Important information safety redundancy backup method and software updating method based on important information safety redundancy backup method

Abstract

The invention discloses an important information security redundancy backup method and a software updating method based on the same, relates to the field of data backup and software updating, aims to solve the problem of high information security cost in the prior art, and adopts the technical scheme that when software updating is carried out, the data backup condition is verified, and when verification is carried out, the data backup condition is verified. After the seed parameters are read through the Dflash, a new seed is calculated through the seed parameters, the new seed is placed in the RAM area, and after reading, the seed parameters are initialized, data are backed up, and the APP is entered. According to the method, at least forty thousand times of seed random non-repetition can be achieved after the controller is reset or powered on and powered off again, and therefore safe redundant backup of data is achieved under the condition that an HSM algorithm library, an HSE algorithm library and a chip without a single core are not used, and data safety in the upgrading process is ensured.

Description

Technical Field

[0001] The present invention relates to the technical field of data backup and software update, and in particular to a method for secure redundant backup of important information and a software update method based on the method. Background Art

[0002] With the development of intelligent, networked and electrified vehicles, the status quo of software-defined vehicles is becoming increasingly prominent, and the high standards for vehicles are becoming increasingly stringent.

[0003] Under such high standards and high requirements, many OEMs and suppliers have put forward functional safety, information security, and redundant backup requirements for controllers to cope with the loss of functions caused by unexpected failures due to various complex working conditions, thereby ensuring the stability of the vehicle.

[0004] Bootloader dual partitions are a popular solution for dual-backup redundancy. To meet information security requirements, these chips require a separate core to run a library containing security algorithms and store important information. While this chip offers convenience, it also comes with increased costs. Summary of the Invention

[0005] The technical problem to be solved by the present invention is to overcome the existing defects and provide an important information security redundant backup method and a software update method based on the method, which can effectively solve the problems in the background technology.

[0006] In order to achieve the above object, the present invention first discloses a method for secure redundant backup of important information, the technical solution of which comprises the following steps: Step 1: After the Bootloader is powered on or reset, it initializes the chip peripherals. Step 2: When powered on and off for the first time, the Bootloader's Pflash reads the Dflash data backup flag to see if it is set. If not, it reads data from the APP's Pflash and stores the data and seed parameter initialization values ​​in Dflash, while setting the backup flag. Step 3, read the seed parameters from the seed area in Dflash; Step 4, calculate a new seed using the seed parameters; Step 5: Place the new seed obtained in step 4 into the RAM area and complete the unlocking. Step 6: Execute information change; information change can be data flashing, data modification, etc. Step 7: Update the information change content and / or the seed parameters obtained in step 4 to Dflash and set the backup flag. After completion, proceed to step 8. Step 8, exit the bootloader; Step 9, execute step 1 again, read the Dflash data, and determine whether the backup flag is set. If it is set, the backup is completed.

[0007] The seed parameter is used as the secret key to calculate a new seed, and the seed parameter is updated after each calculation. This ensures that the seed is random and non-repeated for at least 40,000 times after the controller is reset or powered on and off, thus ensuring the completeness of the current information.

[0008] As a preferred technical solution of the present invention, in step 4, the new seed is calculated using the AEC-128 algorithm.

[0009] As a preferred technical solution of the present invention, in step 5, after unlocking is completed, if the boot is jumped out or the S3sever time times out and exits the boot, the seed parameters are updated.

[0010] As a preferred technical solution of the present invention, step 6 is to execute the security access task, and after completion, the new seed obtained in step 4 is updated to Dflash when exiting boot. This operation can ensure that the backed up data is safe and reliable.

[0011] The present invention also discloses a software update method based on the above-mentioned secure redundant backup method, the technical solution adopted is to include the following steps: Step a: The compiler compiles important information into the APP's Pflash and generates a transmission file for transmission to the recipient; Step b: After receiving the transmission file, the receiver uploads it to the OTA cloud or downloads it to the local host computer. When the host computer performs an OTA upgrade from the OTA cloud or locally, it transmits the data flash package to the Bootloader and reprograms it; In step c, according to the important information security redundant backup method as described in claim 1, determine whether the data flash package transmitted in step b is backed up and written to Dflash. If the reprogramming flag is set to 1, then when executing step 6, wait for the data flash package in step b to be transmitted, perform signature verification, dependency check and integrity check on the data flash package to ensure the security of the transmitted data, and perform data flashing after all passes. When executing step 7, perform backup and write operations on the data after data flashing together with the new seed obtained in step 4; Step d: determine whether there is a re-rewrite request. If there is no re-rewrite request, determine whether the APP is valid. If valid, jump to the APP.

[0012] Based on the secure redundant backup method, data backup and seed updates can be performed in a timely manner each time the software is updated.

[0013] As a preferred technical solution of the present invention, in step c, after unlocking is completed in step 5, if the boot is jumped out or the S3sever time times out and exits the boot, step 6 is directly executed.

[0014] As a preferred technical solution of the present invention, in step c, when executing step 7, the Pflash of the Bootloader backs up the data in the corresponding address of the Pflash of the APP and the new seed of the RAM area in step 5 to the important data backup area of ​​​​Dflash.

[0015] As a preferred technical solution of the present invention, in step d, if the APP is found to be invalid after detection, a UDS flash is requested, and after flashing, the reprogramming flag is recharged, the software update process is reset, and the process returns to step b or step c.

[0016] Compared with the prior art, the present invention has the following advantages: by using the seed parameter as a secret key to calculate a new seed and updating the seed parameter after each calculation, the present invention can ensure that the seed is random and non-repeated for at least 40,000 times after the controller is reset or powered on and off, thereby achieving secure redundant backup of data without using an HSM or HSE algorithm library and without a separate core chip, thereby ensuring data security during the upgrade process.

[0017] Furthermore, during the software update process, the backup status is checked so that the stored data can be updated as the software is updated, and the data is stored in the backup area of ​​DFlash, so that data will not be lost due to flash failure or interruption. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Figure 1 This is a flowchart of the software update of the present invention; Figure 2 This is a basic data backup flow chart of the present invention; Figure 3 This is a flowchart of seed acquisition for the present invention. DETAILED DESCRIPTION

[0019] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention. Example 1

[0020] like Figures 1 to 3 As shown, this embodiment discloses a software update method, which adopts a technical solution including the following steps: Step 1: The compiler compiles the software update data into the APP's Pflash and generates a transfer file to send to the client; Step 2: After receiving the transfer file, the customer uploads it to the OTA cloud. The host computer performs an OTA upgrade from the OTA cloud. At the same time, the Bootloader powers on and initializes the chip peripherals. During the first power-on and power-off, the Bootloader's Pflash reads the Dflash data backup flag to see if it is set. If not, the Bootloader reads data from the APP's Pflash and stores the data and seed parameter initialization values ​​in Dflash, setting the backup flag. Step 3: After step 2 is fully executed, the host computer transmits the data flash package to the Bootloader and APP and reprograms; Step 4: Bootloader's Pflash reads the seed parameters from the seed area in Dflash. Step 5: Use the seed parameter as the secret key and calculate a new seed using the AEC-128 algorithm; Step 6: Place the new seed obtained in step 5 into the RAM area and complete the unlocking. Step 7: Bootloader's Pflash reads the backup storage flag in Dflash to check whether data backup has been performed. If the backup storage flag is set to 1, proceed to steps 8 and 9. If the backup storage flag is not set to 1, proceed to step 10. Step 8: After confirming that the data flash package in step 3 has been transmitted, the data is signed to verify its security, and data dependency check and integrity check are performed. After all passes, the data is flashed; Step 9: The Bootloader's Pflash copies the data transmitted by the host computer to the data area of ​​the APP's Pflash to update the data, and then backs up the data to the important data backup area of ​​the Dflash. After the data update and backup are completed, proceed to step 10. Step 10: Initialize the seed parameters and exit the bootloader. Step 11: Reset the bootloader, initialize the chip peripherals, read the Dflash data, and determine whether the backup flag is set. If so, exit this function and determine whether there is a re-flash request. If not, proceed to step 12. If not, read data from the APP's Pflash and store the data and seed parameter initialization values ​​in Dflash. At the same time, set the backup flag and determine whether there is a re-flash request. If not, proceed to step 12. Step 12: Check the current APP to see if it is valid. If it is valid, jump to the APP to complete the upgrade. If it is invalid, proceed to step 13. Step 13: Request UDS flashing of the APP, recharge the reprogramming flag after flashing, reset the software update process, and return to step 4.

[0021] As a preferred technical solution of the present invention, in step 6, after unlocking is completed, if the boot is jumped out or the S3sever time times out and exits the boot, step 8 is directly executed. Example 2

[0022] This embodiment discloses a data security access method, which adopts a technical solution including the following steps: Step 1: The Bootloader is powered on and the chip peripherals are initialized. During the first power cycle, the Bootloader's Pflash reads the Dflash data backup flag to see if it is set. If not, the Bootloader reads data from the APP's Pflash data area and stores the data and seed parameter initialization values ​​in Dflash, while setting the backup flag. Step 2: Bootloader's Pflash reads the seed parameters from the seed area in Dflash. Step 5: Use the seed parameter as the secret key and calculate a new seed using the AEC-128 algorithm; Step 6: Place the new seed obtained in step 5 into the RAM area and complete the unlocking. Step 7: Access data securely; Step 8: Initialize the seed parameters and exit the bootloader. Step 11: The bootloader resets, executes chip peripheral initialization, reads Dflash data, and determines whether the backup flag is set. If it is, it exits this function and ends the access. If it is not, it reads data from the APP's Pflash and stores the data and seed parameter initialization values ​​in Dflash. At the same time, it sets the backup flag and ends the access.

[0023] As a preferred technical solution of the present invention, in step 6, after unlocking is completed, if the boot is jumped out or the S3sever time times out and exits the boot, step 8 is directly executed.

[0024] In the present invention, calculating a new seed according to seed parameters using the AEC-128 algorithm is a prior art.

[0025] While embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions, and variations may be made to these embodiments without departing from the principles and spirit of the invention, and that the scope of the invention is defined by the appended claims and their equivalents.

Claims

1. A method for safe redundant backup of important information, characterized in that: The following steps are involved: Step 1: After the Bootloader is powered on or reset, it initializes the chip peripherals. Step 2: When powered on and off for the first time, the Bootloader's Pflash reads the Dflash data backup flag to see if it is set. If not, it reads data from the APP's Pflash and stores the data and seed parameter initialization values ​​in Dflash, while setting the backup flag. Step 3, read the seed parameters from the seed area in Dflash; Step 4, calculate a new seed using the seed parameters; Step 5: Place the new seed obtained in step 4 into the RAM area and complete the unlocking. Step 6: Execute information changes; Step 7: Update the information change content and / or the seed parameters obtained in step 4 to Dflash and set the backup flag; After completion, proceed to step 8; Step 8, exit the bootloader; Step 9, execute step 1 again, read the Dflash data, and determine whether the backup flag is set. If it is set, the backup is completed.

2. The important information security redundant backup method according to claim 1, characterized in that: In step 3, a new seed is calculated using the AEC-128 algorithm.

3. The important information security redundant backup method according to claim 1, characterized in that: In step 5, after unlocking is completed, if the boot is exited or the S3sever time times out and the boot is exited, the seed parameters are updated.

4. The important information security redundant backup method according to claim 1, characterized in that: Step 6 is to execute the security access task. After the task is completed, the new seed obtained in step 4 is updated to Dflash when exiting boot.

5. A software updating method, characterized in that: The steps include: Step a: The compiler compiles important information into the APP's Pflash and generates a transmission file for the recipient; Step b: After receiving the transmission file, the receiver uploads it to the OTA cloud or downloads it to the local host computer. When the host computer performs an OTA upgrade from the OTA cloud or locally, it transmits the data flash package to the Bootloader and reprograms it; In step c, according to the important information security redundant backup method as described in claim 1, determine whether the data flash package transmitted in step b is backed up and written to Dflash. If the reprogramming flag is set to 1, then when executing step 6, wait for the data flash package in step b to be transmitted, perform signature verification, dependency check, and integrity check on the data flash package, and perform data flashing after all pass. When executing step 7, perform backup and write operations on the data after data flashing together with the new seed obtained in step 4; Step d: determine whether there is a re-rewrite request. If there is no re-rewrite request, determine whether the APP is valid. If valid, jump to the APP.

6. The software updating method according to claim 5, wherein: In step c, after unlocking is completed in step 5, if the boot is exited or the S3sever time times out and the boot is exited, step 6 is directly executed.

7. The software updating method according to claim 5, wherein: In the step c, when executing step 7, the Pflash of the Bootloader backs up the data in the corresponding address of the Pflash of the APP and the new seed of the RAM area in step 5 to the important data backup area of ​​​​Dflash.

8. The software updating method according to claim 5, wherein: In the step d, if the APP is found to be invalid after detection, a UDS flash is requested, and after the flash, the reprogramming flag is reset, the software update process is reset, and the process returns to step b or step c.

Images