3: After receiving a response allowing the bootloader to be loaded and run, the bootloader starts verifying the application loaded by the bootloader, including: Verify the legitimacy of the application program source and run the application program after passing the verification; Debug and upgrade the feasibility of the application program, and perform corresponding application debugging and updating after passing the verification; S4: After all the verifications in steps S2 to S3 are passed, the vehicle gateway device startup process is completed.
[0006] Furthermore, in step S1, the security chip is connected to the main control via a serial peripheral interface, and the security chip processes and analyzes the data information transmitted by the main control to perform security verification.
[0007] Furthermore, in step S2, the integrity verification of the boot program further includes: S21: receiving the encrypted signature value generated for the boot program related information and verifying it. After the verification is passed, the boot program is encrypted by an encryption algorithm to obtain a unique hash value H1; S22: transmitting the signature value data and the hash value H1 of the boot program to the security chip, and verifying the signature value data by using an asymmetric encryption algorithm; S23: Compare the data after the signature verification with the hash value H1 to complete the integrity verification.
[0008] Wherein, in step S21, receiving the encrypted signature value data and verifying it further includes: S211: Obtain a verification element for verifying the signature value, and decrypt the original signature value data based on the verification element, wherein: If the signature value is encrypted based on an asymmetric encryption algorithm, and the verification factor includes a public key, the public key is used for decryption; If the signature value is encrypted based on a symmetric encryption algorithm, and the verification factor includes a pre-stored key, the key is used for decryption; S212: Compare the original signature value data with a preset reference signature value to verify the authenticity of the signature value data.
[0009] Preferably, in step S21, after verification, encrypting and calculating the boot program using an encryption algorithm to obtain a unique hash value H1 further includes: S213: Selecting an encryption algorithm according to the security requirements and standards of the vehicle gateway device; S214: Reading the complete content data of the boot program, including the code segment and data segment of the boot program; S215: pre-process the read data to make it meet the requirements of the hash algorithm, input the pre-processed data into the hash algorithm for iterative calculation, and obtain the hash value H1.
[0010] Preferably, step S23 further includes: The data after the signature verification is compared byte by byte with the hash value H1 through a comparison function, wherein: If the data after signature verification is consistent with the hash value H1, it is determined that the boot program has not been tampered with or damaged during transmission and storage; Otherwise, it is determined that the boot program integrity verification has failed, and data transmission, device failure, and malicious tampering are checked.
[0011] Furthermore, in step S3, verifying the legitimacy of the source of the application further includes: S31: receiving the encrypted signature value generated for the application related information and verifying it. After the verification is passed, the boot program is encrypted by an encryption algorithm to obtain a unique hash value H2; S32: transmitting the signature value data and the hash value H2 of the application to the security chip, and verifying the signature value data by using an asymmetric encryption algorithm; S33: Compare the data after the signature verification with the hash value H2. If the comparison results are consistent, it proves that the source of the application is legal and has not been tampered with, and the application is loaded and run.
[0012] Preferably, in step S3, verifying the feasibility of debugging the application further includes: S34: receiving a debugging application sent according to a user instruction and opening a debugging interface; S35: Read the access password and authentication PIN code of the debugging interface and verify them, and compare the access password and authentication PIN with the correct password and PIN code stored in advance. If the access password and PIN code completely match, debugging of the application is allowed, otherwise debugging is rejected.
[0013] Preferably, in step S3, verifying the feasibility of upgrading the application further includes: S36: receiving an upgrade application and a new application program sent according to a user instruction; S37: Send the hash value and signature value data of the new application to the security chip, perform signature verification and hash value comparison according to the method steps of steps S31 to S33, and allow the update after verification, otherwise the update will be rejected.
[0014] On the other hand, a vehicle gateway device security startup system based on the above method is provided, including: An initialization module is used to receive a startup program, and to start and initialize the security chip first; The boot program verification module is used to verify the integrity of the boot program. After the verification passes, the boot program is loaded and run; The application verification module is used to start the verification of the application loaded by the boot program after receiving the response allowing the boot program to be loaded and run, including: Verify the legitimacy of the application program source and run the application program after passing the verification; Debug and upgrade the feasibility of the application program, and perform corresponding application debugging and updating after passing the verification; The working startup module is used to complete the startup process of the vehicle gateway device after the verification of the boot program verification module and the application verification module are all passed.
[0015] Compared with the prior art, the present invention has the following beneficial effects: The present invention sets an independent hardware security chip in the vehicle-mounted gateway device to process and analyze the data information transmitted by the master control to perform security verification. Each time the gateway device is started, the security chip is initialized to ensure that it is in a safe state. The cost and difficulty of cracking the security chip are extremely high. The setting of the security chip will only increase the cost slightly. The encryption algorithm provides important security protection under the premise of ensuring timeliness. The present invention reads the boot program and key configuration information stored in the secure storage area, and uses a security chip to verify the integrity of the boot program to ensure that it has not been tampered with. If the verification passes, the boot program loads the application program for verification; The present invention verifies the digital signature of an application when it is started, ensuring that the application comes from a legitimate source and has not been tampered with. Only verified applications can run on the vehicle gateway device. When the application of the present invention needs to be debugged or upgraded, signature authentication is performed before the upgrade, and the debugging and upgrading function is opened only after the verification. Moreover, when the program is updated, the information in the secure storage area will also be updated according to the changes in the program. BRIEF DESCRIPTION OF THE DRAWINGS
[0016] The accompanying drawings are used to provide a further understanding of the present invention and constitute a part of the specification. Together with the embodiments of the present invention, they are used to explain the present invention and do not constitute a limitation of the present invention. In the accompanying drawings: Figure 1 This is a flow chart of a method for safely starting a vehicle-mounted gateway device according to the present invention; Figure 2 This is a schematic diagram of the connection structure between a security chip and a main control of an on-vehicle gateway device of the present invention; Figure 3 This is a flow chart of signature verification and comparison verification in a security chip of the present invention; Figure 4 A flowchart of debugging and upgrading an application program of a vehicle-mounted gateway device of the present invention; DETAILED DESCRIPTION
[0017] To make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.
[0018] Those skilled in the art will appreciate that, unless otherwise stated, the singular forms "a", "an", "said" and "the" used herein may also include plural forms. It should be further understood that the term "comprising" used in the specification of the present invention refers to the presence of the features, integers, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or groups thereof.
[0019] The present invention provides an efficient and secure software startup and update solution for vehicle-mounted gateway devices through a series of innovative technical means. The specific implementation of the present invention is described below in conjunction with the accompanying drawings and embodiments.
[0020] like Figure 1 As shown, this embodiment provides a method for securely starting a vehicle gateway device, and the technical solution includes the following steps: S1: Receive the boot program, start and initialize the security chip first; S2: Verify the integrity of the boot program. After the verification passes, load and run the boot program. S3: After receiving a response allowing the bootloader to be loaded and run, the bootloader starts verifying the application loaded by the bootloader, including: Verify the legitimacy of the application program source and run the application program after passing the verification; Debug and upgrade the feasibility of the application program, and perform corresponding application debugging and updating after passing the verification; S4: After all the verifications in steps S2 to S3 are passed, the vehicle gateway device startup process is completed.
[0021] Among them, Figure 2 As shown, the security chip is connected to the main control via a serial peripheral interface, with the main control acting as the master and the security chip acting as the slave device. The security chip processes and analyzes the data information transmitted by the main control to perform security verification.
[0022] Among them, all signature verification and comparison verification in steps S2~S3 are performed in the security chip. The cost and difficulty of cracking the security chip are extremely high. The setting of the security chip will only increase the cost slightly, but it provides important security protection. The asymmetric encryption algorithm in the security chip is used to fully guarantee security while ensuring timeliness.
[0023] In step S2, if Figure 3 As shown, the integrity verification of the boot program further includes: S21: receiving the encrypted signature value generated for the boot program related information and verifying it. After the verification is passed, the boot program is encrypted by an encryption algorithm to obtain a unique hash value H1; S22: transmitting the signature value data and the hash value H1 of the boot program to the security chip, and verifying the signature value data by using an asymmetric encryption algorithm; S23: Compare the data after the signature verification with the hash value H1 to complete the integrity verification.
[0024] Specifically, in step S21, receiving the encrypted signature value data and verifying it further includes: S211: Obtain a verification element for verifying the signature value, and decrypt the original signature value data based on the verification element, wherein: If the signature value is encrypted based on an asymmetric encryption algorithm, and the verification factor includes a public key, the public key is used for decryption; If the signature value is encrypted based on a symmetric encryption algorithm, and the verification factor includes a pre-stored key, the key is used for decryption; S212: Compare the original signature value data with a preset reference signature value to verify the authenticity of the signature value data.
[0025] In addition, after verification, the boot program is encrypted by an encryption algorithm to obtain a unique hash value H1, which further includes: S213: Selecting an encryption algorithm according to the security requirements and standards of the vehicle gateway device; S214: Reading the complete content data of the boot program, including the code segment and data segment of the boot program; S215: pre-process the read data to make it meet the requirements of the hash algorithm, input the pre-processed data into the hash algorithm for iterative calculation, and obtain the hash value H1.
[0026] Furthermore, step S23 includes: The data after the signature verification is compared byte by byte with the hash value H1 through a comparison function, wherein: If the data after signature verification is consistent with the hash value H1, it is determined that the boot program has not been tampered with or damaged during transmission and storage; Otherwise, it is determined that the boot program integrity verification has failed, and data transmission, device failure, and malicious tampering are checked.
[0027] Then, after the main control receives a response from the security chip allowing the boot program to be loaded and run, it will proceed to the next level of verification.
[0028] First, verify the legitimacy of the application source. Please refer to the process Figure 3 ,include: S31: receiving the encrypted signature value generated for the application related information and verifying it. After the verification is passed, the boot program is encrypted by an encryption algorithm to obtain a unique hash value H2; S32: transmitting the signature value data and the hash value H2 of the application to the security chip, and verifying the signature value data by using an asymmetric encryption algorithm; S33: Compare the data after the signature verification with the hash value H2. If the comparison results are consistent, it proves that the source of the application is legal and has not been tampered with, and the application is allowed to be loaded and run.
[0029] Then receive further instructions from the user, including debugging instructions and upgrade instructions, such as Figure 4 As shown, Debugging the feasibility of the application further includes: S34: receiving a debugging application sent according to a user instruction and opening a debugging interface; S35: Read the access password and authentication PIN code of the debugging interface and verify them, and compare the access password and authentication PIN with the correct password and PIN code stored in advance. If the access password and PIN code completely match, debugging of the application is allowed, otherwise debugging is rejected.
[0030] Verifying the feasibility of upgrading the application further includes: S36: receiving an upgrade application and a new application program sent according to a user instruction; S37: Send the hash value and signature value data of the new application to the security chip, perform signature verification and hash value comparison according to the method steps of steps S31 to S33, and allow the update after verification, otherwise the update will be rejected.
[0031] When all the above authentications are passed, the main control module continues to operate normally, ensuring that the vehicle gateway device is in normal working condition.
[0032] This embodiment adds a security chip and a signature and encryption mechanism to ensure that the main control boot program and application program are credible when the device is started, thereby preventing malicious or unauthorized software from being executed.
[0033] In this embodiment, a vehicle gateway device security startup system based on the above method is also provided, including: An initialization module is used to receive a startup program, and to start and initialize the security chip first; The boot program verification module is used to verify the integrity of the boot program. After the verification passes, the boot program is loaded and run; The application verification module is used to start the verification of the application loaded by the boot program after receiving the response allowing the boot program to be loaded and run, including: Verify the legitimacy of the application program source and run the application program after passing the verification; Debug and upgrade the feasibility of the application program, and perform corresponding application debugging and updating after passing the verification; The working startup module is used to complete the startup process of the vehicle gateway device after the verification of the boot program verification module and the application verification module are all passed.
[0034] Among them, the functional implementation of each module in the vehicle gateway device security startup system corresponds to the steps in the above-mentioned vehicle gateway device security startup method embodiment, and its functions and implementation processes will not be repeated here one by one.
[0035] Finally, it should be noted that the above is only a preferred embodiment of the present invention, and the protection scope of the present invention is not limited to the above embodiments. All technical solutions under the concept of the present invention belong to the protection scope of the present invention. It should be pointed out that for ordinary technicians in this technical field, some improvements and modifications without departing from the principle of the present invention should also be regarded as the protection scope of the present invention.
[0036] The technical features of the above-described embodiments may be arbitrarily combined. To make the description concise, not all possible combinations of the technical features in the above-described embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.
Claims
1. A method for securely starting a vehicle gateway device, characterized in that: The steps include: S1: Receive the boot program, start and initialize the security chip first; S2: Verify the integrity of the boot program. After the verification passes, load and run the boot program. S3: After receiving a response allowing the bootloader to be loaded and run, the bootloader starts verifying the application loaded by the bootloader, including: Verify the legitimacy of the application program source and run the application program after passing the verification; Debug and upgrade the feasibility of the application program, and perform corresponding application debugging and updating after passing the verification; S4: After all the verifications in steps S2 to S3 are passed, the vehicle gateway device startup process is completed.
2. The vehicle gateway device security startup method according to claim 1 is characterized in that: In step S1, the security chip is connected to the main control via a serial peripheral interface, and the security chip processes and analyzes the data information transmitted by the main control to perform security verification.
3. The vehicle gateway device security startup method according to claim 1 is characterized in that: In step S2, the integrity verification of the boot program further includes: S21: receiving the encrypted signature value generated for the boot program related information and verifying it. After the verification is passed, the boot program is encrypted by an encryption algorithm to obtain a unique hash value H1; S22: transmitting the signature value data and the hash value H1 of the boot program to the security chip, and verifying the signature value data by using an asymmetric encryption algorithm; S23: Compare the data after the signature verification with the hash value H1 to complete the integrity verification.
4. The vehicle gateway device security startup method according to claim 3 is characterized in that: In step S21, receiving the encrypted signature value data and verifying it further includes: S211: Obtain a verification element for verifying the signature value, and decrypt the original signature value data based on the verification element, wherein: If the signature value is encrypted based on an asymmetric encryption algorithm, and the verification factor includes a public key, the public key is used for decryption; If the signature value is encrypted based on a symmetric encryption algorithm, and the verification factor includes a pre-stored key, the key is used for decryption; S212: Compare the original signature value data with a preset reference signature value to verify the authenticity of the signature value data.
5. The vehicle gateway device security startup method according to claim 4 is characterized in that: In step S21, after verification, the boot program is encrypted by an encryption algorithm to obtain a unique hash value H1, further comprising: S213: Selecting an encryption algorithm according to the security requirements and standards of the vehicle gateway device; S214: Reading the complete content data of the boot program, including the code segment and data segment of the boot program; S215: pre-process the read data to make it meet the requirements of the hash algorithm, input the pre-processed data into the hash algorithm for iterative calculation, and obtain the hash value H1.
6. The vehicle gateway device security startup method according to claim 3 is characterized in that: Step S23 further includes: The data after the signature verification is compared byte by byte with the hash value H1 through a comparison function, wherein: If the data after signature verification is consistent with the hash value H1, it is determined that the boot program has not been tampered with or damaged during transmission and storage; Otherwise, it is determined that the boot program integrity verification has failed, and data transmission, device failure, and malicious tampering are checked.
7. The vehicle gateway device security startup method according to claim 1 is characterized in that: In step S3, verifying the legitimacy of the source of the application further includes: S31: receiving the encrypted signature value generated for the application related information and verifying it. After the verification is passed, the boot program is encrypted by an encryption algorithm to obtain a unique hash value H2; S32: transmitting the signature value data and the hash value H2 of the application to the security chip, and verifying the signature value data by using an asymmetric encryption algorithm; S33: Compare the data after the signature verification with the hash value H2. If the comparison results are consistent, it proves that the source of the application is legal and has not been tampered with, and the application is loaded and run.
8. The vehicle gateway device security startup method according to claim 7 is characterized in that: In step S3, verifying the feasibility of debugging the application further includes: S34: receiving a debugging application sent according to a user instruction and opening a debugging interface; S35: Read the access password and authentication PIN code of the debugging interface and verify them, and compare the access password and authentication PIN with the correct password and PIN code stored in advance. If the access password and PIN code completely match, debugging of the application is allowed, otherwise debugging is rejected.
9. The vehicle gateway device security startup method according to claim 8, characterized in that: In step S3, verifying the feasibility of upgrading the application further includes: S36: receiving an upgrade application and a new application program sent according to a user instruction; S37: Send the hash value and signature value data of the new application to the security chip, perform signature verification and hash value comparison according to the method steps of steps S31 to S33, and allow the update after verification, otherwise the update will be rejected.
10. A vehicle gateway device security startup system based on the method described in claims 1 to 9, characterized in that: include: An initialization module is used to receive a startup program, and to start and initialize the security chip first; The boot program verification module is used to verify the integrity of the boot program. After the verification passes, the boot program is loaded and run; The application verification module is used to start the verification of the application loaded by the boot program after receiving the response allowing the boot program to be loaded and run, including: Verify the legitimacy of the application program source and run the application program after passing the verification; Debug and upgrade the feasibility of the application program, and perform corresponding application debugging and updating after passing the verification; The working startup module is used to complete the startup process of the vehicle gateway device after the verification of the boot program verification module and the application verification module are all passed.