Safe starting method and device of controller, electronic equipment and medium

Abstract

The invention provides a safe starting method and device for a controller, electronic equipment and a medium, and the method comprises the following steps: after starting running software in a software partition corresponding to a first partition, executing software upgrading and flashing in a software partition corresponding to a second partition; after software upgrading and flashing are successful, authentication data updating is executed in the second partition; the controller executes resetting and restarting after performing partition switching operation, and identifies the current software partition after resetting and restarting; if the partition is the software partition corresponding to the first partition, partition switching fails; and if the partition is the second partition, the partition switching is successful. After software is started and operated in one partition, software upgrading and flashing are executed in the other partition, authentication data before software upgrading are stored in the first partition, authentication data after software upgrading are stored in the second partition, and no matter whether partition conversion succeeds or not, safe starting of the software can be guaranteed.

Description

Technical Field

[0001] The present invention belongs to the technical field of software upgrade, and in particular relates to a controller secure startup method, device, electronic equipment and medium. Background Art

[0002] As the performance and resources of in-vehicle controllers like MCUs improve, two independent, switchable partitions enable over-the-air downloads and seamless flashing. At any given moment, only one partition is active, responsible for normal system operation, while the other is inactive and available for software upgrades, enabling seamless and frictionless software upgrades.

[0003] The secure boot solution verifies the integrity of the software through an encryption algorithm. When the software is last upgraded, a CMAC value is pre-calculated and stored using the encryption algorithm. When the software is started, another CMAC value is calculated based on the currently running software using the same encryption algorithm. The two CMAC values ​​are compared, and a secure boot is performed only if they are the same.

[0004] However, in the case of two independent and switchable partitions, the software runs in one partition and is upgraded in another partition. If the partition switching fails, the CMAC value of the partition running the software before the upgrade will be compared with the CMAC value of the partition running the software after the upgrade, resulting in a secure boot failure. Summary of the Invention

[0005] The purpose of the present invention is to provide a controller security startup method and system, which solves the problem in the related art that two sets of independent and mutually switchable partitions easily lead to security startup failure.

[0006] To this end, in a first aspect, the present invention provides a controller secure boot method, wherein the memory of the controller is divided into two identical partitions, including a first partition and a second partition, wherein the first partition is used to store software authentication data before the upgrade, and the second partition is used to store software authentication data after the upgrade, comprising the following steps:

[0007] After the software partition corresponding to the first partition starts running the software, the software partition corresponding to the second partition performs software upgrade and flashing;

[0008] After the software upgrade is successfully written, the authentication data is updated in the second partition;

[0009] After the controller performs a partition switching operation, it performs a reset and restart, and identifies the current software partition after the reset and restart;

[0010] If it is the software partition corresponding to the first partition, the partition switching fails, the authentication data of the first partition is used for authentication, and the software of the first partition is started after the authentication is passed; if it is the second partition, the partition switching is successful, the updated authentication data of the second partition is used for authentication, and the upgraded software of the second partition is started after the authentication is passed.

[0011] Optionally, after the first partition starts running the software, performing software upgrade and flashing in the second partition includes:

[0012] The first partition stores authentication data of the software according to the software identifier of the software in the software partition corresponding to the first partition.

[0013] Optionally, after the software upgrade is successfully flashed, performing authentication data update in the second partition includes:

[0014] The authentication data of the software in the software partition corresponding to the second partition is calculated by an authentication data encryption algorithm, and the authentication data after the software upgrade is updated in the second partition according to the software identifier of the software in the software partition corresponding to the second partition.

[0015] Optionally, the controller performs a reset and restart after performing the partition switching operation, and identifies the current partition after the reset and restart, including:

[0016] After performing the partition switching operation, the controller is reset and restarted to identify and determine whether the current partition after the controller is reset and restarted is the software partition corresponding to the first partition or the software partition corresponding to the second partition. If it is the software partition corresponding to the first partition, the partition switching operation is judged to have failed; if it is the software partition corresponding to the second partition, the partition switching operation is judged to have succeeded.

[0017] Optionally, if the partition is the first partition, the partition switching fails, authenticating the authentication data of the first partition, and starting the software of the first partition after the authentication passes includes:

[0018] If it is the software partition corresponding to the first partition, the authentication data of the software in the first partition after the controller is reset and restarted is calculated using the authentication data encryption algorithm, and compared and verified with the authentication data stored in the first partition after the controller is reset and restarted. After the verification is consistent, the software is securely started.

[0019] Optionally, if the partition is the second partition, the partition switching is successful, authenticating the updated authentication data of the second partition, and starting the upgraded software of the second partition after the authentication is passed includes:

[0020] If it is the software partition corresponding to the second partition, the authentication data of the software in the second partition after the controller is reset and restarted is calculated using the authentication data encryption algorithm, and compared and verified with the authentication data stored in the second partition after the controller is reset and restarted. After the verification is consistent, the software is securely started.

[0021] In a second aspect, a controller secure boot device is provided, wherein the memory of the controller is divided into two identical partitions including a first partition and a second partition, wherein the first partition is used for software startup and the second partition is used for software upgrade;

[0022] It also includes: a software startup module, which is used to guide the software to start running in the software partition corresponding to the first partition;

[0023] A software flashing module, used for performing software upgrade flashing in the software partition corresponding to the second partition;

[0024] An authentication data update module, configured to update the authentication data in the second partition after the software upgrade is successfully completed;

[0025] The partition switching judgment module is used to reset and restart the controller after the controller performs a software partition switching operation, and identify and judge the current software partition of the controller after the controller is reset and restarted;

[0026] The verification module is used to verify the authentication data of the software in the current software partition after the controller is reset and restarted, and start the software.

[0027] Optionally, each of the partitions includes a software identifier storage area and an authentication data storage area, the software identifier storage area is used to store the software identifier of the software, and the authentication data storage area is used to store the authentication data of the software.

[0028] In a third aspect, an electronic device, a memory, and a processor are provided;

[0029] The memory stores computer-executable instructions;

[0030] The processor executes the computer-executable instructions stored in the memory, so that the processor performs the method described above.

[0031] In a fourth aspect, a computer-readable storage medium is provided, on which a computer program is stored. The program is executed by a processor to implement the controller software upgrade method.

[0032] Beneficial effects:

[0033] The present disclosure provides a controller security startup method, device, electronic device and medium, which starts running software in the software partition corresponding to the first partition and then performs software upgrade and flashing in the software partition corresponding to the second partition. The first partition stores authentication data before the software upgrade, and the second partition stores authentication data after the software upgrade. After converting the software partition, it is determined whether the conversion is successful. If the conversion is successful, the authentication data of the upgraded software is compared with the authentication data stored in the second partition. If the conversion fails, the authentication data of the software before the upgrade is compared with the authentication data stored in the first partition. Regardless of whether the partition conversion is successful, the software can be safely started, and only one verification is required for the activated partition, which simplifies the verification process.

[0034] It should be understood that the content described in this section is not intended to identify the key or important features of the embodiments of the present invention, nor is it intended to limit the scope of the present invention. Other features of the present invention will become readily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0036] Figure 1 This is a method flow chart of an embodiment of a controller security startup method in the present disclosure;

[0037] Figure 2 This is a flow chart of an implementation of an embodiment of a controller secure startup method in the present disclosure;

[0038] Figure 3 This is a flow chart of another embodiment of a controller secure startup method in the present disclosure;

[0039] Figure 4 This is a system structure diagram of an embodiment of a controller safety startup device in the present disclosure;

[0040] Figure 5 A system structure diagram of an embodiment of an electronic device in the present disclosure

[0041] In the figure, 101 is a software startup module, 102 is a software flashing module, 103 is an authentication data updating module, 104 is a partition switching judgment module, 105 is a verification module, 200 is an electronic device, 201 is a processor, 202 is a memory, 203 is a communication component, and 204 is a bus. DETAILED DESCRIPTION

[0042] To make the objectives, technical solutions, and advantages of this application more clear, the technical solutions in this application will be clearly and completely described below in conjunction with the accompanying drawings. Obviously, the embodiments described are only part of the embodiments of this application, not all of them. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0043] In the specification and claims of this application, as well as in the accompanying drawings, the terms "first," "second," "third," "fourth," and the like are used to distinguish similar objects and are not necessarily used to describe a particular order or precedence. It should be understood that such terms are interchangeable where appropriate. For example, first information could be referred to as second information, and similarly, second information could be referred to as first information without departing from the scope of this disclosure.

[0044] The word "if" as used herein may be interpreted as "when" or "when" or "in response to determining," depending on the context.

[0045] Furthermore, as used herein, the singular forms "a," "an" and "the" are intended to include the plural forms as well, unless the context indicates otherwise.

[0046] It should be further understood that the terms “comprises” and “includes” indicate the existence of features, steps, operations, elements, components, items, types, and / or groups, but do not preclude the existence, occurrence, or addition of one or more other features, steps, operations, elements, components, items, types, and / or groups.

[0047] The terms "or" and "and / or" as used herein are to be interpreted as inclusive, or mean any one or any combination. Thus, "A, B, or C" or "A, B, and / or C" means "any one of the following: A; B; C; A and B; A and C; B and C; A, B, and C." An exception to this definition occurs only when a combination of elements, functions, steps, or operations are inherently mutually exclusive in some manner.

[0048] As the performance and resources of in-vehicle controllers like MCUs improve, two independent, switchable partitions enable over-the-air downloads and seamless flashing. At any given moment, only one partition is active, responsible for normal system operation, while the other is inactive and available for software upgrades, enabling seamless and frictionless software upgrades.

[0049] The secure boot solution verifies the integrity of the software through an encryption algorithm. When the software is last upgraded, a CMAC value is pre-calculated and stored using the encryption algorithm. When the software is started, another CMAC value is calculated based on the currently running software using the same encryption algorithm. The two CMAC values ​​are compared, and a secure boot is performed only if they are the same.

[0050] A controller with two partitions: one for software operation and the other for software upgrades. After a software upgrade, the two partitions are switched. The controller system always runs in the active partition, and the read address remains unchanged regardless of the active partition. If the partition switch fails, the CMAC value of the partition running the software before the upgrade is compared with the CMAC value of the partition running the software after the upgrade, causing the secure boot to fail.

[0051] To this end, in a first aspect, the present disclosure provides Figure 1 A controller secure boot method is shown, wherein the memory of the controller is divided into two identical partitions including a first partition and a second partition, wherein the first partition is used for software booting and the second partition is used for software upgrading, including the following steps:

[0052] S101, after the software partition corresponding to the first partition starts running the software, the software partition corresponding to the second partition performs software upgrade and flashing;

[0053] The first partition stores software authentication data based on the software identifier of the software in the software partition corresponding to the first partition. The software running in the first partition is the pre-upgrade version, and the stored authentication data is the pre-upgrade software authentication data. The software upgrade is performed in the second partition, and the software program is written to the software partition corresponding to the second partition to perform software update and optimization.

[0054] The software partition is stored in memory and corresponds to the first and second partitions in the controller. The software identifier is a string or code that uniquely identifies the software. By locating and querying the corresponding authentication data stored in the partition using the software identifier, the software's authentication data can be accurately retrieved. Authentication data is used for identity authentication. The software can only boot securely if the authentication data stored in the controller partition matches the authentication data calculated during software startup.

[0055] S102: After the software upgrade is successfully written, the authentication data is updated in the second partition;

[0056] The authentication data of the software in the software partition corresponding to the second partition is calculated by an authentication data encryption algorithm, and the authentication data after the software upgrade is updated in the second partition according to the software identifier of the software in the software partition corresponding to the second partition.

[0057] The authentication data encryption algorithm is a cryptographic algorithm used to ensure data confidentiality, integrity, and authenticity, such as the Advanced Encryption Standard (ASE), Data Encryption Standard (DES), RSA, or a hash algorithm. Using the same authentication data encryption algorithm can generate the same authentication data.

[0058] S103: After performing the partition switching operation, the controller performs a reset and restart, and identifies the current software partition after the reset and restart;

[0059] After performing the partition switching operation, the controller is reset and restarted to identify and determine whether the current partition after the controller is reset and restarted is the software partition corresponding to the first partition or the software partition corresponding to the second partition. If it is the software partition corresponding to the first partition, the partition switching operation is judged to have failed; if it is the software partition corresponding to the second partition, the partition switching operation is judged to have succeeded.

[0060] After the controller performs a partition switch, it must be reset and restarted to activate the partition. By identifying the partition that is activated after the reset and restart, it provides a basis for the calculation of subsequent authentication data.

[0061] S104. If it is the software partition corresponding to the first partition, the partition switching fails, and the authentication data of the first partition is used for authentication, and the software of the first partition is started after the authentication is passed; if it is the second partition, the partition switching is successful, and the updated authentication data of the second partition is used for authentication, and the upgraded software of the second partition is started after the authentication is passed.

[0062] If it is the software partition corresponding to the first partition, the authentication data of the software in the first partition after the controller is reset and restarted is calculated using the authentication data encryption algorithm, and compared and verified with the authentication data stored in the first partition after the controller is reset and restarted. After the verification is consistent, the software is securely started.

[0063] If it is the software partition corresponding to the second partition, the authentication data of the software in the second partition after the controller is reset and restarted is calculated using the authentication data encryption algorithm, and compared and verified with the authentication data stored in the second partition after the controller is reset and restarted. After the verification is consistent, the software is securely started.

[0064] like Figure 2The figure shows a specific application of a controller secure startup method in one embodiment, wherein the controller is an MCU (Microcontroller Unit), an HSM (Hardware Security Module) is provided in the MCU, and two independent CMAC storage areas are divided in the data memory of the HSM, which are used to store the CMAC values ​​of the first partition and the second partition software respectively.

[0065] When the MCU starts the software in the software partition corresponding to the first partition and performs a software upgrade in the software partition corresponding to the second partition, the steps are as follows:

[0066] S201, flashing and upgrading software in the software partition corresponding to the second partition;

[0067] After the MCU starts up the software partition corresponding to the first partition, the software runs in the software partition corresponding to the first partition. The current active partition is the software partition corresponding to the first partition. When performing a software upgrade, the upgraded software program is flashed to the software partition corresponding to the second partition of the inactive partition.

[0068] S202. Update the software CMAC in the software partition corresponding to the second partition to the second partition of the HSM;

[0069] In one embodiment, a CMAC value (Cipher-based Message Authentication Code) is used as the authentication data of the software. CMAC is a message authentication code algorithm based on a block cipher. It generates an authentication code of a fixed length by encrypting the message to verify the integrity and authenticity of the message. After the upgraded software program is flashed to the software partition corresponding to the second partition, the CMAC value of the upgraded software of the software partition corresponding to the second partition is calculated by an authentication data encryption algorithm such as the AES-128-CMAC algorithm, and the calculated CMAC value of the upgraded software is stored in the second partition of the HSM based on the software identifier of the software in the software partition corresponding to the second partition. The CMAC value is used for secure startup verification of the software when the software partition corresponding to the second partition is activated next time. The AES-128-CMAC algorithm is a CMAC algorithm based on the Advanced Encryption Standard (AES), which uses the AES algorithm with a 128-bit key as the CMAC algorithm of the underlying block cipher.

[0070] S203, MCU performs software partition switching;

[0071] After the software upgrade is completed and the CMAC value of the upgraded software is stored in the second partition of the HSM, the MCU performs a software partition switching operation.

[0072] S204, MCU reset and restart;

[0073] The software partition switching operation requires the MCU to be reset and restarted to complete the software partition switching operation and activate the software partition.

[0074] S205, identifying the currently activated partition;

[0075] Identify whether the active partition of the current MCU is the software partition corresponding to the first partition or the software partition corresponding to the second partition. If the active partition is the software partition corresponding to the first partition, the partition switching is unsuccessful. If the active partition is the software partition corresponding to the second partition, the partition switching is successful.

[0076] S206. Calculate the CMAC value of the software in the currently activated partition;

[0077] The AES-128-CMAC algorithm is used to calculate the CMAC value of the software in the currently active software partition for secure boot verification. If the currently active partition is the software partition corresponding to the first partition, the CMAC value of the software in the first partition before the upgrade is calculated. If the currently active partition is the software partition corresponding to the second partition, the CMAC value of the software in the second partition after the upgrade is calculated.

[0078] S207, compare CMAC values ​​for verification;

[0079] According to the software identification code of the currently activated partition, the corresponding CMAC value is searched in the HSM and compared with the CMAC value of the software in the currently activated partition in S206. If the two are consistent, a secure boot is performed. If the two are inconsistent, a secure boot is not performed.

[0080] If the currently activated partition is the software partition corresponding to the first partition, the CMAC value of the software in the first partition before the upgrade is compared with the CMAC value stored in the first partition in the HSM. If the currently activated partition is the software partition corresponding to the second partition, the CMAC value of the software in the second partition after the upgrade is compared with the CMAC value stored in the second partition in the HSM. Therefore, regardless of whether the first or second partition is activated, secure boot of the software in the current partition is guaranteed, and secure boot failures caused by the software's CMAC value being different from the CMAC value stored in the HSM after a partition switch failure will not occur.

[0081] like Figure 3 As shown, when the MCU is started in the software partition corresponding to the second partition and the software partition corresponding to the first partition is upgraded, the CMAC value of the upgraded software is stored in the first partition of the HSM, and the CMAC value of the software before the upgrade is stored in the second partition of the HSM. The specific method steps are as follows:

[0082] S301, flashing and upgrading software in the software partition corresponding to the first partition;

[0083] After the MCU starts up the software partition corresponding to the second partition, the software runs in the software partition corresponding to the second partition. The current active partition is the software partition corresponding to the second partition. When performing a software upgrade, the upgraded software program is flashed to the software partition corresponding to the first partition of the inactive partition.

[0084] S302. Update the software CMAC in the software partition corresponding to the first partition to the first partition of the HSM;

[0085] In one embodiment, a CMAC value (Cipher-based Message Authentication Code) is used as the authentication data of the software. CMAC is a message authentication code algorithm based on a block cipher. It generates an authentication code of a fixed length by encrypting the message to verify the integrity and authenticity of the message. After the upgraded software program is flashed to the software partition corresponding to the first partition, the CMAC value of the upgraded software of the software partition corresponding to the first partition is calculated by an authentication data encryption algorithm such as the AES-128-CMAC algorithm, and the calculated CMAC value of the upgraded software is stored in the first partition of the HSM based on the software identifier of the software in the software partition corresponding to the first partition. The CMAC value is used for secure startup verification of the software when the software partition corresponding to the first partition is activated next time. The AES-128-CMAC algorithm is a CMAC algorithm based on the Advanced Encryption Standard (AES), which uses the AES algorithm with a 128-bit key as the CMAC algorithm of the underlying block cipher.

[0086] S303, MCU performs software partition switching;

[0087] After the software upgrade is completed and the CMAC value of the upgraded software is stored in the first partition of the HSM, the MCU performs a software partition switching operation.

[0088] S304, MCU reset and restart;

[0089] The software partition switching operation requires the MCU to be reset and restarted to complete the software partition switching operation and activate the software partition.

[0090] S305, identifying the currently activated partition;

[0091] Identify whether the active partition of the current MCU is the software partition corresponding to the second partition or the software partition corresponding to the first partition. If the active partition is the software partition corresponding to the second partition, the partition switching is unsuccessful. If the active partition is the software partition corresponding to the first partition, the partition switching is successful.

[0092] S306. Calculate the CMAC value of the software in the currently activated partition;

[0093] The AES-128-CMAC algorithm is used to calculate the CMAC value of the software in the currently active software partition for secure boot verification. If the currently active partition is the software partition corresponding to the second partition, the CMAC value of the software in the software partition corresponding to the second partition before the upgrade is calculated. If the currently active partition is the software partition corresponding to the first partition, the CMAC value of the software in the software partition corresponding to the first partition after the upgrade is calculated.

[0094] S307, compare CMAC values ​​for verification;

[0095] According to the software identification code of the currently activated software partition, the corresponding CMAC value is searched in the HSM and compared with the CMAC value of the software in the currently activated software partition in S306. If the two are consistent, a secure boot is performed. If the two are inconsistent, a secure boot is not performed.

[0096] If the currently activated partition is the software partition corresponding to the second partition, the CMAC value of the pre-upgraded software in the software partition corresponding to the second partition is compared with the CMAC value of the second partition in the HSM. If the currently activated partition is the software partition corresponding to the first partition, the CMAC value of the upgraded software in the software partition corresponding to the first partition is compared with the CMAC value of the first partition in the HSM. Therefore, regardless of whether the second or first partition is activated, secure boot of the software in the current partition is guaranteed, and secure boot failures due to the software CMAC value after a partition switch failure being different from the CMAC value stored in the HSM will not occur.

[0097] Second, as Figure 4 As shown, a controller security boot device is provided, wherein the memory of the controller is divided into two identical partitions including a first partition and a second partition, wherein the first partition is used for software startup, and the second partition is used for software upgrade;

[0098] Each partition includes a software identifier storage area and an authentication data storage area. The software identifier storage area is used to store the software identifier of the software, and the authentication data storage area is used to store the authentication data of the software. The authentication data of the software can be called through the software identifier.

[0099] The module further comprises: a software startup module 101, configured to guide the software to start running in the software partition corresponding to the first partition;

[0100] A software flashing module 102 is configured to execute software upgrade flashing in the software partition corresponding to the second partition;

[0101] The authentication data update module 103 is used to perform authentication data update in the second partition after the software upgrade is successfully flashed;

[0102] The partition switching judgment module 104 is used to reset and restart the controller after the controller performs a software partition switching operation, and identify and judge the current software partition of the controller after the controller is reset and restarted;

[0103] The verification module 105 is used to verify the software in the current software partition after the controller is reset and restarted, and start the software.

[0104] Thirdly, as Figure 5 As shown, an electronic device is provided, characterized in that it includes: a memory, a processor;

[0105] The memory stores computer-executable instructions;

[0106] The processor executes the computer-executable instructions stored in the memory, so that the processor performs the above method.

[0107] In one embodiment, the electronic device 200 includes: at least one processor 201 and a memory 202. Optionally, the electronic device 200 further includes a communication component 203. The processor 201, the memory 202 and the communication component 203 are connected via a bus 204.

[0108] During the specific implementation process, at least one processor 201 executes the computer-executable instructions stored in the memory 202, so that the at least one processor 201 performs the above method.

[0109] The specific implementation process of the processor 201 can be found in the above method embodiment. Its implementation principle and technical effects are similar and will not be repeated here in this embodiment.

[0110] In the above embodiments, it should be understood that the processor may be a central processing unit (CPU), other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), etc. A general-purpose processor may be a microprocessor or any conventional processor. The steps of the method disclosed in the present invention may be directly implemented by a hardware processor or implemented by a combination of hardware and software modules in the processor.

[0111] The memory may include a high-speed memory (Random Access Memory, RAM), and may also include a non-volatile memory (NVM), such as at least one disk memory.

[0112] The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus. Buses can be classified into address buses, data buses, and control buses. For ease of illustration, the buses in the drawings of this application are not limited to just one bus or just one type of bus.

[0113] In a fourth aspect, the present application also provides a computer-readable storage medium, in which computer-executable instructions are stored. When a processor executes the computer-executable instructions, the above-mentioned method is implemented.

[0114] The above-mentioned readable storage medium can be implemented by any type of volatile or non-volatile memory device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk. The readable storage medium can be any available medium that can be accessed by a general-purpose or special-purpose computer.

[0115] An exemplary readable storage medium is coupled to a processor so that the processor can read information from the readable storage medium and write information to the readable storage medium. Of course, the readable storage medium can also be an integral part of the processor. The processor and the readable storage medium can be located in an application specific integrated circuit (ASIC). Of course, the processor and the readable storage medium can also exist in the device as discrete components.

[0116] The division of units is merely a logical functional division; actual implementations may employ alternative divisions, such as combining or integrating multiple units or components into another system, or omitting or disabling certain features. Furthermore, any direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection between devices or units, either through an interface, electrical, mechanical, or other means.

[0117] Units described as separate components may or may not be physically separate, and components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected to achieve the purpose of this embodiment according to actual needs.

[0118] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0119] If the function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes a number of instructions for enabling an electronic device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, and other media that can store program code.

[0120] Those skilled in the art will appreciate that all or part of the steps in the above-described method embodiments can be implemented using hardware associated with program instructions. The aforementioned program can be stored in a computer-readable storage medium. When executed, the program performs the steps of the above-described method embodiments. The aforementioned storage medium includes various media capable of storing program code, such as ROM, RAM, magnetic disks, or optical disks.

[0121] Finally, it should be noted that those skilled in the art will readily identify other embodiments of the present invention after considering the specification and practicing the invention disclosed herein. The present invention is intended to cover any variations, uses, or adaptations of the present invention that follow the general principles of the present invention and include common knowledge or customary techniques in the art not disclosed herein. The present invention is not limited to the precise structure described above and illustrated in the accompanying drawings, and various modifications and variations may be made without departing from the scope thereof. The scope of the present invention is limited solely by the appended claims.

Claims

1. A controller security startup method, characterized in that: The memory of the controller is divided into two identical partitions including a first partition and a second partition, wherein the first partition is used to store software authentication data before the upgrade, and the second partition is used to store software authentication data after the upgrade, including the following steps: After the software partition corresponding to the first partition starts running the software, the software partition corresponding to the second partition performs software upgrade and flashing; After the software upgrade is successfully written, the authentication data is updated in the second partition; After the controller performs a partition switching operation, it performs a reset and restart, and identifies the current software partition after the reset and restart; If it is the software partition corresponding to the first partition, the partition switching fails, the authentication data of the first partition is used for authentication, and the software of the first partition is started after the authentication is passed; if it is the second partition, the partition switching is successful, the updated authentication data of the second partition is used for authentication, and the upgraded software of the second partition is started after the authentication is passed.

2. A controller safe startup method according to claim 1, characterized in that: After the software is started and run in the first partition, performing software upgrade and flashing in the second partition includes: The first partition stores authentication data of the software according to the software identifier of the software in the software partition corresponding to the first partition.

3. A controller safe startup method according to claim 2, characterized in that: After the software upgrade is successfully written, executing the authentication data update in the second partition includes: The authentication data of the software in the software partition corresponding to the second partition is calculated by an authentication data encryption algorithm, and the authentication data after the software upgrade is updated in the second partition according to the software identifier of the software in the software partition corresponding to the second partition.

4. A controller safe startup method according to claim 3, characterized in that: The controller performs a reset and restart after performing a partition switching operation, and identifies the current partition after the reset and restart, including: After performing the partition switching operation, the controller is reset and restarted to identify and determine whether the current partition after the controller is reset and restarted is the software partition corresponding to the first partition or the software partition corresponding to the second partition. If it is the software partition corresponding to the first partition, the partition switching operation is judged to have failed; if it is the software partition corresponding to the second partition, the partition switching operation is judged to have succeeded.

5. A controller safe startup method according to claim 4, characterized in that: If the partition is the first partition, the partition switching fails, the authentication data of the first partition is authenticated, and the software of the first partition is started after the authentication passes, including: If it is the software partition corresponding to the first partition, the authentication data of the software in the first partition after the controller is reset and restarted is calculated using the authentication data encryption algorithm, and compared and verified with the authentication data stored in the first partition after the controller is reset and restarted. After the verification is consistent, the software is securely started.

6. A controller safe startup method according to claim 4, characterized in that: If the partition is the second partition, the partition switching is successful, authenticating the updated authentication data of the second partition, and starting the upgraded software of the second partition after the authentication is passed includes: If it is the software partition corresponding to the second partition, the authentication data of the software in the second partition after the controller is reset and restarted is calculated using the authentication data encryption algorithm, and compared and verified with the authentication data stored in the second partition after the controller is reset and restarted. After the verification is consistent, the software is securely started.

7. A controller safety startup device, characterized in that: The memory of the controller is divided into two identical partitions including a first partition and a second partition, wherein the first partition is used for software startup and the second partition is used for software upgrade; It also includes: a software startup module, which is used to guide the software to start running in the software partition corresponding to the first partition; A software flashing module, used for performing software upgrade flashing in the software partition corresponding to the second partition; An authentication data update module, configured to update the authentication data in the second partition after the software upgrade is successfully completed; The partition switching judgment module is used to reset and restart the controller after the controller performs a software partition switching operation, and identify and judge the current software partition of the controller after the controller is reset and restarted; The verification module is used to verify the authentication data of the software in the current software partition after the controller is reset and restarted, and start the software.

8. A controller safety starting device according to claim 7, characterized in that: Each partition includes a software identifier storage area and an authentication data storage area. The software identifier storage area is used to store the software identifier of the software, and the authentication data storage area is used to store the authentication data of the software.

9. An electronic device, characterized in that: Memory, processor; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory, so that the processor performs a method according to any one of claims 1 to 6.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: The program is executed by a processor to implement the controller software upgrade method according to any one of claims 1 to 6.

Images