Storage medium authentication method, system and equipment for vehicle flashing and medium

Abstract

The invention discloses a storage medium authentication method, system and device for vehicle flashing and a medium. The storage medium authentication method for vehicle flashing comprises the steps that medium parameters of a storage medium are read through a diagnostic instrument, and the medium parameters at least comprise the serial number of the storage medium; an authorization authentication file is generated according to the medium parameters, and the authorization authentication file at least comprises the serial number and an authorization time period; sending the authorization authentication file to a PKI system, so as to sign the authorization authentication file after the authentication of the authorization authentication file by the PKI system is passed; and receiving a signed authorization file returned by the PKI system, and writing the signed authorization file into the storage medium. By adopting the method and the device, the safety of writing operation of all the external equipment such as the storage medium on the in-vehicle controller is ensured, the national standard requirement is met, the safety certification of the external equipment such as the storage medium is ensured, and the authenticity and the traceability of the writing equipment are ensured.

Description

Technical Field

[0001] This application relates to the field of vehicle technology, and in particular to a method, system, device and medium for authenticating storage media used for vehicle flashing. Background Technology

[0002] With the implementation of regulations such as automotive information security technical requirements, current vehicle upgrades to in-vehicle controllers via external devices, such as USB flash drives, lack any security authentication measures between the vehicle and external access modules like USB flash drives, posing certain data security risks. For example, the main technical problems with directly upgrading in-vehicle controllers via USB flash drives are as follows:

[0003] Unauthorized personnel may use any USB drive to perform unauthorized upgrades; upgrade packages may be maliciously forged, and verification processes may be bypassed; due to the leakage of the platform's signature private key, attackers may be able to forge authentication files and upgrade packages in batches, bypassing the authentication mechanism, and vehicles may face the risk of being illegally upgraded in batches; diagnostic tools or personnel behavior may be unauditable and have poor traceability. Summary of the Invention

[0004] Therefore, it is necessary to provide a method, system, device, and medium for authenticating storage media used for vehicle flashing, in order to address the above-mentioned technical problems. This ensures the security of all external devices, such as storage media, writing operations to the in-vehicle controller, and complies with national standards. It also guarantees the security authentication of external devices such as storage media, the authenticity and traceability of the writing device, and ensures that the source of the software package is controlled and the content is authentic and reliable when it is transferred to the vehicle terminal for upgrade via storage media such as USB flash drive.

[0005] Firstly, a method for authenticating storage media used for vehicle flashing is provided, including:

[0006] The media parameters of the storage medium are read using a diagnostic instrument, wherein the media parameters include at least the serial number of the storage medium;

[0007] An authorization certificate is generated based on the media parameters, wherein the authorization certificate includes at least the serial number and the authorization period.

[0008] The authorization certificate is sent to the PKI system so that the authorization certificate can be signed after the PKI system has authenticated the authorization certificate.

[0009] Receive the signed authorization file returned by the PKI system and write the signed authorization file into the storage medium.

[0010] In some examples, generating the authorization certificate file based on the media parameters includes:

[0011] An authorization and authentication file for the structural specifications is generated based on the media parameters, wherein the authorization and authentication file is an authorization and authentication file in JSON format.

[0012] In some examples, the authorization authentication file includes: serial, issued_to, valid_from, and valid_to, wherein the serial is the serial number of the storage medium, the storage medium is a USB flash drive, the issued_to is used to identify the user of the USB flash drive, the valid_from indicates the authorization start time, and the valid_to indicates the authorization expiration time.

[0013] In some examples, sending the authorization certificate to the PKI system for signing after the PKI system has authenticated the authorization certificate includes:

[0014] The authorization and authentication file is uploaded to the PKI system through a relevant interface, and the PKI system signs the authorization and authentication file to obtain a signed authorization file. Before signing the authorization and authentication file, the PKI system verifies whether the structure of the authorization and authentication file is complete and whether the fields are valid. After the verification is passed, the authorization and authentication file is signed.

[0015] In some examples, the signing private key used by the PKI system to sign the authorization authentication file meets the following conditions:

[0016] The signature private key is configured for a limited purpose;

[0017] The signature algorithm uses either RSA or a hybrid algorithm of ECC and SHA256;

[0018] The signed license file is encoded in DER.

[0019] In some examples, when the PKI system signs the authorization authentication file, it further includes: recording detailed information about the signing behavior, the detailed information including:

[0020] Operator identity, calling IP address or diagnostic tool ID;

[0021] The unique serial number, signing start and end times, and digest value of the authorized authentication document;

[0022] The returned digest value of the signature file;

[0023] Signature time and signature certificate number.

[0024] In some examples, after the signed license file is written to the storage medium, the process further includes:

[0025] When flashing a vehicle using the storage medium, the serial number of the storage medium is read.

[0026] Verify the signed authorization file in the storage medium and parse out the serial number;

[0027] Compare the serial number read from the storage medium with the parsed serial number;

[0028] If the comparison matches, the authorization for the storage medium has not expired, and the vehicle can be flashed through the storage medium.

[0029] Secondly, a storage media authentication system for vehicle flashing is provided, including:

[0030] A reading module is used to read the media parameters of the storage medium through a diagnostic instrument, wherein the media parameters include at least the serial number of the storage medium;

[0031] A generation module is used to generate an authorization and authentication file based on the media parameters, wherein the authorization and authentication file includes at least the serial number and the authorization time period;

[0032] The communication module is used to send the authorization and authentication file to the PKI system, sign the authorization and authentication file after the PKI system has authenticated the authorization and authentication file, receive the signed authorization file returned by the PKI system, and write the signed authorization file to the storage medium.

[0033] Thirdly, a computer device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, it implements the steps of the vehicle flashing storage medium authentication method described in the first aspect and any possible implementation of the first aspect.

[0034] Fourthly, a computer-readable storage medium is provided, on which a computer program is stored, which, when executed by a processor, implements the steps of the storage medium authentication method for vehicle flashing described in the first aspect and any possible implementation thereof.

[0035] Fifthly, a computer program product is provided, on which a computer program is stored, which, when executed by a processor, implements the steps of the vehicle flashing storage medium authentication method described in the first aspect and any possible implementation thereof.

[0036] In the embodiments of this application, the media parameters of the storage medium are read by a diagnostic instrument, an authorization and authentication file is generated based on the media parameters, and the authorization and authentication file is sent to the PKI system. After the PKI system authenticates the authorization and authentication file, it is signed. Finally, the signed authorization file returned by the PKI system is received and written to the storage medium. This ensures the security of all external devices, such as storage media, writing operations to the in-vehicle controller, and complies with national standards. It also ensures the security authentication of external devices such as storage media, the authenticity and traceability of the writing devices, and ensures that the source of the software package is controlled and the content is authentic and reliable when it is transferred to the vehicle terminal for upgrade via storage media such as USB flash drive. Attached Figure Description

[0037] Other features, objects, and advantages of this application will become more apparent from the following detailed description of non-limiting embodiments with reference to the accompanying drawings:

[0038] Figure 1 A flowchart of a storage medium authentication method for vehicle flashing provided in an embodiment of this application;

[0039] Figure 2 A schematic diagram illustrating the application of the vehicle flashing storage medium authentication method provided in this embodiment of the application;

[0040] Figure 3 This is a structural block diagram of a storage medium authentication system for vehicle flashing provided in an embodiment of this application;

[0041] Figure 4 This is a structural block diagram of a computer device provided in an embodiment of this application. Detailed Implementation

[0042] The present application will now be described in further detail with reference to the embodiments and accompanying drawings. It should be understood that the specific embodiments described herein are for illustrative purposes only and are not intended to limit the application. Furthermore, it should be noted that, for ease of description, only the parts relevant to the application are shown in the accompanying drawings.

[0043] It should be noted that, unless otherwise specified, the embodiments and features of the embodiments in this application can be combined with each other. This application will now be described in detail with reference to the accompanying drawings and embodiments.

[0044] The following describes in detail, with reference to the accompanying drawings, a method, system, device, and medium for authenticating storage media used for vehicle flashing according to embodiments of this application.

[0045] Figure 1 This is a flowchart of a storage medium authentication method for vehicle flashing according to an embodiment of this application. Figure 1As shown, the vehicle flashing storage medium authentication method according to an embodiment of this application includes the following steps:

[0046] S101: Read the media parameters of the storage medium using a diagnostic instrument, wherein the media parameters include at least the serial number of the storage medium.

[0047] As a concrete example, let's take a USB flash drive as the storage medium, combined with... Figure 2 As shown, the diagnostic tool automatically identifies the inserted USB drive and reads its unique serial number. For example, the specific method is as follows:

[0048] On the Windows platform, you can use wmicdiskdrive, or call WMIAPI to get the SerialNumber of the USB drive to obtain its unique serial number. Of course, you can also get the device path and device model of the USB drive, which can be used for subsequent packaging and authentication.

[0049] If reading the USB drive's unique serial number fails, for example, if the serial number is empty or cannot be obtained, relevant prompts will be displayed, such as: "The USB drive is untrusted. It is recommended to replace it with an authorized USB drive."

[0050] S102: Generate an authorization certificate based on the media parameters, wherein the authorization certificate includes at least the serial number and the authorization time period.

[0051] In one embodiment of this application, generating an authorization authentication file based on the media parameters includes: generating an authorization authentication file with a structural specification based on the media parameters, wherein the authorization authentication file is an authorization authentication file in JSON format.

[0052] The authorization and authentication files include, but are not limited to, serial, issued_to, valid_from, and valid_to, where serial is the serial number of the USB flash drive, issued_to is used to identify the user of the USB flash drive, valid_from indicates the authorization start time, and valid_to indicates the authorization expiration time.

[0053] Combination Figure 2 As shown, the diagnostic tool generates a structured JSON authorization file, usb_auth.json, based on the read serial number. The structure is as follows:

[0054]

[0055] The parameters are as follows: `issued_to`: identifies the user of the USB drive, which could be the after-sales team or others; this can be manually entered or automatically generated; `valid_from`: the authorization start time, which can be fixed or manually specified; `valid_to`: the authorization expiration time, which can be fixed or manually specified. The output file should be UTF-8 encoded and readable and parsable.

[0056] S103: Send the authorization certificate to the PKI system so that the authorization certificate can be signed after the PKI system has authenticated the authorization certificate.

[0057] In one embodiment of this application, the authorization authentication file is sent to a PKI system for signing after the PKI system authenticates the authorization authentication file. This includes uploading the authorization authentication file to the PKI system via a relevant interface, and having the PKI system sign the authorization authentication file to obtain a signed authorization file. Before signing the authorization authentication file, the PKI system verifies whether the structure of the authorization authentication file is complete and whether its fields are valid, and signs the authorization authentication file after the verification is passed.

[0058] In this example, the signing private key used by the PKI system to sign the authorized authentication file meets the following conditions: the signing private key is set with a limited purpose; the signing algorithm adopts RSA or a hybrid algorithm of ECC and SHA256; and the signed authorization file adopts DER encoding.

[0059] Furthermore, when the PKI system signs the authorized authentication file, it also includes: recording detailed information about the signing behavior, including: the operator's identity, the calling IP or diagnostic tool ID; the unique serial number of the authorized authentication file, the signing initiation and termination time, and the digest value; the returned digest value of the signed file; and the signing time and signing certificate number.

[0060] Combination Figure 2 As shown, the diagnostic instrument uploads the certification document to the PKI platform (i.e., the PKI system) for signing, specifically as follows:

[0061] Upload the authorization and authentication file usb_auth.json to the PKI platform via HTTPS POST interface;

[0062] The PKI platform returns a signed authorization certificate file, usb_auth.cert.

[0063] It should be noted that the PKI platform can provide an open authentication and signature service interface for diagnostic instruments to call, enabling the signing of the authorization and authentication file usb_auth.json, where:

[0064] The interface type is HTTPS RESTful API, which supports authentication via token / certificate.

[0065] The PKI platform needs to verify the structural integrity and field validity of the request JSON (including serial, valid_from, valid_to, and issued_to);

[0066] The signing private key used by the platform typically needs to be securely isolated, for example, meeting the following requirements:

[0067] Set KeyUsage=digitalSignature to restrict the usage of this private key;

[0068] The signature algorithm is recommended to use a hybrid algorithm of RSA or ECC plus SHA256;

[0069] The output format is usb_auth.cert, the content is in CMS / PKCS7 format, and it uses DER encoding.

[0070] The PKI platform should record detailed information on all signature actions for auditing and issue tracing, including but not limited to:

[0071] Operator identity (Token or account name), calling IP or diagnostic tool ID;

[0072] The unique serial number of the requested file, the initiation and termination times of the signing process, and the digest value;

[0073] The returned hash value of the signature file;

[0074] Signature time and signature certificate number.

[0075] Logs should be kept for a certain period of time, such as at least one year, and can be stored in an audit database or security log system.

[0076] S104: Receive the signed authorization file returned by the PKI system and write the signed authorization file into the storage medium.

[0077] like Figure 2 As shown, the PKI platform sends the signed USB flash drive certificate file to the diagnostic tool, which then writes the relevant certificate file to the root directory of the USB flash drive.

[0078] In a specific example, after writing the signed authorization file to the storage medium, the method further includes: when flashing the vehicle through the storage medium, reading the serial number of the storage medium; verifying the signed authorization file in the storage medium and parsing out the serial number; comparing the serial number read from the storage medium with the parsed serial number; if the comparison matches, the authorization for the storage medium has not expired, and flashing the vehicle through the storage medium is permitted.

[0079] For example, the vehicle's central control system's ability to read the unique serial number of an inserted USB drive can be achieved in the following ways:

[0080] Linux or Android systems can read ` / sys / block / sdX / device / serial` to obtain the `SerialNumber`; alternatively, they can use a command to obtain the unique serial number `ID_SERIAL`.

[0081] The UID is extracted via the program interface and used in subsequent authentication processes;

[0082] If the read fails, the central control unit will refuse to upgrade and log the process.

[0083] The USB flash drive contains a file named usb_auth.cert. The signature of this file was successfully verified using the public key built into the control unit. The following fields were parsed and verified: the serial number exactly matches the serial number read from the actual USB flash drive; the current system time falls within the range of valid_from and valid_to.

[0084] According to the vehicle flashing storage medium authentication method of this application embodiment, the storage medium parameters are read by a diagnostic tool, an authorization authentication file is generated based on the storage medium parameters, and the authorization authentication file is sent to the PKI system. After the PKI system authenticates the authorization authentication file, the authorization authentication file is signed. Finally, the signed authorization file returned by the PKI system is received and written into the storage medium. This ensures the security of all external devices such as storage media writing operations to the in-vehicle controller and complies with national standards. It also ensures the security authentication of external devices such as storage media, the authenticity and traceability of the writing device, and ensures that the source of the software package is controlled and the content is authentic and reliable when it is transferred to the vehicle terminal for upgrade via storage medium such as USB flash drive.

[0085] Figure 3 This is a structural block diagram of a storage medium authentication system for vehicle flashing according to an embodiment of this application, such as... Figure 3 As shown, a vehicle flashing storage medium authentication system according to an embodiment of this application includes: a reading module 310, a generating module 320, and a communication module 330, wherein:

[0086] The reading module 310 is used to read the media parameters of the storage medium through a diagnostic instrument, wherein the media parameters include at least the serial number of the storage medium;

[0087] The generation module 320 is used to generate an authorization and authentication file based on the media parameters, wherein the authorization and authentication file includes at least the serial number and the authorization time period;

[0088] The communication module 330 is used to send the authorization authentication file to the PKI system, sign the authorization authentication file after the PKI system authenticates the authorization authentication file, receive the signed authorization file returned by the PKI system, and write the signed authorization file into the storage medium.

[0089] According to the vehicle flashing storage medium authentication system of this application embodiment, the storage medium parameters are read by a diagnostic tool, an authorization authentication file is generated based on the storage medium parameters, and the authorization authentication file is sent to the PKI system. After the PKI system authenticates the authorization authentication file, it signs the authorization authentication file. Finally, the system receives the signed authorization file returned by the PKI system and writes the signed authorization file into the storage medium. This ensures the security of all external devices such as storage media writing operations to the in-vehicle controller and complies with national standards. It also ensures the security authentication of external devices such as storage media, the authenticity and traceability of the writing device, and ensures that the source of the software package is controlled and the content is authentic and reliable when it is transferred to the vehicle terminal for upgrade via storage medium such as USB flash drive.

[0090] Specific limitations regarding the storage media authentication system for vehicle flashing can be found in the limitations of the storage media authentication method for vehicle flashing described above, and will not be repeated here. Each module of the aforementioned storage media authentication system for vehicle flashing can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device in hardware form, or stored in the memory of the computer device in software form, so that the processor can call and execute the corresponding operations of each module.

[0091] In one embodiment, a computer device is provided. Figure 4 This is a structural block diagram of the computer device provided in the embodiments of this application, with reference to... Figure 4 The computer device includes a memory and a processor. The memory stores a computer program, and the processor executes the computer program to implement the aforementioned embodiment of the storage medium authentication method for vehicle flashing. For example, it executes: reading the media parameters of the storage medium using a diagnostic tool, wherein the media parameters include at least the serial number of the storage medium;

[0092] An authorization certificate is generated based on the media parameters, wherein the authorization certificate includes at least the serial number and the authorization period.

[0093] The authorization certificate is sent to the PKI system so that the authorization certificate can be signed after the PKI system has authenticated the authorization certificate.

[0094] Receive the signed authorization file returned by the PKI system and write the signed authorization file into the storage medium.

[0095] This application also provides a computer-readable storage medium storing a computer program. When the processor executes the computer program, it implements the aforementioned storage medium authentication method embodiment for vehicle flashing. For example, it executes: reading the media parameters of the storage medium using a diagnostic tool, wherein the media parameters include at least the serial number of the storage medium;

[0096] An authorization certificate is generated based on the media parameters, wherein the authorization certificate includes at least the serial number and the authorization period.

[0097] The authorization certificate is sent to the PKI system so that the authorization certificate can be signed after the PKI system has authenticated the authorization certificate.

[0098] Receive the signed authorization file returned by the PKI system and write the signed authorization file into the storage medium.

[0099] This application provides a computer program product including instructions that, when executed, cause the method described in this application embodiment to be performed. For example, it can execute... Figure 1 The steps of the vehicle flashing storage medium authentication method shown include, for example, reading the media parameters of the storage medium using a diagnostic tool, wherein the media parameters include at least the serial number of the storage medium;

[0100] An authorization certificate is generated based on the media parameters, wherein the authorization certificate includes at least the serial number and the authorization period.

[0101] The authorization certificate is sent to the PKI system so that the authorization certificate can be signed after the PKI system has authenticated the authorization certificate.

[0102] Receive the signed authorization file returned by the PKI system and write the signed authorization file into the storage medium.

[0103] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the methods described above. Any references to memory, storage, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, or optical storage, etc. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM), etc.

[0104] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0105] The above embodiments merely illustrate several implementation methods of this application, and while the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this patent application should be determined by the appended claims.

Claims

1. A method for authenticating a storage medium used for vehicle flashing, characterized in that, include: The media parameters of the storage medium are read using a diagnostic instrument, wherein the media parameters include at least the serial number of the storage medium; An authorization certificate is generated based on the media parameters, wherein the authorization certificate includes at least the serial number and the authorization period. The authorization certificate is sent to the PKI system so that the authorization certificate can be signed after the PKI system has authenticated the authorization certificate. Receive the signed authorization file returned by the PKI system and write the signed authorization file into the storage medium.

2. The vehicle flashing and authentication method for storage media according to claim 1, characterized in that, The step of generating the authorization and authentication file based on the media parameters includes: An authorization and authentication file for the structural specifications is generated based on the media parameters, wherein the authorization and authentication file is an authorization and authentication file in JSON format.

3. The vehicle flashing and writing storage medium authentication method according to claim 2, characterized in that, The authorization and authentication file includes: serial, issued_to, valid_from, and valid_to, wherein serial is the serial number of the storage medium, the storage medium is a USB flash drive, issued_to is used to identify the user of the USB flash drive, valid_from indicates the authorization start time, and valid_to indicates the authorization expiration time.

4. The storage medium authentication method for vehicle flashing according to claim 1, characterized in that, The step of sending the authorization certificate to the PKI system, and signing the authorization certificate after the PKI system has authenticated it, includes: The authorization and authentication file is uploaded to the PKI system through a relevant interface, and the PKI system signs the authorization and authentication file to obtain a signed authorization file. Before signing the authorization and authentication file, the PKI system verifies whether the structure of the authorization and authentication file is complete and whether the fields are valid. After the verification is passed, the authorization and authentication file is signed.

5. The vehicle flashing and writing storage medium authentication method according to claim 4, characterized in that, The signing private key used by the PKI system to sign the authorization authentication file meets the following conditions: The signature private key is configured for a limited purpose; The signature algorithm uses either RSA or a hybrid algorithm of ECC and SHA256; The signed license file is encoded in DER.

6. The vehicle flashing and writing storage medium authentication method according to claim 4, characterized in that, When the PKI system signs the authorization authentication file, it further includes: recording detailed information about the signing behavior, the detailed information including: Operator identity, calling IP address or diagnostic tool ID; The unique serial number, signing start and end times, and digest value of the authorized authentication document; The returned digest value of the signature file; Signature time and signature certificate number.

7. The vehicle flashing and writing storage medium authentication method according to claim 1, characterized in that, After writing the signed authorization file to the storage medium, the process further includes: When flashing a vehicle using the storage medium, the serial number of the storage medium is read. Verify the signed authorization file in the storage medium and parse out the serial number; Compare the serial number read from the storage medium with the parsed serial number; If the comparison matches, the authorization for the storage medium has not expired, and the vehicle can be flashed through the storage medium.

8. A storage medium authentication system for vehicle flashing, characterized in that, include: A reading module is used to read the media parameters of the storage medium through a diagnostic instrument, wherein the media parameters include at least the serial number of the storage medium; A generation module is used to generate an authorization and authentication file based on the media parameters, wherein the authorization and authentication file includes at least the serial number and the authorization time period; The communication module is used to send the authorization and authentication file to the PKI system, sign the authorization and authentication file after the PKI system has authenticated the authorization and authentication file, receive the signed authorization file returned by the PKI system, and write the signed authorization file to the storage medium.

9. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the storage medium authentication method for vehicle flashing as described in any one of claims 1-7.

10. A computationally readable storage medium, comprising a memory and a computer program stored on the memory and executable on a processor, characterized in that, When the program is executed by the processor, it implements the storage medium authentication method for vehicle flashing according to any one of claims 1-7.

Images