Safe OTA upgrading method for escalator software

Abstract

The invention discloses a safe OTA (Over the Air) upgrading method for escalator software, which comprises the following steps of: after a main control electronic unit receives an upgrading instruction issued by an OTA upgrading module, backing up an original program in an internal Flash, and storing the original program in a BKUPPG (Block Kernel UPPG) area in an external Flash; the OTA upgrading module downloads the encrypted new program data and stores the encrypted new program data in an ENCPG area in an external Flash; the main control electronic unit reads new program data from an ENCPG area in the external Flash and decrypts the new program data, the decrypted data is stored in a DECPG area of the external Flash, and a main program upgrading mark is set to be valid; after reaching the specified upgrading time, if the escalator is in a stop state, resetting to enter a BOOTBASE area; when the BOOTBASE area detects that the main program upgrading mark is valid, the BOOTLOADER area is skipped to; erasing the main program area of the internal Flash, and copying the decrypted new program data from the DECPG area of the external Flash to the main program area of the internal Flash; and verifying the program in the main program area of the internal Flash, setting the main program upgrading mark to be invalid and the program integrity mark to be valid after the verification is passed, and skipping to the main program for execution.

Description

Technical Field

[0001] This invention relates to a secure OTA upgrade method for escalator software. Background Technology

[0002] In software OTA upgrade scenarios, Chinese patent document 1 (CN120145394A) divides the MCU's storage area into a Bootloader program startup area, application area A, application area B, key area A1, and key area B1. When the program is running in area A, the program in area B is upgraded, and when the program is running in area B, the program in area A is upgraded. Chinese patent document 2 (CN119668646A) also adopts a similar approach, dividing the firmware storage area into a Bootloader area, firmware area A, firmware area B, and information area. This A / B partition mutual upgrade method effectively achieves backup operations and has advantages such as simple process and high security, and is widely used in the automotive OTA field.

[0003] However, in escalator OTA upgrade scenarios, most of the MCU chips used in the past do not have a dual-bank structure, making it impossible to support this A / B partition mutual upgrade method from a hardware perspective. Replacing the MCU chip requires redesigning the printing plate and conducting reliability testing, increasing production and R&D costs. Therefore, from the perspectives of backward compatibility and cost reduction, in the practical application of escalator OTA upgrades, MCUs with a single-bank structure are still the mainstay, and the upgrade method of single-bank structure MCUs must be taken into consideration.

[0004] On the other hand, the internal Flash space of an MCU is often quite limited. References 1 and 2 mentioned above can only use half of the internal Flash space for storage. Another Chinese patent document, 3 (CN119537102A), while detailing the advantages and disadvantages of single and dual Flash banks and providing a method for AB backup under single Flash bank conditions, also reduces the available internal Flash space to half. In escalator applications, intelligent operation and maintenance require the MCU to save escalator operating data in real time. Some statistical data and fault data also need to be stored in Flash. In an environment where storage resources are extremely limited, using half of the Flash space for OTA upgrades is unacceptable.

[0005] Regarding OTA security, Reference 1 designed a dedicated key area to store encrypted data. This encrypted data is calculated from program data and the built-in key within the bootloader, ensuring the integrity and security of the program files. It's easy to see that the security of this scheme is essentially tied to the built-in key within the bootloader. If the bootloader's built-in key is leaked, and the key in the MCU cannot be modified, the security of the entire upgrade process will be completely compromised. Escalators are specialized equipment with dedicated maintenance personnel. The goal of using OTA technology for software upgrades is primarily to reduce upgrade time and maintenance costs, unlike the goals of vehicle-mounted systems and electronic devices. For security reasons, even if the key is leaked, a solution must be provided.

[0006] Reference 2 presents a verification method for confirming OTA upgrade security using file feature values. After the upgrade file is sent to the terminal, the terminal calculates a file feature value for the upgrade file and sends it to the upgrade file sender for comparison. The upgrade file sender then returns the comparison result to the terminal. This process is obviously cumbersome. In fact, if the upgrade file sender directly sends the upgrade file and the checksum together, the terminal can calculate the checksum and perform verification directly, reducing the time loss and uncertainty caused by communication confirmation. Furthermore, this scheme cannot guarantee that the file at the upgrade file sender is undamaged, i.e., that the Bin file generated during program compilation is consistent with the Bin file obtained by the terminal. It only guarantees consistency during the file download process and cannot provide a full-process security guarantee. Summary of the Invention

[0007] The technical problem to be solved by the present invention is to provide a technical solution that can support secure OTA upgrades of a single Flash-Bank architecture MCU main control electronic unit.

[0008] To solve the above-mentioned technical problems, the present invention provides a secure OTA upgrade method for escalator software. The escalator includes a main control electronic unit and an OTA upgrade module. The internal Flash of the main control electronic unit is divided into a BOOTBASE area, a BOOTLOADER area, and a main program area.

[0009] After receiving the upgrade command from the OTA upgrade module, the main control electronic unit checks the program integrity flag of the BOOTLOADER. If it is valid, it backs up the original program in the internal Flash and saves it to the BKUPPG area in the external Flash.

[0010] The OTA upgrade module downloads encrypted new program data and saves it to the ENCPG area in external Flash memory.

[0011] The main control electronic unit reads and decrypts the new program data from the ENCPG area in the external Flash, stores the decrypted data in the DENCPG area of ​​the external Flash, and sets the main program upgrade flag to be valid.

[0012] If the escalator is stopped after the designated upgrade time, it will reset and enter the BOOTBASE area.

[0013] If the BOOTBASE area detects that the main program upgrade flag is valid, it will jump to the BOOTLOADER area.

[0014] The BOOTLOADER program is executed to erase the main program area of ​​the internal Flash and copy the decrypted new program data from the DECPG area of ​​the external Flash to the main program area of ​​the internal Flash.

[0015] The program in the main program area of ​​the internal Flash is verified. If the verification is successful, the main program upgrade flag is set to invalid, the program integrity flag is set to valid, and the program is then executed.

[0016] Preferably, the method for encrypting and generating new program data is as follows: compile the source code of the new program to generate a Hex file; perform a hash calculation on the Hex file to generate a verified Hex file; encrypt the verified Hex file using an encryption algorithm; calculate the hash of the encrypted Hex file again and store it at the end of the program.

[0017] Preferably, if the program integrity flag of the BOOTLOADER is invalid, the main program upgrade is stopped, and an OTA program upgrade is performed in the BOOTLOADER area.

[0018] Preferably, after backing up the original program in the internal Flash, the main control electronic unit reads the program data from the BKUPPG area in the external Flash and compares it with the current program data. If the values ​​match, the process continues; otherwise, the backup is repeated until the data matches or the maximum number of backups is exceeded.

[0019] Preferably, after the new program data is encrypted and saved to the ENCPG area in the external Flash, the main control electronic unit reads the program data from the ENCPG area in the external Flash and calculates the hash, compares it with the hash value at the end of the program, and stops the upgrade if the comparison fails.

[0020] Preferably, after the decrypted data is stored in the DECPG area of ​​the external Flash, the main control electronic unit reads the program data from the DECPG area in the external Flash, calculates the hash value, and compares it with the hash value recorded at the end of the program. If the comparison fails, the upgrade stops.

[0021] Preferably, after jumping into the BOOTLOADER area, the main control electronic unit reads program data from the DECPG area in the external Flash, calculates the Hash value, compares it with the Hash value recorded at the end of the program, and if the comparison fails, the upgrade stops and jumps to the main program area for execution.

[0022] Preferably, if the program verification in the main program area of ​​the internal Flash fails, the old program data is read from the BKUPPG area of ​​the external Flash and written back to the main program area of ​​the internal Flash.

[0023] Preferably, each time the printed circuit board is powered on, during the BOOTBASE phase, the hash feature value HASHX1 of the BOOTLOADER area and the hash feature value HASHX2 of the main program area are calculated, and these two values ​​are sent to the OTA upgrade module via CAN communication. Each time the OTA upgrade module establishes communication with the printed circuit board, it uploads the sent HASHX1 and HASHX2 to the cloud. After receiving HASHX1 and HASHX2, the cloud checks whether there is an OTA task for the escalator. If there is, no verification is performed. Otherwise, the cloud queries the BOOTLOADER software feature value HASHX1 and the main program software feature value HASHX2 in the escalator. If HASHX1 and HASHX1 are inconsistent, or HASHX2 and HASHX2 are inconsistent, the abnormal event is recorded.

[0024] This invention also provides a secure OTA upgrade method for escalator software. The escalator includes a main control electronic unit and an OTA upgrade module. The internal Flash of the main control electronic unit is divided into a BOOTBASE area, a BOOTLOADER area, and a main program area.

[0025] After receiving the upgrade command from the OTA upgrade module, the main control electronic unit uploads the current version of the program in the main program area to the OTA upgrade module, which then downloads the current version of the program in the main program area from the cloud as a backup.

[0026] If the escalator is stopped after the designated upgrade time is reached, the main program upgrade flag is enabled, and the process jumps to the BOOTLOADER area for execution.

[0027] The BOOTLOADER program checks the main program upgrade flag. If it is valid, it erases the main program area in the internal Flash. The OTA upgrade module obtains the new program from the main program area and downloads the new program to the main program area in the internal Flash.

[0028] The main control electronic unit reads new program data from the main program area in the internal Flash, decrypts it using a decryption algorithm, and stores the decrypted data into the main program area of ​​the internal Flash.

[0029] The program in the main program area of ​​the internal Flash is verified. If the verification is successful, the main program upgrade flag is set to invalid, the program integrity flag is set to valid, and the program is then executed.

[0030] Preferably, after the new program is downloaded to the main program area of ​​the internal Flash, the main control electronic unit reads the program data from the main program area in the internal Flash and calculates the hash, compares it with the hash value at the end of the program, and stops the upgrade if the comparison fails.

[0031] Preferably, the program upgrade method for the BOOTLOADER area is as follows:

[0032] After receiving the upgrade command from the OTA upgrade module, the main control electronic unit uploads the current version of the program in the BOOTLOADER area to the OTA upgrade module, and the OTA upgrade module downloads the current version of the program in the BOOTLOADER area from the cloud as a backup.

[0033] If the escalator is stopped after the specified upgrade time, the BOOTLOADER area in the internal Flash memory is erased, and a new program in the BOOTLOADER area is obtained from the OTA upgrade module. The new program is then downloaded to the BOOTLOADER area in the internal Flash memory.

[0034] The main control electronic unit reads program data from the BOOTLOADER area in the internal Flash memory, decrypts it using a decryption algorithm, and stores the decrypted data in the BOOTLOADER area of ​​the internal Flash memory.

[0035] The program in the BOOTLOADER area of ​​the internal Flash is verified. If the verification passes, the upgrade is successful.

[0036] Preferably, after the new program is downloaded to the BOOTLOADER area of ​​the internal Flash, the main control electronic unit reads the program data from the BOOTLOADER area of ​​the internal Flash and calculates the hash, compares it with the hash value at the end of the program, and stops the upgrade if the comparison fails.

[0037] Compared to existing technologies, this invention does not establish AB partitions in the internal Flash memory. By supporting upgrades to the bootloader and main program, it can achieve basic OTA (Over-The-Air) functionality, facilitating iterative optimization and problem fixing of the escalator software. It also increases the available space in the internal Flash partition, significantly improving the space utilization rate of the internal Flash memory. Attached Figure Description

[0038] The present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments:

[0039] Figure 1 This is a schematic diagram illustrating the process of encrypting a newly downloaded program as described in Example 1;

[0040] Figure 2 This is a schematic diagram of the OTA upgrade process in the main program area of ​​Example 1;

[0041] Figure 3 This is a schematic diagram of the OTA upgrade process for the Bootloader area in Example 1. Detailed Implementation

[0042] The following specific embodiments illustrate the implementation of the present invention. Those skilled in the art can fully understand other advantages and technical effects of the present invention from the content disclosed in this specification. The present invention can also be implemented or applied through different specific embodiments, and the details in this specification can also be applied based on different viewpoints, with various modifications or changes made without departing from the overall design concept of the invention. It should be noted that, unless otherwise specified, the following embodiments and features can be combined with each other. The following exemplary embodiments of the present invention can be implemented in many different forms and should not be construed as being limited to the specific embodiments set forth herein. It should be understood that these embodiments are provided to make the disclosure of the present invention thorough and complete, and to fully convey the technical solutions of these exemplary embodiments to those skilled in the art.

[0043] Example 1

[0044] This embodiment provides a secure OTA (Over-The-Air) upgrade method for escalator software, primarily applied to escalators. The escalator includes several electronic control units, at least one main control electronic unit and one OTA upgrade module. The OTA upgrade module is responsible for downloading programs from the cloud and upgrading the program of the main control electronic unit.

[0045] This embodiment is applicable to main control electronic units that have external Flash and use MCUs that do not support Dual-Bank architecture; it is also applicable to main control electronic units that have external Flash and whose program data is too large to be contained in a single Flash-Bank.

[0046] The main control electronics unit of a Dual-Bank architecture MCU; in the following text, MCU and main control electronics unit have the same meaning.

[0047] In this embodiment, the MCU's internal Flash memory is divided into a BOOTBASE area, a BOOTLOADER area, and a main program area. The BOOTBASE area is used to check the program integrity flag and jump accordingly. When the main program upgrade flag is invalid and the integrity flag is valid, the program jumps to the main program; when the main program upgrade flag is valid, the program jumps to the BOOTLOADER area; when both the main program upgrade flag and the integrity flag are invalid, the program jumps to the BOOTLOADER area. The upgrade flag and the program integrity flag are stored in non-volatile memory.

[0048] The Hex file used for OTA upgrades should be encrypted according to the following process: Figure 1 As shown:

[0049] Calculate the hash of the Hex file generated from the new program data and store it at the end of the program. Record the storage address AD1 at the fixed address PAD1. Calculate the hash of the Hex file generated from the new program data in the BOOTLOADER area and store it at the end of the program. Record the storage address AD2 at the fixed address PAD2.

[0050] The Hex file data is encrypted using the AES algorithm (this is just an example, and the specific encryption algorithm used is not limited to this). The hash of the encrypted program data is calculated again and stored at the end of the Hex file.

[0051] The main program OTA upgrade process is as follows: Figure 2 As shown:

[0052] After receiving the upgrade command from the OTA upgrade module, the MCU checks the program integrity flag of the BOOTLOADER. If it is invalid, the BOOTLOADER needs to be upgraded first. Therefore, the MCU should report this situation to the OTA upgrade module and stop the current main program OTA upgrade process. If it is valid, the original program in the internal Flash is backed up and saved to the BKUPPG area in the external Flash.

[0053] After the backup is complete, the MCU reads program data from the BKUPPG area in the external Flash and compares it with the current program data. If the values ​​match, the process continues; otherwise, the backup of the original program in the internal Flash is repeated until the data matches or the specified number of backups exceeds the limit BKUP_LIMIT. If the number of backups exceeds the specified limit, the external Flash is considered damaged, and an OTA upgrade should be performed using the method described in Example 2.

[0054] Save the new program data to the ENCPG area in the external Flash memory.

[0055] The MCU reads program data from the ENCPG area in the external Flash and calculates the hash. It then compares the hash with the hash value at the end of the program. If the comparison fails, the upgrade is stopped and an upgrade failure signal is sent to the OTA upgrade module.

[0056] The MCU reads program data from the ENCPG area in the external Flash memory and decrypts it using the AES algorithm (this is just an example; the specific encryption algorithm used is not limited to this). The decrypted data is then stored in the DENCPG area of ​​the external Flash memory.

[0057] The MCU reads program data from the DECPG area in the external Flash, calculates the hash value, and compares it with the hash value recorded at the storage address AD1 at the fixed address PAD1. If the comparison fails, the upgrade is stopped and an upgrade failure signal is sent to the OTA upgrade module.

[0058] If no abnormalities occur in the above steps, the MCU will set the main program upgrade flag to be valid and wait for the escalator to stop running at night. After the specified upgrade time is reached, if the escalator is in a stopped state, it will be reset and enter the BOOTBASE area for execution. If the BOOTBASE area detects that the main program upgrade flag is valid, it will jump to the BOOTLOADER area for execution.

[0059] When the program enters the BOOTLOADER area, the MCU reads the program data from the DECPG area in the external Flash, calculates the hash value, and compares it with the hash value recorded at the storage address AD1 at the fixed address PAD1. If the comparison fails, the upgrade stops, an upgrade failure signal is sent to the OTA upgrade module, and the main program area is jumped to execute. This step is a second confirmation of the new program data.

[0060] If the program data verification passes, the main program area in the internal Flash is erased, the program integrity flag is set to invalid, and the data is copied from the DECPG area of ​​the external Flash to the main program area of ​​the internal Flash.

[0061] After the program copy is complete, the program hash value in the internal Flash is calculated and compared with the hash value recorded at the storage address AD at the fixed address PAD. If the values ​​match, the process continues; otherwise, the erasure and copying are repeated until the data matches or the specified number of attempts (NEWPG_LIMIT) is exceeded. If the number of failures exceeds the specified number of attempts, the old program data is read from the BKUPPG area of ​​the external Flash, written back to the main program area of ​​the internal Flash, and after uploading the upgrade failure signal, the system is guided to the main program area to execute the old program.

[0062] After the program verification is passed, the upgrade flag is set to invalid, the program integrity flag is set to valid, and the program jumps to the main program for execution. The program then sends an upgrade success signal to the OTA upgrade module, and the main program completes the OTA upgrade successfully.

[0063] If the bootloader's program integrity flag is invalid, the main program upgrade will be stopped, and an OTA upgrade of the bootloader area will be performed. The OTA upgrade process for the bootloader area is as follows: Figure 3 As shown:

[0064] After receiving the upgrade command from the OTA upgrade module, the MCU backs up the original program in the internal Flash and saves it to the BKUPBT area in the external Flash.

[0065] After the backup is complete, the MCU reads the program data from the BKUPBT area in the external Flash and compares it with the current program data. If the values ​​match, the process continues; otherwise, the backup of the original program in the internal Flash is repeated until the data matches or the specified number of backups (BKUP_LIMIT) is exceeded. If the number of backups exceeds the specified number of backups, the external Flash is considered damaged, an upgrade failure signal is sent to the OTA upgrade module, and the upgrade of the Bootloader is abandoned.

[0066] Save the new program data to the ENCBT area in the external Flash memory.

[0067] The MCU reads program data from the ENCBT area in the external Flash and calculates the hash. It then compares the hash with the hash value at the end of the program. If the comparison fails, the upgrade is stopped and an upgrade failure signal is sent to the OTA upgrade module.

[0068] The MCU reads program data from the ENCBT area in the external Flash memory and decrypts it using the AES algorithm (this is just an example; the specific encryption algorithm used is not limited to this). The decrypted data is then stored in the DECBT area of ​​the external Flash memory.

[0069] The MCU reads program data from the DECBT area in the external Flash, calculates the hash value, and compares it with the hash value recorded at the fixed address PAD2 at the storage address AD2. If the comparison fails, the upgrade is stopped and an upgrade failure signal is sent to the OTA upgrade module.

[0070] If no abnormalities occur during the above steps, wait for the escalator to stop operating at night.

[0071] If the escalator is stopped after the designated upgrade time, the BOOTLOADER area in the internal Flash is erased, the BOOTLOADER program integrity flag is set to invalid, and data is copied from the DECBT area of ​​the external Flash to the BOOTLOADER area of ​​the internal Flash.

[0072] After the program copy is complete, the program hash value in the internal Flash is calculated and compared with the hash value recorded at the fixed address PAD2 at the storage address AD2. If the values ​​match, the process continues; otherwise, the above steps of erasing and copying are repeated until the data matches or the specified number of attempts (NEWPG_LIMIT) is exceeded. If the number of failures exceeds the specified number of attempts, the old program data is read from the BKUPBT area of ​​the external Flash, written back to the BOOTLOADER area of ​​the internal Flash, and an upgrade failure signal is uploaded.

[0073] After the program verification is successful, the BOOTLOADER program integrity flag is set to valid, and an upgrade success signal is sent to the OTA upgrade module, indicating that the OTA upgrade of the BOOTLOADER area is successful.

[0074] During the OTA process, steps that do not involve erasing and copying the BOOTLOADER area and the main program area can be performed while the escalator is running, in order to shorten the impact time of the OTA.

[0075] Even if the encryption algorithm (such as AES) used in OTA is compromised, the key in the main program can be updated through online upgrades, thus minimizing the impact of the key leak. At the same time, since the upgraded program must use AES encryption, this ensures that only programs compiled by authorized parties with the key can be successfully burned. For third parties who obtain the key through illegal means, as long as the key in the main program is updated, the key they possess will become invalid.

[0076] During each data copying and transfer step in the OTA upgrade process, the hash value carried in the HEX file is verified. By encrypting the original program data, the program content is prevented from being cracked through reverse engineering, disassembly, or other means. The verification hash value is embedded at the end of the Hex file to ensure consistency between the program compilation side and the MCU side. At the same time, the verification hash value embedded at the end of the Hex file also ensures the integrity of program data transmission and ensures that program data is not corrupted after encryption and decryption.

[0077] Because it supports upgrades to the Bootloader, it can fulfill more complex functional requirements, facilitating subsequent software updates and iterations.

[0078] Because it supports backing up the original program, even if the new program fails to be burned or malfunctions, the original program can be restored from the external Flash, avoiding the situation where the escalator cannot operate normally due to upgrade failure.

[0079] By checking the upgrade flags via BOOTBASE and cross-verifying and decrypting between the BOOTBASE and the main program, the security of the OTA upgrade process can be maximized, the risks that OTA upgrades may bring to escalators can be reduced, and unauthorized personnel can be prevented from performing software upgrade operations.

[0080] Preferably, each time the printed circuit board is powered on, during the BOOTBASE phase, the hash feature value HASHX1 of the BOOTLOADER area and the hash feature value HASHX2 of the main program area are calculated, and these two values ​​are sent to the OTA upgrade module via CAN communication. Each time the OTA upgrade module establishes communication with the printed circuit board, it uploads HASHX1 and HASHX2 sent by the printed circuit board to the cloud. After receiving HASHX1 and HASHX2, the cloud checks whether there is an OTA task for the escalator. If there is, no verification is performed. Otherwise, the cloud queries the BOOTLOADER software feature value HASHX1 and the main program software feature value HASHX2 in the escalator. If HASHX1 and HASHX1 are inconsistent, or HASHX2 and HASHX2 are inconsistent, the abnormal event is recorded and handled by the administrator.

[0081] Example 2

[0082] This embodiment provides another secure OTA upgrade method for escalator software, mainly applied to escalators. The escalator includes several electronic control units, including at least one main control electronic unit and one OTA upgrade module. The OTA upgrade module is responsible for downloading programs from the cloud and upgrading the program of the main control electronic unit.

[0083] This embodiment is applicable to main control electronic units that do not have external Flash and use MCUs that do not support Dual-Bank architecture; it is also applicable to main control electronic units that do not have external Flash and whose program data is too large to be contained in a single Flash-Bank and support MCUs with Dual-Bank architecture.

[0084] In this embodiment, the MCU's internal Flash memory is divided into a BootBase area, a BOOTLOADER area, and a main program area. Each time the MCU runs, it first enters the BootBase area and verifies the program data stored in the BOOTLOADER area. If the verification passes, the BOOTLOADER program is executed; otherwise, the main program is executed. In the BOOTLOADER program, the upgrade flag FLAG_UPDATE in memory is checked. If it is invalid, the program data stored in the main program is verified. If the verification passes, the main program is executed.

[0085] The Hex file encryption process used in OTA upgrades is the same as in Example 1.

[0086] The main program OTA upgrade process is as follows:

[0087] After receiving the upgrade command from the OTA upgrade module, the MCU uploads the current program version to the OTA upgrade module, which then downloads the program from the cloud as a backup.

[0088] Wait for the escalator to stop running at night. After the specified upgrade time is reached, if the escalator is still stopped, set the main program upgrade flag FLAG_UPDATE in memory to be valid and jump to the BOOTLOADER area for execution.

[0089] The BOOTLOADER program checks the main program upgrade flag FLAG_UPDATE. If it is valid, it erases the main program area in the internal Flash, obtains the new program from the OTA upgrade module, and downloads the new program to the main program area in the internal Flash.

[0090] The MCU reads program data from the main program area in the internal Flash and calculates the hash. It then compares the hash with the hash value at the end of the program. If the comparison fails, the upgrade is stopped and an upgrade failure signal is sent to the OTA upgrade module.

[0091] The MCU reads program data from the main program area in the internal Flash memory, decrypts it using the AES algorithm (this is just an example; the specific encryption algorithm used is not limited to this), and stores the decrypted data in the main program area in the internal Flash memory.

[0092] The above decryption algorithm requires that the MCU memory size should not be less than the minimum erase unit size of the internal Flash. If this requirement cannot be met, the remaining space of the internal Flash can be used as a cache.

[0093] The MCU reads program data from the main program area in the internal Flash and calculates the hash value. It compares the hash value with the hash value recorded at the fixed address PAD1 at the storage address AD1. If the comparison fails, the upgrade stops, an upgrade failure signal is sent to the OTA upgrade module, and the original program obtained by the OTA upgrade module is downloaded to repeat the main program OTA upgrade process for upgrade.

[0094] After the program verification is successful, the program jumps to the main program for execution, sends an upgrade success signal to the OTA upgrade module, and the main program completes the OTA upgrade successfully.

[0095] The OTA upgrade process for the Bootler zone is as follows:

[0096] After receiving the upgrade command from the OTA upgrade module, the MCU uploads the current program version to the OTA upgrade module, which then downloads the program from the cloud as a backup.

[0097] Wait for the escalator to stop running at night. After the designated upgrade time is reached, if the escalator is still stopped, erase the BOOTLOADER area in the internal Flash, obtain the new program from the OTA upgrade module, and download the new program to the BOOTLOADER area in the internal Flash.

[0098] The MCU reads program data from the BOOTLOADER area in the internal Flash and calculates the hash. It then compares the hash with the hash value at the end of the program. If the comparison fails, the upgrade is stopped and an upgrade failure signal is sent to the OTA upgrade module.

[0099] The MCU reads program data from the BOOTLOADER area in the internal Flash memory, decrypts it using the AES algorithm (this is just an example; the specific encryption algorithm used is not limited to this), and stores the decrypted data in the BOOTLOADER area of ​​the internal Flash memory.

[0100] The above decryption algorithm requires that the MCU memory size should not be less than the minimum erase unit size of the internal Flash. If this requirement cannot be met, the remaining space of the internal Flash can be used as a cache.

[0101] The MCU reads program data from the BOOTLOADER area in the internal Flash, calculates the hash value, and compares it with the hash value recorded at the storage address AD2 at the fixed address PAD2. If the comparison fails, the upgrade stops, an upgrade failure signal is sent to the OTA upgrade module, and the original program obtained by the OTA upgrade module is downloaded to repeat the OTA upgrade process steps in the BOOTLOADER area to perform the upgrade.

[0102] After the program verification is successful, an upgrade success signal is sent to the OTA upgrade module, and the BOOTLOADER program successfully completes the OTA upgrade.

[0103] Since there is no external Flash, the upgrade operation must be performed directly in the internal Flash. Compared with Example 1, the OTA will have a longer impact time.

[0104] The present invention has been described in detail above through specific embodiments and examples, but these are not intended to limit the invention. Many modifications and improvements can be made by those skilled in the art without departing from the principles of the invention, and these should also be considered within the scope of protection of the present invention.

Claims

1. A secure OTA upgrade method for escalator software, characterized in that, The escalator includes a main control electronic unit and an OTA upgrade module; the internal Flash of the main control electronic unit is divided into a BOOTBASE area, a BOOTLOADER area, and a main program area; After receiving the upgrade command from the OTA upgrade module, the main control electronic unit checks the program integrity flag of the BOOTLOADER. If it is valid, it backs up the original program in the internal Flash and saves it to the BKUPPG area in the external Flash. The OTA upgrade module downloads the encrypted new program data and saves it to the ENCPG area in the external Flash memory. The main control electronic unit reads and decrypts the new program data from the ENCPG area in the external Flash, stores the decrypted data in the DENCPG area of ​​the external Flash, and sets the main program upgrade flag to be valid. If the escalator is stopped after the designated upgrade time, it will reset and enter the BOOTBASE area. If the BOOTBASE area detects that the main program upgrade flag is valid, it will jump to the BOOTLOADER area. The BOOTLOADER program is executed to erase the main program area of ​​the internal Flash and copy the decrypted new program data from the DECPG area of ​​the external Flash to the main program area of ​​the internal Flash. The program in the main program area of ​​the internal Flash is verified. If the verification is successful, the main program upgrade flag is set to invalid, the program integrity flag is set to valid, and the program is then executed.

2. The secure OTA upgrade method for escalator software according to claim 1, characterized in that, The method for encrypting and generating new program data is as follows: The source code of the new program is compiled to generate a Hex file; Calculate the hash of the Hex file and generate a Hex file with verification. Encrypt the Hex file with verification using an encryption algorithm; The hash of the encrypted Hex file is calculated again and stored at the end of the Hex file; Finally, the data in the HEX file is used as new program data for OTA upgrades.

3. The secure OTA upgrade method for escalator software according to claim 2, characterized in that, If the program integrity flag of the BOOTLOADER is invalid, stop the main program upgrade and perform an OTA upgrade of the program in the BOOTLOADER area.

4. The secure OTA upgrade method for escalator software according to claim 2, characterized in that, After backing up the original program in the internal Flash, the main control electronic unit reads the program data from the BKUPPG area in the external Flash and compares it with the current program data. If the values ​​match, the process continues; otherwise, the backup is repeated until the data matches or the maximum number of backups is exceeded.

5. The secure OTA upgrade method for escalator software according to claim 2, characterized in that, After the new program data is saved to the ENCPG area in the external Flash, the main control electronic unit reads the program data from the ENCPG area in the external Flash and calculates the hash, which is then compared with the hash value at the end of the program. If the comparison fails, the upgrade stops.

6. The secure OTA upgrade method for escalator software according to claim 2, characterized in that, After the decrypted data is stored in the DECPG area of ​​the external Flash, the main control electronic unit reads the program data from the DECPG area in the external Flash and calculates the hash value, which is then compared with the hash value recorded at the end of the program. If the comparison fails, the upgrade stops.

7. The secure OTA upgrade method for escalator software according to claim 2, characterized in that, After jumping into the BOOTLOADER area, the main control electronic unit reads program data from the DECPG area in the external Flash, calculates the hash value, and compares it with the hash value recorded at the end of the program. If the comparison fails, the upgrade stops and jumps to the main program area for execution.

8. The secure OTA upgrade method for escalator software according to claim 2, characterized in that, If the program verification in the main program area of ​​the internal Flash fails, the old program data is read from the BKUPPG area of ​​the external Flash and written back to the main program area of ​​the internal Flash.

9. The secure OTA upgrade method for escalator software according to claim 1, characterized in that, Each time the printed circuit board is powered on, during the BOOTBASE phase, the hash feature value HASHX1 of the BOOTLOADER area is calculated, and the hash feature value HASHX2 of the main program area is calculated. These two values ​​are then sent to the OTA upgrade module via CAN communication. Each time the OTA upgrade module establishes communication with the printed circuit board, it uploads HASHX1 and HASHX2 to the cloud. After receiving HASHX1 and HASHX2, the cloud checks whether there is an OTA task for the escalator. If there is, no verification is performed; otherwise, it queries the BOOTLOADER software characteristic value HASHY1 and the main program software characteristic value HASHX2 in the escalator. If HASHX1 and HASHY1 are inconsistent, or HASHX2 and HASHY2 are inconsistent, the abnormal event is recorded.

10. A secure OTA upgrade method for escalator software, characterized in that, The escalator includes a main control electronic unit and an OTA upgrade module; the internal Flash of the main control electronic unit is divided into a BOOTBASE area, a BOOTLOADER area, and a main program area; After receiving the upgrade command from the OTA upgrade module, the main control electronic unit uploads the current version of the program in the main program area to the OTA upgrade module, which then downloads the current version of the program in the main program area from the cloud as a backup. If the escalator is stopped after the designated upgrade time is reached, the main program upgrade flag is enabled, and the process jumps to the BOOTLOADER area for execution. The BOOTLOADER program checks the main program upgrade flag. If it is valid, it erases the main program area in the internal Flash. The OTA upgrade module obtains the new program from the main program area and downloads the new program to the main program area in the internal Flash. The main control electronic unit reads new program data from the main program area in the internal Flash, decrypts it using a decryption algorithm, and stores the decrypted data into the main program area of ​​the internal Flash. The program in the main program area of ​​the internal Flash is verified. If the verification is successful, the main program upgrade flag is set to invalid, the program integrity flag is set to valid, and the program is then executed.

11. The secure OTA upgrade method for escalator software according to claim 10, characterized in that, After the new program is downloaded to the main program area of ​​the internal Flash, the main control electronic unit reads the program data from the main program area in the internal Flash and calculates the hash, which is then compared with the hash value at the end of the program. If the comparison fails, the upgrade stops.

12. The secure OTA upgrade method for escalator software according to claim 10, characterized in that, The program upgrade method for the BOOTLOADER area is as follows: After receiving the upgrade command from the OTA upgrade module, the main control electronic unit uploads the current version of the program in the BOOTLOADER area to the OTA upgrade module, and the OTA upgrade module downloads the current version of the program in the BOOTLOADER area from the cloud as a backup. If the escalator is stopped after the specified upgrade time, the BOOTLOADER area in the internal Flash memory is erased, and a new program in the BOOTLOADER area is obtained from the OTA upgrade module. The new program is then downloaded to the BOOTLOADER area in the internal Flash memory. The main control electronic unit reads program data from the BOOTLOADER area in the internal Flash memory, decrypts it using a decryption algorithm, and stores the decrypted data in the BOOTLOADER area of ​​the internal Flash memory. The program in the BOOTLOADER area of ​​the internal Flash is verified. If the verification passes, the upgrade is successful.

13. The secure OTA upgrade method for escalator software according to claim 12, characterized in that, After the new program is downloaded to the BOOTLOADER area of ​​the internal Flash, the main control electronic unit reads the program data from the BOOTLOADER area of ​​the internal Flash and calculates the hash, which is then compared with the hash value at the end of the program. If the comparison fails, the upgrade stops.

Images