Safety management method and system for remote upgrade of railway vehicle software OTA system

Abstract

The invention provides a safety management method and system for remote upgrade of a railway vehicle software OTA system, and is suitable for the technical field of railway vehicle software upgrade.The safety management method comprises the steps that a user name and a password input by an operator are received, and a software upgrade notification is responded; sharing and outputting a user name, a password and a software upgrading request through a one-way data sharing link; the accuracy of the closing password M1 is verified, if the closing password M1 is accurate, the relay K1 is closed, and the upgrading main link is connected; receiving the upgrade data packet of the new version through the upgrade main link, and decrypting and checking the upgrade data packet; software upgrading is carried out through the upgrading main link and the decrypted and verified upgrading data packet of the new version; after software upgrading is completed, the relay K1 is disconnected, and an upgrading main link is cut off; the method has the beneficial effects that the method can be suitable for the environment of centralized and unified upgrading of multiple devices in the railway vehicle, and can meet the requirements of accuracy, timeliness and safety.

Description

Technical Field

[0001] This application relates to the technical field of rail vehicle software upgrades, specifically to a secure management method and system for remote upgrades of rail vehicle software OTA systems. Background Technology

[0002] Traditional upgrades to rail vehicle onboard software typically involve manual, timed, and location-specific wired connections to replace old software versions. The correctness of these upgrades directly impacts vehicle safety and operational stability. However, due to the manual nature of the process, the accuracy, timeliness, and security of the upgrades cannot be guaranteed. In scenarios with complex and ever-changing software versions, upgrade personnel face increasing difficulties during on-site implementation. Furthermore, each rail vehicle upgrade involves communication and coordination among multiple departments, including electrical, locomotive, dispatching, track maintenance, and rolling stock. Therefore, the current upgrade method is insufficient for quickly completing upgrades, making it difficult to effectively control the process and results, and posing certain safety risks.

[0003] Currently, rail vehicles (such as high-speed trains and subways) have achieved a high level of informatization. To ensure efficient and safe operation, various types of monitoring, communication, and control equipment have been installed, including Dynamic Monitoring System (DMS), EMU Driver Operation Information Analysis System (EOAS), and Vehicle Wireless Transmission Device (WTD). As the informatization requirements of vehicles further increase, the number of onboard data acquisition devices is growing. Arranging centralized upgrades by various equipment suppliers during vehicle maintenance not only requires significant manpower and resources for coordination but also presents considerable management challenges. Not only do high-speed trains and subways with high informatization levels require centralized upgrades, but locomotives, diesel multiple units, and high-end passenger cars, whose informatization is gradually improving, also need centralized upgrades. Therefore, there is an urgent need for a method that can quickly and safely perform centralized upgrades of multiple devices.

[0004] Over-the-air (OTA) software updates are commonly used in the automotive industry to enable wireless software upgrades, reducing manual workload and improving upgrade efficiency. OTA systems typically use vehicle-to-ground wireless communication. During the upgrade process, because upgrade data packets are transmitted over open networks, they are easily attacked by intruders. Intruders often use impersonation and tampering techniques to attack the upgrade data packets, leading to their unauthorized acquisition and modification during network transmission, resulting in data leakage or upgrade failure. Therefore, it is necessary to encrypt the upgrade data packets for OTA systems. However, intruders can still decipher encrypted upgrade data packets. Therefore, a more secure data management method is needed during OTA system upgrades.

[0005] Invention patent 202410925668.0 discloses a secure management method, system, medium, and electronic device for OTA upgrades, describing the distribution of keys from the vehicle controller to the smart cockpit control domain within the vehicle. However, it does not consider the security of the wireless transmission of upgrade software packages from the ground server to the vehicle. Based on experience with rail vehicle software upgrades, since the vehicle's local network management is relatively secure, the risk of upgrade data packets being tampered with generally occurs during the wireless network phase of vehicle-to-ground transmission. Summary of the Invention

[0006] To address one of the aforementioned technical deficiencies, this application provides a safe management method and system for remote upgrades of rail vehicle software OTA systems.

[0007] According to the first aspect of this application, a secure management method for remote upgrades of a rail vehicle software OTA system is provided, comprising: It receives the username and password entered by the operator and responds to the software upgrade notification initiated by the operator. The system shares and outputs the username, password, and software upgrade request via a one-way data sharing link. Receive and verify the accuracy of the closed password M1 generated based on the username, password, and system time. If accurate, close relay K1 to connect the main upgrade link and output a message indicating that the main upgrade link has been successfully connected. The upgrade process involves receiving new version upgrade data packets via the main link and then decrypting and verifying these data packets. Software upgrades are performed by upgrading the main link and decrypting and verifying the new version of the upgrade data packet. After the software upgrade is complete, disconnect relay K1 to cut off the main upgrade link and output a message indicating that the software upgrade was successful.

[0008] Preferably, a network security protocol is constructed after the main link is upgraded and connected. The process of receiving the new version upgrade data packet via the upgrade main link specifically includes: receiving the new version upgrade data packet via a network security protocol; The software upgrade, which involves upgrading the main link and decrypting and verifying the new version of the upgrade data packet, specifically includes: upgrading the software using network security protocols and decrypting and verifying the new version of the upgrade data packet.

[0009] More preferably, the construction of the network security protocol specifically includes: Two-way identity certificate verification is performed by upgrading the main link. If the two-way identity certificate verification is successful, a negotiation key M2 is generated through the negotiation protocol. The closed cipher M1 and the negotiated key M2 are merged to form the merged cipher M3, and an IPsec VPN tunnel is established by upgrading the main link based on the merged cipher M3.

[0010] More preferably, the step of performing two-way identity certificate verification and signature through upgrading the main link specifically includes: Send a request to verify the target identity certificate; Upon receiving the target identity certificate information, the system performs a first verification on the target identity certificate information using a preset first public key. If the first verification passes, the system sends its own identity certificate information for a second verification. Receive the second verification result. If the second verification passes, the two-way identity certificate verification passes.

[0011] According to a second aspect of this application, a safety management system for remote upgrades of a rail vehicle software OTA system is provided, comprising: The data sharing module is used to share usernames, passwords, and software upgrade requests via a one-way data sharing link; The first communication module is used to output the username, password, and software upgrade request; it is also used to output information indicating that the main link for the upgrade has been successfully established; and it is also used to output information indicating that the software upgrade has been successfully completed. The upgrade management module is used to receive the username and password entered by the operator and respond to the software upgrade notification initiated by the operator; it is also used to receive and verify the accuracy of the closed password M1 generated based on the username, password and system time. The main link control module is used to close relay K1 and connect the upgrade main link when the closing password M1 is accurate; it is also used to disconnect relay K1 and disconnect the upgrade main link after the software upgrade is completed. The data processing module is used to receive the new version upgrade data packet through the upgrade main link, and to decrypt and verify the new version upgrade data packet; The first upgrade module is used to upgrade the software by upgrading the main link and decrypting and verifying the new version of the upgrade data packet.

[0012] Preferably, the data processing module, the data sharing module, and the first communication module are electrically connected sequentially via a unidirectional data sharing link; The data processing module is electrically connected to the security monitoring module and the first upgrade module; The first communication module is electrically connected to the security monitoring module via an upgrade main link, and a relay K1 is installed on the upgrade main link; the upgrade management module is electrically connected to the security monitoring module, and the upgrade management module and the relay K1 are electrically connected via a main link control module.

[0013] Preferably, it further includes a network security protocol construction module, used to construct a network security protocol after the main link is upgraded; the network security protocol construction module is electrically connected to both the first communication module and the security monitoring module.

[0014] More preferably, the network security protocol construction module includes: The two-way identity verification unit is used to perform two-way identity certificate verification through the upgraded main link; The negotiation key generation unit is used to generate negotiation key M2 through negotiation protocol when the two-way identity certificate verification is successful. A fusion unit is used to fuse the closed cipher M1 and the negotiated key M2 to form a fusion cipher M3; The tunnel establishment unit is used to establish an IPsec VPN tunnel by upgrading the main link based on the converged cipher M3.

[0015] More preferably, the two-way identity verification unit includes: The request unit is used to issue a signature verification request for the target identity certificate; The first receiving unit is used to receive the target identity certificate information; it is also used to receive the second verification result. If the second verification is successful, the two-way identity certificate verification is successful. The first signature verification unit is used to perform a first signature verification on the target identity certificate information using a preset first public key when the target identity certificate information is received. The first output unit is used to send its own identity certificate information for the second verification if the first verification passes.

[0016] Preferably, it further includes: The second communication module is used to receive the new version upgrade data packet and the current software version information; it is also used to output "no update required" when the comparison results are consistent, and to send a software upgrade notification to the operator when the comparison results are inconsistent; it is also used to receive the username, password, and software upgrade request; it is also used to output the closure cipher M1; it is also used to send the software upgrade request to the supervisor to activate the upgrade program; it is also used to output the new version upgrade data packet through the upgrade main link after receiving the upgrade main link connection success information based on the closure cipher M1; and it is also used to receive the software upgrade success information and complete the software upgrade. The version comparison module is used to compare the version information of the new version upgrade data package with the current software version information; The password generation module is used to generate a closed password M1 based on the username, password, and system time. The second upgrade module is used to upgrade the software by upgrading the main link.

[0017] According to a third aspect of this application, an electronic device is provided, comprising: Memory; Processor; and Computer programs; The computer program is stored in the memory and configured to be executed by the processor to implement the safety management method for remote upgrade of the rail vehicle software OTA system as described in any of the above.

[0018] According to a fourth aspect of this application, a computer-readable storage medium is provided having a computer program stored thereon; the computer program is executed by a processor to implement a secure management method for remote upgrades of a rail vehicle software OTA system as described in any of the preceding claims.

[0019] The beneficial effects of this application are as follows: In this application, under normal conditions (i.e., non-upgrade mode), the vehicle-mounted terminal can communicate unidirectionally with the outside world through a one-way data sharing link. It can periodically write the current software version information (software version information of each device) into the data sharing module 10. Based on requests initiated by the ground terminal, it then outputs the information unidirectionally through the first communication module 20, facilitating comparison by the ground terminal to determine whether a software upgrade is needed. When the operator's username and password are received and their identity is confirmed, the terminal responds to the software upgrade notification initiated by the operator. It then outputs the username, password, and software upgrade request unidirectionally, allowing the ground terminal to generate a closed cipher M1. The accuracy of the closed cipher M1 is verified (i.e., the decryption process). If the verification is successful, relay K1 is closed, connecting the upgrade main link. Before connecting the upgrade main link, information can only be transmitted unidirectionally; after connecting, information can be received through the upgrade main link, facilitating software upgrades (entering upgrade mode), including receiving upgrade data packets for the new version. After the upgrade is complete, relay K1 (which is physically isolated) still needs to be disconnected to cut off the main upgrade link, restore unidirectional output, and output the upgraded software status and device heartbeat feedback. In this application, in non-upgrade mode, a unidirectional data sharing link is used to achieve communication with the outside world, ensuring that the vehicle status of the rail vehicle (specifically, the current software status of each device, current software version information, historical upgrade time, operating status of safety detection module 70, status of data processing module 50, status of first upgrade module 60, etc.) is output unidirectionally, ensuring that the on-board intranet is not attacked by external networks. In addition, in upgrade mode, the main upgrade link is connected, and the software upgrade can only be performed after multiple security authentications. It is suitable for environments where multiple devices in rail vehicles are upgraded centrally and uniformly, and can meet the requirements of accuracy, timeliness, and security. It avoids the problems of multiple departments needing to communicate and coordinate, high upgrade difficulty, and certain security risks in existing technologies. While ensuring the correct upgrade of the rail vehicle's on-board software, it improves the safety of the rail vehicle and enables the rail vehicle to operate normally.

[0020] Other features and advantages of this application will be set forth in the following description, and will be apparent in part from the description, or may be learned by practicing the application. The objectives and other advantages of this application may be realized and obtained by means of what is pointed out in the written description and the accompanying drawings. Attached Figure Description

[0021] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings: Figure 1A flowchart illustrating a safety management method for remote upgrades of a rail vehicle software OTA system provided in this application; Figure 2 Another flowchart illustrating a safety management method for remote upgrades of a rail vehicle software OTA system provided in this application; Figure 3 Another flowchart illustrating a safety management method for remote upgrades of a rail vehicle software OTA system provided in this application; Figure 4 for Figure 3 A schematic diagram illustrating the process of two-way identity certificate verification and signing via upgrading the main link; Figure 5 A schematic diagram of the ground-side process for a safety management method for remote upgrade of a rail vehicle software OTA system provided in this application; Figure 6 This is another flowchart illustrating the process of performing two-way identity certificate verification and signing by upgrading the main link; Figure 7 A schematic diagram of the structure of a safety management system for remote upgrade of rail vehicle software OTA system provided in this application; Figure 8 Another structural diagram of a safety management system for remote upgrade of rail vehicle software OTA system provided in this application; Figure 9 A structural diagram of the modules for building network security protocols; Figure 10 for Figure 9 A schematic diagram of the structure of the two-way identity verification unit; Figure 11 A schematic diagram of the ground end of a safety management system for remote upgrade of rail vehicle software OTA system provided in this application; Figure 12 Another structural diagram of the two-way identity verification unit provided in this application; In the picture: 10 is the data sharing module, 20 is the first communication module, 30 is the upgrade management module, 40 is the main link control module, 50 is the data processing module, 60 is the first upgrade module, 70 is the security monitoring module, 80 is the network security protocol construction module, 90 is the second communication module, 100 is the version comparison module, 110 is the password generation module, 120 is the second upgrade module, 801 is the two-way identity verification unit, 802 is the negotiation key generation unit, 803 is the fusion unit, 804 is the tunnel establishment unit, 8011 is the request unit, 8012 is the first receiving unit, 8013 is the first verification unit, 8014 is the first output unit, 8015 is the second receiving unit, 8016 is the second output unit, and 8017 is the second verification unit. Detailed Implementation

[0022] To make the technical solutions and advantages of the embodiments of this application clearer, the exemplary embodiments of this application will be described in further detail below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not an exhaustive list of all embodiments. It should be noted that, unless otherwise specified, the embodiments and features in the embodiments of this application can be combined with each other.

[0023] like Figure 1 , Figure 2 As shown, to address the above-mentioned problems, this application provides a secure management method for remote upgrades of a rail vehicle software OTA system, including: The current software version information is processed and shared and output through a one-way data sharing link; It receives the username and password entered by the operator and responds to the software upgrade notification initiated by the operator. The system shares and outputs the username, password, and software upgrade request via a one-way data sharing link. Receive and verify the accuracy of the closed password M1 generated based on the username, password, and system time (usually sent via email or SMS). If accurate, close relay K1 (using hard-wired commands to control the on / off state of relay K1), connect the upgrade main link, and output a message indicating that the upgrade main link has been successfully connected. The upgrade process involves receiving new version upgrade data packets via the main link and then decrypting and verifying these data packets. After receiving confirmation of the upgrade request from the regulatory personnel (usually via email or SMS), the upgrade process is activated. Software upgrades are performed by upgrading the main link and by decrypting and verifying the new version of the upgrade data packet. After the software upgrade is complete, disconnect relay K1 to cut off the main upgrade link and output a message indicating that the software upgrade was successful. Specifically, it can also share and output the upgraded software status and device heartbeat feedback through a one-way data sharing link.

[0024] In this application, under normal conditions (i.e., non-upgrade mode), the vehicle-mounted terminal can communicate unidirectionally with the outside world through a one-way data sharing link. It can periodically write the current software version information (software version information of each device) into the data sharing module 10. Based on requests initiated by the ground terminal, it then outputs the information unidirectionally through the first communication module 20, facilitating comparison by the ground terminal to determine whether a software upgrade is needed. When the operator's username and password are received and their identity is confirmed, the terminal responds to the software upgrade notification initiated by the operator. It then outputs the username, password, and software upgrade request unidirectionally, allowing the ground terminal to generate a closed cipher M1. The accuracy of the closed cipher M1 is verified (i.e., the decryption process). If the verification is successful, relay K1 is closed, connecting the upgrade main link. Before connecting the upgrade main link, information can only be transmitted unidirectionally; after connecting, information can be received through the upgrade main link, facilitating software upgrades (entering upgrade mode), including receiving upgrade data packets for the new version. After the upgrade is complete, relay K1 (which is physically isolated) still needs to be disconnected to cut off the main upgrade link, restore unidirectional output, and output the upgraded software status and device heartbeat feedback. In this application, in non-upgrade mode, a unidirectional data sharing link is used to achieve communication with the outside world, ensuring that the vehicle status of the rail vehicle (specifically, the current software status of each device, current software version information, historical upgrade time, operating status of safety detection module 70, status of data processing module 50, status of first upgrade module 60, etc.) is output unidirectionally, ensuring that the on-board intranet is not attacked by external networks. In addition, in upgrade mode, the main upgrade link is connected, and the software upgrade can only be performed after multiple security authentications. It is suitable for environments where multiple devices in rail vehicles are upgraded centrally and uniformly, and can meet the requirements of accuracy, timeliness, and security. It avoids the problems of multiple departments needing to communicate and coordinate, high upgrade difficulty, and certain security risks in existing technologies. While ensuring the correct upgrade of the rail vehicle's on-board software, it improves the safety of the rail vehicle and enables the rail vehicle to operate normally.

[0025] like Figure 2 As shown, more specifically, all received information needs to be security monitored first.

[0026] In this application, all received information undergoes security monitoring in both non-upgrade and upgrade modes, further ensuring the security of wireless data transmission and enabling timely detection of issues such as impersonation or tampering of new version upgrade data packets. The relay K1 in this application features a physically isolated design and includes steps for operators to enter a username and password. Only with correct login information can login be successful and a software upgrade notification initiated. Furthermore, supervisory personnel must respond to the software upgrade request and confirm the upgrade instruction before the upgrade program can be activated. These multiple layers of protection enhance security.

[0027] like Figure 3 As shown, furthermore, after upgrading the main link, a network security protocol is constructed; The process of receiving the new version upgrade data packet via the upgrade main link specifically includes: receiving the new version upgrade data packet via a network security protocol; The software upgrade, which involves upgrading the main link and decrypting and verifying the new version of the upgrade data packet, specifically includes: upgrading the software using network security protocols and decrypting and verifying the new version of the upgrade data packet.

[0028] Furthermore, the construction of the network security protocol specifically includes: Two-way identity certificate verification is performed by upgrading the main link. If the two-way identity certificate verification is successful, a negotiation key M2 is generated through the negotiation protocol (Diffie-Hellman, key exchange protocol). The closed cipher M1 and the negotiated key M2 are merged to form the merged cipher M3, and an IPsec VPN tunnel is established by upgrading the main link based on the merged cipher M3.

[0029] In this application, after the main link is successfully upgraded, a network security protocol is constructed, specifically including two-way identity certificate verification, the setting of a fused cipher, and the establishment of an IPsec VPN tunnel. This further enhances the security authentication level and improves the security of wireless communication software upgrades. Two-way identity certificate verification and the negotiation key M2 are both verified or negotiated bidirectionally by the vehicle-mounted and ground-based terminals to form a fused cipher M3. The encryption method is relatively private and complex, preventing external intrusion. The security settings in this application, such as two-way identity certificate verification, negotiation key M2, fused cipher M3, and IPsec VPN tunnel, are integrated with the aforementioned relay K1 control; the operator inputs a username and password; only with correct login information can login be successful and a software upgrade notification initiated; and the supervisor needs to reply with confirmation of the upgrade request before the upgrade program can be activated. These multiple security elements (encryption protection, authentication protection, physical isolation protection, etc.) are integrated to ensure the security of data transmission in both non-upgrade and upgrade modes.

[0030] like Figure 4 As shown, further, the step of performing two-way identity certificate verification and signing through upgrading the main link specifically includes: Send a request to verify the target identity certificate; Upon receiving the target identity certificate information, the system performs a first verification on the target identity certificate information using a preset first public key. If the first verification passes, the system sends its own identity certificate information for a second verification. Receive the second verification result. If the second verification passes, the two-way identity certificate verification passes.

[0031] This application implements two-way identity certificate verification, which includes a first verification of the target identity certificate information on the ground end and a second verification of the vehicle-mounted end's own identity certificate information. Only after passing both the first and second verifications can the two-way identity certificate verification be completed, allowing subsequent software upgrade operations to proceed. This further enhances security.

[0032] like Figure 5 As shown, this application also includes a security management method for providing new version upgrade data packets (typically ground-based), comprising the following steps: Receive the new version upgrade data package and the current software version information, and compare the version information of the new version upgrade data package with the current software version information; If the comparison results match, output that no information needs to be updated; otherwise, send a software upgrade notification to the operator. Receive username, password and software upgrade request, and generate and output closed password M1 based on username, password and system time; Send the software upgrade request to regulators to activate the upgrade process; Upon receiving the message that the upgrade main link has been successfully connected according to the closed cipher M1, the new version upgrade data packet will be output through the upgrade main link. Software upgrades are performed using established network security protocols. Receive the software upgrade success message and complete the software upgrade.

[0033] This application provides a method for the ground terminal to provide a new version of the upgrade data package to support the upgrade operation. It interacts with the vehicle-mounted terminal, comparing the version information of the new version of the upgrade data package with the current software version information. If the comparison results are consistent, it indicates that the current software version is the latest version, and no upgrade is needed. If the comparison results are inconsistent, it indicates that a software upgrade is required to adapt to the usage requirements of the new environment. The method includes generating a closed cipher M1 based on the username, password, and system time; sending a software upgrade request to supervisors to activate the upgrade process; and outputting the new version of the upgrade data package to the vehicle-mounted terminal after the main upgrade link is successfully established. Furthermore, the network security protocol is jointly negotiated and constructed by the vehicle-mounted terminal and the ground terminal, essentially establishing a private channel for exclusive data communication.

[0034] like Figure 6 As shown, specifically, upgrading the main link for two-way identity certificate verification also includes: After receiving the target identity certificate verification request, output the target identity certificate information; After receiving the first verification result and its own identity certificate information, it performs a second verification on its own identity certificate information using a preset second public key. If the second verification passes, the two-way identity certificate verification passes, and a two-way identity certificate verification pass notification is output.

[0035] This application provides a ground-based verification method for corresponding two-way identity certificate verification, enabling mutual verification of identities with the vehicle-mounted terminal, thus enhancing security.

[0036] like Figure 7 As shown, this application also provides a safety management system for remote upgrades of rail vehicle software OTA systems, including: Data sharing module 10 is used to share the current software version information through a one-way data sharing link; it is also used to share usernames, passwords and software upgrade requests through a one-way data sharing link. The first communication module 20 is used to output the current software version information; it is also used to output the username, password and software upgrade request; it is also used to output the information that the main link for the upgrade has been successfully connected; and it is also used to output the information that the software upgrade has been successfully completed. The upgrade management module 30 is used to receive the username and password entered by the operator and respond to the software upgrade notification initiated by the operator; it is also used to receive and verify the accuracy of the closed password M1 generated based on the username, password and system time; and it is also used to activate the upgrade program after receiving the confirmation upgrade instruction from the supervisor in response to the software upgrade request. The main link control module 40 is used to close relay K1 and connect the upgrade main link when the closing password M1 is accurate; it is also used to disconnect relay K1 and disconnect the upgrade main link after the software upgrade is completed. The data processing module 50 is used to receive the new version upgrade data packet through the upgrade main link, and to decrypt and verify the new version upgrade data packet; it is also used to process the current software version information. The first upgrade module 60 is used to perform software upgrades by upgrading the main link and decrypting and verifying the new version of the upgrade data packet. The security monitoring module 70 is used to perform security monitoring on all received information.

[0037] This application provides a corresponding security management system, which corresponds to the security management method. Therefore, it can be considered to include the beneficial effects of the aforementioned security management method. It does not serve the purpose of being concise and saving space, so it will not be elaborated here.

[0038] Specifically, the first upgrade module 60 is also used to upgrade the verified upgrade data packets to the vehicle network equipment, such as the traction control system, HMI system, door system and air conditioning system, through the maintenance network switch according to the upgrade script.

[0039] Furthermore, the data processing module 50, the data sharing module 10, and the first communication module 20 are electrically connected sequentially via a unidirectional data sharing link; The data processing module 50 is electrically connected to the security monitoring module 70 and the first upgrade module 60. The first communication module 20 is electrically connected to the security monitoring module 70 via an upgrade main link, and a relay K1 is provided on the upgrade main link; the upgrade management module 30 is electrically connected to the security monitoring module 70, and the upgrade management module 30 and the relay K1 are electrically connected via a main link control module 40.

[0040] In the non-upgrade mode of this application, the data processing module 50 processes the vehicle-mounted data, and then outputs it unidirectionally through the unidirectional data sharing link between the data sharing module 10 and the first communication module 20. The on / off control of the upgrade main link is achieved by the relay K1 on the upgrade main link. After the first communication module 20 and the upgrade management module 30 receive external input information, they both undergo defensive security monitoring through the security monitoring module 70. The security monitoring module 70 supports access control whitelists, application-layer VPN technology, firewall functions, and CA authentication to ensure the security of input information and prevent malicious attacks from the external network from damaging the internal network. Simultaneously, the security monitoring module 70 has an automatic physical isolation function, capable of cutting off communication between the OTA server and the external network as needed. Furthermore, the security monitoring module 70 has a trusted module to ensure the trustworthiness and security of its own functions.

[0041] like Figure 8 , Figure 9 As shown, it further includes a network security protocol construction module 80, used to construct a network security protocol after the main link is upgraded; The network security protocol construction module 80 is electrically connected to the first communication module 20 and the security monitoring module 70.

[0042] Furthermore, the network security protocol construction module 80 includes: The two-way identity verification unit 801 is used to perform two-way identity certificate verification through the upgraded main link. The negotiation key generation unit 802 is used to generate a negotiation key M2 through the negotiation protocol when the two-way identity certificate verification is successful. The fusion unit 803 is used to fuse the closed cipher M1 and the negotiation key M2 to form the fusion cipher M3; Tunnel establishment unit 804 is used to establish an IPsec VPN tunnel by upgrading the main link based on the converged cipher M3.

[0043] like Figure 10 As shown, the two-way identity verification unit 801 further includes: Request unit 8011 is used to issue a target identity certificate verification request; The first receiving unit 8012 is used to receive target identity certificate information; it is also used to receive the second verification result. If the second verification is successful, the two-way identity certificate verification is successful. The first signature verification unit 8013 is used to perform a first signature verification on the target identity certificate information using a preset first public key when the target identity certificate information is received. The first output unit 8014 is used to send its own identity certificate information for the second verification if the first verification passes.

[0044] like Figure 11 As shown, it further includes: The second communication module 90 is used to receive the new version upgrade data packet and the current software version information; it is also used to output no update information when the comparison results are consistent, and to send a software upgrade notification to the operator when the comparison results are inconsistent; it is also used to receive the username, password and software upgrade request; it is also used to output the closure cipher M1; it is also used to send the software upgrade request to the supervisor to activate the upgrade program; it is also used to output the new version upgrade data packet through the upgrade main link after receiving the upgrade main link connection success information based on the closure cipher M1; it is also used to receive the software upgrade success information and complete the software upgrade. Version comparison module 100 is used to compare the version information of the new version upgrade data package with the current software version information; Password generation module 110 is used to generate a closed password M1 based on the username, password and system time; The second upgrade module 120 is used to perform software upgrades by upgrading the network security protocols built on the main link.

[0045] The second communication module 90 in this application can also provide access services to the OTA system, and includes functions such as status monitoring of the OTA system, management of logged-in users, and permission management. In addition, the ground terminal is equipped with an upgrade server, a temporary storage server, a CA certificate, a firewall, a vulnerability scanning system, a security monitoring platform, a data server, and a bastion host. The upgrade server is used to import programs to be upgraded and upgrade plans, and to execute the upgrade function for the vehicle-mounted software; the temporary storage server mainly stores programs to be upgraded and upgrade plans, and performs virus scanning on the imported upgrade data packets. After confirming the security of the upgrade data packets, it sends them to the upgrade server for upgrade; the CA certificate should meet the application scenarios and business customization requirements of the wireless upgrade ground system, and have the function of providing identity authentication services for the vehicle-mounted wireless upgrade device; the firewall has filtering, NAT, and stateful inspection functions, and access control based on stateful inspection technology can effectively resist unauthorized access, prevent network attacks, and prevent virus transmission. The system includes: a vulnerability scanning system capable of performing penetration testing on system-level vulnerabilities such as operating systems, network devices, firewalls, and remote services; a security monitoring platform that collects communication data in real time via a bypass installation method; a data server that stores system data such as upgrade results, operational data, and daily maintenance data; and a bastion host that serves as the system's operation and audit management platform, providing a unified maintenance platform for operators to maintain hosts and network devices.

[0046] like Figure 12 As shown, specifically, the two-way identity verification unit 801 also includes: The second receiving unit 8015 is used to receive the target identity certificate verification request; it is also used to receive the first verification pass result and its own identity certificate information; and it is also used to output a two-way identity certificate verification pass notification. The second output unit 8016 is used to output the target identity certificate information; The second signature verification unit 8017 is used to perform a second signature verification on its own identity certificate information using a preset second public key. If the second signature verification is successful, the two-way identity certificate signature verification is successful.

[0047] This application also provides an electronic device, including: Memory; Processor; and Computer programs; The computer program is stored in the memory and configured to be executed by the processor to implement the safety management method for remote upgrade of the rail vehicle software OTA system as described in any of the above.

[0048] This application also provides a computer-readable storage medium having a computer program stored thereon; the computer program is executed by a processor to implement a secure management method for remote upgrades of a rail vehicle software OTA system as described in any of the above claims.

[0049] It should be understood that although the steps in the flowchart are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order constraint on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the diagram may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the sub-steps or stages of other steps.

[0050] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code. The solutions in the embodiments of this application can be implemented in various computer languages, such as C, VHDL, Verilog, the object-oriented programming language Java, and the interpreted scripting language JavaScript.

[0051] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0052] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0053] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0054] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature. In the description of this application, "multiple" means at least two, such as two, three, etc., unless otherwise explicitly specified.

[0055] Although preferred embodiments of this application have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of this application.

[0056] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.

Claims

1. A safety management method for remote upgrades of a rail vehicle software OTA system, characterized in that, include: It receives the username and password entered by the operator and responds to the software upgrade notification initiated by the operator. The system shares and outputs the username, password, and software upgrade request via a one-way data sharing link. Receive and verify the accuracy of the closed password M1 generated based on the username, password, and system time. If accurate, close relay K1 to connect the main upgrade link and output a message indicating that the main upgrade link has been successfully connected. The upgrade process involves receiving new version upgrade data packets via the main link and then decrypting and verifying these data packets. Software upgrades are performed by upgrading the main link and decrypting and verifying the new version of the upgrade data packet. After the software upgrade is complete, disconnect relay K1 to cut off the main upgrade link and output a message indicating that the software upgrade was successful.

2. The safety management method for remote upgrade of rail vehicle software OTA system according to claim 1, characterized in that, After upgrading the main link, establish network security protocols; The process of receiving the new version upgrade data packet via the upgrade main link specifically includes: receiving the new version upgrade data packet via a network security protocol; The software upgrade, which involves upgrading the main link and decrypting and verifying the new version of the upgrade data packet, specifically includes: upgrading the software using network security protocols and decrypting and verifying the new version of the upgrade data packet.

3. The safety management method for remote upgrade of rail vehicle software OTA system according to claim 2, characterized in that, The construction of the network security protocol specifically includes: Two-way identity certificate verification is performed by upgrading the main link. If the two-way identity certificate verification is successful, a negotiation key M2 is generated through the negotiation protocol. The closed cipher M1 and the negotiated key M2 are merged to form the merged cipher M3, and an IPsec VPN tunnel is established by upgrading the main link based on the merged cipher M3.

4. The safety management method for remote upgrade of rail vehicle software OTA system according to claim 3, characterized in that, The aforementioned two-way identity certificate verification and signature verification via upgrading the main link specifically includes: Send a request to verify the target identity certificate; Upon receiving the target identity certificate information, the system performs a first verification on the target identity certificate information using a preset first public key. If the first verification passes, the system sends its own identity certificate information for a second verification. Receive the second verification result. If the second verification passes, the two-way identity certificate verification passes.

5. A safety management system for remote upgrades of a rail vehicle software OTA system, characterized in that, include: The data sharing module (10) is used to share usernames, passwords and software upgrade requests through a one-way data sharing link; The first communication module (20) is used to output the username, password and software upgrade request; it is also used to output the information that the main link upgrade was successful; it is also used to output the information that the software upgrade was successful. The upgrade management module (30) is used to receive the username and password entered by the operator and respond to the software upgrade notification initiated by the operator; It is also used to receive and verify the accuracy of the closed cipher M1 generated based on the username, password, and system time; The main link control module (40) is used to close the relay K1 and connect the upgrade main link when the closing password M1 is accurate. It is also used to disconnect relay K1 and cut off the main upgrade link after the software upgrade is completed; The data processing module (50) is used to receive the new version upgrade data packet through the upgrade main link, and to decrypt and verify the new version upgrade data packet; The first upgrade module (60) is used to perform software upgrades by upgrading the main link and decrypting and verifying the new version of the upgrade data packet.

6. The safety management system for remote upgrade of rail vehicle software OTA system according to claim 5, characterized in that, The data processing module (50), the data sharing module (10), and the first communication module (20) are electrically connected in sequence via a one-way data sharing link; The data processing module (50) is electrically connected to the security monitoring module (70) and the first upgrade module (60); The first communication module (20) is electrically connected to the security monitoring module (70) through an upgrade main link, and a relay K1 is provided on the upgrade main link; the upgrade management module (30) is electrically connected to the security monitoring module (70), and the upgrade management module (30) and the relay K1 are electrically connected through a main link control module (40).

7. The safety management system for remote upgrade of rail vehicle software OTA system according to claim 5, characterized in that, It also includes a network security protocol construction module (80), used to build network security protocols after the main link is upgraded; The network security protocol construction module (80) is electrically connected to the first communication module (20) and the security monitoring module (70).

8. The safety management system for remote upgrade of rail vehicle software OTA system according to claim 7, characterized in that, The network security protocol construction module (80) includes: The two-way identity verification unit (801) is used to perform two-way identity certificate verification through the upgraded main link; The negotiation key generation unit (802) is used to generate a negotiation key M2 through the negotiation protocol when the two-way identity certificate verification is successful. The fusion unit (803) is used to fuse the closure cipher M1 and the negotiation key M2 to form the fusion cipher M3; The tunnel establishment unit (804) is used to establish an IPsec VPN tunnel by upgrading the main link based on the converged cipher M3.

9. The safety management system for remote upgrade of rail vehicle software OTA system according to claim 8, characterized in that, The two-way identity verification unit (801) includes: The request unit (8011) is used to issue a signature verification request for the target identity certificate; The first receiving unit (8012) is used to receive target identity certificate information; it is also used to receive the second verification result. If the second verification is successful, the two-way identity certificate verification is successful. The first signature verification unit (8013) is used to perform a first signature verification on the target identity certificate information using a preset first public key when the target identity certificate information is received. The first output unit (8014) is used to send its own identity certificate information for the second verification if the first verification passes.

10. The safety management system for remote upgrade of rail vehicle software OTA system according to claim 5, characterized in that, Its characteristic is that it further includes: The second communication module (90) is used to receive the new version upgrade data packet and the current software version information; it is also used to output no update information when the comparison results are consistent, and to send a software upgrade notification to the operator when the comparison results are inconsistent; it is also used to receive the username, password and software upgrade request; it is also used to output the closure password M1; it is also used to send the software upgrade request to the supervisor to activate the upgrade program; it is also used to output the new version upgrade data packet through the upgrade main link after receiving the upgrade main link connection success information based on the closure password M1; it is also used to receive the software upgrade success information and complete the software upgrade. The version comparison module (100) is used to compare the version information of the new version upgrade data package with the current software version information; The password generation module (110) is used to generate a closed password M1 based on the username, password and system time. The second upgrade module (120) is used to upgrade the software via the upgrade main link.

11. An electronic device, characterized in that, include: Memory; processor; as well as Computer programs; The computer program is stored in the memory and configured to be executed by the processor to implement the safety management method for remote upgrade of the rail vehicle software OTA system as described in any one of claims 1 to 4.

12. A computer-readable storage medium, characterized in that, It stores a computer program; the computer program is executed by a processor to implement the safe management method for remote upgrade of the rail vehicle software OTA system as described in any one of claims 1 to 4.

Images