Program loading verification method and device, system, vehicle and electronic equipment

Abstract

The present disclosure discloses a program loading verification method and device, system, vehicle and electronic device, the main technical scheme includes: after obtaining the code to be run, calculating the target verification value corresponding to the code to be run; the code to be run is the code that controls the operation of the receiving end of the code to be run; sending the first frame message to the receiving end of the code to be run; comparing the target verification value with the reference verification value; based on the comparison result of the target verification value and the reference verification value, determining whether to allow the code to be run to run at the receiving end. Compared with the related art, the method of adding asynchronous verification target verification value to the main control chip achieves the goal of not extending the time of sending the first frame message at startup, and realizing the integrity verification of the code to be run.

Description

Technical Field

[0001] The present disclosure relates to the field of vehicle technology, and in particular to a method and device for verifying program loading, a system, a vehicle, and an electronic device. Background Art

[0002] At present, with the widespread promotion and application of vehicle functional safety in automotive electronics and the development of autonomous driving business, the requirements for automotive safety integrity levels have also generally increased. For automotive electronic controllers with an Automotive Safety Integration Level (ASIL) D level, executable code will be required to have reliable integrity and the ability to verify integrity during the driving cycle to prevent violations of safety goals due to code corruption anomalies.

[0003] For the main control chip that does not have a large internal read-only memory (ROM), an external code storage unit is required to store the code. When the controller starts, the code in the external storage unit needs to be loaded into the chip's internal random access memory (RAM) for instruction execution.

[0004] In the related art, the integrity of the code of this type of chip is mainly ensured by cyclic redundancy check (CRC) check, such as Figure 1 As shown, the code is stored together with the code CRC check code. When the chip is started, the CRC value of the code after the transfer is calculated and compared with the original stored CRC value to determine the integrity of the code before and after the transfer. Figure 1 In the scheme shown, the CRC calculation time is proportional to the amount of code, that is, the larger the amount of code, the longer the verification time required. However, using the CRC verification algorithm to ensure the integrity of the code before and after transfer causes the controller to power on and start up too long, which cannot meet the first frame message time requirement. Summary of the invention

[0005] The present invention provides a program loading verification method, device, system, vehicle and electronic device. Its main purpose is to solve the problem that the controller power-on startup time is too long and cannot meet the startup first frame message time requirement when using CRC verification algorithm to ensure the integrity of code before and after transfer.

[0006] According to a first aspect of the present disclosure, a method for verifying program loading is provided, which includes:

[0007] After obtaining the code to be run, calculating the target check value corresponding to the code to be run; the code to be run is the code that controls the execution of the receiving end of the code to be run;

[0008] After determining that the receiving end that controls the code to be run sends the first frame message, the target check value is compared with the reference check value; based on the comparison result of the target check value and the reference check value, it is determined whether the code to be run is allowed to run at the receiving end.

[0009] Optionally, the determining whether to allow the code to be executed to be executed at the receiving end based on the comparison result between the target check value and the reference check value includes:

[0010] When it is determined that the target check value is consistent with the reference check value, controlling the receiving end to run the code to be run;

[0011] When it is determined that the target check value is inconsistent with the reference check value, a prompt message indicating that a fault exists in the code to be run is output, and control is performed to enter a preset fault post-processing.

[0012] Optionally, comparing the target check value with a reference check value includes:

[0013] Acquire the reference check value from an external storage unit of the chip;

[0014] The target check value is compared with the reference check value.

[0015] Optionally, before acquiring the reference verification value from an external storage unit of the chip, the method includes:

[0016] Calling a timer to count the time after the first frame message is successfully sent;

[0017] The obtaining of the reference check value from the external storage unit of the chip comprises:

[0018] After the time reaches a preset time threshold, the reference check value is obtained from the external storage unit.

[0019] Optionally, after obtaining the code to be executed, calculating the target check value corresponding to the code to be executed includes:

[0020] After the chip is powered on or reset, the code to be executed is obtained from an external storage unit of the chip;

[0021] Transferring the code to be executed to a random access memory inside the chip;

[0022] A preset algorithm is called, and the target check value corresponding to the code to be run is calculated according to the starting address and the ending address of the code to be run in the random access memory.

[0023] According to a second aspect of the present disclosure, there is provided a program loading verification system, comprising: a chip and an external storage unit;

[0024] A security module, which is included in the chip and is used to obtain the code to be run from the internal random access memory and calculate the target check value corresponding to the code to be run; the code to be run is the code that controls the execution of the receiving end of the code to be run;

[0025] The chip is also used to control the receiving end of the code to be run to send a first frame message, and determine whether to allow the code to be run at the receiving end based on the comparison result of the target check value output by the security module and the reference check value.

[0026] According to a third aspect of the present disclosure, a program loading verification device is provided, comprising:

[0027] A calculation unit, configured to calculate a target check value corresponding to the code to be run after obtaining the code to be run; the code to be run is a code that controls the execution of a receiving end of the code to be run;

[0028] A comparison unit, configured to compare the target check value with a reference check value after determining that the receiving end of the control code to be executed sends a first frame message;

[0029] A determination unit is used to determine whether to allow the code to be executed to execute at the receiving end based on a comparison result between the target check value and the reference check value.

[0030] Optionally, the determining unit includes:

[0031] A first control module, configured to control the receiving end to execute the code to be executed when it is determined that the target check value is consistent with the reference check value;

[0032] The second control module is used to output a prompt message indicating that the code to be run has a fault when it is determined that the target check value is inconsistent with the reference check value, and control the entry into a preset fault post-processing.

[0033] Optionally, the comparison unit includes:

[0034] A first acquisition module, used for acquiring the reference check value from an external storage unit of the chip;

[0035] A comparison module is used to compare the target verification value with the reference verification value.

[0036] Optionally, the comparison unit further includes:

[0037] A timing module, used for calling a timer to count the time after the first frame message is successfully sent before the acquisition module acquires the reference check value from the external storage unit of the chip;

[0038] The first acquisition module is further configured to acquire the reference verification value from the external storage unit after the time reaches a preset time threshold.

[0039] Optionally, the computing unit includes:

[0040] A second acquisition module, used for acquiring the code to be executed from the external storage unit of the chip after the chip is powered on or reset;

[0041] A transport module, used for transporting the code to be executed to a random access memory inside the chip;

[0042] The calculation module is used to call a preset algorithm and calculate the target check value corresponding to the code to be run according to the starting address and the ending address of the code to be run in the random access memory.

[0043] According to a fourth aspect of the present disclosure, a vehicle is provided, the vehicle comprising the program loading verification system as described in the second aspect;

[0044] Alternatively, the vehicle comprises a program-loaded verification device as described in any one of the third aspects.

[0045] According to a fifth aspect of the present disclosure, there is provided an electronic device, including:

[0046] at least one processor; and

[0047] a memory communicatively connected to the at least one processor; wherein,

[0048] The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method described in the first aspect.

[0049] According to a sixth aspect of the present disclosure, a non-transitory computer-readable storage medium storing computer instructions is provided, wherein the computer instructions are used to enable the computer to execute the method described in the first aspect above.

[0050] According to a seventh aspect of the present disclosure, a computer program product is provided, comprising a computer program, wherein when the computer program is executed by a processor, the computer program implements the method as described in the first aspect above.

[0051] The program loading verification method, device, system, vehicle and electronic device provided by the present disclosure calculates the target verification value corresponding to the code to be run after obtaining the code to be run; the code to be run is the code that controls the operation of the receiving end of the code to be run; sends the first frame message to the receiving end of the code to be run; compares the target verification value with the reference verification value; based on the comparison result of the target verification value and the reference verification value, determines whether to allow the code to be run to run at the receiving end. Compared with the related art, the method of adding asynchronous verification target verification value to the main control chip achieves the goal of not extending the time of sending the first frame message at startup, and can also achieve integrity verification of the code to be run.

[0052] It should be understood that the content described in this section is not intended to identify the key or important features of the embodiments of the present application, nor is it intended to limit the scope of the present application. Other features of the present application will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] The accompanying drawings are used to better understand the present solution and do not constitute a limitation of the present disclosure.

[0054] Figure 1 A flowchart of a program loading verification method provided by the related technology;

[0055] Figure 2 A flowchart of a program loading verification method provided by an embodiment of the present disclosure;

[0056] Figure 3 A flowchart of another method for verifying program loading provided by an embodiment of the present disclosure;

[0057] Figure 4 A schematic diagram of the structure of a program loading verification system provided by an embodiment of the present disclosure;

[0058] Figure 5 A schematic diagram of the structure of a program loading verification device provided by an embodiment of the present disclosure;

[0059] Figure 6 A schematic diagram of the structure of another program loading verification device provided by an embodiment of the present disclosure;

[0060] Figure 7 A schematic block diagram of an exemplary electronic device 500 provided for an embodiment of the present disclosure. DETAILED DESCRIPTION

[0061] The following is a description of exemplary embodiments of the present disclosure in conjunction with the accompanying drawings, including various details of the embodiments of the present disclosure to facilitate understanding, which should be considered as merely exemplary. Therefore, it should be recognized by those of ordinary skill in the art that various changes and modifications may be made to the embodiments described herein without departing from the scope and spirit of the present disclosure. Similarly, for the sake of clarity and conciseness, descriptions of well-known functions and structures are omitted in the following description.

[0062] The following describes the program loading verification method and device, system, vehicle and electronic device of the embodiment of the present disclosure with reference to the accompanying drawings. The method is applied to a vehicle chip, Figure 2 A flowchart of a program loading verification method provided by an embodiment of the present disclosure.

[0063] like Figure 2 As shown, the method comprises the following steps:

[0064] Step 101, after obtaining the code to be run, calculate the target check value corresponding to the code to be run; the code to be run is the code that controls the execution of the receiving end of the code to be run.

[0065] In the disclosed embodiment, the code to be run is a code that controls the execution of the receiving end of the code to be run. The code to be run may generate errors during the transmission process due to reasons such as transmission medium failure or external interference, resulting in abnormal damage to the code to be run, which is inconsistent with the code to be run before transmission. In the field of vehicle safety, running erroneous code will cause immeasurable losses and cause safety hazards. Therefore, after obtaining the code to be run, it is necessary to check whether the code to be run is damaged or missing during the transmission process to ensure the safety of running the code to be run. There are many ways to check the integrity of the code to be run, and common ones include parity check, sum check, hash algorithm, etc. Their working principle is that the sending end calculates the check value of the data according to a certain algorithm, sends the check value and the data together to the receiving end, and then the receiving end checks to determine whether the data has changed.

[0066] The target check value is calculated according to a preset algorithm for the acquired code to be run to obtain a corresponding check value, which is used to check whether the code to be run has changed to ensure that the running code is complete. The preset algorithm is an error check algorithm used to check the integrity of the code to be run, which can be flexibly set as needed, such as a hash algorithm, etc. The specific embodiment of the present application does not limit the target check value.

[0067] In the embodiment of the present application, the code to be run is generally stored in the external storage unit of the chip, and the chip reads it from the external storage unit to the random access memory inside the chip for execution. For chips that do not have a large read-only memory (ROM) integrated internally, in order to ensure the integrity of the code to be run, it is generally necessary to set up an external storage unit of the chip to store the code to be run. The external storage unit of the chip can be used but not limited to some external storage devices or external storage chips, such as using pseudo static random access memory (PSRAM) as the external storage unit of the chip. The specific external storage device or external storage chip used as the external storage unit is not limited in the embodiment of the present application.

[0068] In the related art, after sending the first frame message, it is necessary to wait for the matching result of the target check value and the reference check value, and only after determining that the target check value is consistent with the reference check value, will the code to be run continue. In this application, after triggering the calculation of the target check value, the receiving end of the code to be run is directly controlled to send the first frame message without waiting for the calculation of the target check value to be completed.

[0069] Step 102: after determining that the receiving end of the control code to be executed sends the first frame message, compare the target check value with the reference check value.

[0070] To facilitate the understanding of the code to be run, the code to be run may be a control code of a certain functional domain. For example, the code to be run is used to control automatic heating of a seat, or the code to be run is used to control the adjustment of lights in the vehicle, etc. The specific embodiments of the present application do not limit the code to be run.

[0071] If the code to be run is used to control the adjustment of the lights in the car, the receiving end of the code to be run (lighting controller) needs to establish a connection with the chip through a "handshake" protocol. After the chip and the receiving end of the code to be run receive the code to be run, they continue to perform the initialization operation of the startup phase, which includes but is not limited to the initialization of the receiving end of the code to be run, or the initialization of the control components, such as the initialization of the lights, the initialization of the seats and other hardware initializations.

[0072] After continuing to execute the necessary operations in the startup phase, the receiving end of the code to be run is controlled to send the first frame message, so that there is no need to wait for the target check value calculation to cause a delay in sending the startup message.

[0073] In order to obtain the comparison result between the target check value and the reference check value, the code to be run is moved from the external storage unit to the inside of the chip for integrity verification. After determining that the receiving end that controls the code to be run sends the first frame message, the reference check value is obtained from the external storage unit of the chip. The reference check value is pre-stored in the external storage unit of the chip for easy acquisition during comparison; then the target check value calculated inside the chip is compared with the reference check value obtained from the external storage unit of the chip.

[0074] Step 103: Based on the comparison result between the target check value and the reference check value, determine whether to allow the code to be executed to execute at the receiving end.

[0075] When it is determined that the target check value is consistent with the reference check value, the receiving end is controlled to run the code to be run; when it is determined that the target check value is inconsistent with the reference check value, a prompt message that there is a fault in the code to be run is output, and control is entered into a preset fault post-processing.

[0076] The program loading verification method provided by the present disclosure calculates the target verification value corresponding to the code to be run after obtaining the code to be run; the code to be run is the code that controls the operation of the receiving end of the code to be run; sends the first frame message to the receiving end of the code to be run; compares the target verification value with the reference verification value; based on the comparison result of the target verification value and the reference verification value, determines whether to allow the code to be run to run at the receiving end. Compared with the related art, the method of adding asynchronous verification target verification value to the main control chip achieves the goal of not extending the time of sending the first frame message at startup, and can also achieve integrity verification of the code to be run.

[0077] In some embodiments, in order to reduce the startup time extended by the integrity check before and after the code to be run is moved, a method of adding an asynchronous verification target check value to the main control chip can be adopted but is not limited to this method. This verification method requires the setting of a security module, which is included in the chip but is independent of the chip central processing unit (CPU) module, and can be used to calculate the target check value corresponding to the code to be run. The method of using the security module of the chip to calculate the target check value does not occupy the CPU resources of the chip, and can be calculated without affecting the time of sending the first frame message, thereby reducing the startup time extended by the integrity check before and after the code to be run is moved.

[0078] Figure 3The present invention provides a flowchart of a verification method for program loading using a hash algorithm as a preset algorithm. The hash algorithm is an algorithm for verifying the integrity of the code to be run and is commonly used in the field of information security. Figure 3 As shown, after the chip is reset or powered on, the chip issues a code transfer instruction, controls the chip to read the code to be run stored in the external storage unit and transfers it to the random access memory (internal Ram) inside the chip; after the code to be run is transferred, the Hash calculation instruction is triggered, controls the security module contained in the chip to obtain the code to be run from the external storage unit, and calls the Hash algorithm to calculate the target verification value corresponding to the code to be run, that is, the Hash value. After the Hash calculation is triggered, there is no need to wait for the Hash calculation to be completed, but continue to perform the necessary operations in the startup phase to perform the transmission of the first frame message without waiting for the completion of the calculation. After the message is sent, the Hash calculation result can be obtained at a preset time and compared with the Hash value stored in the external storage unit. If the calculation result is consistent with the Hash value in the external storage unit, the verification is successful and the verification of the code to be run is completed; if the calculation result is inconsistent with the Hash value in the external storage unit, the verification fails, and the prompt information that the code to be run has a fault is output, and the control enters the preset fault post-processing.

[0079] In some embodiments, the external storage unit is also used to store a reference check value corresponding to the code to be run. The reference check value is a check value corresponding to the code to be run before it is moved, and is used to compare with a target check value calculated by the code to be run after it is moved, so as to confirm that the code to be run after it is moved is consistent with that before it is moved, thereby ensuring the integrity of the code to be run.

[0080] In one embodiment of the present disclosure, in order to calculate the target check value corresponding to the code to be run, it is possible to adopt but not limited to: calling a preset algorithm, and calculating the target check value corresponding to the code to be run according to the start address and end address of the code to be run in the random access memory. In an implementable manner of the embodiment of the present disclosure, the preset algorithm can adopt but not limited to a hash algorithm to calculate the target check value.

[0081] In the above embodiment, the hash algorithm refers to mapping a binary value of arbitrary length to a shorter fixed-length binary value, and this small binary value is called a hash value. A hash value is a unique and extremely compact numerical representation of a piece of data. If a letter of a hashed plaintext is changed in the paragraph, subsequent hashes will produce different values. It is computationally impossible to find two different inputs that hash to the same value, so the hash value of the data can verify the integrity of the data. The hash algorithm is a basic technology used for information storage and query. It is a file construction method based on the hash function, which can realize fast random access to records and is generally used for authentication, certification, encryption, indexing, etc. The main advantages of the hash algorithm are simple operation, short preprocessing time, low memory consumption, fast matching search speed, easy maintenance and refresh, and support for a large number of matching rules. Therefore, the hash algorithm is often used in information security. The application of the hash algorithm in information security is mainly reflected in the following three aspects: file verification, digital signature and authentication protocol. Commonly used check algorithms include parity check and CRC check, which have no ability to resist data tampering. They can detect and correct channel errors in data transmission to a certain extent, but cannot prevent malicious damage to data. The specific preset algorithm is not limited in the embodiments of this application.

[0082] Associated with the above embodiment, after triggering the calculation of the target check value corresponding to the code to be run, the chip may not wait for the completion of the calculation of the target check value corresponding to the code to be run, but continue to execute the initialization operation of starting the code to be run, and then control the receiving end of the code to be run to send the first frame message. This method will not cause a delay in sending the first frame message due to waiting for the calculation of the target check value. After the first frame message is sent, the chip can obtain the calculation result of the target check value after the preset time threshold is reached. The preset time threshold can be set as needed, such as being set to be obtained immediately after the calculation of the target check value is completed, or it can be set to be obtained after 5 seconds or 10 seconds. The specific can be determined according to actual needs and is not limited in this embodiment.

[0083] In some embodiments, in order to obtain the reference check value for comparison at a preset time, the following method can be used but should not be limited to. For example, before obtaining the reference check value from the external storage unit of the chip, it is necessary to call a timer to count the time after the first frame message is successfully sent to monitor whether the time reaches the preset time threshold; after the time reaches the preset time threshold, the reference check value is obtained from the external storage unit.

[0084] In some embodiments, based on the comparison result between the target check value and the reference check value, it is determined whether the code to be run is allowed to run at the receiving end: if it is determined that the target check value is consistent with the reference check value, the code to be run is determined to be consistent with before the transfer, and the receiving end is controlled to run the code to be run; if it is determined that the target check value is inconsistent with the reference check value, the code to be run has been damaged and abnormal, and it is determined that the code to be run cannot be run. In order to avoid potential safety accidents, a prompt message indicating that there is a fault in the code to be run is output, and the control enters the preset fault post-processing.

[0085] In summary, the embodiments of the present disclosure can achieve the following effects:

[0086] 1. By adding an asynchronous check target check value to the main control chip, it is achieved that the time for sending the first frame message at startup is not extended, and the integrity check of the running code can be achieved.

[0087] 2. It can timely discover fault problems before and after the code to be run is moved without extending the time of sending the first frame message, improve the fault diagnosis coverage measurement, meet the standard requirements, and avoid the occurrence of potential safety accidents.

[0088] Figure 4 A schematic diagram of a program loading verification system provided by an embodiment of the present disclosure is shown in FIG. Figure 4 As shown, the system includes: a chip 21 and an external storage unit 22, wherein the chip 21 includes a security module 211;

[0089] The external storage unit 22 is used to store the code to be executed;

[0090] The security module 211 is used to obtain the code to be run from the random access memory inside the chip and calculate the target check value corresponding to the code to be run; the code to be run is the code that controls the execution of the receiving end of the code to be run; after the chip is powered on or reset, the code to be run is obtained from the external storage unit 22 of the chip and the code to be run is moved to the random access memory inside the chip;

[0091] The chip 21 is also used to send a first frame message to the receiving end of the code to be run to control the receiving end of the code to be run to send the first frame message, and based on the comparison result of the target check value output by the security module and the reference check value, determine whether to allow the code to be run at the receiving end.

[0092] Corresponding to the above-mentioned program loading verification method, the present invention also provides a program loading verification device. Since the device embodiment of the present invention corresponds to the above-mentioned method embodiment, the details not disclosed in the device embodiment can be referred to the above-mentioned method embodiment, and will not be repeated in the present invention.

[0093] Figure 5 A schematic diagram of a program loading verification device provided by an embodiment of the present disclosure is shown in FIG. Figure 5 As shown, including:

[0094] The calculation unit 31 is used to calculate the target check value corresponding to the code to be run after obtaining the code to be run; the code to be run is the code that controls the receiving end to run the code to be run;

[0095] A comparison unit 32, configured to compare the target check value with a reference check value after determining that the receiving end of the control code to be executed sends a first frame message;

[0096] The determination unit 33 is used to determine whether to allow the code to be executed to execute at the receiving end based on the comparison result between the target check value and the reference check value.

[0097] The program loading verification device provided by the present disclosure calculates the target verification value corresponding to the code to be run after obtaining the code to be run; the code to be run is the code that controls the operation of the receiving end of the code to be run; sends the first frame message to the receiving end of the code to be run; compares the target verification value with the reference verification value; based on the comparison result of the target verification value and the reference verification value, determines whether to allow the code to be run to run at the receiving end. Compared with the related art, the method of adding asynchronous verification target verification value to the main control chip achieves the goal of not extending the time of sending the first frame message at startup, and can also achieve integrity verification of the code to be run.

[0098] Figure 6 A schematic diagram of the structure of another program loading verification device provided by an embodiment of the present disclosure, optionally, as Figure 6 As shown, the determining unit 33 includes:

[0099] A first control module 331 is used to control the receiving end to run the code to be run when it is determined that the target check value is consistent with the reference check value;

[0100] The second control module 332 is used to output a prompt message indicating that the code to be run has a fault when it is determined that the target check value is inconsistent with the reference check value, and control the entry into a preset fault post-processing.

[0101] Optionally, the comparison unit 32 includes:

[0102] A first acquisition module 321 is used to acquire the reference check value from an external storage unit of the chip;

[0103] The comparison module 322 is used to compare the target verification value with the reference verification value.

[0104] Optionally, the comparison unit 32 further includes:

[0105] The timing unit module 323 is used to call the timer to count the time after the first frame message is successfully sent after the sending unit sends the first frame message to the receiving end of the code to be run before the acquisition module obtains the reference check value from the external storage unit of the chip;

[0106] The first acquisition module 321 is further configured to acquire the reference verification value from the external storage unit after the time reaches a preset time threshold.

[0107] Optionally, the calculation unit 31 includes:

[0108] A second acquisition module 311 is used to acquire the code to be executed from the external storage unit of the chip after the chip is powered on or reset;

[0109] A transfer module 312, used for transferring the code to be executed to a random access memory inside the chip;

[0110] The calculation module 313 is used to call a preset algorithm and calculate the target check value corresponding to the code to be executed according to the starting address and the ending address of the code to be executed in the random access memory.

[0111] It should be noted that the above explanation of the method embodiment is also applicable to the device of this embodiment, and the principle is the same, which is not limited in this embodiment.

[0112] According to an embodiment of the present disclosure, the present disclosure also provides a vehicle, an electronic device, a readable storage medium, and a computer program product.

[0113] Figure 7A schematic block diagram of an example electronic device 400 that can be used to implement an embodiment of the present disclosure is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present disclosure described and / or required herein.

[0114] like Figure 7 As shown, the device 400 includes a computing unit 401, which can perform various appropriate actions and processes according to a computer program stored in a ROM (Read-Only Memory) 402 or a computer program loaded from a storage unit 408 to a RAM (Random Access Memory) 403. In the RAM 403, various programs and data required for the operation of the device 400 can also be stored. The computing unit 401, the ROM 402, and the RAM 403 are connected to each other via a bus 404. An I / O (Input / Output) interface 405 is also connected to the bus 404.

[0115] A number of components in the device 400 are connected to the I / O interface 405, including: an input unit 406, such as a keyboard, a mouse, etc.; an output unit 407, such as various types of displays, speakers, etc.; a storage unit 408, such as a disk, an optical disk, etc.; and a communication unit 409, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 409 allows the device 400 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0116] The computing unit 401 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the computing unit 401 include, but are not limited to, a CPU (Central Processing Unit), a GPU (Graphic Processing Units), various dedicated AI (Artificial Intelligence) computing chips, various computing units running machine learning model algorithms, a DSP (Digital Signal Processor), and any appropriate processor, controller, microcontroller, etc. The computing unit 401 performs the various methods and processes described above, such as a verification method for program loading. For example, in some embodiments, the verification method for program loading may be implemented as a computer software program, which is tangibly contained in a machine-readable medium, such as a storage unit 408. In some embodiments, part or all of the computer program may be loaded and / or installed on the device 400 via the ROM 402 and / or the communication unit 409. When the computer program is loaded into the RAM 403 and executed by the computing unit 401, one or more steps of the method described above may be performed. Alternatively, in other embodiments, the computing unit 401 may be configured to execute the aforementioned program loading verification method in any other appropriate manner (eg, by means of firmware).

[0117] Various embodiments of the systems and techniques described above herein may be implemented in digital electronic circuit systems, integrated circuit systems, FPGAs (Field Programmable Gate Arrays), ASICs (Application-Specific Integrated Circuits), ASSPs (Application Specific Standard Products), SOCs (System On Chips), CPLDs (Complex Programmable Logic Devices), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include: being implemented in one or more computer programs that may be executed and / or interpreted on a programmable system including at least one programmable processor that may be a dedicated or general-purpose programmable processor that may receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0118] The program code for implementing the method of the present disclosure may be written in any combination of one or more programming languages. These program codes may be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that the program code, when executed by the processor or controller, enables the functions / operations specified in the flow chart and / or block diagram to be implemented. The program code may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0119] In the context of the present disclosure, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or device, or any suitable combination of the foregoing. More specific examples of machine-readable storage media may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a RAM, a ROM, an EPROM (Electrically Programmable Read-Only-Memory) or a flash memory, an optical fiber, a CD-ROM (Compact Dis sc Read-Only Memory), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0120] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device (e.g., a CRT (Cathode-Ray Tube) or LCD (Liquid Crystal Display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the computer. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0121] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: LAN (Local Area Network), WAN (Wide Area Network), the Internet, and blockchain networks.

[0122] A computer system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The relationship between the client and the server is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services ("Virtual Private Server", or "VPS" for short). The server may also be a server of a distributed system, or a server combined with a blockchain.

[0123] It should be noted that artificial intelligence is a discipline that studies how computers can simulate certain human thought processes and intelligent behaviors (such as learning, reasoning, thinking, planning, etc.), and includes both hardware-level and software-level technologies. Artificial intelligence hardware technologies generally include technologies such as sensors, dedicated artificial intelligence chips, cloud computing, distributed storage, and big data processing; artificial intelligence software technologies mainly include computer vision technology, speech recognition technology, natural language processing technology, as well as machine learning / deep learning, big data processing technology, knowledge graph technology, and other major directions.

[0124] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps recorded in this disclosure can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solutions disclosed in this disclosure can be achieved, and this document does not limit this.

[0125] The above specific implementations do not constitute a limitation on the protection scope of the present disclosure. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present disclosure shall be included in the protection scope of the present disclosure.

Claims

1. A method for verifying program loading, characterized in that: include: After obtaining the code to be executed, calculating the target check value corresponding to the code to be executed; The code to be executed is a code that controls the execution of the receiving end of the code to be executed; After determining that the receiving end of the control code to be executed sends the first frame message, comparing the target check value with the reference check value; Based on the comparison result between the target check value and the reference check value, it is determined whether to allow the code to be executed to be executed at the receiving end.

2. The method according to claim 1, characterized in that The determining whether to allow the code to be executed to be executed at the receiving end based on the comparison result between the target check value and the reference check value includes: When it is determined that the target check value is consistent with the reference check value, controlling the receiving end to run the code to be run; When it is determined that the target check value is inconsistent with the reference check value, a prompt message indicating that a fault exists in the code to be run is output, and control is performed to enter a preset fault post-processing.

3. The method according to claim 1, characterized in that: The comparing the target check value with the reference check value comprises: Acquire the reference check value from an external storage unit of the chip; The target check value is compared with the reference check value.

4. The method according to claim 3, characterized in that Before acquiring the reference verification value from the external storage unit of the chip, the method includes: Calling a timer to count the time after the first frame message is successfully sent; The obtaining of the reference check value from the external storage unit of the chip comprises: After the time reaches a preset time threshold, the reference check value is obtained from the external storage unit.

5. The method according to claim 1, characterized in that The obtaining of the code to be executed includes: After the chip is powered on or reset, the code to be executed is obtained from an external storage unit of the chip; Transferring the code to be executed to a random access memory inside the chip; The calculating of the target check value corresponding to the code to be executed includes: A preset algorithm is called, and the target check value corresponding to the code to be run is calculated according to the starting address and the ending address of the code to be run in the random access memory.

6. A program loading verification system, characterized in that: include: A chip and an external storage unit, wherein the chip includes a security module; The external storage unit is used to store the code to be executed; The security module is used to obtain the code to be run from the random access memory inside the chip and calculate the target check value corresponding to the code to be run; the code to be run is the code that controls the execution of the receiving end of the code to be run; after the chip is powered on or reset, the code to be run is obtained from the external storage unit of the chip and the code to be run is moved to the random access memory inside the chip; The chip is used to control the receiving end of the code to be run to send a first frame message, and determine whether to allow the code to be run to be run at the receiving end according to the comparison result of the target check value output by the security module and the reference check value.

7. A program loading verification device, characterized in that: include: A calculation unit, configured to calculate a target check value corresponding to the code to be executed after obtaining the code to be executed; The code to be executed is a code that controls the execution of the receiving end of the code to be executed; A comparison unit, configured to compare the target check value with a reference check value after determining that the receiving end of the control code to be executed sends a first frame message; A determination unit is used to determine whether to allow the code to be executed to execute at the receiving end based on a comparison result between the target check value and the reference check value.

8. The device according to claim 7, characterized in that The determining unit comprises: When it is determined that the target check value is consistent with the reference check value, controlling the receiving end to run the code to be run; When it is determined that the target check value is inconsistent with the reference check value, a prompt message indicating that a fault exists in the code to be run is output, and control is performed to enter a preset fault post-processing.

9. The device according to claim 7, characterized in that The comparison unit comprises: An acquisition module, used for acquiring the reference check value from an external storage unit of the chip; A comparison module is used to compare the target verification value with the reference verification value.

10. The device according to claim 9, characterized in that The comparison unit comprises: A timing module, used for calling a timer to count the time after the first frame message is successfully sent before the acquisition module acquires the reference check value from the external storage unit of the chip; The acquisition module is further configured to acquire the reference verification value from the external storage unit after the time reaches a preset time threshold.

11. The device according to claim 7, characterized in that The computing unit comprises: An acquisition module, used for acquiring the code to be executed from the external storage unit of the chip after the chip is powered on or reset; A transport module, used for transporting the code to be executed to a random access memory inside the chip; The calculation module is used to call a preset algorithm and calculate the target check value corresponding to the code to be run according to the starting address and the ending address of the code to be run in the random access memory.

12. A vehicle, characterized in that: The vehicle includes a program-loaded verification system as claimed in claim 6; Or, the vehicle includes a program loading verification device as described in any one of claims 7-11.

13. An electronic device, characterized in that: include: at least one processor; as well as a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method according to any one of claims 1 to 5.

14. A non-transitory computer-readable storage medium storing computer instructions, characterized in that: The computer instructions are used to cause the computer to execute the method according to any one of claims 1-5.

Images