Refreshing and upgrading method and system for vehicle-mounted controller

Abstract

The invention provides a refreshing and upgrading method and system for a vehicle-mounted controller, and the method comprises the steps: selecting a corresponding authentication mode according to a recognized upgrading mode when an upgrading instruction is received, and carrying out the identity verification with the connected vehicle-mounted controller according to the selected authentication mode; when the identity verification is successful, transmitting a pre-generated encrypted upgrade package to the vehicle-mounted controller, and performing integrity verification on the encrypted upgrade package; when the integrity verification is passed, the vehicle-mounted controller decrypts the received encrypted upgrade package, and if decryption succeeds, signature information is obtained and authenticated; and when the authentication is successful, comparing the obtained version information of the encrypted upgrade package with the operation version information of the vehicle-mounted controller, and determining whether to start refreshing and upgrading according to a comparison result. According to the method, software can be prevented from being broken during refreshing through multi-layer authentication, potential safety hazards existing in vehicle operation are avoided, it is guaranteed that the upgrade package can be safely and reliably transmitted to the controller, and a safe refreshing mechanism is protected.

Description

Technical Field

[0001] The present invention relates to the technical field of vehicle information security, and particularly to a method and system for refreshing and upgrading an in-vehicle controller. Background Art

[0002] With the development of science and technology, the intelligence of automobiles has been continuously improved, and the security of controllers in automobiles also needs to be further strengthened. Once attacked maliciously or invaded by hackers, it will bring property losses and life risks to people. At present, vehicle information security in the automotive field is still in the development stage, and the refresh and upgrade of controllers are not yet perfect. In order to prevent illegal online or offline refresh and upgrade of controllers and tamper with programs.

[0003] The current existing secure refresh solution is that after refreshing, reset and start Boot, and judge whether the upgrade package meets the requirements by checking the information defined in the header file. The judged content includes information such as node id, Ecu name, Ecu id, etc. After passing, run the application program; however, the upgrade package is not encrypted and signed. Although it can avoid inconsistent version information of the upgrade package, the data of the upgrade package can be tampered with at will, it can be easily broken, and secure refresh cannot be guaranteed. Moreover, once the verification fails, the controller will not be able to run the application program. Or the current existing secure refresh solution performs signature and verification of the upgrade package, as well as the update of the private key; however, the public key can be modified, there is a possibility of being tampered with, and the upgrade package is not encrypted, it is easy to view the original data, thus modifying the data, and the solution does not describe the verification process in detail. Summary of the Invention

[0004] The purpose of the present invention is to provide a method and system for refreshing and upgrading an in-vehicle controller, and solve the technical problem of how to implement a secure software refresh mechanism and improve the safety and reliability of vehicles.

[0005] On the one hand, a method for refreshing and upgrading an in-vehicle controller is provided, including:

[0006] When receiving an upgrade instruction, select a corresponding authentication method according to the identified upgrade method, and perform identity verification with the connected in-vehicle controller according to the selected authentication method; wherein, the upgrade method at least includes local upgrade or OTA server upgrade;

[0007] When the identity verification is successful, transmit a pre-generated encrypted upgrade package to the in-vehicle controller, and perform integrity verification on the encrypted upgrade package;

[0008] When passing the integrity verification, the in-vehicle controller decrypts the received encrypted upgrade package. If the decryption is successful, obtain the corresponding signature information and authenticate the signature information;

[0009] When the signature information authentication is successful, compare the obtained encrypted upgrade package version information with the running version information of the vehicle-mounted controller, and determine whether to start the refresh upgrade according to the comparison result.

[0010] Preferably, it further includes: before the refresh upgrade, generate corresponding public and private keys through a preset system, and set a unique public and private key for each type of vehicle-mounted controller;

[0011] When the vehicle-mounted controller is initialized, write the public key into the vehicle-mounted controller and set that it cannot be modified after the public key is written.

[0012] Preferably, it further includes generating an encrypted upgrade package through the following steps:

[0013] Determine the Hash value of the software upgrade package, and use the private key and this Hash value as parameters to determine the corresponding signature information through a preset signature algorithm;

[0014] Concatenate the signature information behind the data of the software upgrade package to generate a signed upgrade package;

[0015] Encrypt the signed upgrade package through a preset encryption algorithm to generate an encrypted upgrade package.

[0016] Preferably, the identity verification with the connected vehicle-mounted controller according to the selected authentication method includes:

[0017] When the authentication method is local upgrade, the host computer calculates the corresponding secret key through a preset encryption algorithm according to the random number received from the vehicle-mounted controller; and compare this secret key with the secret key set in the vehicle-mounted controller. If the two are consistent, it is determined that the identity verification is successful. If they are inconsistent, it is determined that the identity verification fails and the upgrade is exited;

[0018] When the authentication method is OTA server upgrade, authenticate the public key of the vehicle-mounted controller through PKI. If the authentication is passed, it is determined that the identity verification is successful. If the authentication fails, it is determined that the identity verification fails and the upgrade is exited.

[0019] Preferably, the integrity verification of the encrypted upgrade package includes:

[0020] Compare the file CRC checksum with the CRC checksum corresponding to the encrypted upgrade package calculated by the vehicle-mounted controller through a preset program. If the two are consistent, it is determined that the integrity verification is passed. If they are inconsistent, it is determined that the integrity verification fails and the upgrade is exited.

[0021] Preferably, it further includes:

[0022] Decrypt the encrypted upgrade package through a preset RSA algorithm. If the decryption fails, exit the upgrade.

[0023] Preferably, the authentication of the signature information includes:

[0024] Taking the signature information and the public key as parameters, calculating a Hash value through a preset algorithm;

[0025] Comparing the calculated Hash value with the Hash value in the encrypted upgrade package. If the two are consistent, the signature information authentication is successful; if the two are inconsistent, the signature information authentication fails and the upgrade exits.

[0026] Preferably, determining whether to start refreshing and upgrading according to the comparison result includes:

[0027] If the version of the encrypted upgrade package version information is higher than the version of the running version information of the vehicle-mounted controller, it is determined to start refreshing and upgrading;

[0028] If the version of the encrypted upgrade package version information is not higher than the version of the running version information of the vehicle-mounted controller, it is determined not to start refreshing and upgrading.

[0029] Preferably, determining whether to start refreshing and upgrading according to the comparison result further includes:

[0030] If the controller type of the encrypted upgrade package version information is the same as the controller type of the running version information of the vehicle-mounted controller, it is determined to start refreshing and upgrading;

[0031] If the controller type of the encrypted upgrade package version information is different from the controller type of the running version information of the vehicle-mounted controller, it is determined not to start refreshing and upgrading.

[0032] On the other hand, a refreshing and upgrading system for a vehicle-mounted controller is also provided to implement the refreshing and upgrading method for the vehicle-mounted controller, including:

[0033] An upgrade control terminal, configured to, when receiving an upgrade instruction, select a corresponding authentication method according to the identified upgrade method, and perform identity verification with the connected vehicle-mounted controller according to the selected authentication method; wherein, the upgrade method at least includes local upgrade or OTA server upgrade;

[0034] When the identity verification is successful, transmit a pre-generated encrypted upgrade package to the vehicle-mounted controller and perform integrity verification on the encrypted upgrade package;

[0035] A vehicle-mounted controller, configured to, when passing the integrity verification, decrypt the received encrypted upgrade package. If the decryption is successful, obtain the corresponding signature information and authenticate the signature information;

[0036] The upgrade control terminal is further configured to, when the signature information authentication is successful, compare the obtained encrypted upgrade package version information with the running version information of the vehicle-mounted controller, and determine whether to start the refresh upgrade according to the comparison result.

[0037] In summary, implementing the embodiments of the present invention has the following beneficial effects:

[0038] The refresh upgrade method and system for a vehicle-mounted controller provided by the present invention achieve five-layer security refresh protection through pre-file transfer security authentication, data integrity verification during the file transfer process, signature verification and decryption of the upgrade package, and subsequent verification of the upgrade package version information, ensuring that the upgrade package can be safely and reliably transmitted to the controller and protecting the security refresh mechanism. It can prevent being breached during software refreshing through multiple-layer authentication, avoid potential safety hazards in vehicle operation, and prevent improper official operations such as using upgrade packages of other controllers or low-version upgrade packages to refresh and upgrade the controller. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] In order to more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the following will briefly introduce the drawings required for the description of the embodiments or the prior art. Obviously, the drawings in the following description are only some embodiments of the present invention. For those of ordinary skill in the art, without creative efforts, obtaining other drawings based on these drawings still belongs to the scope of the present invention.

[0040] Figure 1 It is a schematic diagram of the main process of a refresh upgrade method for a vehicle-mounted controller in an embodiment of the present invention.

[0041] Figure 2 It is a schematic diagram of the logic of a refresh upgrade method for a vehicle-mounted controller in an embodiment of the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0042] To make the objectives, technical solutions, and advantages of the present invention clearer, the present invention will be further described in detail below with reference to the drawings.

[0043] As Figure 1 and Figure 2 shown, it is a schematic diagram of an embodiment of a refresh upgrade method for a vehicle-mounted controller provided by the present invention. In this embodiment, the method includes the following steps:

[0044] Step S1: When an upgrade instruction is received, select a corresponding authentication method according to the identified upgrade method, and perform identity authentication with the connected vehicle-mounted controller according to the selected authentication method. Among them, the upgrade method includes at least local upgrade or OTA server upgrade. That is, when the local or OTA server wants to refresh and upgrade the controller, first perform security authentication through the AES-128-CMAC algorithm.

[0045] In one embodiment, before performing the upgrade operation, it is necessary to generate public and private keys and synthesize the upgrade package. Specifically, before refreshing the upgrade, generate the corresponding public and private keys through a preset system, and set a unique public and private key for each type of vehicle-mounted controller. When the vehicle-mounted controller is initialized, write the public key into the vehicle-mounted controller and set that the public key cannot be modified after being written. Generate RSA2048 public and private keys through the KMS system, and each controller has a unique public and private key. When the controller is initialized, write the public key driver into the controller, and after the public key is written, it cannot be modified. For different controller types, calculate the corresponding public and private keys.

[0046] In a specific embodiment, generate the encrypted upgrade package through the following steps: determine the Hash value of the software upgrade package, and use the private key and the Hash value as parameters to determine the corresponding signature information through a preset signature algorithm; splice the signature information behind the data of the software upgrade package to generate a signed upgrade package; encrypt the signed upgrade package through a preset encryption algorithm to generate an encrypted upgrade package. This process is to calculate the Hash value of the software upgrade package, use the private key and the Hash value as parameters, calculate the signature through the HMAC algorithm; splice the signature information behind the original upgrade package data to form a signed upgrade package; encrypt the data of the signed upgrade package through the RSA algorithm encryption to form an encrypted upgrade package.

[0047] An embodiment, the authentication with the connected vehicle-mounted controller according to the selected authentication method includes: when the authentication method is local upgrade, the host computer calculates the corresponding secret key through a preset encryption algorithm according to the received random number from the vehicle-mounted controller (used as the random number for AES-128-CMAC security authentication); and compares the secret key with the secret key set in the vehicle-mounted controller. If the two are the same, it is determined that the authentication is successful. If they are different, it is determined that the authentication fails and the upgrade exits; when the authentication method is OTA server upgrade, the public key of the vehicle-mounted controller is authenticated through PKI. If the authentication passes, it is determined that the authentication is successful. If the authentication fails, it is determined that the authentication fails and the upgrade exits. It can be understood that, if it is a local refresh, the controller sends a random number to the host computer, and the host computer calculates the secret key through the AES-128-CMAC algorithm and then transmits it to the controller. The controller calculates the secret key through the same algorithm. If they are the same, it passes; if it is an OTA server, the controller connects to the OTA server and passes the PKI authentication. After passing, it enters the next step. If it fails, the upgrade exits.

[0048] Step S2, when the authentication is successful, transmit the pre-generated encrypted upgrade package to the vehicle-mounted controller and perform integrity verification on the encrypted upgrade package; equivalently, the local or OTA server transmits the encrypted upgrade package to the controller, and then performs integrity verification on the transmitted file. The CRC checksum transmitted by the local or OTA server and the CRC checksum calculated by the controller itself are used to check the integrity of the data transmission.

[0049] An embodiment, the integrity verification of the encrypted upgrade package includes: comparing the file CRC checksum with the CRC checksum corresponding to the encrypted upgrade package calculated by the vehicle-mounted controller through a preset program. If the two are the same, it is determined that the integrity verification passes. If the two are different, it is determined that the integrity verification fails and the upgrade exits. Send the file CRC checksum to the controller, and the controller calculates the CRC checksum through the upgrade package data. If the two are the same, it enters the next step. If it fails, the upgrade exits.

[0050] Step S3, when the integrity verification passes, the vehicle-mounted controller decrypts the received encrypted upgrade package. If the decryption is successful, obtain the corresponding signature information and authenticate the signature information; specifically, decrypt the encrypted upgrade package through a preset RSA algorithm. If the decryption is successful, proceed to the next step. If the decryption fails, the upgrade exits. Among them, for the signature information, public key, and Hash value calculated from the upgrade package data, use the signature information and public key as parameters, calculate the Hash value through the HMAC algorithm, and compare it with the Hash value of the upgrade package to determine whether the signature verification is correct.

[0051] In one embodiment, the authentication of the signature information includes: using the signature information and the public key as parameters, calculating a Hash value through a preset algorithm; comparing the calculated Hash value with the Hash value in the encrypted upgrade package. If the two are consistent, the signature information authentication is successful. If the two are inconsistent, the signature information authentication fails and the upgrade exits. The controller obtains the decrypted upgraded signature information, uses the signature information and the public key as parameters, calculates a Hash value through the HMAC algorithm, and checks it against the Hash value of the upgrade package. If they are consistent, the signature authentication is successful and the process proceeds to the next step. If it fails, the upgrade exits.

[0052] Step S4, when the signature information authentication is successful, compare the obtained encrypted upgrade package version information with the operating version information of the vehicle-mounted controller, and determine whether to start the refresh upgrade according to the comparison result. The controller obtains the upgrade package version information and compares it with its own operating version information.

[0053] In one embodiment, determining whether to start the refresh upgrade according to the comparison result includes: if the version of the encrypted upgrade package version information is higher than the version of the operating version information of the vehicle-mounted controller, determine to start the refresh upgrade; if the version of the encrypted upgrade package version information is not higher than the version of the operating version information of the vehicle-mounted controller, determine not to start the refresh upgrade. If the version is increased, that is, a non-downgrade version upgrade, proceed to the next next step. If it fails, the upgrade exits.

[0054] In a specific embodiment, if the controller type of the encrypted upgrade package version information is the same as the controller type of the operating version information of the vehicle-mounted controller, determine to start the refresh upgrade; if the controller type of the encrypted upgrade package version information is different from the controller type of the operating version information of the vehicle-mounted controller, determine not to start the refresh upgrade. If the controller types are the same, start the upgrade. If it fails, the upgrade exits.

[0055] An embodiment of the present invention further provides a refresh upgrade system for a vehicle-mounted controller to implement the refresh upgrade method for the vehicle-mounted controller, including:

[0056] An upgrade control terminal, configured to, when receiving an upgrade instruction, select a corresponding authentication method according to the identified upgrade method, and perform identity verification with the connected vehicle-mounted controller according to the selected authentication method; wherein, the upgrade method at least includes local upgrade or OTA server upgrade;

[0057] When the identity verification is successful, transmit a pre-generated encrypted upgrade package to the vehicle-mounted controller and perform integrity verification on the encrypted upgrade package;

[0058] A vehicle-mounted controller, configured to, when the integrity verification is passed, decrypt the received encrypted upgrade package. If the decryption is successful, obtain the corresponding signature information and authenticate the signature information;

[0059] The upgrade control terminal is further configured to, when the signature information authentication is successful, compare the obtained encrypted upgrade package version information with the running version information of the vehicle-mounted controller, and determine whether to start the refresh upgrade according to the comparison result.

[0060] It should be noted that the system described in the above embodiment corresponds to the method described in the above embodiment. Therefore, the parts not described in detail in the system described in the above embodiment can be obtained by referring to the content of the method described in the above embodiment, and will not be elaborated here.

[0061] In summary, implementing the embodiments of the present invention has the following beneficial effects:

[0062] The method and system for refreshing and upgrading the vehicle-mounted controller provided by the present invention provide five-layer security refresh protection through pre-file-transfer security authentication, data integrity verification during the file transfer process, signature verification and decryption of the upgrade package, and subsequent verification of the upgrade package version information, ensuring that the upgrade package can be safely and reliably transmitted to the controller and protecting the security refresh mechanism. It can prevent being breached during software refreshing through multiple-layer authentication, avoid potential safety hazards in vehicle operation, and prevent improper official operations such as using upgrade packages of other controllers or low-version upgrade packages to refresh and upgrade the controller.

[0063] The above-disclosed are only the preferred embodiments of the present invention. Of course, the scope of the rights of the present invention cannot be limited thereby. Therefore, equivalent changes made according to the claims of the present invention still fall within the scope covered by the present invention.

Claims

1. A method for refreshing and upgrading a vehicle-mounted controller, characterized in that, Including: When receiving an upgrade instruction, select a corresponding authentication method according to the identified upgrade method, and perform identity verification with the connected vehicle-mounted controller according to the selected authentication method; wherein, the upgrade method at least includes local upgrade or OTA server upgrade; When the identity verification is successful, transmit a pre-generated encrypted upgrade package to the vehicle-mounted controller and perform integrity verification on the encrypted upgrade package; When the integrity verification is passed, the vehicle-mounted controller decrypts the received encrypted upgrade package. If the decryption is successful, obtain the corresponding signature information and authenticate the signature information; When the signature information authentication is successful, compare the obtained encrypted upgrade package version information with the running version information of the vehicle-mounted controller, and determine whether to start the refresh upgrade according to the comparison result.

2. The method according to claim 1, wherein Also including: Before the refresh upgrade, generate corresponding public and private keys through a preset system, and set a unique public and private key for each type of vehicle-mounted controller; When the vehicle-mounted controller is initialized, write the public key into the vehicle-mounted controller and set that the public key cannot be modified after being written.

3. The method according to claim 2, characterized in that, Also including, generating an encrypted upgrade package through the following steps: Determine the Hash value of the software upgrade package, and use the private key and this Hash value as parameters to determine the corresponding signature information through a preset signature algorithm; Concatenate the signature information behind the data of the software upgrade package to generate a signed upgrade package; Encrypt the signed upgrade package through a preset encryption algorithm to generate an encrypted upgrade package.

4. The method according to claim 3, wherein The performing identity verification with the connected vehicle-mounted controller according to the selected authentication method includes: When the authentication method is local upgrade, the host computer calculates the corresponding secret key through a preset encryption algorithm according to the random number received from the vehicle-mounted controller; and compare this secret key with the secret key set in the vehicle-mounted controller. If the two are the same, it is determined that the identity verification is successful. If they are different, it is determined that the identity verification fails and the upgrade exits; When the authentication method is OTA server upgrade, authenticate the public key of the vehicle-mounted controller through PKI. If the authentication passes, it is determined that the identity verification is successful. If the authentication fails, it is determined that the identity verification fails and the upgrade exits.

5. The method according to claim 4, wherein The performing integrity verification on the encrypted upgrade package includes: Compare the file CRC checksum with the CRC checksum corresponding to the encrypted upgrade package calculated by the vehicle-mounted controller through a preset program. If the two are the same, it is determined that the integrity verification is passed. If the two are different, it is determined that the integrity verification fails and the upgrade exits.

6. The method according to claim 5, characterized in that, Also including: Decrypt the encrypted upgrade package through a preset RSA algorithm. If the decryption fails, exit the upgrade.

7. The method according to claim 6, characterized in that, The authenticating the signature information includes: Use the signature information and the public key as parameters to calculate the Hash value through a preset algorithm; Compare the calculated Hash value with the Hash value in the encrypted upgrade package. If the two are the same, the signature information authentication is successful. If the two are different, the signature information authentication fails and the upgrade exits.

8. The method according to claim 7, wherein The determining whether to start the refresh upgrade according to the comparison result includes: If the version of the encrypted upgrade package version information is higher than the version of the running version information of the vehicle-mounted controller, determine to start the refresh upgrade; If the version of the encrypted upgrade package version information is not higher than the version of the operating version information of the vehicle-mounted controller, it is determined not to start the refresh upgrade.

9. The method according to claim 8, wherein The determination of whether to start the refresh upgrade according to the comparison result further includes: If the controller type of the encrypted upgrade package version information is the same as the controller type of the operating version information of the vehicle-mounted controller, it is determined to start the refresh upgrade; If the controller type of the encrypted upgrade package version information is different from the controller type of the operating version information of the vehicle-mounted controller, it is determined not to start the refresh upgrade.

10. A refreshing and upgrading system for a vehicle-mounted controller, used to implement the method described in any one of claims 1-9, characterized in that, It includes: An upgrade control terminal, which is used to select a corresponding authentication method according to the identified upgrade method when receiving an upgrade instruction, and perform identity verification with the connected vehicle-mounted controller according to the selected authentication method; wherein, the upgrade method at least includes local upgrade or OTA server upgrade; When the identity verification is successful, transmit the pre-generated encrypted upgrade package to the vehicle-mounted controller and perform integrity verification on the encrypted upgrade package; A vehicle-mounted controller, which is used to decrypt the received encrypted upgrade package when the integrity verification is passed, and if the decryption is successful, obtain the corresponding signature information and authenticate the signature information; The upgrade control terminal is further used to compare the obtained encrypted upgrade package version information with the operating version information of the vehicle-mounted controller when the signature information authentication is successful, and determine whether to start the refresh upgrade according to the comparison result.

Images