Network security protection method for high-pressure water heater

Abstract

The invention discloses a network security protection method for a high-pressure water heater, and the method comprises the steps: enabling a system to gradually check the integrity of a Bootloader and an application program when an ECU (Electronic Control Unit) is started through a security starting scheme, and preventing malicious tampering; secondly, through an OTA firmware encryption scheme, encryption protection is carried out on the firmware upgrading process, and it is ensured that firmware is not tampered or replaced in the transmission and installation process; meanwhile, the integrated hardware security module (HSM) performs key management, ensures the generation, storage and use security of the key, and prevents the key from being leaked or cracked, thereby ensuring the confidentiality of the firmware signature, decryption process and data transmission; and finally, the protection of the physical layer is further enhanced by closing the debugging port, so that the external equipment is prevented from directly accessing the chip through the physical interface, and the debugging and tampering risks are reduced.

Description

Technical Field

[0001] The present invention relates to a heating system for a new energy vehicle, and is specifically used in a high-pressure water heater product. The high-pressure water heater product is mainly used in an air-conditioning system and a battery thermal management system for a new energy vehicle, providing a heat source for the air-conditioning system of the new energy vehicle and heating for the power battery. Background Art

[0002] It stems from the increasingly complex electronic and software systems of modern cars. With the development of new energy vehicles, more and more sensors, controllers and communication modules are integrated into vehicles, which enable cars to connect to the Internet and other vehicles. Although these technologies improve the safety and convenience of cars, they also expose them to greater risks of cyber attacks.

[0003] In recent years, cyber attacks on automobiles have gradually increased, such as remote control of vehicles, data theft, and attacks on key vehicle systems. This has prompted the industry to pay attention to automotive cybersecurity, leading to the formulation of new regulations and standards, such as ISO / SAE 21434 and UNECE WP.29, to ensure that cybersecurity is taken into account during the design and production of automobiles.

[0004] As high-pressure water heaters are controlled devices in the vehicle network, they have been neglected in network security applications, mainly in the following aspects:

[0005] First, during the design phase of the high-pressure water heater, network security factors were not fully considered, and the necessary security architecture and risk assessment were lacking. This makes it easy to become a weak link in attacks, and there is a lack of effective protection mechanisms to deal with increasingly complex network security threats. In addition, the firmware and software update mechanisms of the existing technology are not sound enough, and the firmware update process lacks encryption protection and identity authentication, which cannot effectively prevent malware or unauthorized firmware from being loaded, increasing the risk of system attacks and malicious tampering.

[0006] Secondly, the existing technology lacks sufficient data encryption measures when transmitting and storing data between the high-pressure water heater and other vehicle systems, making sensitive information, such as operating instructions and sensor data, vulnerable to man-in-the-middle attacks or data leakage. Finally, the existing technology is relatively weak in the user identity authentication system and the control of authorized access is not strict, which can easily lead to unauthorized users or attackers gaining access to the system, further exacerbating potential security risks.

[0007] In view of this, the present invention is proposed. Summary of the invention

[0008] The technical problem to be solved by the present invention is to overcome the deficiencies of the prior art and provide a network security protection method for a high-pressure water heater, thereby solving the problems raised in the above-mentioned background technology.

[0009] In order to solve the above technical problems, the basic concept of the technical solution adopted by the present invention is:

[0010] A network security protection method for a high-pressure water heater comprises the following steps:

[0011] The integrity of the Bootloader and the application when the ECU is started is verified step by step through the trusted boot program. The integrity of the Bootloader is verified first. If it is complete, the integrity of the application is verified to ensure that the firmware has not been tampered with and prevent malware from loading.

[0012] After the firmware passes the bootloader verification, OTA firmware encryption is performed. The encryption process prevents unauthorized firmware upgrade packages from being executed and ensures that the firmware is not tampered with or replaced during transmission and upgrade.

[0013] Integrate the HSM module in the ECU for key generation, storage and management to ensure the key security of firmware encryption and decryption operations and ensure that encryption operations will not be cracked or leaked;

[0014] After the product goes into mass production, use chip tools to close the debug port to prevent external direct access to the chip through hard-wired connections, further enhance physical security, and avoid potential physical attacks and debugging.

[0015] Optionally, before performing secure boot, it is necessary to extract the hash value of the firmware, encrypt the hash value using a symmetric encryption or an asymmetric encryption algorithm, and then write the encrypted hash value to a fixed address of the firmware.

[0016] Optionally, when the ECU is powered on and started, the system verifies the integrity of the firmware level by level through the bootloader as follows:

[0017] The bootloader verifies the integrity of the firmware itself and checks whether it matches the expected signature. If the bootloader is incomplete or damaged, the system will reboot to prevent the execution of malicious code.

[0018] If the Bootloader is complete, the system will continue to verify the integrity of the application. If the application is incomplete, the system will also restart to prevent unsafe firmware from being loaded;

[0019] If the application is complete, execution of the application continues.

[0020] Optionally, after the MCU is started, the firmware security needs to be checked. The steps are as follows:

[0021] Use the hardware security engine to calculate the hash value A of the firmware and compare it with the hash value B stored in the firmware. Next, extract the public key from the hardware encryption module and use the public key to decrypt the signature of the firmware to obtain the hash value B'. Subsequently, compare the hash value A with the hash value B'. If the two are consistent, it means that the firmware has not been tampered with and the system will continue to execute subsequent operations. If the hash values ​​are inconsistent, the system will trigger a restart to avoid executing maliciously tampered firmware.

[0022] Optionally, after the hash value A and the hash value B' are consistent, it is also necessary to extract the stored user identity identification code signature from the hardware security module and perform a decryption operation. Then, the decrypted UID is compared with the UID stored in the MCU. If the two are consistent, it means that the user identity is legal and the system continues to execute subsequent software. If the UID is inconsistent, the system will restart to ensure that only authorized users can continue to access and use the system.

[0023] Optionally, after the high-pressure water heater is safely started, the signed firmware needs to be encrypted. During the encryption process, the firmware is encrypted every 16 bytes using a symmetric encryption or an asymmetric encryption algorithm.

[0024] Optionally, after the firmware is encrypted, the MCU will decrypt the encrypted firmware using the same symmetric or asymmetric encryption algorithm as used for encryption. The decrypted firmware will be restored to the original data and written into the MCU's Flash storage to complete the firmware security upgrade.

[0025] After adopting the above technical solution, the present invention has the following beneficial effects compared with the prior art. Of course, any product implementing the present invention does not necessarily need to achieve all the advantages described below at the same time:

[0026] Through the secure boot scheme, the system can gradually verify the integrity of the Bootloader and the application when the ECU starts to prevent malicious tampering; secondly, through the OTA firmware encryption scheme, the firmware upgrade process is encrypted and protected to ensure that the firmware is not tampered with or replaced during transmission and installation; at the same time, the integrated hardware security module (HSM) performs key management to ensure the security of key generation, storage and use, prevent key leakage or cracking, thereby ensuring the confidentiality of firmware signature, decryption process and data transmission; finally, by closing the debug port, the physical level protection is further enhanced to prevent external devices from directly accessing the chip through the physical interface, reducing the risk of debugging and tampering. The schemes of the present invention are layered and complementary, forming a complete security protection system from the network, software to the hardware level, effectively preventing malicious attacks, tampering and physical intrusion, thereby ensuring the high-pressure water heater in a complex network environment. Efficient, safe and stable operation.

[0027] The specific implementation modes of the present invention are further described in detail below in conjunction with the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] The drawings described below are only some embodiments. For those skilled in the art, other drawings can be obtained based on these drawings without creative work.

[0029] In the figure:

[0030] Figure 1 This is the secure startup process of the present invention.

[0031] Figure 2 This is the firmware signing process of the present invention.

[0032] Figure 3 This is the firmware security check process in the secure startup of the present invention.

[0033] Figure 4 This is the software upgrade package encryption process of the present invention.

[0034] Figure 5 This is the decryption process of the flash software upgrade package of the present invention.

[0035] It should be noted that these drawings and textual descriptions are not intended to limit the conceptual scope of the present invention in any way, but are intended to illustrate the concept of the present invention for those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0036] The present invention will now be described in further detail with reference to the accompanying drawings.

[0037] See also Figure 1-5 As shown, in this embodiment, a network security protection method for a high-pressure water heater is provided, comprising the following steps:

[0038] The integrity of the Bootloader and the application when the ECU is started is verified step by step through the trusted boot program. The integrity of the Bootloader is verified first. If it is complete, the integrity of the application is verified to ensure that the firmware has not been tampered with and prevent malware from loading.

[0039] After the firmware passes the bootloader verification, OTA firmware encryption is performed. The encryption process prevents unauthorized firmware upgrade packages from being executed and ensures that the firmware is not tampered with or replaced during transmission and upgrade.

[0040] The HSM module is integrated in the ECU for key generation, storage and management, ensuring the key security of firmware encryption and decryption operations, and ensuring that encryption operations will not be cracked or leaked; HSM module application: All key keys are stored in the HSM module of the ECU. The HSM module has hardware encryption function and can perform encryption, decryption and other operations without exposing the key, thereby ensuring the security of the key.

[0041] It should be noted that: With the increasing number of new energy vehicles and on-board electronic units, their safety is facing serious challenges. As an electronic control unit, the high-pressure water heater is connected to the vehicle network, and network security is becoming increasingly important. The present invention is based on a high-pressure water heater product and designs a network security solution. The present invention is based on the existing high-pressure water heating product and can improve the network security of the high-pressure water heater product without increasing the hardware cost, thereby ensuring its safety and reliability in a complex network environment. Unauthorized access and control are effectively avoided, and the firmware upgrade process is encrypted and protected to prevent potential malicious tampering and reversal. The HSM module is used to ensure key security, and closing the debug port further improves physical protection.

[0042] After the product is mass-produced, use the chip tool to close the debug port (Debug port) to prevent external direct access to the chip through hard-wired connections, further strengthen physical security, and avoid potential physical attacks and debugging. Debug port closing operation: After the product is mass-produced, use the chip configuration tool to close the Debug port to prevent debugging the chip through hardware connections. This method can effectively prevent unauthorized debugging operations and further improve the security of the device.

[0043] The present invention uses a secure boot scheme, and the system can gradually verify the integrity of the Bootloader and the application when the ECU is started to prevent malicious tampering; secondly, through the OTA firmware encryption scheme, the firmware upgrade process is encrypted and protected to ensure that the firmware is not tampered with or replaced during transmission and installation; at the same time, the integrated hardware security module (HSM) performs key management to ensure the security of key generation, storage and use, prevent key leakage or cracking, thereby ensuring the confidentiality of firmware signature, decryption process and data transmission; finally, by closing the debug port (Debug port), the physical level protection is further enhanced to prevent external devices from directly accessing the chip through the physical interface, reducing the risk of debugging and tampering. These schemes provide layered protection and complement each other, forming a complete security protection system from the network, software to hardware level, effectively preventing malicious attacks, tampering and physical intrusion, thereby ensuring the high-pressure water heater in a complex network environment. Efficient, safe and stable operation.

[0044] See also Figure 2As shown, in this embodiment, before performing secure boot, it is necessary to extract the hash value of the firmware, and encrypt the hash value using a symmetric encryption (such as AES) or an asymmetric encryption (such as RSA) algorithm, and then write the encrypted hash value to a fixed address of the firmware. By adopting symmetric encryption (such as AES) or asymmetric encryption (such as RSA), security is increased. Asymmetric encryption (such as RSA) ensures higher security, and is particularly suitable for scenarios that require stronger encryption protection, increasing the trustworthiness of the entire system.

[0045] By extracting the hash value of the firmware and encrypting it before secure boot, it ensures that the firmware has not been tampered with or damaged during transmission and storage. The encrypted hash value ensures the confidentiality of the data and prevents unauthorized access.

[0046] See also Figure 1 As shown, in this embodiment, when the ECU is powered on and started, the system verifies the integrity of the firmware step by step through the boot program:

[0047] The bootloader verifies the integrity of the firmware itself and checks whether it matches the expected signature. If the bootloader is incomplete or damaged, the system will restart to prevent the execution of malicious code. By verifying the integrity of the bootloader and the application in stages, each layer of verification ensures that every link from system startup to application loading is safe. In this way, even if a part of the firmware is tampered with, the system can detect it in time and prevent it from starting.

[0048] If the Bootloader is complete, the system will continue to verify the integrity of the application. If the application is incomplete, the system will also restart to prevent unsafe firmware from being loaded;

[0049] If the application is complete, execution of the application continues.

[0050] By verifying the integrity of the entire boot chain (from Bootloader to application), the stability and reliability of system startup are ensured. If any link does not meet expectations, the system will recover in time to avoid unstable operation.

[0051] See also Figure 3 As shown, in this embodiment: after the MCU is started, the firmware security needs to be checked, and the steps are:

[0052] The hardware security engine (HSE) is used to calculate the hash value A of the firmware and compare it with the hash value B stored in the firmware. Then, the public key is extracted from the hardware encryption module (HSM) and the signature of the firmware is decrypted with the public key to obtain the hash value B'. Subsequently, the hash value A is compared with the hash value B'. If the two are consistent, it means that the firmware has not been tampered with and the system will continue to perform subsequent operations. If the hash values ​​are inconsistent, the system will trigger a restart to avoid executing maliciously tampered firmware. By using the hardware security engine (HSE) to calculate the firmware hash value and compare it with the stored hash value, combined with the public key decryption of the hardware encryption module (HSM), the security of firmware verification is increased. Hardware-level encryption and verification are more difficult to crack than software implementations, ensuring the reliability of firmware integrity verification.

[0053] See also Figure 3 As shown, in this embodiment, after the hash value A is consistent with the hash value B', it is also necessary to extract the stored user identity identification code signature from the hardware security module and perform a decryption operation. Then, the decrypted UID is compared with the UID stored in the MCU. If the two are consistent, it means that the user identity is legal, and the system continues to execute subsequent software. If the UID is inconsistent, the system will restart to ensure that only authorized users can continue to access and use the system.

[0054] See also Figure 4 As shown, in this embodiment, after the high-pressure water heater is safely started, the signed firmware needs to be encrypted. During the encryption process, a symmetric encryption or an asymmetric encryption algorithm is used to encrypt every 16 bytes of the firmware.

[0055] See also Figure 5 As shown, in this embodiment, after completing the encryption of the firmware, the MCU will decrypt the encrypted firmware using the same symmetric or asymmetric encryption algorithm as used for encryption. The decrypted firmware will be restored to the original data and written into the Flash storage of the MCU to complete the security upgrade of the firmware.

[0056] The present invention is not limited to the above-mentioned embodiments. Anyone should be aware that any structural changes made under the enlightenment of the present invention, and any technical solutions that are the same or similar to the present invention, fall within the protection scope of the present invention. The technology, shape, and structural parts not described in detail in the present invention are all well-known technologies.

Claims

1. A network security protection method for a high-pressure water heater, characterized in that: The following steps are involved: The integrity of the Bootloader and the application when the ECU is started is verified step by step through the trusted boot program. The integrity of the Bootloader is verified first. If it is complete, the integrity of the application is verified to ensure that the firmware has not been tampered with and prevent malware from loading. After the firmware passes the bootloader verification, OTA firmware encryption is performed. The encryption process prevents unauthorized firmware upgrade packages from being executed and ensures that the firmware is not tampered with or replaced during transmission and upgrade. Integrate the HSM module in the ECU for key generation, storage and management to ensure the key security of firmware encryption and decryption operations and ensure that encryption operations will not be cracked or leaked; After the product goes into mass production, use chip tools to close the debug port to prevent external direct access to the chip through hard-wired connections, further enhance physical security, and avoid potential physical attacks and debugging.

2. A network security protection method for a high pressure water heater according to claim 1, characterized in that: Before performing secure boot, you need to extract the hash value of the firmware and encrypt the hash value using a symmetric encryption or asymmetric encryption algorithm. Then, write the encrypted hash value to a fixed address of the firmware.

3. The network security protection method for a high pressure water heater according to claim 1, characterized in that: When the ECU is powered on and started, the system verifies the integrity of the firmware step by step through the bootloader: The bootloader verifies the integrity of the firmware itself and checks whether it matches the expected signature. If the bootloader is incomplete or damaged, the system will reboot to prevent the execution of malicious code. If the Bootloader is complete, the system will continue to verify the integrity of the application. If the application is incomplete, the system will also restart to prevent unsafe firmware from being loaded; If the application is complete, execution of the application continues.

4. The network security protection method for a high pressure water heater according to claim 1, characterized in that: After the MCU is started, the firmware security needs to be checked. The steps are as follows: Use the hardware security engine to calculate the hash value A of the firmware and compare it with the hash value B stored in the firmware. Next, extract the public key from the hardware encryption module and use the public key to decrypt the signature of the firmware to obtain the hash value B'. Subsequently, compare the hash value A with the hash value B'. If the two are consistent, it means that the firmware has not been tampered with and the system will continue to execute subsequent operations. If the hash values ​​are inconsistent, the system will trigger a restart to avoid executing maliciously tampered firmware.

5. The network security protection method for a high pressure water heater according to claim 1, characterized in that: After the hash value A and the hash value B' are consistent, it is also necessary to extract the stored user identity identification code signature from the hardware security module and perform a decryption operation. Then, the decrypted UID is compared with the UID stored in the MCU. If the two are consistent, it means that the user identity is legal and the system continues to execute subsequent software. If the UID is inconsistent, the system will restart to ensure that only authorized users can continue to access and use the system.

6. A network security protection method for a high pressure water heater according to claim 1, characterized in that: After the high-pressure water heater is safely started, the signed firmware needs to be encrypted. During the encryption process, the firmware is encrypted every 16 bytes using a symmetric encryption or an asymmetric encryption algorithm.

7. A network security protection method for a high pressure water heater according to claim 1, characterized in that: After the firmware is encrypted, the MCU will decrypt the encrypted firmware using the same symmetric or asymmetric encryption algorithm as used for encryption. The decrypted firmware will be restored to the original data and written into the MCU's Flash storage to complete the firmware security upgrade.

Images