Safe storage method and system based on automobile Bluetooth key

Abstract

The invention provides a secure storage method and system based on an automobile Bluetooth key, and belongs to the technical field of automobile secure storage, the method comprises the following steps: S1, segmenting and encrypting existing plaintext Bluetooth key information to obtain ciphertext Bluetooth key information, and storing the ciphertext Bluetooth key information in a virtualized memory container; s2, acquiring the ciphertext Bluetooth key information from the virtualized memory container, performing decryption operation to obtain plaintext Bluetooth key information, and performing encryption and decryption operation on the target information by using the plaintext Bluetooth key information to obtain a ciphertext plaintext of the target information; the virtualized memory container comprises an RAM (Random Access Memory) area and a FLASH area and is used for storing ciphertext Bluetooth key information. According to the invention, through the segmentation and encryption processing of the virtualized memory container and the plaintext Bluetooth key information, higher security is provided, and data leakage is effectively prevented; according to the method, the number of stored keys is not limited any more, and the method has great flexibility; according to the invention, the dependence on a hardware security module can be reduced, and the hardware cost is reduced.

Description

Technical Field

[0001] This invention relates to the field of automotive secure storage technology, and in particular to a secure storage method and system based on a car Bluetooth key. Background Technology

[0002] With the continuous improvement of Bluetooth key technology, more and more vehicles are equipped with Bluetooth key functionality. Most Bluetooth keys are based on a TBOX (Telematics Box), which integrates a Bluetooth module to communicate with a mobile phone and execute Bluetooth services. As Bluetooth key functionality expands, a vehicle often has multiple Bluetooth keys. The TBOX needs to securely store multiple sets of Bluetooth key information and implement AES (Advanced Encryption Standard) encryption and decryption algorithms. Furthermore, the interaction information between the TBOX and other components (such as a cloud platform) also needs to be securely stored and encrypted using AES.

[0003] To ensure the security of key information, T-BOX typically requires the selection of an HSM (Hardware Security Module) when choosing a main control chip.

[0004] Currently, NXP's "S32K1xx" chips offer a "CSEc" module that meets the HIS-SHE specification 1.1 rev 439 standard. It supports storing up to 17 sets of user key information and also supports AES encryption algorithms, random number generation algorithms, etc. The entire encryption and decryption process is implemented on independent hardware, preventing plaintext key leakage. However, this chip is relatively expensive, which hinders cost reduction.

[0005] There are also cheaper chips that can replace NXP chips. These chips have a built-in HSM (Hardware Smart Controller) and support AES encryption and random number generation algorithms. The encryption and decryption process is performed in the HSM, and the entire HSM memory area is inaccessible, ensuring the security of the plaintext key. However, these chips only support one set of keys and cannot meet the requirement of securely storing multiple sets of keys. Summary of the Invention

[0006] This invention aims to provide a secure storage solution based on car Bluetooth keys. It can efficiently and securely store multiple sets of key information based on Bluetooth key information by using virtualized storage containers and key segmentation and derivation technologies, even when the hardware security module does not support storing multiple sets of keys. This reduces the requirements for hardware encryption modules and lowers material costs.

[0007] In a first aspect, embodiments of the present invention provide a secure storage method based on a car Bluetooth key, comprising:

[0008] Step S1: The existing plaintext Bluetooth key information is segmented and encrypted to obtain ciphertext Bluetooth key information, which is then stored in a virtualized memory container.

[0009] Step S2: Obtain the encrypted Bluetooth key information from the virtualized memory container, perform decryption to obtain the plaintext Bluetooth key information, and use the plaintext Bluetooth key information to perform encryption / decryption operations on the target information to obtain the encrypted / plaintext of the target information.

[0010] The virtualized memory container includes a RAM area and a FLASH area, used to store encrypted Bluetooth key information.

[0011] Preferably, step S1 includes: step S101, converting plaintext Bluetooth key information using custom rules to obtain plaintext data to be encrypted of a preset length; step S102, transforming and filling the product serial number of the current remote control terminal main control chip to obtain an encryption key; step S103, using a set of data derived from the encryption key as an initialization vector; step S104, inputting the plaintext data to be encrypted, the encryption key, and the initialization vector into the hardware security module of the main control chip to perform encryption calculations to obtain ciphertext Bluetooth key information; and step S105, storing the ciphertext Bluetooth key information in a virtualized memory container.

[0012] Preferably, step S2 includes: step S201, obtaining encrypted Bluetooth key information from the virtualized memory container; step S202, inputting the encrypted Bluetooth key information, encryption key, and initialization vector into the HSM hardware security module of the main control chip to perform a decryption operation to obtain plaintext Bluetooth key information; step S203, inputting the plaintext Bluetooth key information, plaintext / ciphertext of the target information, and initialization vector into the HSM hardware security module of the main control chip to perform an encryption / decryption operation to obtain ciphertext / plaintext of the target information, wherein the plaintext Bluetooth key information is the encryption key for this encryption / decryption operation.

[0013] Preferably, after step S202, the method further includes: step S202a, which saves the plaintext Bluetooth key information obtained by performing the decryption operation in step S202 in the HSM hardware security module as the encryption key input for the next encryption / decryption operation in step S203.

[0014] Preferably, after step S203, the method further includes: step S203a, performing a reset operation on the HSM hardware security module to clear the plaintext Bluetooth key information stored in the HSM hardware security module.

[0015] Preferably, the method also includes the following steps for updating encrypted Bluetooth key information: Bluetooth data verification: Perform verification calculation on the entire RAM area data storing the encrypted Bluetooth key information in the virtualized memory container to obtain verification data A; Check the FLASH area: Check the entire FLASH area storing the encrypted Bluetooth key information in the virtualized memory container to check if there is a FLASH area that has not been written to; If there is a FLASH area that has not been written to, write the current RAM data to the FLASH area. After writing, perform verification calculation on the FLASH area to obtain verification data B. Compare verification data B with verification data A. If the verification results are consistent, the encrypted Bluetooth key information is successfully updated.

[0016] Preferably, the encrypted Bluetooth key information update step further includes: when the entire FLASH area storing the encrypted Bluetooth key information contains data, a preset FLASH area is used as a backup FLASH area, the encrypted Bluetooth key information stored in the FLASH area is written into the backup FLASH area, after writing is completed, a verification calculation is performed on the backup FLASH area to obtain verification data C, and the verification data C is compared with the verification data A. If the verification results are consistent, the backup is successful; an erasure operation is performed on the entire FLASH area storing the encrypted Bluetooth key information; the current RAM data is written into the FLASH area, after writing is completed, a verification calculation is performed on the FLASH area to obtain verification data D, and the verification data D is compared with the verification data A. If the verification results are consistent, the encrypted Bluetooth key information is successfully updated.

[0017] Secondly, embodiments of the present invention provide a secure storage system based on a car Bluetooth key, comprising: a remote control terminal, a virtualized memory container, and a secure storage module; the remote control terminal includes a main control chip, and the hardware security module of the main control chip is capable of performing encrypted calculations; the secure storage module implements the steps of any method in the first aspect; the virtualized memory container includes: a RAM area and a FLASH area, used to store encrypted Bluetooth key information.

[0018] Preferably, the RAM area is used for online data update and reading, and the FLASH area is used for data storage; the FLASH area is an integer multiple of the RAM area, and the FLASH is divided into multiple areas according to the size of the RAM.

[0019] Thirdly, embodiments of the present invention provide a computer-readable medium storing a computer program that, when executed by a processor, implements the steps of any method in the first aspect. The computer-readable storage medium may be volatile or non-volatile.

[0020] Beneficial effects of this invention:

[0021] This invention provides enhanced security and effectively prevents data leakage by segmenting and encrypting virtualized memory containers and plaintext Bluetooth key information.

[0022] This invention removes the limitation on the number of keys that can be stored, thus providing great flexibility;

[0023] This invention reduces reliance on hardware security modules and lowers hardware costs. Attached Figure Description

[0024] Figure 1 This is a schematic flowchart of a secure storage method based on a car Bluetooth key provided by an embodiment of the present invention;

[0025] Figure 2 This is a flowchart illustrating an optional specific implementation method of step S1 in an embodiment of the present invention;

[0026] Figure 3 This is a flowchart illustrating an optional specific implementation method of step S2 in an embodiment of the present invention;

[0027] Figure 4 This is a flowchart illustrating an optional specific implementation method of steps S202a and S202b in an embodiment of the present invention.

[0028] Figure 5 This is a flowchart illustrating an optional specific implementation method for the encrypted Bluetooth key information update step in an embodiment of the present invention.

[0029] Figure 6 This is a structural block diagram of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0030] To enable those skilled in the art to better understand the technical solutions of the present invention, exemplary embodiments of the present invention are described below in conjunction with the accompanying drawings, including various details of the embodiments of the present invention to aid understanding. These should be considered merely exemplary. Therefore, those skilled in the art should recognize that various changes and modifications can be made to the embodiments described herein without departing from the scope and spirit of the present invention. Similarly, for clarity and brevity, descriptions of well-known functions and structures are omitted in the following description.

[0031] Where there is no conflict, the various embodiments of the present invention and the features thereof may be combined with each other.

[0032] As used herein, the term “and / or” includes any and all combinations of one or more related enumerated entries.

[0033] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the invention. As used herein, the singular forms “a” and “the” are intended to include the plural forms as well, unless the context clearly indicates otherwise. It will also be understood that when the terms “comprising” and / or “made of” are used in this specification, the presence of the stated feature, integral, step, operation, element, and / or component is specified, but the presence or addition of one or more other features, integrals, steps, operations, elements, components, and / or groups thereof is not excluded. Terms such as “connected” or “linked” are not limited to physical or mechanical connections but can include electrical connections, whether direct or indirect.

[0034] Unless otherwise specified, all terms used herein (including technical and scientific terms) have the same meaning as commonly understood by one of ordinary skill in the art. It will also be understood that terms such as those defined in commonly used dictionaries should be interpreted as having the meaning consistent with their meaning in the context of the relevant art and the invention, and will not be interpreted as having an idealized or overly formal meaning unless expressly so defined herein.

[0035] In the technical solution of this invention, the collection, storage, use, processing, transmission, provision, and disclosure of user personal information all comply with relevant laws and regulations and do not violate public order and good morals. The use of user data in this technical solution follows relevant national laws and regulations (e.g., the "Information Security Technology - Personal Information Security Specification"). For example: appropriate measures are taken for personal information access control; restrictions are imposed on the display of personal information; the purpose of using personal information does not exceed the scope of direct or reasonable association; and explicit identity targeting is eliminated when using personal information to avoid precisely locating a specific individual.

[0036] Figure 1 This is a flowchart illustrating a secure storage method based on a car Bluetooth key, provided by an embodiment of the present invention; as shown below. Figure 1 As shown, the method includes:

[0037] Step S1: The existing plaintext Bluetooth key information is segmented and encrypted to obtain ciphertext Bluetooth key information, which is then stored in a virtualized memory container.

[0038] Step S2: Obtain the encrypted Bluetooth key information from the virtualized memory container, perform a decryption operation to obtain the plaintext Bluetooth key information, and use the plaintext Bluetooth key information to perform encryption / decryption operations on the target information to obtain the encrypted / plaintext of the target information.

[0039] Among them, the existing plaintext Bluetooth key information can be plaintext Bluetooth key information issued by a remote server.

[0040] The virtualized memory container includes a RAM area and a FLASH area for storing encrypted Bluetooth key information. The RAM area is used for online data updates and retrieval, while the FLASH area is used for data storage. The FLASH area is an integer multiple of the RAM area, and the FLASH is divided into multiple areas based on the RAM size. Each time the encrypted Bluetooth key information is updated, the data in RAM is written to a blank FLASH area, reducing the number of FLASH erase operations, significantly reducing the execution time for storing the encrypted Bluetooth key information, and also enabling the backup of the encrypted Bluetooth key information.

[0041] In some embodiments, such as Figure 2 As shown, step S1 includes:

[0042] Step S101: Use custom rules to convert the plaintext Bluetooth key information (content filling, format transformation, etc.) to obtain plaintext data to be encrypted of a preset length;

[0043] Step S102: Transform and fill the product serial number of the current T-BOX main control chip to obtain the encryption key, so as to ensure that the encryption key of each product is different and reduce the risk of key leakage.

[0044] Step S103: Use a set of data derived from the encryption key as an initialization vector to ensure uniqueness;

[0045] Step S104: Input the plaintext data to be encrypted, the encryption key, and the initialization vector into the HSM hardware security module of the main control chip to perform encryption calculation and obtain the ciphertext Bluetooth key information;

[0046] Step S105: Store the encrypted Bluetooth key information in a virtualized memory container.

[0047] In some embodiments, such as Figure 3 As shown, step S2 includes:

[0048] Step S201: Obtain encrypted Bluetooth key information from the virtualized memory container;

[0049] Step S202: Input the encrypted Bluetooth key information, encryption key, and initialization vector into the HSM hardware security module of the main control chip to perform decryption operation and obtain the plaintext Bluetooth key information;

[0050] Step S203: The plaintext Bluetooth key information, the plaintext / ciphertext of the target information, and the initialization vector are input to the HSM hardware security module of the main control chip to perform encryption / decryption operations to obtain the ciphertext / plaintext of the target information. The plaintext Bluetooth key information is the encryption key for this encryption / decryption operation.

[0051] In some embodiments, such as Figure 4As shown, after step S202, the following steps are also included:

[0052] Step S202a: The plaintext Bluetooth key information obtained from the decryption operation in step S202 is stored in the HSM hardware security module as the encryption key input for the next encryption / decryption operation in step S203.

[0053] In some embodiments, such as Figure 4 As shown, after step S203, the following steps are also included:

[0054] Step S203a: Perform a reset operation on the HSM hardware security module to clear the plaintext Bluetooth key information stored in the HSM hardware security module.

[0055] In some embodiments, such as Figure 4 As shown, it also includes the steps for updating encrypted Bluetooth key information:

[0056] Bluetooth data verification: Perform verification calculations on the entire RAM area data storing the encrypted Bluetooth key information in the virtualized memory container to obtain verification data A, which is used for data verification after FLASH storage;

[0057] Check the FLASH area: Check the entire FLASH area where the encrypted Bluetooth key information is stored in the virtualized memory container to check for any FLASH areas that have not been written to.

[0058] When there is an area that has not been written to the FLASH, the current RAM data is written to that FLASH area. After the writing is completed, a verification calculation is performed on the FLASH area to obtain verification data B. Verification data B is compared with verification data A. If the verification results are consistent, the encrypted Bluetooth key information is successfully updated.

[0059] In some embodiments, such as Figure 4 As shown, when the entire FLASH area storing the encrypted Bluetooth key information contains data, a preset FLASH area is used as a backup FLASH area. The encrypted Bluetooth key information stored in the FLASH area is written into the backup FLASH area. After writing, a verification calculation is performed on the backup FLASH area to obtain verification data C. Verification data C is compared with verification data A to ensure that the data is completely consistent. If the verification results are consistent, the backup is successful.

[0060] Perform an erase operation on the entire FLASH area storing the encrypted Bluetooth key information in order to update the encrypted Bluetooth key information;

[0061] Write the current RAM data to the FLASH area. After writing, perform a verification calculation on the FLASH area to obtain verification data D. Compare verification data D with verification data A. If the verification results match, the encrypted Bluetooth key information is successfully updated.

[0062] In some embodiments, the present invention proposes a secure storage system based on a car Bluetooth key, the system comprising: a remote control terminal (TBOX, Telematics BOX), a virtualized memory container, and a secure storage module;

[0063] The remote control terminal includes a main control chip, and the HSM hardware security module of the main control chip can perform encrypted calculations;

[0064] The secure storage module implements the steps in any of the methods described in the above embodiments;

[0065] The virtualized memory container includes a RAM area and a FLASH area, used to store encrypted Bluetooth key information.

[0066] In some embodiments, the RAM area is used for online data updates and reads, and the FLASH area is used for data storage. The FLASH area is an integer multiple of the RAM area, and the FLASH is divided into multiple areas according to the size of the RAM.

[0067] Based on the same inventive concept, embodiments of the present invention also provide an electronic device. Figure 6 This is a structural block diagram of an electronic device provided in an embodiment of the present invention. Figure 6 As shown, an embodiment of the present invention provides an electronic device including: one or more processors 101, a memory 102, and one or more I / O interfaces 103. The memory 102 stores one or more programs, which, when executed by the one or more processors, cause the one or more processors to implement any of the methods described in the above embodiments; the one or more I / O interfaces 103 are connected between the processor and the memory, configured to enable information interaction between the processor and the memory.

[0068] The processor 101 is a device with data processing capabilities, including but not limited to a central processing unit (CPU); the memory 102 is a device with data storage capabilities, including but not limited to random access memory (RAM, more specifically SDRAM, DDR, etc.), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), and flash memory (FLASH); the I / O interface (read / write interface) 103 is connected between the processor 101 and the memory 102, and can realize information interaction between the processor 101 and the memory 102, including but not limited to a data bus (Bus).

[0069] In some embodiments, the processor 101, memory 102, and I / O interface 103 are interconnected via bus 104, and thus connected to other components of the computing device.

[0070] In some embodiments, the one or more processors 101 include a field-programmable gate array.

[0071] This invention also provides a computer-readable medium. The computer-readable medium stores a computer program, which, when executed by a processor, implements the steps of any of the methods described in the above embodiments. The computer-readable storage medium may be a volatile or non-volatile computer-readable storage medium.

[0072] This invention also provides a computer program product, including computer-readable code, or a non-volatile computer-readable storage medium carrying computer-readable code, wherein when the computer-readable code is run in a processor of an electronic device, the processor in the electronic device performs any of the methods described in the above embodiments.

[0073] Those skilled in the art will understand that all or some of the steps, systems, and apparatuses disclosed above, and their functional modules / units, can be implemented as software, firmware, hardware, or suitable combinations thereof. In hardware implementations, the division between functional modules / units mentioned above does not necessarily correspond to the division of physical components; for example, a physical component may have multiple functions, or a function or step may be performed collaboratively by several physical components. Some or all physical components may be implemented as software executed by a processor, such as a central processing unit, digital signal processor, or microprocessor, or as hardware, or as an integrated circuit, such as an application-specific integrated circuit (ASIC). Such software can be distributed on a computer-readable storage medium, which may include computer storage media (or non-transitory media) and communication media (or transient media).

[0074] As is known to those skilled in the art, the term computer storage medium includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information, such as computer-readable program instructions, data structures, program modules, or other data. Computer storage media includes, but is not limited to, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM), static random access memory (SRAM), flash memory or other memory technologies, portable compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical disc storage, magnetic cartridges, magnetic tape, disk storage or other magnetic storage devices, or any other medium that can be used to store desired information and is accessible to a computer. Furthermore, it is known to those skilled in the art that communication media typically contain computer-readable program instructions, data structures, program modules, or other data in modulated data signals such as carrier waves or other transmission mechanisms, and may include any information delivery medium.

[0075] The computer-readable program instructions described herein can be downloaded from computer-readable storage media to various computing / processing devices, or downloaded via a network, such as the Internet, local area network, wide area network, and / or wireless network, to an external computer or external storage device. The network may include copper transmission cables, fiber optic transmission, wireless transmission, routers, firewalls, switches, gateway computers, and / or edge servers. A network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards them to the computer-readable storage media in the respective computing / processing device.

[0076] The computer program instructions used to perform the operations of this invention may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, state setting data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Smalltalk, C++, etc., and conventional procedural programming languages ​​such as the "C" language or similar programming languages. The computer-readable program instructions may be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or may be connected to an external computer (e.g., via the Internet using an Internet service provider). In some embodiments, electronic circuitry, such as programmable logic circuitry, field-programmable gate arrays (FPGAs), or programmable logic arrays (PLAs), is personalized by utilizing state information from the computer-readable program instructions. This electronic circuitry can execute the computer-readable program instructions to implement various aspects of the invention.

[0077] The computer program product described herein can be implemented specifically through hardware, software, or a combination thereof. In one alternative embodiment, the computer program product is specifically embodied in a computer storage medium; in another alternative embodiment, the computer program product is specifically embodied in a software product, such as a software development kit (SDK), etc.

[0078] Various aspects of the present invention are described herein with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer-readable program instructions.

[0079] These computer-readable program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing apparatus to produce a machine such that, when executed by the processor of the computer or other programmable data processing apparatus, they create means for implementing the functions / actions specified in one or more blocks of the flowchart and / or block diagram. These computer-readable program instructions can also be stored in a computer-readable storage medium that causes a computer, programmable data processing apparatus, and / or other device to operate in a particular manner; thus, the computer-readable medium storing the instructions comprises an article of manufacture that includes instructions for implementing aspects of the functions / actions specified in one or more blocks of the flowchart and / or block diagram.

[0080] Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device to cause a series of operational steps to be performed on the computer, other programmable data processing apparatus, or other device to produce a computer-implemented process, thereby causing the instructions executed on the computer, other programmable data processing apparatus, or other device to perform the functions / actions specified in one or more boxes of a flowchart and / or block diagram.

[0081] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of an instruction, which contains one or more executable instructions for implementing a specified logical function. In some alternative implementations, the functions marked in the blocks may occur in a different order than those shown in the drawings. For example, two consecutive blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, may be implemented using a dedicated hardware-based system that performs the specified function or action, or using a combination of dedicated hardware and computer instructions.

[0082] Example embodiments have been disclosed herein, and while specific terminology has been used, it is for illustrative purposes only and should be construed as such, and is not intended to be limiting. In some instances, it will be apparent to those skilled in the art that features, characteristics, and / or elements described in conjunction with particular embodiments may be used alone, or in combination with features, characteristics, and / or elements described in conjunction with other embodiments, unless otherwise expressly indicated. Therefore, those skilled in the art will understand that various changes in form and detail may be made without departing from the scope of the invention as set forth in the appended claims.

Claims

1. A secure storage method based on a car Bluetooth key, characterized in that, include: Step S1: The existing plaintext Bluetooth key information is segmented and encrypted to obtain ciphertext Bluetooth key information, which is then stored in a virtualized memory container. Step S2: Obtain the encrypted Bluetooth key information from the virtualized memory container, perform decryption to obtain the plaintext Bluetooth key information, and use the plaintext Bluetooth key information to perform encryption / decryption operations on the target information to obtain the encrypted / plaintext of the target information. The virtualized memory container includes a RAM area and a FLASH area, used to store encrypted Bluetooth key information.

2. The method according to claim 1, wherein, Step S1 includes: Step S101: Use custom rules to convert plaintext Bluetooth key information to obtain plaintext data to be encrypted of a preset length; Step S102: Transform and fill the product serial number of the current remote control terminal main control chip to obtain the encryption key; Step S103: Use a set of data derived from the encryption key as an initialization vector; Step S104: Input the plaintext data to be encrypted, the encryption key, and the initialization vector into the hardware security module of the main control chip to perform encryption calculation and obtain the ciphertext Bluetooth key information; Step S105: Store the encrypted Bluetooth key information in a virtualized memory container.

3. The method according to claim 1 or 2, wherein, Step S2 includes: Step S201: Obtain encrypted Bluetooth key information from the virtualized memory container; Step S202: Input the encrypted Bluetooth key information, encryption key, and initialization vector into the HSM hardware security module of the main control chip to perform decryption operation and obtain the plaintext Bluetooth key information; Step S203: The plaintext Bluetooth key information, the plaintext / ciphertext of the target information, and the initialization vector are input to the HSM hardware security module of the main control chip to perform encryption / decryption operations to obtain the ciphertext / plaintext of the target information. The plaintext Bluetooth key information is the encryption key for this encryption / decryption operation.

4. The method according to claim 3, wherein, Following step S202 are: Step S202a: The plaintext Bluetooth key information obtained from the decryption operation in step S202 is stored in the HSM hardware security module as the encryption key input for the next encryption / decryption operation in step S203.

5. The method according to claim 3, wherein, Step S203 is followed by: Step S203a: Perform a reset operation on the HSM hardware security module to clear the plaintext Bluetooth key information stored in the HSM hardware security module.

6. The method according to claim 3, wherein, It also includes the steps for updating encrypted Bluetooth key information: Bluetooth data verification: Perform verification calculations on the entire RAM area data storing the encrypted Bluetooth key information in the virtualized memory container to obtain verification data A; Check the FLASH area: Check the entire FLASH area where the encrypted Bluetooth key information is stored in the virtualized memory container to check for any FLASH areas that have not been written to. When there is an area that has not been written to the FLASH, the current RAM data is written to that FLASH area. After the writing is completed, a verification calculation is performed on the FLASH area to obtain verification data B. Verification data B is compared with verification data A. If the verification results are consistent, the encrypted Bluetooth key information is successfully updated.

7. The method according to claim 6, wherein, The encrypted Bluetooth key information update step also includes: When the entire FLASH area storing the encrypted Bluetooth key information contains data, a preset FLASH area is used as a backup FLASH area. The encrypted Bluetooth key information stored in the FLASH area is written into the backup FLASH area. After writing is completed, a verification calculation is performed on the backup FLASH area to obtain verification data C. Verification data C is compared with verification data A. If the verification results are consistent, the backup is successful. Perform an erase operation on the entire FLASH area storing the encrypted Bluetooth key information; Write the current RAM data to the FLASH area. After writing, perform a verification calculation on the FLASH area to obtain verification data D. Compare verification data D with verification data A. If the verification results match, the encrypted Bluetooth key information is successfully updated.

8. A secure storage system based on a car Bluetooth key, characterized in that, include: Remote control terminal, virtualized memory container, secure storage module; The remote control terminal includes a main control chip, and the hardware security module of the main control chip can perform encrypted calculations; The secure storage module implements the steps in any one of claims 1 to 7; The virtualized memory container includes a RAM area and a FLASH area, used to store encrypted Bluetooth key information.

9. The system according to claim 8, wherein, The RAM area is used for online data updates and reading, and the FLASH area is used for data storage; the FLASH area is an integer multiple of the RAM area, and the FLASH has been divided into multiple areas according to the size of the RAM.

10. A computer-readable medium storing a computer program thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of any of the methods described in claims 1 to 7, wherein the computer-readable storage medium is a volatile or non-volatile computer-readable storage medium.

Images